[security-dev 00250]: Handling of APDU output chaining in Channel.transmit()

[Ming Yung]

 Hi there,

This relates to a limitation (bug?) in the implementation of
javax.smartcardio.Channel.

I am looking at doing APDU output chaining using the "SW 61XX and GET
RESPONSE" mechanism in order to transfer large datasets out of a JavaCard.
As it stands, I am limited to chains of length 31 because of the following
condition in sun.security.smartcardio.ChannelImpl.doTransmit(byte[]
command):

 int k=0;
 while (true) {
    if (++k >=32) {
      throw new CardException("Could not obtain response");
    }
     ....

Is there any reason for this condition? I cannot find it in ISO 7816-4 (2005
edition).

Right now, a workaround is to set the undocumented system property
"sun.security.smartcardio.t1GetResponse" to "false" (I'm using a T=1 card)
and handle the chaining outside smartcardio.

Cheers,
Ming