I have been all over the web, have the DOD and IDO docs for CAC/ADPU, but I cannot find/figure out the sequence to access the data on a card. I would like to get the public info username, e.g. SMITH.JOE.123123123
Thick java application, using smartcardio.
I issue the 0x84 CHALLENGE command and get back the challenge bytes with 9000 return code. I believe these to be in 3DES, but how would I decode if I don't have the key/password?
I am now confused as to what to do next. What do I need to do with the CHALLENGE bytes?
I tried an EXTERNAL AUTH (0x82) This succeeds, but with return code 6300 (which is warning NV RAM updated) Note sure if that's good or bad - maybe it is updating a count or date or something.
Then I try a SELECT (0xa4), but get 6D00 - command not found
I have also tried GET DATA (0xCB) - 6D00 also
I'm guessing the last two fail because I am not in the correct security state to issue them.
What is the sequence of the commands I need to go through?
Any info greatly appreciated!
You are supposed to encrypt the challenge (random byte sequence, length is important) and send the result with External Authenticate. Without knowledge of the respective key or its algorithm the journey ends here.
Some data may be readable without authentication, but I'm not familiar enough with CAC to decide, whether the username is in this category.
A result code of 6D 00 is very unlikely to mean security status not satisfied, for which 69 82 is defined.
For a start try ISO 7816-4 (not much explanation, difficult to digest) or an introduction into smart cards.