I'm currently reading a lot about smartcard standards (ISO 7816, ECC-IAS...). During my research, I've encountered a lot of APDU commands similar to the one shown below:
In my scenario, I needed Local reference data (Application)
. Using bruteforce, I've grasped that I had to use the value 0x81
/ b'10000001'
. However, I'm wondering about how to interpret the x
and -
values in future commands?
The Global reference PIN command is handled by the card's OS which could then be used by any applet on the card if the applet allows it. If the command has the Local reference set, the command is passed to the active applet.
The local reference applies to the selected applet.
The card may have multiple applets, each could have a 0x81 pin with different values. An applet may also have multiple PIN each with a different reference.
For example NIST 800-73-4 PIV cards have an option to configure the PIV applet to accept either the local or global PIN. This is set by the card issuer.
In general P1 and P2 vary by command.