globalplatform.h File Reference

#include <stdio.h>
#include "types.h"
#include "unicode.h"
#include "error.h"
#include "errorcodes.h"
#include "library.h"
#include "connection.h"
#include "security.h"
#include "stringify.h"

Include dependency graph for globalplatform.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	OPGP_PROGRESS_CALLBACK_PARAMETERS
struct	OPGP_PROGRESS_CALLBACK
struct	OPGP_AID
struct	OP201_APPLICATION_DATA
struct	OPGP_LOAD_FILE_PARAMETERS
struct	GP211_APPLICATION_DATA
struct	GP211_EXECUTABLE_MODULES_DATA
struct	OPGP_EXTENDED_CARD_RESOURCE_INFORMATION
struct	OPGP_CPLC
struct	GP211_CARD_RECOGNITION_DATA
struct	GP211_SCP11_CERTIFICATE
struct	GP211_SCP_INFORMATION
struct	GP211_CARD_CAPABILITY_INFORMATION
struct	GP211_UICC_TOOLKIT_MENU_ENTRY
struct	GP211_UICC_TOOLKIT_APP_PARAMS
struct	GP211_UICC_ACCESS_RULE
struct	GP211_UICC_ACCESS_PARAMS
struct	GP211_UICC_SYSTEM_SPECIFIC_PARAMS
struct	GP211_SIM_TOOLKIT_PARAMS
struct	GP211_SIM_SPECIFIC_PARAMS
struct	GP211_SD_SCP_ENTRY
struct	GP211_SD_INSTALL_PARAMS

