C8 – M.O.S.T. Card® Contactless Microprocessor Smart Cards

Definitions

AES (Advanced Encryption Standard)

A symmetric 128-bit block data encryption technique developed by Belgian cryptographers Joan Daemen and Vincent Rijmen. The U.S government adopted the algorithm as its encryption technique in October 2000, replacing the DES encryption it used. AES works at multiple network layers simultaneously. The National Institute of Standards and Technology (NIST) of the U.S. Department of Commerce selected the algorithm, called Rijndael (pronounced Rhine Dahl or Rain Doll), out of a group of five algorithms under consideration, including one called MARS from a large research team at IBM.

Anti-tearing

A card feature which protects the contents of memory if the card is removed before the end of the transaction.

API (Application programming interface)

A source code interface that a computer system or program library provides to support requests for services to be made of it by a computer program. An API differs from an application binary interface in that it is specified in terms of a programming language that can be compiled when an application is built, rather than an explicit low level description of how data is laid out in memory.

CHV (Cardholder Verification)

is a method used to evaluate whether the person presenting the card is the legitimate cardholder.

Contactless Card

A proximity card (prox card or RFID card) is a generic name for contactless integrated circuit devices used for security access or payment systems. The card contains electronic information that can be read from a distance with special card readers that use radio wave. The card It can refer to the older 125 kHz devices or the newer 13.56 MHz contactless RFID cards, most commonly known as contactless smartcards.

DES (Data Encryption Standard)

A widely-used method of data encryption using a private (secret) key that was judged so difficult to break by the U.S. government that it was restricted for exportation to other countries. There are 72,000,000,000,000,000 (72 quadrillion) or more possible encryption keys that can be used. For each given message, the key is chosen at random from among this enormous number of keys. Like other private key cryptographic methods, both the sender and the receiver must know and use the same private key.

EEPROM

A memory chip that can be reprogrammed any number of times, as to correct bugs, by first clearing its contents with ultraviolet light.

EHR (Electronic Health Record)

An electronic health record is a digital collection of patient health information compiled at one or more meetings in any care delivery setting. A patient’s record typically includes patient demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. The term EHR is often used to refer to the software platform that manages patient records maintained by a hospital or medical practice.

Electronic Health Record (EHR or EMR)

An electronic health record is a collection of patient health information generated by one or more meetings in any care delivery setting. An EHR typically includes patient demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. It’s said to streamline clinicians’ workflow, and it has the ability to generate a complete record of a clinical patient encounter.

E-purse (electronic purse)

A smart card can be used to store a monetary value for small purchases. Card readers retrieve the amount currently stored, and subtract the amount for the goods or services being purchased. Groceries, transportation tickets, parking, laundromats, cafeterias, taxis and all types of vending machines are only some of the purchases that often do not reach amounts to justify the hassle of using a credit card (a cash card reader does not require a permanent phone connection with a host computer). Radio-read smart cards will allow the free flow of people through transportation systems, avoiding the need of ticketing machines or validation gates.

eSignature

is an electronic indication of intent to agree to or approve the contents of a document.

FIPS (Federal Information Processing Standards)

A set of standards that describe document processing, encryption algorithms and other information technology standards for use within non-military government agencies and by government contractors and vendors who work with the agencies.

GUID (Global Unique Identifier)

A 128-bit unique reference number used as an identifier in computer software. The term GUID typically refers to various implementations of the universally unique identifier (UUID) standard. A smart card can register support for an interface through association with the interface’s (GUID). This binding between a card and an interface is done at the time the card is first introduced to the system&emdash;typically when the SCSP is installed. Once the card is introduced to the system, applications can search for smart cards, based on a specific interface or GUID. For example, a cash card could make itself available to Windows-based applications by registering interfaces to access its purse scheme.

HMAC (Hash-based Message Authentication Code)

is a small set of data that helps authenticate the nature of message; it protects the integrity and the authenticity of the message. The secret key is a unique piece of information that is used to compute the HMAC and is known both by the sender and the receiver of the message.

ICAO (International Civil Aviation Organization) Passport

is a biometric passport, also known as an e-passport, ePassport or a digital passport, is a combined paper and electronic passport that contains biometric information that can be used to authenticate the identity of travelers. It uses contactless smart card technology, including a microprocessor chip (computer chip) and antenna (for both power to the chip and communication) embedded in the front or back cover, or center page, of the passport.

ISO

Founded in 1946, ISO is an international organization composed of national standards bodies from over 75 countries. For example, ANSI (American National Standards Institute) is a member of ISO. ISO has defined a number of important computer standards, the most significant of which is perhaps OSI (Open Systems Interconnection), a standardized architecture for designing networks.

ISO/IEC 14443

ISO/IEC 14443 is a four-part international standard for Contactless Smart Cards operating at 13.56 MHz in close proximity with a reader antenna. Proximity Integrated Circuit Cards (PICC) are intended to operate within approximately 10cm of the reader antenna.

14443 Specifies:

• Part 1: Physical characteristics
• Part 2: Radio frequency power and signal interface
• Part 3: Initialization and anticollision
• Part 4: Transmission protocol

ISO/IEC 7810

The standard specifies the physical characteristics of identification cards including card material, construction, characteristics and nominal dimensions for three sizes of cards (ID-1, ID-2 and ID-3). It is the ID-1 card that forms the basis of ISO 7816-1.

ISO/IEC 7816

The standardization of physical characteristics, dimensions and location of contacts, electrical interface and transmission protocols, organization, security and commands for interchange of a smart card. It was created in 1987, updated in 1998, amended in 2003.

