Knowledge Base - SMAOT UICC: (Milenage) NFC enabled Multi application card - Quick Guide

This article applies to the following products

An example on how to personalize a Smartjac SMAOT100NFC card (USIM / ISIM / CSIM / NFC) with Milenage algorithm support, with Ki and OPc value, using Gemalto Card Admin.

This lesson applies to our multi application UICC cards SMAOT100NFC.

Card ATR (Answer To Reset) : 3B9F96803FC7008031E073FE211B6408050300829000EF

Default codes:
GPIN: 1234
LPIN: 5678
ADM1: 11111111
PUK: 12345678

Software used is Gemalto Card Admin version 2.8. Please make sure you use this version if you need to work with CSIM or ISIM files. Contact our support if you need help to upgrade.

Start Card Admin and put the USIM card in the smart card reader

Selecting correct Card Type first time you insert the card in the card reader

1. Select your card
2. Select Card Type "3G/GSM/CDMA OP Card"
3. Click "Apply"

Select Mode

Leave as is and click "Select"

The software will now scan files in a range defined in Tools/Options/3G Scan Configuration. However this scan is not enough in order to see all DF's and EF's on our card so we will need to scan the card again.

Scan card

Right-click on 3F00 - MF and select "Scan 3G"

Click "Yes" on the popup window warning.

Scan result

You will now see more files and directories. As you can see the ISIM application directory is now visible. You should also see files 6FFC and 6FFD under ADF USIM application directory. These are the files where the authentication keys are kept. The Key Ki is put in 6FFC and the OPc is put in file 6FFD. in case you want to read and/or update the content of the files, you will need to change the access rights in file 6F06, in this case the records 10 and 11 (can be 13 and 14 also). (the column SE01 in Card Admin shows what security record the files uses)

Checking EF's security record number SE01

So in this screenshot 10 means that you will have to go to tab / record 10 in file 6F06 that keeps Access Rules for the files.

Verify ADMIN code

APDU Exchange window: Use this window to send any of the APDU commands handled by the card in byte code.

Click on the ikon for APDU exchange [A] and then verify the Admin code as shown on the screen-shot. Click "Exchange" and you should get SW1=90 SW2=00 as a confirmation that the verification was succesful.

First time:

Create a macro file and add APDU macros to it:

Click File and select New to create a new macro file.
Specify the name and location of the macro file (with a .amf file extension) and click Save to create a new file.
Enter a description of the macro in the Macro Name box.
Enter the APDU command in the fields as in screenshot
Click Exchange to send the APDU command to the card.
Click Add to add the macro to the file.

Verify GPIN

Verify GPIN1 by right-clicking on AFD USIM, select "Secret codes...", select GPIN1 in secret code management window, enter 1234 (default for SMAOT cards. If you have a pre-personalized card from us, then GPIN1 is probably disabled). Click on "Verify".

Edit ARR [Access Rule Reference] file

1. Open ARR [Access Rule Reference] file by double-clicking on file 6F06.
2. Go to record 10 (tab 10 (or 13)) and change Read to ALWAYS, then click "Check and Modify"
3. Go to record 11 (or 14) and change Read to ALWAYS and Update to ALWAYS, click "Check and Modify"
4. Click on "Update"

Note: on our standard 3G Milenage SMAOT cards, records 16 and 17 are the records to be changed.

You may change these records back to original settings after editing the files 6FFC and 6FFD if you need to keep these files secured.

Entering a new Ki and OPc

In this example we will update the Ki to 77777777777777777777777777777777 and OPc to DB46EEF88A1A4F3BB05B1AD880DA07F2. With SMAOT100NFC cards you will need to calculate a CRC value and add it to the end of the Ki and OPc value. If you have a CRC calculator or a tool to calculate CRC values then use CRC-CCITT (0xFFFF) 16 bit calculations with CRC polynom 1021. In our case we will use online tools to calculate this.

Calculating CRC value for Ki

Go to http://www.lammertbies.nl/comm/info/crc-calculation.html and click button "Hex" and enter the Ki value and click "Calculate CRC". The checksum in our case is CA39.