Macros
#define	max(a, b)   (((a)>(b))?(a):(b))
#define	min(a, b)   (((a)>(b))?(b):(a))
#define	APDU_COMMAND_LEN   261
	The APDU command length: 5 bytes header + 255 body + Le.
#define	APDU_RESPONSE_LEN   258
	The APDU response length: 256 data + 2 bytes SW.
#define	GP211_LIFE_CYCLE_LOAD_FILE_LOADED   0x01
	Executable Load File is loaded.
#define	GP211_LIFE_CYCLE_CARD_OP_READY   0x01
	Card is OP ready.
#define	GP211_LIFE_CYCLE_CARD_INITIALIZED   0x07
	Card is initialized.
#define	GP211_LIFE_CYCLE_CARD_SECURED   0x0f
	Card is in secured state.
#define	GP211_LIFE_CYCLE_CARD_LOCKED   0x7f
	Card is locked.
#define	GP211_LIFE_CYCLE_CARD_TERMINATED   0xff
	Card is terminated.
#define	GP211_LIFE_CYCLE_APPLICATION_INSTALLED   0x03
	Application is installed.
#define	GP211_LIFE_CYCLE_APPLICATION_SELECTABLE   0x07
	Application is selectable.
#define	GP211_LIFE_CYCLE_APPLICATION_LOCKED   0x83
	Application is locked.
#define	GP211_LIFE_CYCLE_SECURITY_DOMAIN_INSTALLED   0x03
	Application is installed.
#define	GP211_LIFE_CYCLE_SECURITY_DOMAIN_SELECTABLE   0x07
	Application is selectable.
#define	GP211_LIFE_CYCLE_SECURITY_DOMAIN_PERSONALIZED   0x0f
	Application is personalized.
#define	GP211_LIFE_CYCLE_SECURITY_DOMAIN_LOCKED   0x83
	Application is locked.
#define	GP211_MANAGE_CHANNEL_OPEN   0x00
	Open the next available Supplementary Logical Channel.
#define	GP211_MANAGE_CHANNEL_CLOSE   0x80
	Close the Supplementary Logical Channel.
#define	GP211_STATUS_APPLICATIONS   0x40
	Indicate Applications or Security Domains in GP211_get_status().
#define	GP211_STATUS_ISSUER_SECURITY_DOMAIN   0x80
	Indicate Issuer Security Domain in GP211_get_status().
#define	GP211_STATUS_LOAD_FILES   0x20
	Request GP211_APPLICATION_DATA for Executable Load Files in GP211_get_status().
#define	GP211_STATUS_LOAD_FILES_AND_EXECUTABLE_MODULES   0x10
	Request GP211_EXECUTABLE_MODULES_DATA for Executable Load Files and their Executable Modules in GP211_get_status().
#define	GP211_STATUS_TYPE_APPLICATIONS   0x40
	Indicate Applications or supplementary Security Domains in GP211_set_status().
#define	GP211_STATUS_TYPE_ISSUER_SECURITY_DOMAIN   0x80
	Indicate Issuer Security Domain in GP211_set_status().
#define	GP211_STATUS_TYPE_SECURITY_DOMAIN_AND_APPLICATIONS   0x60
	Indicate Security Domain and its associated Applications in GP211_set_status().
#define	GP211_STATUS_FORMAT_NEW   0x02
	New GP2.1.1 GET STATUS format.
#define	GP211_STATUS_FORMAT_DEPRECATED   0x00
	New GP2.1.1 GET STATUS deprecated format.
#define	GP211_KEY_ACCESS_SD_AND_APPS   0x00
	Key may be used by the Security Domain and any associated Application.
#define	GP211_KEY_ACCESS_SD_ONLY   0x01
	Key may only be used by the Security Domain.
#define	GP211_KEY_ACCESS_APPS_ONLY   0x02
	Key may be used by any Application associated with the Security Domain but not by the Security Domain itself.
#define	GP211_KEY_PURPOSE_SCP03   0x0003
	Key purpose for SCP03.
#define	GP211_KEY_PURPOSE_SCP04   0x0004
	Key purpose for SCP04.
#define	GP211_KEY_PURPOSE_SCP10   0x0010
	Key purpose for SCP10.
#define	GP211_KEY_PURPOSE_SCP11   0x0011
	Key purpose for SCP11.
#define	GP211_KEY_PURPOSE_TOKEN_VERIFICATION   0x7000
	Token Verification.
#define	GP211_KEY_PURPOSE_RECEIPT_GENERATION   0x7001
	Receipt Generation.
#define	GP211_KEY_PURPOSE_DAP_VERIFICATION   0x7003
	DAP Verification.
#define	GP211_KEY_PURPOSE_CASD_AND_CONFIDENTIAL_SETUP   0x7004
	CASD and Confidential Setup of Secure Channel Keys.
#define	GP211_KEY_PURPOSE_CIPHERED_LOAD_FILE   0x7005
	Ciphered Load File Data Block Key.
#define	STORE_DATA_ENCRYPTION_NO_INFORMATION   0x00
	No general encryption information or non - encrypted data.
#define	STORE_DATA_ENCRYPTION_APPLICATION_DEPENDENT   0x20
	Application dependent encryption of the data.
#define	STORE_DATA_ENCRYPTION_RFU   0x40
	RFU(encryption indicator)
#define	STORE_DATA_ENCRYPTION_ENCRYPTED   0x60
	Encrypted data. Must be encrypted with data encryption key.
#define	STORE_DATA_FORMAT_NO_INFORMATION   0x00
	No general data structure information.
#define	STORE_DATA_FORMAT_DGI   0x08
	DGI format of the command data field.
#define	STORE_DATA_FORMAT_BER_TLV   0x10
	BER-TLV format of the command data field.
#define	STORE_DATA_FORMAT_RFU   0x18
	RFU (data structure information)
#define	OP201_LIFE_CYCLE_LOAD_FILE_LOGICALLY_DELETED   0x00
	Executable Load File is logically deleted.
#define	OP201_LIFE_CYCLE_LOAD_FILE_LOADED   0x01
	Executable Load File is loaded.
#define	OP201_LIFE_CYCLE_CARD_MANAGER_OP_READY   0x01
	Card is OP ready.
#define	OP201_LIFE_CYCLE_CARD_MANAGER_INITIALIZED   0x07
	Card is initialized.
#define	OP201_LIFE_CYCLE_CARD_MANAGER_SECURED   0x0f
	Card is in secured state.
#define	OP201_LIFE_CYCLE_CARD_MANAGER_CM_LOCKED   0x7f
	Card is locked.
#define	OP201_LIFE_CYCLE_CARD_MANAGER_TERMINATED   0xff
	Card is terminated.
#define	OP201_LIFE_CYCLE_APPLICATION_LOGICALLY_DELETED   0x00
	Application is logically deleted.
#define	OP201_LIFE_CYCLE_APPLICATION_INSTALLED   0x03
	Application is installed.
#define	OP201_LIFE_CYCLE_APPLICATION_SELECTABLE   0x07
	Application is selectable.
#define	OP201_LIFE_CYCLE_APPLICATION_PERSONALIZED   0x0f
	Application is personalized.
#define	OP201_LIFE_CYCLE_APPLICATION_BLOCKED   0x7f
	Application is blocked.
#define	OP201_LIFE_CYCLE_APPLICATION_LOCKED   0xff
	Application is locked.
#define	OP201_STATUS_APPLICATIONS   0x40
	Indicate Applications or Security Domains in OP201_get_status() or OP201_set_status().
#define	OP201_STATUS_CARD_MANAGER   0x80
	Indicate Card Manager in OP201_get_status() or OP201_set_status().
#define	OP201_STATUS_LOAD_FILES   0x20
	Request OP201_APPLICATION_DATA for Executable Load Files in OP201_get_status().
#define	OPGP_DERIVATION_METHOD_NONE   0
	No key derivation is used during mutual authentication.
#define	OPGP_DERIVATION_METHOD_VISA2   1
	The VISA2 key derivation is used during mutual authentication.
#define	OPGP_DERIVATION_METHOD_EMV_CPS11   2
	The EMV CPS 11 derivation is used during mutual authentication.
#define	OPGP_DERIVATION_METHOD_VISA1   3
	The VISA1 key derivation is used during mutual authentication.
#define	GP211_HASH_SHA1   1
	SHA-1.
#define	GP211_HASH_SHA256   2
	SHA2-256.
#define	GP211_HASH_SHA384   3
	SHA2-384.
#define	GP211_HASH_SHA512   4
	SHA2-512.
#define	GP211_HASH_SM3   5
	SM3.
#define	GP211_KEY_VERSION_TOKEN_VERIFICATION   0x70
	Token Verification.
#define	GP211_KEY_VERSION_RECEIPT_GENERATION   0x71
	Receipt Generation.
#define	GP211_KEY_VERSION_DAP_VERIFICATION   0x73
	DAP Verification.
#define	GP211_KEY_VERSION_CASD_AND_CONFIDENTIAL_SETUP   0x74
	CASD and Confidential Setup of Secure Channel Keys.
#define	GP211_KEY_VERSION_CIPHERED_LOAD_FILE   0x75
	Ciphered Load File Data Block Key.
#define	OPGP_WORK_UNKNOWN   -1
	The amount of work is not known.
#define	OPGP_TASK_FINISHED   1
	The task is finished.
#define	INIT_PROGRESS_CALLBACK_PARAMETERS(callbackParameters, callback)
#define	GP211_MAX_CARD_RECOGNITION_SCP_INFOS   16
#define	GP211_MAX_CARD_RECOGNITION_SCP_IMPL_OID_BYTES   8
#define	GP211_SCP02_SCPI_THREE_KEYS   0x01
	SCP02: 1=3 static keys, 0=1 base key.
#define	GP211_SCP02_SCPI_MODE_MASK   0x0E
	SCP02: initiation/ICV mode selector.
#define	GP211_SCP02_SCPI_MODE_EXPLICIT   0x04
	SCP02: explicit initiation, C-MAC on modified APDU, ICV=0.
#define	GP211_SCP02_SCPI_MODE_IMPLICIT   0x0A
	SCP02: implicit initiation, C-MAC on unmodified APDU, ICV=MAC(AID).
#define	GP211_SCP02_SCPI_CMAC_ICV_ENCRYPTION   0x10
	SCP02: C-MAC ICV encryption enabled.
#define	GP211_SCP02_SCPI_PSEUDO_RANDOM_CARD_CHALLENGE   0x40
	SCP02: pseudo-random card challenge algorithm.
#define	GP211_SCP03_SCPI_PSEUDO_RANDOM_CARD_CHALLENGE   0x10
	SCP03: 1=pseudo-random card challenge, 0=random.
#define	GP211_SCP03_SCPI_RESPONSE_MASK   0x60
	SCP03: response protection coding mask.
#define	GP211_SCP03_SCPI_RESPONSE_NONE   0x00
	SCP03: no R-MAC / no R-ENC.
#define	GP211_SCP03_SCPI_RESPONSE_R_MAC   0x20
	SCP03: R-MAC / no R-ENC.
#define	GP211_SCP03_SCPI_RESPONSE_R_ENC_R_MAC   0x60
	SCP03: R-MAC and R-ENC.
#define	GP211_SCP11_SCPI_B1_SECOND_BYTE_PRESENT   0x80
	SCP11 byte 1: second byte present.
#define	GP211_SCP11_SCPI_B1_S16_MODE   0x40
	SCP11 byte 1: 1=S16 secure messaging, 0=S8.
#define	GP211_SCP11_SCPI_B1_SCP11C_AUTH_BF20   0x20
	SCP11 byte 1: SCP11c authorization mechanism supported.
#define	GP211_SCP11_SCPI_B1_SCP11C_SUPPORTED   0x10
	SCP11 byte 1: SCP11c supported.
#define	GP211_SCP11_SCPI_B1_CERT_CHAIN_SUPPORTED   0x08
	SCP11 byte 1: certificate chain supported.
#define	GP211_SCP11_SCPI_B1_SD_PERSISTENT_PK_OCE_ECKA   0x04
	SCP11 byte 1: SD persistently stores PK.OCE.ECKA.
#define	GP211_SCP11_SCPI_B1_SCP11B_SUPPORTED   0x02
	SCP11 byte 1: SCP11b supported.
#define	GP211_SCP11_SCPI_B1_SCP11A_SUPPORTED   0x01
	SCP11 byte 1: SCP11a supported.
#define	GP211_SCP11_SCPI_B2_GP_LEGACY_CERT_NOT_SUPPORTED   0x04
	SCP11 byte 2: GP legacy format certificates not supported.
#define	GP211_SCP11_SCPI_B2_X509_CERT_SUPPORTED   0x02
	SCP11 byte 2: X.509 certificates supported.
#define	GP211_SCP11_SCPI_B2_SCP11A_AUTH_BF20   0x01
	SCP11 byte 2: SCP11a authorization mechanism supported.
#define	GP211_MAX_CARD_CAPABILITY_SCP_INFOS   16
#define	GP211_MAX_CARD_CAPABILITY_SCP_OPTIONS   16
#define	GP211_MAX_CARD_CAPABILITY_TLS_CIPHER_SUITES   16
#define	GP211_MAX_CARD_CAPABILITY_LFDBH_ALGORITHMS   8
#define	GP211_MAX_CARD_CAPABILITY_CIPHER_SUITES   32
#define	GP211_MAX_CARD_CAPABILITY_KEY_PARAMETER_REFERENCES   128
#define	GP211_MAX_CARD_CAPABILITY_ELF_UPGRADE   32
#define	GP211_SCP_SUPPORTED_KEY_SIZE_128   0x01
#define	GP211_SCP_SUPPORTED_KEY_SIZE_192   0x02
#define	GP211_SCP_SUPPORTED_KEY_SIZE_256   0x04
#define	GP211_LFDB_ENCRYPTION_3DES_16B_KEY   0x01
#define	GP211_LFDB_ENCRYPTION_AES_128   0x02
#define	GP211_LFDB_ENCRYPTION_AES_192   0x04
#define	GP211_LFDB_ENCRYPTION_AES_256   0x08
#define	GP211_LFDB_ENCRYPTION_SM4   0x10
#define	GP211_LFDB_ENCRYPTION_ICV_SUPPORTED   0x80
#define	GP211_SIGNATURE_CS_RSA_1024_SHA1   0x0100
#define	GP211_SIGNATURE_CS_RSA_PSS_SHA256   0x0200
#define	GP211_SIGNATURE_CS_DES_MAC_16B   0x0400
#define	GP211_SIGNATURE_CS_CMAC_AES_128   0x0800
#define	GP211_SIGNATURE_CS_CMAC_AES_192   0x1000
#define	GP211_SIGNATURE_CS_CMAC_AES_256   0x2000
#define	GP211_SIGNATURE_CS_ECDSA_256_SHA256   0x4000
#define	GP211_SIGNATURE_CS_ECDSA_384_SHA384   0x8000
#define	GP211_SIGNATURE_CS_ECDSA_512_SHA512   0x0001
#define	GP211_SIGNATURE_CS_ECDSA_521_SHA512   0x0002
#define	GP211_SIGNATURE_CS_SM2   0x0004
#define	GP211_SCP11_CERTIFICATE_MAX_ID_LENGTH   16
#define	GP211_SCP11_CERTIFICATE_MAX_DATE_LENGTH   4
#define	GP211_SCP11_CERTIFICATE_MAX_PUBLIC_KEY_LENGTH   160
#define	GP211_SCP11_CERTIFICATE_MAX_KEY_PARAMETER_REFERENCE_LENGTH   2
#define	GP211_SCP11_CERTIFICATE_MAX_SIGNATURE_LENGTH   160
#define	GP211_SCP11_CERTIFICATE_MAX_DISCRETIONARY_DATA_LENGTH   127
#define	GP211_SCP11_CERTIFICATE_MAX_AUTHORIZATIONS_LENGTH   1024
#define	GP211_ELF_UPGRADE_SINGLE   0x00
#define	GP211_ELF_UPGRADE_MULTI   0x01
#define	GP211_UICC_ACCESS_DOMAIN_FULL_ACCESS   0x00
	Access Domain Parameter: Full access to the File System.
#define	GP211_UICC_ACCESS_DOMAIN_UICC_ACCESS   0x02
	Access Domain Parameter: UICC access mechanism (3-byte ADD).
#define	GP211_UICC_ACCESS_DOMAIN_NO_ACCESS   0xFF
	Access Domain Parameter: No access to the File System.
#define	GP211_UICC_MSL_PARAMETER_MINIMUM_SPI1   0x01
	Minimum Security Level parameter: Minimum SPI1.
#define	GP211_UICC_TOOLKIT_MAX_TIMERS   0x08
	Max number of timers per ETSI TS 102 223.
#define	GP211_UICC_TOOLKIT_MAX_CHANNELS   0x07
	Max number of channels per ETSI TS 102 223.
#define	GP211_UICC_TOOLKIT_MAX_SERVICES   0x08
	Max number of services per ETSI TS 102 223.
#define	GP211_UICC_MAX_MENU_ENTRIES   8
	Maximum menu entries supported by the helper structures.
#define	GP211_UICC_MAX_ACCESS_RULES   4
	Maximum access rules supported by the helper structures.
#define	GP211_UICC_MAX_TAR_VALUES   4
	Maximum TAR values supported by the helper structures.
#define	GP211_UICC_TOOLKIT_DAP_MAX_LENGTH   16
	Maximum toolkit parameters DAP length supported.
#define	GP211_UICC_ACCESS_DOMAIN_DAP_MAX_LENGTH   16
	Maximum access domain DAP length supported.
#define	GP211_SPI1_RC_CC_DS_MASK   0x03
	SPI1 RC/CC/DS mask (b2..b1).
#define	GP211_SPI1_RC_CC_DS_NONE   0x00
	SPI1 RC/CC/DS: none.
#define	GP211_SPI1_RC_CC_DS_RC   0x01
	SPI1 RC/CC/DS: Redundancy Check.
#define	GP211_SPI1_RC_CC_DS_CC   0x02
	SPI1 RC/CC/DS: Cryptographic Checksum.
#define	GP211_SPI1_RC_CC_DS_DS   0x03
	SPI1 RC/CC/DS: Digital Signature (reserved).
#define	GP211_SPI1_CIPHERING   0x04
	SPI1 ciphering bit (b3).
#define	GP211_SPI1_COUNTER_MASK   0x18
	SPI1 counter mask (b5..b4).
#define	GP211_SPI1_COUNTER_NONE   0x00
	SPI1 counter: no counter.
#define	GP211_SPI1_COUNTER_AVAILABLE   0x08
	SPI1 counter: available, no replay/sequence check.
#define	GP211_SPI1_COUNTER_HIGHER_THAN_RE   0x10
	SPI1 counter: process if counter higher than RE.
#define	GP211_SPI1_COUNTER_INCREMENT_RE   0x18
	SPI1 counter: process if counter is one higher than RE.
#define	GP211_SPI1_RFU_MASK   0xE0
	SPI1 RFU mask (b8..b6).
#define	GP211_SD_MAX_SCP   8
	Maximum SCP entries supported by the helper structures.
#define	GP211_SD_PARAM_TAG_SCP   0x81
	SD install param tag for SCP (tag '81').
#define	GP211_SD_PARAM_TAG_ACCEPT_EXTRACTION   0x82
	SD install param tag for accept extraction (tag '82').
#define	GP211_SD_PARAM_TAG_ACCEPT_DELETE   0x83
	SD install param tag for accept deletion (tag '83').
#define	GP211_SD_PARAM_TAG_PERSONALIZED   0x84
	SD install param tag for personalized state (tag '84').
#define	GP211_SD_PARAM_TAG_CASD_CAPABILITY   0x86
	SD install param tag for CASD capability (tag '86').
#define	GP211_SD_PARAM_TAG_ACCEPT_GLOBAL_DELETE   0x87
	SD install param tag for accept global delete (tag '87').
#define	GP211_SD_PARAM_LEN_SCP   0x02
	SD install param length for SCP (tag '81').
#define	GP211_SD_PARAM_LEN_ACCEPT_DELETE   0x01
	SD install param length for accept deletion (tag '83').
#define	GP211_SD_PARAM_LEN_CASD_CAPABILITY   0x02
	SD install param length for CASD capability (tag '86').
#define	GP211_SD_PARAM_LEN_PERSONALIZED   0x00
	SD install param length for personalized state (tag '84').
#define	GP211_SD_PARAM_LEN_ACCEPT_MIN   0x01
	SD install param minimum length for accept policies (tags '82','87').
#define	GP211_SD_PARAM_LEN_ACCEPT_MAX   0x02
	SD install param maximum length for accept policies (tags '82','87').
#define	GP211_SD_ACCEPT_NONE   0x00
	Accept policy: no acceptance (default).
#define	GP211_SD_ACCEPT_ANCESTOR_AM   0x80
	Accept policy: from ancestor SD with AM privilege.
#define	GP211_SD_ACCEPT_HIERARCHY_AM   0xC0
	Accept policy: from any SD in hierarchy with AM privilege.
#define	GP211_SD_ACCEPT_ISD   0x20
	Accept policy: from Issuer Security Domain.
#define	GP211_SD_ACCEPT_DM_UNDER_ANCESTOR_AM   0x08
	Accept policy: from any SD with DM under ancestor SD with AM.
#define	GP211_SD_ACCEPT_ALL_AM   0xF0
	Accept policy: from every SD with AM privilege (RFU bits set to 0).

