An Efficient and Simple Way to Test the Security of Java CardsTM

Till recently it was impossible to have more than one single application running on a smart card. Multiapplication cards, and especially Java Cards, now make it possible to have several applications sharing the same physical piece of plastic. Today, these cards accept to load code only after an authentication. But in the future, the cards will be open an everybody should be authorized to upload an application. This raises new security problems by creating additional ways to attack Java Cards. These problems and the method to test them are the topic of this paper. The attacks will be illustrated with code samples. The method presented here can be applied right now by authorised people (e.g. Information Technology Evaluation Facility – ITSEF) to test the security of Java Cards since they have the authentication keys and tomorrow a hacker may also be able to use this method to attack cards without needing the keys.