Calculating CRC value for OPc

The CRC value / checksum for OPc is B8FD

Fill Ki value + checksum in file 6FFC

Fill in value and click "Update"

Fill OPc value + checksum in file

Fill in the OPc value + checksum after the first byte "01". Click "Update"

Do Authentication

Right-click USIM - ADF USIM and select "Authenticate..." to check that your values was correctly set and your checksum values are correct.

Authentication

Choose algorithm and fill in your key (and OPc value if you chose Milenage, this time without checksums) and click "Authenticate" to verify your values.

Tip! If you don't want to calculate the OPc value from the OP value...

...or you don't have the tools to do so, then you can actually use the OP value in file 6FFD. Change the first byte to "00" and enter the OP value after that. You still have to calculate the CRC checksum.

Note!

Don't forget to edit IMSI and ACC. Both most have values (ACC must be different from 00 00) in order for the card to succesfully register on the network.

Details

Created : 2016-05-25 11:49:51, Last Modified : 2017-06-15 13:50:09

User Comments

Card Admin

Gemalto Telecom Card Admin tool is a tool to edit SIM & UICC cards. Card Admin provides all the necessary fundamentals to FULLY (Proprietary files, Proprietary commands etc.) administrate any 2G, 3G, LTE and CDMA card (Gemalto & Competition).

Module

The unit formed of a chip and a contact plate.

SMAOT

Smartjac OT series of UICC / SIM cards ranging from 2G SIM cards with XOR support, to advanced multi-application LTE UICC cards with Milenage support, NFC, USIM, ISIM and CSIM.

UICC

A high capacity smart card used in mobile terminals for GSM, UMTS/3G and now 4G/LTE networks.

Click for more info

CDMA

Code Division Multiple Access. A wireless communications technology that uses the spread spectrum communication to provide increased bandwidth.

Click for more info

Edge

A pre-3G digital mobile phone technology allowing improved data transmission rates.

Java

A network oriented programming language invented by Sun Microsystems and specificallt designed so that programs can be safely downloaded to remote devices.

USIM

Universal Subscriber Identity Module. A SIM with adbanced software that ensures continuity when migrating to 3G services.

HTTP

Hyper Text Transfer Protocol. A client-server communication protocol developed for World Wide Web. See IETF RFC2616, www.ietf.org.

IMSI

International Mobile Subscriber Identity. A unique number associated with each mobile phone user. It is stored in the SIM inside the phone and is sent by the phone to the network. It is primarily intended for obtaining information on the use of the Public Land Mobile Network (PLMN) by subscribers. It is also used for other functions such as to compute the Paging Occasions (PO) in LTE. See 3GPP TS22.016 and TS23.003.

SIM

A subscriber identity module or subscriber identification module (SIM) is an integrated circuit chip that is intended to securely store the international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephony devices.

Click for more info

NFC

Near field communication (NFC)

Click for more info

3FF

3FF (3rd Form Factor) is a very small SIM card, also known as micro-SIM, for use in small mobile device.

Click for more info

GSM

Global System for Mobile Communications. A European standard for digital cellular phones that has now been widely adopted throughout the world.

NFC

Near-Field Communication. A wireless technology that enables communication over short distances (e.g. 4cm), typically between a mobile device and a reader.

PDA

Personal Digital Assistant. A mobile device that functions as a personal information manager, often with the ability to connect to the internet.

Personal Identification Number. A secret code required to confirm a user's identity.

BER

Bit Error Rate. A measure of received signal quality, the proportion of received bits which is decoded erroneously.

Click for more info

CRC

Cyclic Redundancy Check. An error detecting code appended to a block of data to be transmitted. The value of the CRC is calculated only from the block of data itself. The length of the CRC determines the number of errors which can be detected in the block of data on reception. A CRC is not able to correct errors or determine which bits are erroneous.

Click for more info

IMS

Internet Protocol Multimedia Subsystem. An architectural framework for delivering Internet Protocol (IP) multimedia services via UTRAN and E- UTRAN. See 3GPP TS23.228 and TS23.406.