Enumerations
enum	GP211_APPLICATION_PRIVILEGES {   GP211_SECURITY_DOMAIN = 1u << (7 + 16) , GP211_DAP_VERIFICATION = 0xC0 << 16 , GP211_DELEGATED_MANAGEMENT = 0xA0 << 16 , GP211_CARD_MANAGER_LOCK_PRIVILEGE = 1u << (4 + 16) ,   GP211_CARD_MANAGER_TERMINATE_PRIVILEGE = 1u << (3 + 16) , GP211_DEFAULT_SELECTED_CARD_RESET_PRIVILEGE = 1u << (2 + 16) , GP211_PIN_CHANGE_PRIVILEGE = 1u << (1 + 16) , GP211_MANDATED_DAP_VERIFICATION = 0xD0 << 16 ,   GP211_TRUSTED_PATH = 1u << (7 + 8) , GP211_AUTHORIZED_MANAGEMENT = 1u << (6 + 8) , GP211_TOKEN_VERIFICATION = 1u << (5 + 8) , GP211_GLOBAL_DELETE = 1u << (4 + 8) ,   GP211_GLOBAL_LOCK = 1u << (3 + 8) , GP211_GLOBAL_REGISTRY = 1u << (2 + 8) , GP211_FINAL_APPLICATION = 1u << (1 + 8) , GP211_GLOBAL_SERVICE = 1u << (0 + 8) ,   GP211_RECEIPT_GENERATION = 1u << 7 , GP211_CIPHERED_LOAD_FILE_DATA_BLOCK = 1u << 6 , GP211_CONTACTLESS_ACTIVATION = 1u << 5 , GP211_CONTACTLESS_SELF_ACTIVATION = 1u << 4 }
	Application privileges. More...
enum	OP201_APPLICATION_PRIVILEGES {   OP201_SECURITY_DOMAIN = 1u << 7 , OP201_DAP_VERIFICATION = 0xC0 , OP201_DELEGATED_MANAGEMENT = 0xA0 , OP201_CARD_MANAGER_LOCK_PRIVILEGE = 1u << 4 ,   OP201_CARD_MANAGER_TERMINATE_PRIVILEGE = 1u << 3 , OP201_DEFAULT_SELECTED = 1u << 2 , OP201_PIN_CHANGE_PRIVILEGE = 1u << 1 , OP201_MANDATED_DAP_VERIFICATION = 0xD0 }
	Application privileges. More...

