secureChannel.unwrap function return 6982(Security status not satisfied)

Question

I want using secure messaging in my applet by org.globalplatform package. I have a library in C# which implements some of globalplatform commands. I can open secure channel to card in CLR, MAC and ENC mode and i can load and install applet on card in mentioned mode. Also i open secure channel in my applet successfuly and external authentication response 9000. like this:

case INS_INIT_UPDATE:
case INS_External_AUTHENTICATION:
      SDInstruction(apdu);
      break;

and

private void SDInstruction(APDU apdu) 
    {
        byte[] buf = apdu.getBuffer();
        byte cla = buf[ISO7816.OFFSET_CLA];
        byte ins = buf[ISO7816.OFFSET_INS];

    apdu.setIncomingAndReceive();
        if(ins == INS_INIT_UPDATE)
            secureChannel = GPSystem.getSecureChannel();

        short len = secureChannel.processSecurity(apdu);

        apdu.setOutgoing();
    apdu.setOutgoingLength(len);
        apdu.sendBytes(ISO7816.OFFSET_CDATA, (short) len);        
    }

but when i want unwrap command apdu "which wraped by global platform c# library" in my applet , cardManager return 6982(Security Status not satisfid).unwraping code:

byte[] buf = apdu.getBuffer();
if (secureChannel.getSecurityLevel() < (SecureChannel.AUTHENTICATED))
                ISOException.throwIt(ISO7816.SW_CONDITIONS_NOT_SATISFIED);

        short len = secureChannel.unwrap(buf, (short) 0, (short) buf.length);

trace of secure channel apdu:

Command APDU >> Class=00 Ins=A4 P1=04 P2=00 P3=09 Data=A00000030800001000
Response APDU << SW=611A
Command APDU >> Class=00 Ins=C0 P1=00 P2=00 P3=1A 
Response APDU << SW=9000 Data=61174F06000010000100790D4F0BA00000030800001000010009
Command APDU >> Class=80 Ins=50 P1=00 P2=00 P3=08 Data=0101010101010101
Response APDU << SW=611C
Command APDU >> Class=00 Ins=C0 P1=00 P2=00 P3=1C 
Response APDU << SW=9000 Data=4D0022840106A783224FFF01AF258B0267752E248D07854961DA9851
Command APDU >> Class=84 Ins=82 P1=01 P2=00 P3=10 Data=F6E5BC84DE83E5242E8B6C9CA0ECB741
Response APDU << SW=9000
Command APDU >> Class=04 Ins=20 P1=00 P2=80 P3=0E Data=3131313131315F34DCF6BE7EDD3A
Response APDU << SW=6982
Wrapping apdu command faild.

Anyone can help me? Thank you very much,

Mohsen.

Adding APDU commands trace to your question is useful. You can also replace ISO7816.SW_CONDITIONS_NOT_SATISFIED with (short) secureChannel.getSecurityLevel() in the if(...) block to check its value. :) — Ebrahim Ghasemi
hi abraham,(short) secureChannel.getSecurityLevel() return 0x81 — Mohsen Gorgani
Hi dear Mohsen. You have been restricted CLA values to CLA_GP or 0x84 in the 4th line of SDInstruction method and your last APDU command's CLA is 0x04. Right? Is there similar restriction for this command in your applet? — Ebrahim Ghasemi
thanks for reply. sorry in last version of code this block are deleted. — Mohsen Gorgani
I see you handle the INS_External_AUTHENTICATION instruction in the first block of code but not in the second. Is this on purpose? — Maarten Bodewes

Paul Bastian Paul Bastian · Accepted Answer · 2016-04-18T12:06:45

I think your unwrapping command specifies a wrong length.
try:

short len = secureChannel.unwrap(buf, (short) 0, (short)(ISO7816.OFFSET_CDATA + apdu.getIncomingLength()));

secureChannel.unwrap function return 6982(Security status not satisfied)

1 Answers