NDS

Network Domain Security. A security architecture for network domain Internet Protocol (IP) based control planes, which is applied to NDS/IP-networks (i.e. 3GPP and fixed broadband networks) to provide security in the Core Network (CN). See 3GPP TS33.210.

RAN

Radio Access Network. A RAN consists of the ground-based infrastructure required for delivery of communication between UEs and the Core Network (CN). In LTE, the RAN consists of one or more base stations (i.e. eNodeBs). Examples of other RANs are UMTS, TD-SCDMA, GSM, CDMA2000 and WiMAX.

RAT

Radio Access Technology. The RAT is the type of radio technology used in a Radio Access Network (RAN) to access the Core Network (CN), e.g. UMTS, GSM, CDMA2000, WiMAX.

3G

(Third Generation) The broadband telecommunications systems that combine high speed voice, data and multimedia.

Click for more info

4G

4G (fourth generation) is a comprehensive, secure all-IP based mobile broadband solution to smartphones, tablets, laptop computers, wireless modems and other mobile devices.

Click for more info

DM

Device Management: Management of mobile phone configuration, updates and other managed objects of mobile devices over the entire life-cycle as defined by OMA DM. DM is also used generically to describe all methods and activities associated with mobile device management.

Click for more info

IM

Using text on a mobile handset to communicate in real time

IP

Internet Protocol. A protocol for communicating data accross a network

Click for more info

OS

Operating System. Software that runs on computers and other smart devices and that manages the way they function.

SE

Secure Element. A secure and personalised physical component added to a system to manage users rights and to host secure apps. SE typically consist of a Silicon Chip, a secure Operating System, application software and a secure protocol to communicate to the device. SE can be a removable device (such as UICC or ÂµSD for mobile devices or MIM for M2M connected machines). SE can also be components inside the system.

BS

Base Station. The entity in a radio access network responsible for radio trans- mission and reception in one or more cells to and from the UE. In LTE the BS is known as the eNodeB.

Click for more info

DL

DownLink. The radio link in the direction from the base station to the mobile terminal.

Click for more info

HE

Home Environment. The HE of a subscriber is responsible for the overall pro- vision and control of the personal service environment to the subscriber.Â

HO

HandOver. HO is a procedure by which a mobile terminal changes serving cells (within the same frequency or on different frequencies or even on different Radio Access Technologies (RAT)). See 3GPP TS36.133.

PS

Packet Switched. In PS communication each data packet is labelled with the destination address and routed over a shared transmission resource. In contrast with Circuit Switching (CS) where dedicated transmission resources are re- served between network nodes to deliver a reliable transmission rate and delay, in a PS connection the transmission rate and delay may vary depending on the traffic load and the medium capacity, with packets being buffered if necessary.

UE

User Equipment. The mobile unit which allows a user to access network services, connecting to the UTRAN or E-UTRAN via the radio interface. A UE can be subdivided into a Universal Integrated Circuit Card (UICC) and a Mo- bile Equipment (ME). See 3GPP TS21.905 Section 3.

SIM

Click for more info

SIM

Click for more info

Knowledge Base - SMAOT UICC: (Milenage) NFC enabled Multi application card - Quick Guide

Start Card Admin and put the USIM card in the smart card reader

Selecting correct Card Type first time you insert the card in the card reader

Select Mode

Scan card

Scan result

Checking EF's security record number SE01

Verify ADMIN code

Verify GPIN

Edit ARR [Access Rule Reference] file

Entering a new Ki and OPc

Calculating CRC value for Ki

Calculating CRC value for OPc

Fill Ki value + checksum in file 6FFC

Fill OPc value + checksum in file

Do Authentication

Authentication

Tip! If you don't want to calculate the OPc value from the OP value...

Note!

Details

User Comments

Card Admin

Module

SMAOT

UICC

CDMA

Edge

Java

USIM

HTTP

IMSI

SIM

NFC

3FF

GSM

NFC

PDA

PIN

BER

CRC

IMS

NDS

RAN

RAT

3G

4G

DM

IM

IP

OS

SE

BS

DL

HE

HO

PS

UE

SIM

SIM

Keyword Search

Newsletter signup

Subscribe to our mailing list

PGP

This Site

Webstore menu