Functions
OPGP_API OPGP_ERROR_STATUS	OPGP_select_application (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE AID, DWORD AIDLength)
	GlobalPlatform2.1.1: Selects an application on a card by AID and resets secure channel state. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_get_extended_card_resources_information (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, OPGP_EXTENDED_CARD_RESOURCE_INFORMATION *extendedCardResourceInformation)
	Reads the extended card resource information (number of applications + free memory). More...
OPGP_API OPGP_ERROR_STATUS	OPGP_get_cplc (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, OPGP_CPLC *cplc)
	Reads and parses the CPLC data. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_parse_cplc (const BYTE *data, DWORD dataLength, OPGP_CPLC *cplc)
	Parses the CPLC data response. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_parse_extended_card_resources_information (const BYTE *data, DWORD dataLength, OPGP_EXTENDED_CARD_RESOURCE_INFORMATION *extendedCardResourceInformation)
	Parses the extended card resources information response. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_status (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE cardElement, BYTE format, GP211_APPLICATION_DATA *applData, GP211_EXECUTABLE_MODULES_DATA *executableData, PDWORD dataLength)
	GlobalPlatform2.1.1: Gets the life cycle status of Applications, the Issuer Security Domains, Security Domains and Executable Load Files and their privileges or information about Executable Modules of the Executable Load Files. More...
OPGP_API OPGP_ERROR_STATUS	GP211_set_status (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE statusType, PBYTE AID, DWORD AIDLength, BYTE lifeCycleState)
	GlobalPlatform2.1.1: Sets the life cycle status of Applications, Security Domains or the Card Manager. More...
OPGP_API OPGP_ERROR_STATUS	GP211_mutual_authentication (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, PBYTE baseKeyOrStaticOcePrivateKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK, DWORD keyLength, BYTE keySetVersion, BYTE keyIndex, BYTE secureChannelProtocol, BYTE secureChannelProtocolImpl, BYTE securityLevel, BYTE derivationMethod, PBYTE certOceEcka, DWORD certOceEckaLength, PBYTE sdPublicKeyOverride, DWORD sdPublicKeyOverrideLength, OPGP_STRING sdPublicKeyFileName, GP211_SECURITY_INFO *secInfo)
	GlobalPlatform2.1.1: Mutual authentication. More...
OPGP_API OPGP_ERROR_STATUS	GP211_init_implicit_secure_channel (PBYTE AID, DWORD AIDLength, BYTE baseKey[16], BYTE S_ENC[16], BYTE S_MAC[16], BYTE DEK[16], BYTE secureChannelProtocolImpl, BYTE sequenceCounter[2], GP211_SECURITY_INFO *secInfo)
	GlobalPlatform2.1.1: Inits a Secure Channel implicitly. More...
OPGP_API OPGP_ERROR_STATUS	GP211_close_implicit_secure_channel (GP211_SECURITY_INFO *secInfo)
	GlobalPlatform2.1.1: Closes a Secure Channel implicitly. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE identifier[2], PBYTE recvBuffer, PDWORD recvBufferLength)
	GlobalPlatform2.1.1: Retrieve card data. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_ecka_certificate (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keyVersionNumber, BYTE keyIdentifier, PBYTE recvBuffer, PDWORD recvBufferLength)
	SCP11: Retrieves the ECKA certificate store (GET DATA with tag BF21). More...
OPGP_API OPGP_ERROR_STATUS	GP211_ca_kloc_kid_kvn (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE caKlocIdentifier, DWORD caKlocIdentifierLength, BYTE *keyIdentifier, BYTE *keyVersionNumber)
	SCP11: Resolves KID/KVN from a CA-KLOC Identifier (GET DATA with tag 0083). More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_supported_ca_identifiers (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BOOL returnCaKlccIdentifiers, PBYTE recvBuffer, PDWORD recvBufferLength)
	SCP11: Retrieves supported CA identifiers (GET DATA with tag FF33 or FF34). More...
OPGP_API OPGP_ERROR_STATUS	GP211_perform_security_operation (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE caKlocKeyVersionNumber, BYTE caKlocKeyIdentifier, PBYTE certificateData, DWORD certificateDataLength, BOOL moreCertificatesExpected)
	SCP11: Submits CERT.OCE.ECKA (PERFORM SECURITY OPERATION, INS 2A). More...
OPGP_API OPGP_ERROR_STATUS	GP211_perform_security_operation_certificate_chain (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE caKlocKeyVersionNumber, BYTE caKlocKeyIdentifier, PBYTE certificateChainData, DWORD certificateChainDataLength)
	SCP11: Submits a certificate chain ending in CERT.OCE.ECKA with PERFORM SECURITY OPERATION. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_diversification_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE recvBuffer, PDWORD recvBufferLength)
	GlobalPlatform2.1.1: Retrieve diversification data (tag 0xCF). More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_data_iso7816_4 (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, BYTE identifier[2], PBYTE recvBuffer, PDWORD recvBufferLength)
	Retrieve card data according ISO/IEC 7816-4 command not within a secure channel. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_card_recognition_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, GP211_CARD_RECOGNITION_DATA *cardData)
	GlobalPlatform2.1.1: Return the card recognition data. More...
OPGP_API OPGP_ERROR_STATUS	GP211_parse_card_recognition_data (const BYTE *data, DWORD dataLength, GP211_CARD_RECOGNITION_DATA *cardData)
	Parses the card recognition data response. More...
OPGP_API OPGP_ERROR_STATUS	GP211_parse_scp11_certificate (PBYTE certificateData, DWORD certificateDataLength, GP211_SCP11_CERTIFICATE *certificate)
	SCP11: Parses a certificate encoded according to table 6-12. More...
OPGP_API OPGP_ERROR_STATUS	GP211_parse_certificate_store (const BYTE *certificateStoreData, DWORD certificateStoreDataLength, PBYTE parsedCertificateStore, PDWORD parsedCertificateStoreLength)
	SCP11: Parses a BF21 certificate store. For legacy GP certificates (tag '7F21') the output contains a contiguous array of GP211_SCP11_CERTIFICATE structures. For X.509 DER certificates (tag '30') the output contains PEM encoded CERTIFICATE blocks.
OPGP_API OPGP_ERROR_STATUS	GP211_build_scp11_certificate (GP211_SCP11_CERTIFICATE *certificate, OPGP_STRING subjectPublicKeyFileName, char *subjectPublicKeyPassPhrase, OPGP_STRING signingPrivateKeyFileName, char *signingPrivateKeyPassPhrase, PBYTE certificateData, PDWORD certificateDataLength)
	SCP11: Builds and signs a certificate encoded according to table 6-12. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_card_capability_information (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, GP211_CARD_CAPABILITY_INFORMATION *cardCapabilityInfo)
	GlobalPlatform2.3.1: Return the card capability information. More...
OPGP_API OPGP_ERROR_STATUS	GP211_parse_card_capability_information (const BYTE *data, DWORD dataLength, GP211_CARD_CAPABILITY_INFORMATION *cardCapabilityInfo)
	Parses the card capability information response. More...
OPGP_API OPGP_ERROR_STATUS	GP211_build_card_recognition_data (const GP211_CARD_RECOGNITION_DATA *cardData, PBYTE data, PDWORD dataLength)
	Builds the card recognition data response. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_build_bcd_encoding (const char *numericString, PBYTE bcdData, PDWORD bcdDataLength)
	BCD encodes a numeric string. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_secure_channel_protocol_details (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE *secureChannelProtocol, BYTE *secureChannelProtocolImpl)
	GlobalPlatform2.1.1: This returns the Secure Channel Protocol and the Secure Channel Protocol implementation. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_sequence_counter (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, DWORD *sequenceCounter)
	GlobalPlatform2.1.1: This returns the current Sequence Counter. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_confirmation_counter (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, DWORD *confirmationCounter)
	GlobalPlatform2.1.1: This returns the confirmation counter. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE identifier[2], PBYTE dataObject, DWORD dataObjectLength)
	GlobalPlatform2.1.1: Put card data. More...
OPGP_API OPGP_ERROR_STATUS	GP211_pin_change (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE tryLimit, PBYTE newPIN, DWORD newPINLength)
	GlobalPlatform2.1.1: Changes or unblocks the global PIN. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_symmetric_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, BYTE key[32], DWORD keyLength, BYTE keyType)
	GlobalPlatform2.1.1: replaces a single symmetric key in a key set or adds a new key. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_aes_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, BYTE aesKey[32], DWORD keyLength)
	GlobalPlatform2.1.1: replaces a single AES key in a key set or adds a new AES key. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_3des_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, BYTE _3DESKey[16])
	GlobalPlatform2.1.1: replaces a single 3DES key in a key set or adds a new 3DES key. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_rsa_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.1.1: replaces a single public RSA key in a key set or adds a new public RSA key. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_ecc_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: replaces a single public ECC key in a key set or adds a new public ECC key. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_ecc_key_with_curve_parameter_reference (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: replaces or adds a public ECC key using a curve parameter reference. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_ecc_private_key_with_curve_parameter_reference (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, BYTE privateKey[32], DWORD privateKeyLength)
	GlobalPlatform2.3.1: replaces or adds a raw private ECC key using a curve parameter reference. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_asymmetric_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase, BYTE keyType)
	GlobalPlatform2.3.1: replaces a single public asymmetric key in a key set or adds a new public asymmetric key. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_secure_channel_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE newKeySetVersion, PBYTE baseKey, PBYTE newS_ENC, PBYTE newS_MAC, PBYTE newDEK, DWORD keyLength, BYTE keyType)
	GlobalPlatform2.1.1: replaces or adds a secure channel key set consisting of S-ENC, S-MAC and DEK. More...
OPGP_API OPGP_ERROR_STATUS	GP211_delete_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex)
	GlobalPlatform2.1.1: deletes a key or multiple keys. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_key_information_templates (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keyInformationTemplate, GP211_KEY_INFORMATION *keyInformation, PDWORD keyInformationLength)
	GlobalPlatform2.1.1: Retrieves key information of keys on the card. More...
OPGP_API OPGP_ERROR_STATUS	GP211_delete_application (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, OPGP_AID *AIDs, DWORD AIDsLength, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable, PBYTE deleteToken, DWORD deleteTokenLength)
	GlobalPlatform2.1.1: Deletes a Executable Load File or an application. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_load (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, PBYTE loadToken, DWORD loadTokenLength, DWORD nonVolatileCodeSpaceLimit, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit)
	GlobalPlatform2.1.1: Prepares the card for loading an application. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_extradition_token_signature_data (PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, PBYTE extraditionTokenSignatureData, PDWORD extraditionTokenSignatureDataLength)
	GlobalPlatform2.1.1: Function to retrieve the data to sign by the Card Issuer in an Extradition Token. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_load_token_signature_data (PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, DWORD nonVolatileCodeSpaceLimit, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE loadTokenSignatureData, PDWORD loadTokenSignatureDataLength)
	GlobalPlatform2.1.1: Function to retrieve the data to sign by the Card Issuer in a Load Token. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_install_token_signature_data (BYTE P1, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE executableModuleAID, DWORD executableModuleAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE installParameters, DWORD installParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installTokenSignatureData, PDWORD installTokenSignatureDataLength)
	GlobalPlatform2.1.1: Function to retrieve the data to sign by the Card Issuer in an Install Token. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_registry_update_token_signature_data (PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, PBYTE registryUpdateParameters, DWORD registryUpdateParametersLength, PBYTE tokenSignatureData, PDWORD tokenSignatureDataLength)