7816 Specifies:

• Contents of command-response pairs exchanged at the interface
• Means of retrieval of data elements and data objects in the card
• Structures and contents of historical bytes to describe operating characteristics of the card
• Structures for applications and data in the card, as seen at the interface when processing commands
• Access methods to files and data in the card
• A security architecture defining access rights to files and data in the card
• Means and mechanisms for identifying and addressing applications in the card
• Methods for secure messaging
• Access methods to the algorithms processed by the card. It does not describe these algorithms

The characteristics specified include:

• Physical dimensions
• Resistance to bending, flame, chemicals, temperature and humidity
• Toxicity
• The standard includes test methods for resistance to heat

Microprocessor

A chip that serves as the Central Processing Unit controlling a computer. It provides programmable intelligence.

Microprocessor Smart Cards

A smart card that has a microprocessor that includes components of this type of architecture including a CPU, RAM, ROM, and EEPROM. The operating system is typically stored in ROM, the CPU uses RAM as its working memory, and most of the data is stored in EEPROM. A rule of thumb for smartcard silicon is that RAM requires four times as much space as EEPROM, which in turn requires four times as much space as ROM.

NFC (Near-Field Communication)

is a set of close-range wireless communication standards. NFC-equipped smartphones and other devices can exchange information with each other with a simple tap or wave.

OS (Operating System or COS)

The OS is the hardware-specific firmware that provides basic functionality as secure access to on-card storage, authentication and encryption. Only a few cards allow writing programs that are loaded onto the smart card – just like programs on a computer. This is a great way to extend the basic functionality of the smart card OS.

PC/SC (Personal Computer/Smart Card)

A specification for smart-card integration into computing environments. Microsoft has implemented PC/SC in Microsoft Windows 200x/XP and makes it available under Microsoft Windows NT/9x. A free implementation of PC/SC, PC/SC Lite, is available for Linux and other Unixes; a forked version comes bundled with Mac OS X.

PKI (Public key infrastructure)

Enables users of a basically unsecure public network such as the Internet to securely and privately exchange data and money through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority. The public key infrastructure provides for a digital certificate that can identify an individual or an organization and directory services that can store and, when necessary, revoke the certificates. Although the components of a PKI are generally understood, a number of different vendor approaches and services are emerging.

RFID (Radio-frequency Identification)

The wireless non-contact use of radio-frequency electromagnetic fields to transfer data, for the purposes of automatically identifying and tracking tags attached to objects. The tags contain electronically stored information. Some tags are powered by and read at short ranges via magnetic fields (electromagnetic induction).

(SHA-1) Secure Hash Algorithm

is one of a number of cryptographic hash functions. A cryptographic hash is like a signature for a text or a data file. SHA-160 algorithm generates an almost-unique, fixed size 160-bit (20-byte) hash. Hash is a one way function – it cannot be decrypted back.

(SHA-2) Secure Hash Algorithm

is one of a number of cryptographic hash functions. A cryptographic hash is like a signature for a text or a data file. SHA-256 algorithm generates an almost-unique, fixed size 256-bit (32-byte) hash. Hash is a one way function – it cannot be decrypted back.

SDK (Software Development Kit)

A package of pre-written code that developers can re-use in order to minimize the amount of unique code that they need to develop themselves. SDKs can help to prevent unnecessary duplication of effort in a development community.

SSO (single sign-on)

is a session/user authentication process that permits a user to enter one name and password in order to access multiple applications. The process authenticates the user for all the applications they have been given rights to and eliminates further prompts when they switch applications during a particular session.

T=CL

A transmission protocol that is defined in the ISO/IEC 14443-4 standard. This standard describes an optional transport layer protocol. This protocol is often also referred-to as “T=CL”. This is a name derived from the commonly-used contact based smart card protocols T=0 and T=1. “CL” means “contact less”. T=CL is not a protocol in the same sense as T=0 or 1, because you can’t simply send raw bytes on the radio link the same way as on the contact (please don’t say “contactfull” ROFL) I/O line. It’s not the same protocol level.

T=0

is a asynchronous half duplex character transmission protocal for smart cards that requires 2 request/response pairs per command (send command and get response saying got command, then a command to get the response and then the actual response). T=0 requires a GET RESPONSE additional exchange only for case 4 commands or when the command provides more bytes than requested for an outgoing command. It can also require more than two exchanges if the terminal requests the outgoing data per-block.

T=1

is an asynchronous half-duplex block transmission protocol for smart cards that is defined in the ISO/IEC 7816-3 standard. T=1 supports a form of integrity check with a LRC (XOR checksum) or a CRC.

3DES (Triple DES)

Triple DES is a minor variation of this standard. It is three times slower than regular DES but can be billions of times more secure if used properly. Triple DES enjoys much wider use than DES because DES is so easy to break with today’s rapidly advancing technology. This just serves to illustrate that any organization with moderate resources can break through DES with very little effort these days.

UHF (Ultra high frequency)

is the ITU designation for radio frequencies in the range between 300 MHz and 3 GHz, also known as the decimetre band as the wavelengths range from one meter to one decimetre. UHF cards that complying with the UHF Gen2 standard for RFID use the 860 to 960 MHz band. While there is some variance in frequency from region to region, UHF Gen2 RFID systems in most countries operate between 900 and 915 MHz.
The read range of passive UHF systems can be as long as 12 m, and UHF RFID has a faster data transfer rate than LF or HF.

UID (Unique Identifier)

is a numeric or alphanumeric string that is associated with a single entity within a given system. UIDs make it possible to address that entity, so that it can be accessed and interacted with. UID is defined in the ISO/IEC 14443-3.