ACS ACR38 Smart, Reference Manual

Page 1: ...1008 10th Floor Hongkong International Trade and Exhibition Centre 1 Trademart Drive Kowloon Bay Hong Kong Tel 852 2796 7873 Fax 852 2796 1286 Email info acs com hk Website www acs com hk Version 1 9 02 2006 ...

Page 2: ...ontrol Commands 11 8 1 1 GET_ACR_STAT 11 8 1 2 SELECT_CARD_TYPE 12 8 1 3 SET_OPTION 12 8 1 4 SET_CARD_PPS 12 8 1 5 SET_READER_PPS 13 8 2 Card Commands 14 8 2 1 MCU based Card 14 8 2 1 1 RESET_WITH_5_VOLTS_DEFAULT 14 8 2 1 2 RESET_WITH_SPECIFIC_VOLTAGE 14 8 2 1 3 POWER_OFF 15 8 2 1 4 EXCHANGE_TPDU_T0 15 8 2 1 5 EXCHANGE_TPDU_T1 16 8 2 2 Memory Card 1 2 4 8 16 kbit I2C card 16 8 2 2 1 SELECT_CARD_TY...

Page 3: ...ARD only SLE 4428 30 8 2 6 7 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD only SLE 4428 30 8 2 7 Memory Card SLE4432 4442 32 8 2 7 1 SELECT_CARD_TYPE 32 8 2 7 2 READ_MEMORY_CARD 32 8 2 7 3 WRITE_MEMORY_CARD 33 8 2 7 4 WRITE_PROTECTION_MEMORY_CARD 33 8 2 7 5 PRESENT_CODE_MEMORY_CARD only SLE 4442 34 8 2 7 6 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD only SLE 4442 35 8 2 7 7 CHANGE_CODE_MEMORY_CARD ...

Page 4: ...ion of a smart card system The ACR38 Smart Card Reader Writer is connected to the computer through USB interface The reader accepts commands from the computer carries out the specified function at the smart card and returns the requested data or status information NOTE Although the ACR38 is a true card reader writer as it can read and write smart cards the terms card reader or reader will be used ...

Page 5: ... present and communication parameters other than the default parameters the ACR38 will execute the PPS and try to use the communication parameters that the card suggested in its ATR If the card does not accept the PPS the reader will use the default parameters F 372 D 1 For the meaning of the aforementioned parameters please refer to ISO7816 part 3 3 2 Memory based smart cards synchronous interfac...

Page 6: ...CU based cards the reader allows to select the preferred protocol T 0 or T 1 However this selection is only accepted and carried out by the reader through the PPS when the card inserted in the reader supports both protocol types Whenever an MCU based card supports only one protocol type T 0 or T 1 the reader automatically uses that protocol type regardless of the protocol type selected by the appl...

Page 7: ... activation status of the smart card interface Flashing slowly turns on 200ms for every 2 seconds Indicates that the ACR38 is powered up and is in the standby state Either the smart card has not been inserted or the smart card has not been powered up if it is inserted Lighting up Indicates power supply to the smart card is switched on i e the smart card is activated Flashing quickly Indicates that...

Page 8: ...en ACR30 and PC 4 GND Reference voltage level for power supply NOTE In order for the ACR38 to function properly through USB interface either ACS proprietary device driver or ACS PC SC device driver has to be installed Please refer to the Device Driver Installation Guide for more detail 6 2 Endpoints The ACR38 uses the following endpoints to communicate with the host computer Control Endpoint For s...

Page 9: ...on The instruction code of the command to be carried out by the ACR38 Data Length Number of subsequent data bytes and is encoded in 2 bytes The first byte MSB and second byte LSB represent data length N Data Data contents of the command For a READ command for example the data bytes would specify the start address and the number of bytes to be read For a WRITE command the data bytes would specify t...

Page 10: ...ndpoint 7 3 Card Status Message When a card is being inserted into the reader or an inserted card is being removed from the reader while the reader is idle i e not executing a command the reader transmits a Card Status Message to notify the host computer of the change in the card insertion status The Card Status Messages have the following structure and contents Card Status Message for Card Insert...

Page 11: ...01 H 01 H 00 H 00 H Response data format Header Status Data length INTERNAL MAX_C MAX_R C_TYPE C_SEL C_STAT LEN 01 H INTERNAL 10 bytes data for internal use only MAX_C The maximum number of command data bytes MAX_R The maximum number of data bytes that can be requested to be transmitted in a response C_TYPE The card types supported by the ACR38 This data field is a bitmap with each bit representin...

Page 12: ...H 8 1 3 SET_OPTION This command selects the options for the reader Command format Header Instruction Data length Data LEN Option 01 H 07 H 00 H 01 H Option Bit 4 Select for EMV mode Specifies whether the reader is in EMV mode 0 reader not in EMV mode default 1 reader in EMV mode Bit 5 Select for memory card mode Specifies whether the reader is in memory card mode 0 reader not in memory card mode d...