	GlobalPlatform2.3.1: Function to retrieve the data to sign for delegated management in a Registry Update Token. More...
OPGP_API OPGP_ERROR_STATUS	GP211_get_delete_token_signature_data (OPGP_AID *AIDs, DWORD AIDsLength, PBYTE deleteTokenSignatureData, PDWORD deleteTokenSignatureDataLength)
	GlobalPlatform2.3.1: Function to retrieve the data to sign for delegated management in a Delete Token. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_load_token (PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, DWORD nonVolatileCodeSpaceLimit, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE loadToken, PDWORD loadTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.1.1: Calculates a Load Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_install_token (BYTE P1, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE executableModuleAID, DWORD executableModuleAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE installParameters, DWORD installParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installToken, PDWORD installTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.1.1: Calculates an Install Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_extradition_token (PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, PBYTE extraditionToken, PDWORD extraditionTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.1.1: Calculates an Extradition Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_update_registry_token (PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, PBYTE registryUpdateParameters, DWORD registryUpdateParametersLength, PBYTE registryUpdateToken, PDWORD registryUpdateTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Calculates a Registry Update Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_delete_token (PBYTE applicationOrExecutableLoadFileAID, DWORD applicationOrExecutableLoadFileAIDLength, PBYTE deleteToken, PDWORD deleteTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Calculates a Delete Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	GP211_build_uicc_system_specific_params (GP211_UICC_SYSTEM_SPECIFIC_PARAMS *params, PBYTE uiccSystemSpecParams, PDWORD uiccSystemSpecParamsLength)
	GlobalPlatform2.1.1: Builds the UICC System Specific Parameters (tag 'EA' value without the tag and length). More...
OPGP_API OPGP_ERROR_STATUS	GP211_build_sim_specific_params (GP211_SIM_SPECIFIC_PARAMS *params, PBYTE simSpecParams, PDWORD simSpecParamsLength)
	GlobalPlatform2.1.1: Builds the SIM File Access and Toolkit Application Specific Parameters (tag 'CA' value without the tag and length). More...
OPGP_API OPGP_ERROR_STATUS	GP211_build_sd_parameters (GP211_SD_INSTALL_PARAMS *params, PBYTE sdParameters, PDWORD sdParametersLength)
	GlobalPlatform2.1.1: Builds the Security Domain install parameters (tag 'C1' with tag and length). More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_load_file_data_block_hash (OPGP_STRING executableLoadFileName, PBYTE hash, DWORD hashLength, BYTE hashType)
	GlobalPlatform2.1.1: Calculates a Load File Data Block Hash. More...
OPGP_API OPGP_ERROR_STATUS	GP211_load (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, GP211_DAP_BLOCK *dapBlock, DWORD dapBlockLength, OPGP_STRING executableLoadFileName, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable, OPGP_PROGRESS_CALLBACK *callback)
	GlobalPlatform2.1.1: Loads a Executable Load File (containing an application) to the card. More...
OPGP_API OPGP_ERROR_STATUS	GP211_load_from_buffer (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, GP211_DAP_BLOCK *dapBlock, DWORD dapBlockLength, PBYTE loadFileBuffer, DWORD loadFileBufSize, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable, OPGP_PROGRESS_CALLBACK *callback)
	GlobalPlatform2.1.1: Loads a Executable Load File (containing an application) from a buffer to the card. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_install (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE executableModuleAID, DWORD executableModuleAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE installParameters, DWORD installParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installToken, DWORD installTokenLength, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	GlobalPlatform2.1.1: Installs an application on the card. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_make_selectable (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, PBYTE installToken, DWORD installTokenLength, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	GlobalPlatform2.1.1: Makes an installed application selectable. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_install_and_make_selectable (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE executableModuleAID, DWORD executableModuleAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE installParameters, DWORD installParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installToken, DWORD installTokenLength, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	GlobalPlatform2.1.1: Installs and makes an installed application selectable. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_registry_update (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, DWORD applicationPrivileges, PBYTE registryUpdateParameters, DWORD registryUpdateParametersLength, PBYTE registryUpdateToken, DWORD registryUpdateTokenLength, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	GlobalPlatform2.3.1: Updates the registry of an application or Security Domain. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_personalization (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE applicationAID, DWORD applicationAIDLength)
	GlobalPlatform2.1.1: Informs a Security Domain that a associated application will retrieve personalization data. More...
OPGP_API OPGP_ERROR_STATUS	GP211_install_for_extradition (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, PBYTE extraditionToken, DWORD extraditionTokenLength, GP211_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	GlobalPlatform2.1.1: Associates an application with another Security Domain. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_delegated_management_token_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase, BYTE tokenKeyType)
	GlobalPlatform2.1.1: Adds a token verification key set for Delegated Management. More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_dap_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase, BYTE keyType, BYTE key[32], DWORD keyLength)
	GlobalPlatform2.3.1: Adds a DAP verification key set (asymmetric or symmetric). More...
OPGP_API OPGP_ERROR_STATUS	GP211_put_delegated_management_receipt_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE newKeySetVersion, BYTE receiptKey[32], DWORD keyLength, BYTE receiptKeyType)
	GlobalPlatform2.1.1: Adds a receipt generation key set for Delegated Management. More...
OPGP_API OPGP_ERROR_STATUS	GP211_send_APDU (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE capdu, DWORD capduLength, PBYTE rapdu, PDWORD rapduLength)
	Sends an application protocol data unit. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_DAP (BYTE loadFileDataBlockHash[64], BYTE hashLength, BYTE DAPCalculationKey[32], DWORD keyLength, PBYTE signature, PDWORD signatureLength, BYTE secureChannelProtocol)
	GlobalPlatform2.1.1: Calculates a Load File Data Block Signature using AES or 3DES. More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_rsa_DAP (BYTE loadFileDataBlockHash[20], PBYTE securityDomainAID, DWORD securityDomainAIDLength, OPGP_STRING PEMKeyFileName, char *passPhrase, GP211_DAP_BLOCK *loadFileDataBlockSignature)
	GlobalPlatform2.1.1: Calculates a Load File Data Block Signature using SHA-1 and PKCS#1 (RSA). More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_rsa_schemeX_DAP (PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, OPGP_STRING PEMKeyFileName, char *passPhrase, PBYTE signature, PDWORD signatureLength)
	GlobalPlatform2.1.1: Calculates a Load File Data Block Signature using SHA-256/SHA-512 and RSA-PSS (Scheme 2). More...
OPGP_API OPGP_ERROR_STATUS	GP211_calculate_ecc_DAP (PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, OPGP_STRING PEMKeyFileName, char *passPhrase, PBYTE signature, PDWORD signatureLength)
	GlobalPlatform2.3.1: Calculates an ECC Load File Data Block Signature in plain format (TR-03111 r||s). More...
OPGP_API OPGP_ERROR_STATUS	GP211_validate_delete_receipt (PBYTE receiptKey, DWORD keyLength, GP211_RECEIPT_DATA receiptData, PBYTE AID, DWORD AIDLength, BYTE receiptKeyType, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Validates a Delete Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys. More...
OPGP_API OPGP_ERROR_STATUS	GP211_validate_install_receipt (PBYTE receiptKey, DWORD keyLength, GP211_RECEIPT_DATA receiptData, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, BYTE receiptKeyType, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Validates an Install Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys. More...
OPGP_API OPGP_ERROR_STATUS	GP211_validate_load_receipt (PBYTE receiptKey, DWORD keyLength, GP211_RECEIPT_DATA receiptData, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, BYTE receiptKeyType, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Validates a Load Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys. More...
OPGP_API OPGP_ERROR_STATUS	GP211_validate_extradition_receipt (PBYTE receiptKey, DWORD keyLength, GP211_RECEIPT_DATA receiptData, PBYTE oldSecurityDomainAID, DWORD oldSecurityDomainAIDLength, PBYTE newSecurityDomainAID, DWORD newSecurityDomainAIDLength, PBYTE applicationOrExecutableLoadFileAID, DWORD applicationOrExecutableLoadFileAIDLength, BYTE receiptKeyType, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Validates an Extradition Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys. More...
OPGP_API OPGP_ERROR_STATUS	GP211_validate_registry_update_receipt (PBYTE receiptKey, DWORD keyLength, GP211_RECEIPT_DATA receiptData, PBYTE oldSecurityDomainAID, DWORD oldSecurityDomainAIDLength, PBYTE applicationAID, DWORD applicationAIDLength, PBYTE newSecurityDomainAID, DWORD newSecurityDomainAIDLength, DWORD applicationPrivileges, PBYTE registryUpdateParameters, DWORD registryUpdateParametersLength, BYTE receiptKeyType, OPGP_STRING PEMKeyFileName, char *passPhrase)
	GlobalPlatform2.3.1: Validates a Registry Update Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_manage_channel (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO *cardInfo, GP211_SECURITY_INFO *secInfo, BYTE openClose, BYTE channelNumberToClose, BYTE *channelNumberOpened)
	ISO 7816-4 / GlobalPlatform2.1.1: Opens or closes a Logical Channel. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_select_channel (OPGP_CARD_INFO *cardInfo, BYTE channelNumber)
	ISO 7816-4 / GlobalPlatform2.1.1: If multiple Logical Channels are open or a new Logical Channel is opened with select_application(), selects the Logical Channel. More...
OPGP_ERROR_STATUS	OPGP_calculate_key_check_value (GP211_SECURITY_INFO *secInfo, BYTE keyType, PBYTE keyData, DWORD keyDataLength, BYTE keyCheckValue[3])
	Calculates the key check value of a key. More...
OPGP_ERROR_STATUS	OPGP_encrypt_sensitive_data (GP211_SECURITY_INFO *secInfo, PBYTE data, DWORD dataLength, PBYTE encryptedData, PDWORD encryptedDataLength)
	Encrypts sensitive data like keys or other data which is used in STORE DATA. More...
OPGP_API OPGP_ERROR_STATUS	GP211_store_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE encryptionFlags, BYTE formatFlags, BOOL responseDataExpected, PBYTE data, DWORD dataLength)
	GlobalPlatform2.1.1: The STORE DATA command is used to transfer data to an Application or the Security Domain processing the command. More...
OPGP_API OPGP_ERROR_STATUS	GP211_store_data_ecka_certificate (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keyVersionNumber, BYTE keyIdentifier, OPGP_STRING certificateStoreFileName)
	SCP11: STORE DATA for the ECKA certificate store (section 6.7). More...
OPGP_API OPGP_ERROR_STATUS	GP211_store_data_whitelist (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE keyVersionNumber, BYTE keyIdentifier, BOOL whitelistCounterPresent, USHORT whitelistCounter, PBYTE *certificateSerialNumbers, PDWORD certificateSerialNumberLengths, DWORD certificateSerialNumberCount)
	SCP11: STORE DATA for a whitelist linked to a PK.CA-KLOC.ECDSA (section 6.8). More...
OPGP_API OPGP_ERROR_STATUS	GP211_store_data_ca_kloc_kid_kvn (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE caKlocIdentifier, DWORD caKlocIdentifierLength, BYTE keyIdentifier, BYTE keyVersionNumber)
	SCP11: STORE DATA for a CA-KLOC Identifier to PK.CA-KLOC.ECDSA mapping (section 6.9). More...
OPGP_API OPGP_ERROR_STATUS	GP211_build_store_data_keys (BYTE scp, BYTE scpImpl, PBYTE dataEncryptionKey, DWORD dataEncryptionKeyLength, BYTE keyType, USHORT keyPurpose, PBYTE keys[], BYTE keyIds[], DWORD numKeys, DWORD keyLength, BYTE keyVersion, BYTE keyAccessCondition, PBYTE output, PDWORD outputLength)
	GlobalPlatform2.3.1: Builds STORE DATA encoding for symmetric keys according to section 11.11.4. More...
