why I receive 6A80, 6A84 And 6A88 while I trying to change JavaCard keys?

Question

I have a java card that is empty of applets. when I try to add/modify its keys via JCManager I receive 6A84 and 6A88 APDU-Response.

Note-1: I searched GP Card Spec2.2 for both of this responses and finally I found nothing but the meaning of them!

Note-2: When I change key set number to 2 , And set the radio button on add , I receive 6A80 [Incorrect parameters in the command data field] !!!

Note-3: Then, I could add and modify keys successfully. Also after removing the card from reader and put it again in it, there was'nt any change in the cards keys! but after some try to add and modify, I receive 6A80/6A84/6A88

This is output of jcmanager, while I put radio button on "Add" that give me 6A84 [Not enough memory space in the file] :

And when I seelect the "Modify" radio button, I receive 6A88 [Referenced data or reference data not found] :

Update: I use GPSHELL to replace / recycle keys, but I receive this output:

C:\Users\ghasemi\Desktop\GPShell-1.4.4>gpshell recyclekey-cosmo-gp211.txt
mode_211
enable_trace
establish_context
card_connect
select -AID a0000000030000
Command --> 00A4040007A0000000030000
Wrapped command --> 00A4040007A0000000030000
Response <-- 6F108408A000000003000000A5049F6501FF9000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 505152535455565758595a5b5c5d5e5
f -enc_key 505152535455565758595a5b5c5d5e5f -kek_key 505152535455565758595a5b5c5
d5e5f // Open secure channel
Command --> 80CA006600
Wrapped command --> 80CA006600
Response <-- 664C734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864
886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012
A026E01029000
Command --> 8050000008EFBC3082C086980800
Wrapped command --> 8050000008EFBC3082C086980800
Response <-- 0000116001007F8B0AF9020201CE4DA5AC97B74B861FCDC3513F4E279000
mutual_authentication() returns 0x80302000 (The verification of the card cryptog
ram failed.)

C:\Users\ghasemi\Desktop\GPShell-1.4.4>gpshell replacekey-cosmo-gp211.txt
mode_211
enable_trace
establish_context
card_connect
select -AID a0000000030000
Command --> 00A4040007A0000000030000
Wrapped command --> 00A4040007A0000000030000
Response <-- 6F108408A000000003000000A5049F6501FF9000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4
f -enc_key 404142434445464748494a4b4c4d4e4f -kek_key 404142434445464748494a4b4c4
d4e4f // Open secure channel
Command --> 80CA006600
Wrapped command --> 80CA006600
Response <-- 664C734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864
886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012
A026E01029000
Command --> 8050000008265AB6AEA30BA66700
Wrapped command --> 8050000008265AB6AEA30BA66700
Response <-- 0000116001007F8B0AF9020201CE4DA5AC97B74BC8B179AE19AE9C799000
Command --> 848201001038FCE51496D47D400D437EC5F7D51EFE
Wrapped command --> 848201001038FCE51496D47D400D437EC5F7D51EFE
Response <-- 9000
put_sc_key -keyver 1 -newkeyver 1 -mac_key 505152535455565758595a5b5c5d5e5f -enc
_key 505152535455565758595a5b5c5d5e5f -kek_key 505152535455565758595a5b5c5d5e5f
// Put secure channel keys
Command --> 80D8018143018010AA3EB3DDC7861B08DA195E1CA04A8BDF03A4B7D68010AA3EB3DD
C7861B08DA195E1CA04A8BDF03A4B7D68010AA3EB3DDC7861B08DA195E1CA04A8BDF03A4B7D600
Wrapped command --> 84D801814B018010AA3EB3DDC7861B08DA195E1CA04A8BDF03A4B7D68010
AA3EB3DDC7861B08DA195E1CA04A8BDF03A4B7D68010AA3EB3DDC7861B08DA195E1CA04A8BDF03A4
B7D602CA7DE4B07AD3DE00
Response <-- 6A88
put_secure_channel_keys() returns 0x80206A88 (6A88: Referenced data not found.)

C:\Users\ghasemi\Desktop\GPShell-1.4.4>

this is contents of recyclekey-cosmo-gp211.txt [script of gpshell]:

mode_211
enable_trace
establish_context
card_connect
# -readerNumber 3
select -AID a0000000030000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 505152535455565758595a5b5c5d5e5f -enc_key 505152535455565758595a5b5c5d5e5f -kek_key 505152535455565758595a5b5c5d5e5f // Open secure channel
put_sc_key -keyver 1 -newkeyver 1 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f -kek_key 404142434445464748494a4b4c4d4e4f // Put secure channel keys
card_disconnect
release_context

and this is contents of replacekey-cosmo-gp211.txt [script of gpshell] :

mode_211
enable_trace
establish_context
card_connect
# -readerNumber 3
select -AID a0000000030000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f -kek_key 404142434445464748494a4b4c4d4e4f // Open secure channel
put_sc_key -keyver 1 -newkeyver 1 -mac_key 505152535455565758595a5b5c5d5e5f -enc_key 505152535455565758595a5b5c5d5e5f -kek_key 505152535455565758595a5b5c5d5e5f // Put secure channel keys
#put_sc_key -keyver 1 -newkeyver 1 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f -kek_key 404142434445464748494a4b4c4d4e4f // Put secure channel keys
card_disconnect
release_context

Update 2:

How can I handle this problem?

Answer 1

I've never used JCManager so I am not sure of how it maps the fields in the form to parameters in the APDU, but it could be mapping Keyset to P1 (key version number). In many configurations, key version numbers for SCP02 begin at 0x20 - key version number 1 does not exist, hence the 6A88 response code.

So my advice is: try setting Keyset to 0x20(32) and see what happens. Good luck!

I'd like to reference some spec where it says that SCP02 key version numbers begin at 0x20, but I can't find other than the UICC configuration, and that one is not freely available - sorry about that.

Try reading the ids and versions of the keys already in the card, using GET DATA with tag 'E0'. The raw APDU should be:80CA00E000. The command will respond with a E0 data structure containing information about all the keys in the Security Domain (which you will have selected previously). See table 11-27 in GP CardSpec.