Page 13: ...eader and asks the reader to switch its protocol and or speed to communication with the smart card This command should work in pair with SET_CARD_PPS Command format Header Instruction Data length Data LEN PPS Response 01 H 0B H MSB LSB LEN Length of PPS response Typical value is 4 PPS ResponsePPS Response received from the card Please refer to ISO IEC 7816 3 1997 Section 7 for details of PPS respo...

Page 14: ... length ATR LEN 01 H ATR Answer To Reset as transmitted by the card according to ISO7816 3 NOTE The ATR is only returned in the ACR38 response if the communication protocol of the card is compatible with the reader i e if the card can be processed by the ACR38 Otherwise the ACR38 returns an error status and deactivates the smart card interface 8 2 1 2 RESET_WITH_SPECIFIC_VOLTAGE This command power...

Page 15: ...rd inserted in the card reader Command format Header Instruction Data length LEN 01 H 81 H 00 H 00 H Response data format Header Status Data length LEN 01 H 8 2 1 4 EXCHANGE_TPDU_T0 To exchange an APDU Application Protocol Data Unit command response pair between the MCU card inserted in the ACR38 and the host computer Command format Header Instruction Data length LEN Data MSB LSB T0 TPDU 01 H A0 H...

Page 16: ...ommand data N Data T1 TPDU frame to be sent to the card It should include NAD PCB LEN INF and EDC fields Please refer to ISO IEC 7816 3 1997 E Section 9 4 for detailed information Response data format Header Status Data length BYTE 1 BYTE N LEN 01 H BYTE x Response T1 Block from card if any The response should include NAD PCB LEN INF and EDC fields Please refer to ISO IEC 7816 3 1997 E Section 9 4...

Page 17: ...It will reset to default value whenever the card is removed or the reader is powered off Command format Header Instruction Data length Data LEN CLA INS P1 P2 Lc Page size 01 H A0 H 00 H 06 H FF H 01 H 00 H 00 H 01 H Page size 03 H for 8 byte page write 04 H for 16 byte page write 05 H for 32 byte page write 06 H for 64 byte page write 07 H for 128 byte page write Response data format Header Status...

Page 18: ...90 H 00 H if no error 8 2 2 4 WRITE_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS Byte Address MEM_L Byte 1 Byte n MSB LSB MSB LSB 01 H A0 H FF H D0 H Byte Address Memory address location of the memory card LEN 5 MEM_L MEM_L Length of data to be written to the memory card Byte x Data to be written to the memory card Response data format Header Status Data length SW1 SW...

Page 19: ... Data length BYTE 1 BYTE N SW1 SW2 LEN 01 H BYTE x ATR from card if any SW1 SW2 90 H 00 H if no error 8 2 3 2 SELECT_PAGE_SIZE This command will choose the page size to read the smart card The default value is 8 byte page write It will reset to default value whenever the card is removed or the reader is powered off Command format Header Instruction Data length Data LEN CLA INS P1 P2 Lc Page size 0...

Page 20: ...ength of data to be read from the memory card Response data format Header Status Data length BYTE 1 BYTE N SW1 SW2 LEN 01 H BYTE x Data read from memory card SW1 SW2 90 H 00 H if no error 8 2 3 4 WRITE_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS Byte Address MEM_L Byte 1 Byte n MSB LSB MSB LSB 01 H A0 H FF H INS D0 H for 32 64 128 256 512kbit iic card 1101 000 b for ...

Page 21: ... Data length Data LEN CLA INS P1 P2 Lc Card Type 01 H A0 H 00 H 06 H FF H A4 H 00 H 00 H 01 H 03 H Response data format Header Status Data length BYTE 1 BYTE 2 BYTE 3 BYTE 4 SW1 SW2 LEN 01 H BYTE x ATR from card SW1 SW2 90 H 00 H if no error 8 2 4 2 READ_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS P1 Byte Address MEM_L 01 H A0 H 00 H 05 H FF H 00 H INS B0 H for readi...

Page 22: ...01 b D2 H for writing zone 10 b D3 H for writing zone 11 b D4 H for writing fuse Byte Address Memory address location of the memory card LEN 5 MEM_L MEM_L Length of data to be written to the memory card MEM_D Data to be written to the memory card Response data format Header Status Data length SW1 SW2 LEN 01 H SW1 SW2 90 H 00 H if no error 8 2 4 4 VERIFTY_PASSWORD Command format Header Instruction ...