OPGP_API OPGP_ERROR_STATUS	GP211_store_secure_channel_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE AID, DWORD AIDLength, BYTE keyType, PBYTE baseKey, PBYTE newS_ENC, PBYTE newS_MAC, PBYTE newDEK, DWORD keyLength, BYTE keySetVersion, BYTE keyAccessCondition)
	GlobalPlatform2.3.1: STORE DATA command for storing secure channel keys using the symmetric key format. More...
OPGP_API OPGP_ERROR_STATUS	OP201_get_status (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE cardElement, OP201_APPLICATION_DATA *applData, PDWORD applDataLength)
	Open Platform: Gets the life cycle status of Applications, the Card Manager and Executable Load Files and their privileges. More...
OPGP_API OPGP_ERROR_STATUS	OP201_set_status (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE statusType, PBYTE AID, DWORD AIDLength, BYTE lifeCycleState)
	Open Platform: Sets the life cycle status of Applications, Security Domains or the Card Manager. More...
OPGP_API OPGP_ERROR_STATUS	OP201_mutual_authentication (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, PBYTE baseKey, PBYTE encKey, PBYTE macKey, PBYTE kekKey, BYTE keySetVersion, BYTE keyIndex, BYTE securityLevel, BYTE derivationMethod, OP201_SECURITY_INFO *secInfo)
	Open Platform: Mutual authentication. More...
OPGP_API OPGP_ERROR_STATUS	OP201_get_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE identifier[2], PBYTE recvBuffer, PDWORD recvBufferLength)
	Open Platform: Retrieve card data. More...
OPGP_API OPGP_ERROR_STATUS	OP201_put_data (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE identifier[2], PBYTE dataObject, DWORD dataObjectLength)
	Open Platform: Put card data. More...
OPGP_API OPGP_ERROR_STATUS	OP201_pin_change (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE tryLimit, PBYTE newPIN, DWORD newPINLength, BYTE KEK[16])
	Open Platform: Changes or unblocks the global PIN. More...
OPGP_API OPGP_ERROR_STATUS	OP201_put_3desKey (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, BYTE _3desKey[16])
	Open Platform: replaces a single 3DES key in a key set or adds a new 3DES key. More...
OPGP_API OPGP_ERROR_STATUS	OP201_put_rsa_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase)
	Open Platform: replaces a single public RSA key in a key set or adds a new public RSA key. More...
OPGP_API OPGP_ERROR_STATUS	OP201_put_secure_channel_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE newKeySetVersion, BYTE new_encKey[16], BYTE new_macKey[16], BYTE new_KEK[16])
	Open Platform: replaces or adds a secure channel key set consisting of encryption key, MAC key and key encryption. More...
OPGP_API OPGP_ERROR_STATUS	OP201_delete_key (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE keyIndex)
	Open Platform: deletes a key or multiple keys. More...
OPGP_API OPGP_ERROR_STATUS	OP201_get_key_information_templates (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE keyInformationTemplate, OP201_KEY_INFORMATION *keyInformation, PDWORD keyInformationLength)
	Open Platform: Retrieves key information of keys on the card. More...
OPGP_API OPGP_ERROR_STATUS	OP201_delete_application (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, OPGP_AID *AIDs, DWORD AIDsLength, OP201_RECEIPT_DATA *receiptData, PDWORD receiptDataLength)
	Open Platform: Deletes a Executable Load File or an application. More...
OPGP_API OPGP_ERROR_STATUS	OP201_install_for_load (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, PBYTE loadToken, DWORD loadTokenLength, DWORD nonVolatileCodeSpaceLimit, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit)
	Open Platform: Prepares the card for loading an application. More...
OPGP_API OPGP_ERROR_STATUS	OP201_get_load_token_signature_data (PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE loadFileDataBlockHash, DWORD loadFileDataBlockHashLength, DWORD nonVolatileCodeSpaceLimit, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE loadTokenSignatureData, PDWORD loadTokenSignatureDataLength)
	Open Platform: Function to retrieve the data to sign for delegated management in a Load Token. More...
OPGP_API OPGP_ERROR_STATUS	OP201_get_install_token_signature_data (BYTE P1, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE AIDWithinLoadFileAID, DWORD AIDWithinLoadFileAIDLength, PBYTE applicationInstanceAID, DWORD applicationInstanceAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE applicationInstallParameters, DWORD applicationInstallParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installTokenSignatureData, PDWORD installTokenSignatureDataLength)
	Open Platform: Function to retrieve the data to sign for delegated management in an Install Token. More...
OPGP_API OPGP_ERROR_STATUS	OP201_calculate_load_token (PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength, PBYTE loadFileDAP, DWORD loadFileDAPLength, DWORD nonVolatileCodeSpaceLimit, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE loadToken, PDWORD loadTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	Open Platform: Calculates a Load Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	OP201_calculate_install_token (BYTE P1, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE AIDWithinLoadFileAID, DWORD AIDWithinLoadFileAIDLength, PBYTE applicationInstanceAID, DWORD applicationInstanceAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE applicationInstallParameters, DWORD applicationInstallParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installToken, PDWORD installTokenLength, OPGP_STRING PEMKeyFileName, char *passPhrase)
	Open Platform: Calculates an Install Token using PKCS#1. More...
OPGP_API OPGP_ERROR_STATUS	OP201_calculate_load_file_DAP (OP201_DAP_BLOCK *dapBlock, DWORD dapBlockLength, OPGP_STRING executableLoadFileName, BYTE hash[20])
	Open Platform: Calculates a Load File DAP. More...
OPGP_API OPGP_ERROR_STATUS	OP201_load (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, OP201_DAP_BLOCK *dapBlock, DWORD dapBlockLength, OPGP_STRING executableLoadFileName, OP201_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable, OPGP_PROGRESS_CALLBACK *callback)
	Open Platform: Loads a Executable Load File (containing an application) to the card. More...
OPGP_API OPGP_ERROR_STATUS	OP201_load_from_buffer (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, OP201_DAP_BLOCK *dapBlock, DWORD dapBlockLength, PBYTE loadFilebuf, DWORD loadFileBufSize, OP201_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable, OPGP_PROGRESS_CALLBACK *callback)
	Open Platform: Loads a Executable Load File (containing an application) from a buffer to the card. More...
OPGP_API OPGP_ERROR_STATUS	OP201_install_for_install (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE AIDWithinLoadFileAID, DWORD AIDWithinLoadFileAIDLength, PBYTE applicationInstanceAID, DWORD applicationInstanceAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE applicationInstallParameters, DWORD applicationInstallParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installToken, DWORD installTokenLength, OP201_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	Open Platform: Installs an application on the card. More...
OPGP_API OPGP_ERROR_STATUS	OP201_install_for_make_selectable (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE applicationInstanceAID, DWORD applicationInstanceAIDLength, DWORD applicationPrivileges, PBYTE installToken, DWORD installTokenLength, OP201_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	Open Platform: Makes an installed application selectable. More...
OPGP_API OPGP_ERROR_STATUS	OP201_install_for_install_and_make_selectable (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE AIDWithinLoadFileAID, DWORD AIDWithinLoadFileAIDLength, PBYTE applicationInstanceAID, DWORD applicationInstanceAIDLength, DWORD applicationPrivileges, DWORD volatileDataSpaceLimit, DWORD nonVolatileDataSpaceLimit, PBYTE applicationInstallParameters, DWORD applicationInstallParametersLength, PBYTE sdParameters, DWORD sdParametersLength, PBYTE uiccSystemSpecParams, DWORD uiccSystemSpecParamsLength, PBYTE simSpecParams, DWORD simSpecParamsLength, PBYTE installToken, DWORD installTokenLength, OP201_RECEIPT_DATA *receiptData, PDWORD receiptDataAvailable)
	Open Platform: Installs and makes an installed application selectable. More...
OPGP_API OPGP_ERROR_STATUS	OP201_put_delegated_management_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, BYTE keySetVersion, BYTE newKeySetVersion, OPGP_STRING PEMKeyFileName, char *passPhrase, BYTE receiptGenerationKey[16])
	Open Platform: Adds a key set for Delegated Management. More...
OPGP_API OPGP_ERROR_STATUS	OP201_send_APDU (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE capdu, DWORD capduLength, PBYTE rapdu, PDWORD rapduLength)
	Sends an application protocol data unit. More...
OPGP_API OPGP_ERROR_STATUS	OP201_calculate_3des_DAP (PBYTE securityDomainAID, DWORD securityDomainAIDLength, OPGP_STRING executableLoadFileName, BYTE DAP_verification_key[16], OP201_DAP_BLOCK *dapBlock)
	Open Platform: Calculates a Load File Data Block DAP using 3DES. More...
OPGP_API OPGP_ERROR_STATUS	OP201_calculate_rsa_DAP (PBYTE securityDomainAID, DWORD securityDomainAIDLength, OPGP_STRING executableLoadFileName, OPGP_STRING PEMKeyFileName, char *passPhrase, OP201_DAP_BLOCK *dapBlock)
	Open Platform: Calculates a Load File Data Block DAP using SHA-1 and PKCS#1 (RSA). More...
OPGP_API OPGP_ERROR_STATUS	OP201_validate_delete_receipt (DWORD confirmationCounter, BYTE cardUniqueData[10], BYTE receiptGenerationKey[16], OP201_RECEIPT_DATA receiptData, PBYTE AID, DWORD AIDLength)
	Open Platform: Validates a Load Receipt. More...
OPGP_API OPGP_ERROR_STATUS	OP201_validate_install_receipt (DWORD confirmationCounter, BYTE cardUniqueData[10], BYTE receiptGenerationKey[16], OP201_RECEIPT_DATA receiptData, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE applicationInstanceAID, DWORD applicationInstanceAIDLength)
	Open Platform: Validates an Install Receipt. More...
OPGP_API OPGP_ERROR_STATUS	OP201_validate_load_receipt (DWORD confirmationCounter, BYTE cardUniqueData[10], BYTE receiptGenerationKey[16], OP201_RECEIPT_DATA receiptData, PBYTE executableLoadFileAID, DWORD executableLoadFileAIDLength, PBYTE securityDomainAID, DWORD securityDomainAIDLength)
	Open Platform: Validates a Load Receipt. More...
OPGP_API OPGP_ERROR_STATUS	GP211_begin_R_MAC (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE securityLevel, PBYTE data, DWORD dataLength)
	Initiates a R-MAC session. More...
OPGP_API OPGP_ERROR_STATUS	GP211_end_R_MAC (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, BYTE secureChannelProtocol)
	Terminates a R-MAC session. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_read_executable_load_file_parameters (OPGP_STRING loadFileName, OPGP_LOAD_FILE_PARAMETERS *loadFileParams)
	Reads the parameters of an Executable Load File. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_cap_to_ijc (OPGP_CSTRING capFileName, OPGP_STRING ijcFileName)
	Converts a CAP file to an IJC file (Executable Load File). More...
OPGP_API OPGP_ERROR_STATUS	OPGP_extract_cap_file (OPGP_CSTRING fileName, PBYTE loadFileBuf, PDWORD loadFileBufSize)
	Extracts a CAP file into a buffer. More...
OPGP_API OPGP_ERROR_STATUS	OPGP_read_executable_load_file_parameters_from_buffer (PBYTE loadFileBuf, DWORD loadFileBufSize, OPGP_LOAD_FILE_PARAMETERS *loadFileParams)
	Receives Executable Load File as a buffer instead of a FILE. More...
OPGP_API OPGP_ERROR_STATUS	GP211_EMV_CPS11_derive_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the EMV CPS 1.1 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	GP211_VISA2_derive_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE AID, DWORD AIDLength, PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the VISA 2 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	GP211_VISA1_derive_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, GP211_SECURITY_INFO *secInfo, PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the VISA 1 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	OP201_EMV_CPS11_derive_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the EMV CPS 1.1 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	OP201_VISA2_derive_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE AID, DWORD AIDLength, PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the VISA 2 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	OP201_VISA1_derive_keys (OPGP_CARD_CONTEXT cardContext, OPGP_CARD_INFO cardInfo, OP201_SECURITY_INFO *secInfo, PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the VISA 1 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	VISA2_derive_keys (BYTE baseKeyDiversificationData[10], PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the VISA 2 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	VISA1_derive_keys (BYTE cardSerialNumber[8], PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the VISA 1 key derivation scheme. More...
OPGP_API OPGP_ERROR_STATUS	EMV_CPS11_derive_keys (BYTE baseKeyDiversificationData[10], PBYTE masterKey, PBYTE S_ENC, PBYTE S_MAC, PBYTE DEK)
	Derives the static keys from a master key according the EMV CPS11 derivation scheme. More...

