Presentation on http://jmrtd.org at TkkrLab Enschede on the occasion of Hardware Freedom Day.

1. Smart cards, ePassports, …
and Open Source
Martijn Oostdijk, Novay
Wojciech Mostowski, UTwente

2. whois
• Martijn Oostdijk, advisor @ Novay
• Wojciech Mostowski, researcher @ Utwente
• We share a history of applying formal
methods to smart cards (in Nijmegen)
• And as a result started some open source
projects:
– JMRTD.org (ePassport API & applet)
– GPJ (Global Platform), ISO 18013 (eDL), PKI applet

3. Smart Cards
• Chances are you have at least 3 smart cards on
you right now…
– Banking (EMV debit/credit card)
– Telecom (SIM card)
– Government (passport / identity card)
– Public transport (“OV chipkaart”)
– Access control (access key card for building)
– Conditional access (card for TV decoder)
• They’re EVERYWHERE!

4. Smart Cards
• Simple computer, designed for security
• Simple I/O (ISO 7816 comparable to RS 232)
• With crypto processor
• And security counter measures
– Noise generator
– Dual rail logic
– Active grid
• Ranging from “filesystem with access control”
to “fully programmable microcontroller”

6. Java Card
applet
applet
applet
Java Card
Java Card platform API
Java Card
Virtual Machine
Command APDU
Response APDU smart card hardware

7. Java Card
• Higher level of abstraction than native
assembly programming (but only slightly)
• Published standard: JLS, JCVM
• Multiple applets on one card
• Use standard Java toolset to develop for JC
• Simpler VM: 16 bit arithmetic, simpler API, no
floats
• More complex: transactions, applet firewall
• Crypto API (for access to crypto processor)

8. ePassports

10. Why? Document authenticity
Look-a-like
fraud cheaper
than document
falsification
Cheaper to alter
genuine than to
fabricate one
Special paper,
some stamps
typewriter
Watermark Polycarbonate Document with
holder page public key crypto signature
10

11. Why? Extra info on user
• Face ~ 449x599 .jpg ~ 20KB
– Machine can do (reasonable) match
– Human inspector gets better quality
• Fingerprints ~ 35KB
– Machine can do match
• Signature ~ 2KB
– Machine can check authenticity,
based on country root certificate
Compare QR code: 7KB max11

12. Why? ABC
[Link]
• ePasport == Privium for mere mortals
12

13. DEMO

14. OSS coding “in the boss’s time”
• @RU 2006: BZK funded security test ePassport
• @RU 2009: BZK funded security test EAC
• @RU/Novay: RDW funded pilot
• @Novay: NLnet funded project
• @Novay: project for ScanTech-IT (Denmark)

15. Conclusions
• Smartcard == “secure core” computer
• ePassport primarily for doc authenticity, we will
have to see about biometric, ABC, etc.
• Academic project == good starting point OSS
• Smart cards, Java Card, ePassport … small incrowd
of developers & users. It’s not Linux / OpenOffice
• Still, some adoption, and developers, perhaps NFC
in more handsets will help

16. More Info
• http://jmrtd.org
• http://isodl.sf.net
• http://javacardsign.sf.net
• http://gpj.sf.net
• http://martijno.blogspot.com
• http://wwwhome.ewi.utwente.nl/~mostowski
wi/