Page 23: ... length Data LEN CLA INS P1 P2 Lc Q 0 Q 1 Q 7 01 H A0 H 00 H 0D H FF H 84 H 00 H 00 H 08 H Q 0 Q 1 Q 7 Host random number 8 bytes Response data format Header Status Data length SW1 SW2 LEN 01 H SW1 SW2 90 H 00 H if no error 8 2 4 6 VERIFY_AUTHENTICATION Command format Header Instruction Data length Data LEN CLA INS P1 P2 Lc Ch 0 Ch 1 Ch 7 01 H A0 H 00 H 0D H FF H 82 H 00 H 00 H 08 H Ch 0 Ch 1 Ch 7...

Page 24: ... Response data format Header Status Data length BYTE 1 BYTE 2 BYTE 3 BYTE 4 SW1 SW2 LEN 01 H BYTE x ATR from card SW1 SW2 90 H 00 H if no error 8 2 5 2 READ_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS Zone Address Byte Address MEM_L 01 H A0 H 00 H 05 H FF H INS B0 H for reading user zone B1 H for reading configuration zone or reading fuse Zone Address 0000 0A10A9A8 b...

Page 25: ...0 0A10A9A8 b where A10 is the MSB of zone address don t care for writing fuse Byte Address A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card 1000 0000 b for writing fuse LEN 5 MEM_L MEM_L Length of data to be written to the memory card Byte x Data to be written to the memory card Response data format Header Status Data length SW1 SW2 LEN 01 H SW1 SW2 90 H 00 H if no error 8 2 5...

Page 26: ...TICATION Command format Header Instruction Data length Data LEN CLA INS P1 P2 Lc Q 0 Q 1 Q 7 01 H A0 H 00 H 0D H FF H 84 H 00 H 00 H 08 H Byte Address Memory address location of the memory card Q 0 Q 1 Q 7 Host random number 8 bytes Response data format Header Status Data length SW1 SW2 LEN 01 H SW1 SW2 90 H 00 H if no error 8 2 5 6 VERIFY_AUTHENTICATION Command format Header Instruction Data leng...

Page 27: ...Type 01 H A0 H 00 H 06 H FF H A4 H 00 H 00 H 01 H 05 H Response data format Header Status Data length BYTE 1 BYTE 2 BYTE 3 BYTE 4 SW1 SW2 LEN 01 H BYTE x ATR from card SW1 SW2 90 H 00 H if no error 8 2 6 2 READ_MEMORY_WITH_PROTECT_BIT_CARD Command format Header Instruction Data length Data LEN CLA INS Byte Address MEM_L MSB LSB 01 H A0 H 00 H 05 H FF H B0 H MSB Byte Address 0000 00A9A8 b is the me...

Page 28: ...3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 P18 P17 Px is the protection bit of BYTE x in the response data 0 byte is write protected 1 byte can be written 8 2 6 3 READ_MEMORY_WITHOUT_PROTECT_BIT_CARD Command format Header Instruction Data length Data LEN CLA INS Byte Address MEM_L MSB LSB 01 H A0 H 00 H 05 H FF H B2 H MSB Byte Address 0000 00A9A8 b is the memory address location of the memory card LSB...

Page 29: ...Y_CARD Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified address and if the data matches the corresponding protection bit is irreversibly programmed to 0 Command format Header Instruction Data length Data LEN CLA INS Byte Address MEM_L Byte 1 Byte N MSB LSB MSB LSB 01 H A0 H FF H D1 H MSB Byte Address 0000 00A9A8 b is the memory add...

Page 30: ...e 2 01 H A0 H 00 H 07 H FF H 20 H 00 H 00 H 02 H CODE Two bytes secret code PIN Response data format Header Status Data length ERRCNT CODE SW1 SW2 LEN Byte 1 Byte 2 01 H ERRCNT The value of the presentation error counter after the code presentation CODE The two bytes secret code read from the card SW1 SW2 90 H 00 H if no error If the correct code has been presented to the card the value of ERRCNT ...

Page 31: ...esponse data format Header Status Data length ERRCNT DUMMY 1 DUMMY 2 SW1 SW2 LEN 01 H ERRCNT The value of the presentation error counter DUMMY Two bytes dummy data read from the card SW1 SW2 90 H 00 H if no error Advanced Card Systems Ltd Page 31 of 43 ...

Page 32: ...INS P1 P2 Lc Card Type 01 H A0 H 00 H 06 H FF H A4 H 00 H 00 H 01 H 06 H Response data format Header Status Data length BYTE 1 BYTE 2 BYTE 3 BYTE 4 SW1 SW2 LEN 01 H BYTE x ATR from card SW1 SW2 90 H 00 H if no error 8 2 7 2 READ_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS P1 Byte Address MEM_L 01 H A0 H 00 H 05 H FF H B0 H 00 H Byte Address A7A6A5A4 A3A2A1A0 b is the...

Page 33: ...n 8 2 7 3 WRITE_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS P1 Byte Address MEM_L Byte 1 Byte N MSB LSB 01 H A0 H FF H D0 H 00 H Byte Address A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card LEN 5 MEM_L MEM_L Length of data to be written to the memory card Byte x Data to be written to the memory card Response data format Header Status Data length...