Detailed Description

This file contains all GlobalPlatform related functionality.

Macro Definition Documentation

GP211_MAX_CARD_RECOGNITION_SCP_INFOS

#define GP211_MAX_CARD_RECOGNITION_SCP_INFOS   16

The Card Recognition Data returned for tag 0x66 with GET DATA.

INIT_PROGRESS_CALLBACK_PARAMETERS

#define INIT_PROGRESS_CALLBACK_PARAMETERS	(		callbackParameters,
			callback
	)

Value:

        if (callback != NULL) {callbackParameters.parameters = callback->parameters; \
        callbackParameters.finished = !OPGP_TASK_FINISHED;}

Enumeration Type Documentation

GP211_APPLICATION_PRIVILEGES

enum GP211_APPLICATION_PRIVILEGES

Application privileges.

Enumerator
GP211_SECURITY_DOMAIN	Application is security domain.
GP211_DAP_VERIFICATION	Application can require DAP verification for loading and installing applications.
GP211_DELEGATED_MANAGEMENT	Security domain has delegated management right.
GP211_CARD_MANAGER_LOCK_PRIVILEGE	Application can lock the Card Manager.
GP211_CARD_MANAGER_TERMINATE_PRIVILEGE	Application can terminate the card.
GP211_DEFAULT_SELECTED_CARD_RESET_PRIVILEGE	Application is default selected. In GlobalPlatform 2.3.1 this was redefined as Card Reset privilege.
GP211_PIN_CHANGE_PRIVILEGE	Application can change global PIN.
GP211_MANDATED_DAP_VERIFICATION	Security domain requires DAP verification for loading and installing applications.
GP211_TRUSTED_PATH	Application is a Trusted Path for inter-application communication.
GP211_AUTHORIZED_MANAGEMENT	Application is capable of Card Content Management; Security Domain privilege shall also be set.
GP211_TOKEN_VERIFICATION	Application is capable of verifying a token for Delegated Card Content Management.
GP211_GLOBAL_DELETE	Application may delete any Card Content.
GP211_GLOBAL_LOCK	Application may lock or unlock any Application.
GP211_GLOBAL_REGISTRY	Application may access any entry in the GlobalPlatform Registry.
GP211_FINAL_APPLICATION	The only Application selectable in card Life Cycle State CARD_LOCKED and TERMINATED.
GP211_GLOBAL_SERVICE	Application provides services to other Applications on the card.
GP211_RECEIPT_GENERATION	Application is capable of generating a receipt for Delegated Card Content Management.
GP211_CIPHERED_LOAD_FILE_DATA_BLOCK	The Security Domain requires that the Load File being associated with it is to be loaded ciphered.
GP211_CONTACTLESS_ACTIVATION	Application is capable of activating and deactivating any Application on the contactless interface.
GP211_CONTACTLESS_SELF_ACTIVATION	Application is capable of activating itself on the contactless interface without a prior request to the Application with the Contactless Activation privilege.

OP201_APPLICATION_PRIVILEGES

enum OP201_APPLICATION_PRIVILEGES

Application privileges.

Enumerator
OP201_SECURITY_DOMAIN	Application is security domain.
OP201_DAP_VERIFICATION	Application can require DAP verification for loading and installing applications.
OP201_DELEGATED_MANAGEMENT	Security domain has delegated management right.
OP201_CARD_MANAGER_LOCK_PRIVILEGE	Application can lock the Card Manager.
OP201_CARD_MANAGER_TERMINATE_PRIVILEGE	Application can terminate the card.
OP201_DEFAULT_SELECTED	Application is default selected.
OP201_PIN_CHANGE_PRIVILEGE	Application can change global PIN.
OP201_MANDATED_DAP_VERIFICATION	Security domain requires DAP verification for loading and installing applications.

Function Documentation

EMV_CPS11_derive_keys()

OPGP_API OPGP_ERROR_STATUS EMV_CPS11_derive_keys	(	BYTE	baseKeyDiversificationData[10],
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the EMV CPS11 derivation scheme.

Derives static Secure Channel keys using the EMV CPS 1.1 derivation scheme. The baseKeyDiversificationData buffer must contain the 10 byte KEYDATA value used by the card for INITIALIZE UPDATE.

Parameters

baseKeyDiversificationData	[in] The 10 byte EMV CPS 1.1 key diversification data.
masterKey	[in] The master key.
S_ENC	[out] The derived static Encryption key.
S_MAC	[out] The derived static Message Authentication Code key.
DEK	[out] The derived static Data Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_begin_R_MAC()

OPGP_API OPGP_ERROR_STATUS GP211_begin_R_MAC	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	securityLevel,
		PBYTE	data,
		DWORD	dataLength
	)

Initiates a R-MAC session.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
securityLevel	Level of security for all subsequent commands GP211_SCP02_SECURITY_LEVEL_R_MAC - Each APDU response contains a R-MAC during the session. GP211_SCP02_SECURITY_LEVEL_NO_SECURE_MESSAGING - Only the END R-MAC SESSION response message will contain a R-MAC. GP211_SCP03_SECURITY_LEVEL_R_MAC - Each APDU response contains a R-MAC during the session. GP211_SCP03_SECURITY_LEVEL_R_ENC_R_MAC - Each APDU response contains a R-MAC and R-encryption during the session.
data	[in] Data for the BEGIN R-MAC SESSION command, e.g. extra challenge.
dataLength	[in] Length of data.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_build_card_recognition_data()

OPGP_API OPGP_ERROR_STATUS GP211_build_card_recognition_data	(	const GP211_CARD_RECOGNITION_DATA *	cardData,
		PBYTE	data,
		PDWORD	dataLength
	)

Builds the card recognition data response.

Builds a GlobalPlatform Card Recognition Data response. The output is encoded as tag 66 containing tag 73 with the card recognition OID, card management version OID, card identification scheme OID, SCP OIDs and optional card detail templates from GP211_CARD_RECOGNITION_DATA.

Parameters

cardData	[in] The card recognition data to encode.
data	[out] The output buffer for the encoded response.
dataLength	[in, out] The length of data and, on success, the number of encoded bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_build_scp11_certificate()

OPGP_API OPGP_ERROR_STATUS GP211_build_scp11_certificate	(	GP211_SCP11_CERTIFICATE *	certificate,
		OPGP_STRING	subjectPublicKeyFileName,
		char *	subjectPublicKeyPassPhrase,
		OPGP_STRING	signingPrivateKeyFileName,
		char *	signingPrivateKeyPassPhrase,
		PBYTE	certificateData,
		PDWORD	certificateDataLength
	)

SCP11: Builds and signs a certificate encoded according to table 6-12.

Builds and signs an SCP11 certificate encoded according to table 6-12. The signed data is generated according to table 6-13. If subjectPublicKeyFileName is provided, the public key Q and key parameter reference are extracted from the OpenSSL EC public or private key file before signing.

Parameters

certificate	[in, out] The certificate fields. The public key and signature fields are updated.
subjectPublicKeyFileName	[in] OpenSSL EC public or private key file for the certificate subject, or NULL to use certificate->publicKey.
subjectPublicKeyPassPhrase	[in] Passphrase for subjectPublicKeyFileName, or NULL if not needed.
signingPrivateKeyFileName	[in] OpenSSL EC private key file used to sign the certificate.
signingPrivateKeyPassPhrase	[in] Passphrase for signingPrivateKeyFileName, or NULL if not needed.
certificateData	[out] The encoded 7F21 certificate.
certificateDataLength	[in, out] The length of certificateData and, on success, the number of encoded bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_build_sd_parameters()

OPGP_API OPGP_ERROR_STATUS GP211_build_sd_parameters	(	GP211_SD_INSTALL_PARAMS *	params,
		PBYTE	sdParameters,
		PDWORD	sdParametersLength
	)

GlobalPlatform2.1.1: Builds the Security Domain install parameters (tag 'C1' with tag and length).

Builds Security Domain install parameters. The output is the value of tag C1, including the nested tags and lengths for SCP entries, extradition/deletion policies, personalized-state marker, CASD capability information and extradition-away policy.

Parameters

params	[in] The structured Security Domain install parameters to encode.
sdParameters	[out] The output buffer for the encoded parameters.
sdParametersLength	[in, out] The length of sdParameters and, on success, the number of encoded bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_build_sim_specific_params()

OPGP_API OPGP_ERROR_STATUS GP211_build_sim_specific_params	(	GP211_SIM_SPECIFIC_PARAMS *	params,
		PBYTE	simSpecParams,
		PDWORD	simSpecParamsLength
	)

GlobalPlatform2.1.1: Builds the SIM File Access and Toolkit Application Specific Parameters (tag 'CA' value without the tag and length).

Builds the SIM File Access and Toolkit Application Specific Parameters value. The output is the value of tag CA without the tag and length bytes.

