I saw that security domains in Global Platform can have DAP Verification or (Mandated DAP Verification). I want to know why we should have such privileges?
Normally MAC at each APDU can verify the integrity of load blocks. So what is the usage for DAP Verification?
And as long as I know we have 3 keys for each SD that is shared with application providers: ENC, MAC, KEK.
So why we got one more DAP key for security domains with DAP Verification privilege? Is this key also shared with application provider by card issuer or the scenario is different for DAP?
The MAC is only verifying that the data during the download is not manipulated. The owner of the security domain, i.e. the application provider, can load any content with the MAC and ENC key.
Now an application provider could request that they want to be sure that the application binary was not manipulated somehow before the loading. Think of a payment application or signature application, which could have been manipulated willingly or by an attacker, e.g. an internal attacker like an admin. As an application provider you want to be sure this is not the case they.
The application provider signs the application after a verification process preventing any manipulation afterwards e.g. with a private key (symmetric key is also possible). The application providers security domain with the DAP verification privilege is using the public key counterpart to check the DAP signature and reject the loading process if necessary.
Mandated DAP privilege is similar, but now an entity installed as a security domain is enforcing the DAP check for all applications to be loaded in any security domain, i.e. for all application DAP data from this entity is required. The DAP privilege for one special security domain is only checking content for its own security domain.
The keys are not shared with the card issuer. They should be rotated if the card issuer did the installation. In the case of a public key for DAP verification this is obviuosly not needed.