Page 34: ...compared with the data at Byte Address N 1 Response data format Header Status Data length SW1 SW2 LEN 01 H SW1 SW2 90 H 00 H if no error 8 2 7 5 PRESENT_CODE_MEMORY_CARD only SLE 4442 To submit the secret code to the memory card to enable the write operation with the SLE4442 card The following actions are executed search a 1 bit in the presentation error counter and write the bit to 0 present the ...

Page 35: ...code Command format Header Instruction Data length Data LEN CLA INS P1 P2 MEM_L MSB LSB 01 H A0 H 00 H 08 H FF H B1 H 00 H 00 H 00 H Response data format Header Status Data length ERRCNT DUMMY 1 DUMMY 2 DUMMY 3 SW1 SW2 LEN 01 H ERRCNT The value of the presentation error counter DUMMY Three bytes dummy data read from the card SW1 SW2 90 H 00 H if no error 8 2 7 7 CHANGE_CODE_MEMORY_CARD only SLE 44...

Page 36: ...ACR38 Reference Manual version 1 9 February 2006 Response data format Header Status Data length SW1 SW2 LEN 01 H SW1 SW2 90 H 00 H if no error Advanced Card Systems Ltd Page 36 of 43 ...

Page 37: ...rtion Command format Header Instruction Data length Data LEN CLA INS P1 P2 Lc Card Type 01 H A0 H 00 H 06 H FF H A4 H 00 H 00 H 01 H 07 H Response data format Header Status Data length BYTE 1 BYTE 2 BYTE 3 BYTE 4 SW1 SW2 LEN 01 H BYTE x ATR from card SW1 SW2 90 H 00 H if no error 8 2 8 2 READ_MEMORY_CARD Command format Header Instruction Data length Data LEN CLA INS P1 Byte Address MEM_L 01 H A0 H...

Page 38: ...er stage This write mode can therefore only be used for updating the counter value in the card c Write with backup enabled SLE4436 and SLE5536 only The byte value specified in the command is written to the specified address This command can be used for writing personalization data and counter values to the card Backup bit is enabled to prevent data loss when card tearing occurs d Write with carry ...

Page 39: ... 01 H SW1 SW2 90 H 00 H if no error 8 2 8 4 PRESENT_CODE_MEMORY_CARD To submit the secret code to the memory card to enable the card personalization mode The following actions are executed search a 1 bit in the presentation counter and write the bit to 0 present the specified code to the card The ACR38 does not try to erase the presentation counter after the code submission This must be done by th...

Page 40: ...n data calculated by the card in the response Command format Header Instruction Data length Data LEN CLA INS P1 P2 MEM_L CODE MSB LSB KEY CLK_CNT Byte1 Byte 2 Byte 5 Byte 6 01 H A0 H 00 H 08 H FF H 84 H 00 H 00 H 08 H KEY Key to be used for the computation of the authentication certificate 00H key 1 with no cipher block chaining 01H key 2 with no cipher block chaining 80H key 1 with cipher block c...

Page 41: ...ber mouse card type code Card Type 00H Auto select T 0 or T 1 communication protocol 01H I2C memory card 1k 2k 4k 8k and 16k bits 02H I2C memory card 32k 64k 128k 256k 512k and 1024k bits 03H Atmel AT88SC153 secure memory card 04H Atmel AT88SC1608 secure memory card 05H Infineon SLE4418 and SLE4428 06H Infineon SLE4432 and SLE4442 07H Infineon SLE4406 SLE4436 and SLE5536 0CH MCU based cards with T...

Page 42: ...tatus 00 OK command successfully executed F4 SLOTERROT_PROCEDURE_BYTE_CONFLICT F6 SLOTERROR_BAD_LENGTH F7 SLOTERROR_BAD_FIDI F8 SLOTERROR_BAD_ATR_TS F9 SLOTERROR_ICC_NOT_POWERED_UP FA SLOTERROR_ICC_NOT_INSERTED FB SLOTERROR_HW_ERROR FC SLOTERROR_XFE_OVERRUN FD SLOTERROR_XFE_PARITY_ERROR FE SLOTERROR_ICC_MUTE FF SLOTERROR_CMD_ABORTED Advanced Card Systems Ltd Page 42 of 43 ...

Page 43: ...rough a green LED on the reader CLK frequency 4 MHz Card connector Contact Card insertion cycles min 100 000 Optional SAM Card Interface Card connector Landing Location Under the removable dark lid Physical Specifications Dimensions 73 0mm L x 96 5mm W x 19 0mm H Color Silver Weight 95g 5g allowance for cable Spaceship casing Cable length cord connector 1 5 meters Fixed non detachable USB A Operat...