Parameters

params	[in] The structured SIM specific parameters to encode.
simSpecParams	[out] The output buffer for the encoded parameters.
simSpecParamsLength	[in, out] The length of simSpecParams and, on success, the number of encoded bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_build_store_data_keys()

OPGP_API OPGP_ERROR_STATUS GP211_build_store_data_keys	(	BYTE	scp,
		BYTE	scpImpl,
		PBYTE	dataEncryptionKey,
		DWORD	dataEncryptionKeyLength,
		BYTE	keyType,
		USHORT	keyPurpose,
		PBYTE	keys[],
		BYTE	keyIds[],
		DWORD	numKeys,
		DWORD	keyLength,
		BYTE	keyVersion,
		BYTE	keyAccessCondition,
		PBYTE	output,
		PDWORD	outputLength
	)

GlobalPlatform2.3.1: Builds STORE DATA encoding for symmetric keys according to section 11.11.4.

Builds STORE DATA encoding for symmetric keys according to GlobalPlatform v2.3.1.49 section 11.11.4.

Parameters

scp	[in] The secure channel protocol. See GP211_SCP03.
scpImpl	[in] The secure channel protocol implementation. See GP211_SCP03_IMPL_i04.
dataEncryptionKey	[in] The data encryption key for encrypting sensitive data.
dataEncryptionKeyLength	[in] The length of the data encryption key in bytes.
keyType	[in] The key type. See GP211_KEY_TYPE_AES.
keyPurpose	[in] The key purpose. See GP211_KEY_PURPOSE_SCP03.
keys	[in] Array of key data pointers.
keyIds	[in] Array of key identifiers.
numKeys	[in] Number of keys.
keyLength	[in] The key length in bytes.
keyVersion	[in] The key version number.
keyAccessCondition	[in] The key access condition. See GP211_KEY_ACCESS_SD_AND_APPS.
output	[out] The output buffer for the encoded data.
outputLength	[in, out] The available and returned length of the output buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_build_uicc_system_specific_params()

OPGP_API OPGP_ERROR_STATUS GP211_build_uicc_system_specific_params	(	GP211_UICC_SYSTEM_SPECIFIC_PARAMS *	params,
		PBYTE	uiccSystemSpecParams,
		PDWORD	uiccSystemSpecParamsLength
	)

GlobalPlatform2.1.1: Builds the UICC System Specific Parameters (tag 'EA' value without the tag and length).

Builds the UICC System Specific Parameters value. The output is the value of tag EA without the tag and length bytes.

Parameters

params	[in] The structured UICC system specific parameters to encode.
uiccSystemSpecParams	[out] The output buffer for the encoded parameters.
uiccSystemSpecParamsLength	[in, out] The length of uiccSystemSpecParams and, on success, the number of encoded bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_ca_kloc_kid_kvn()

OPGP_API OPGP_ERROR_STATUS GP211_ca_kloc_kid_kvn	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	caKlocIdentifier,
		DWORD	caKlocIdentifierLength,
		BYTE *	keyIdentifier,
		BYTE *	keyVersionNumber
	)

SCP11: Resolves KID/KVN from a CA-KLOC Identifier (GET DATA with tag 0083).

Resolves the SCP11 CA-KLOC Identifier to a Key Identifier and Key Version Number. The command sends GET DATA tag 0083 with the CA-KLOC Identifier in tag 42 and expects a tag 83 response containing KID || KVN.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
caKlocIdentifier	[in] The CA-KLOC Identifier value.
caKlocIdentifierLength	[in] The length of caKlocIdentifier.
keyIdentifier	[out] The resolved Key Identifier (KID).
keyVersionNumber	[out] The resolved Key Version Number (KVN).

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_calculate_DAP()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_DAP	(	BYTE	loadFileDataBlockHash[64],
		BYTE	hashLength,
		BYTE	DAPCalculationKey[32],
		DWORD	keyLength,
		PBYTE	signature,
		PDWORD	signatureLength,
		BYTE	secureChannelProtocol
	)

GlobalPlatform2.1.1: Calculates a Load File Data Block Signature using AES or 3DES.

This is used with SCP02 or SCP03. If a security domain has DAP verification privilege the security domain validates this DAP. The loadFileDataBlockHash can be calculated using calculate_load_file_data_block_hash().

Parameters

loadFileDataBlockHash	[in] The Load File Data Block Hash. Must be a SHA-256, SHA-384 or SHA-512 hash.
hashLength	[in] The length of the hash.
DAPCalculationKey	[in] The key to calculate the DAP.
keyLength	[in] The key length of the DAPCalculationKey.
signature	[out] Output buffer for the raw DAP signature bytes.
signatureLength	[in,out] Input: size of signature buffer. Output: generated signature length.
secureChannelProtocol	[in] The Secure Channel Protocol.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_delete_token()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_delete_token	(	PBYTE	applicationOrExecutableLoadFileAID,
		DWORD	applicationOrExecutableLoadFileAIDLength,
		PBYTE	deleteToken,
		PDWORD	deleteTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Calculates a Delete Token using PKCS#1.

The parameters must match the parameters of a later GP211_delete_application() method.

Parameters

applicationOrExecutableLoadFileAID	[in] A buffer containing the AID of the application or executable load file.
applicationOrExecutableLoadFileAIDLength	[in] The length of the AID buffer.
deleteToken	[out] The calculated Delete Token.
deleteTokenLength	[in, out] The length of the deleteToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_ecc_DAP()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_ecc_DAP	(	PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		PBYTE	signature,
		PDWORD	signatureLength
	)

GlobalPlatform2.3.1: Calculates an ECC Load File Data Block Signature in plain format (TR-03111 r||s).

Calculates an ECC Load File Data Block Signature according to GlobalPlatform Card Specification 2.3.1. The returned signature is encoded in plain format according to BSI TR-03111 (r||s).

Parameters

loadFileDataBlockHash	[in] The Load File Data Block Hash to sign.
loadFileDataBlockHashLength	[in] The length of the Load File Data Block Hash.
PEMKeyFileName	[in] A PEM file name with the private ECC key.
*passPhrase	[in] The passphrase. Must be an ASCII string.
signature	[out] Output buffer for the raw DAP signature bytes.
signatureLength	[in,out] Input: size of signature buffer. Output: generated signature length.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_extradition_token()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_extradition_token	(	PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		PBYTE	extraditionToken,
		PDWORD	extraditionTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.1.1: Calculates an Extradition Token using PKCS#1.

The parameters must match the parameters of a later GP211_install_for_extradition() method.

Parameters

securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.
extraditionToken	[out] The calculated Extradition Token.
extraditionTokenLength	[in, out] The length of the extraditionToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_install_token()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_install_token	(	BYTE	P1,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	executableModuleAID,
		DWORD	executableModuleAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	installParameters,
		DWORD	installParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installToken,
		PDWORD	installTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.1.1: Calculates an Install Token using PKCS#1.

The parameters must match the parameters of a later GP211_install_for_install(), GP211_install_for_make_selectable() and GP211_install_for_install_and_make_selectable() method.

Parameters

P1	[in] The parameter P1 in the APDU command. 0x04 for a INSTALL [for install] command 0x08 for an INSTALL [for make selectable] command 0x0C for an INSTALL [for install and make selectable] 0x10 for an INSTALL [for extradiction]
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
executableModuleAID	[in] The AID of the application class in the package.
executableModuleAIDLength	[in] The length of the executableModuleAID buffer.
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See GP211_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
installParameters	[in] Applet install parameters for the install() method of the application.
installParametersLength	[in] The length of the installParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installToken	[out] The calculated Install Token. A 1024 bit RSA signature.
installTokenLength	[in, out] The length of the installToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_load_file_data_block_hash()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_load_file_data_block_hash	(	OPGP_STRING	executableLoadFileName,
		PBYTE	hash,
		DWORD	hashLength,
		BYTE	hashType
	)

GlobalPlatform2.1.1: Calculates a Load File Data Block Hash.

This is a hash of the Load File Data Block with SHA-1 for SCP02 or SHA-256, SHA-384, SHA-512 or SM3 for SCP03.

Parameters

executableLoadFileName	[in] The name of the Executable Load File to hash.
hash	[out] The hash value.
hashLength	[in] The hash length for SCP03: 32 for AES-128, 48 for AES-192, 64 for AES-256, 32 for SM3.
hashType	[in] The hash type. See GP211_HASH_SHA256.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_load_token()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_load_token	(	PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		DWORD	nonVolatileCodeSpaceLimit,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	loadToken,
		PDWORD	loadTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.1.1: Calculates a Load Token using PKCS#1.

The parameters must match the parameters of a later GP211_install_for_load() method.

Parameters

executableLoadFileAID	[in] A buffer containing the Executable Load File AID.
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
loadFileDataBlockHash	[in] The Load File DAP. The same calculated as in GP211_install_for_load().
loadFileDataBlockHashLength	[in] The length of the loadFileDataBlockHash buffer.
nonVolatileCodeSpaceLimit	[in] The minimum space required to store the package.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
loadToken	[out] The calculated Load Token. A 1024 bit RSA signature.
loadTokenLength	[in, out] The length of the loadToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_rsa_DAP()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_rsa_DAP	(	BYTE	loadFileDataBlockHash[20],
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		GP211_DAP_BLOCK *	loadFileDataBlockSignature
	)

GlobalPlatform2.1.1: Calculates a Load File Data Block Signature using SHA-1 and PKCS#1 (RSA).

If a security domain has DAP verification privilege the security domain validates this DAP. The loadFileDataBlockHash can be calculated using calculate_load_file_data_block_hash().

Parameters

loadFileDataBlockHash	[in] The Load File Data Block Hash.
securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
PEMKeyFileName	[in] A PEM file name with the DAP Verification private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.
*loadFileDataBlockSignature	[out] A pointer to the returned GP211_DAP_BLOCK structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_rsa_schemeX_DAP()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_rsa_schemeX_DAP	(	PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		PBYTE	signature,
		PDWORD	signatureLength
	)

GlobalPlatform2.1.1: Calculates a Load File Data Block Signature using SHA-256/SHA-512 and RSA-PSS (Scheme 2).

Calculates a Load File Data Block Signature according to the GlobalPlatform specification 2.1.1. This function supports RSA keys larger than 1024 bits using RSA-PSS (Scheme 2). Uses SHA-256 for RSA keys <= 2048 bits and SHA-512 for RSA keys > 2048 bits.

Parameters

loadFileDataBlockHash	[in] The Load File Data Block Hash to sign.
loadFileDataBlockHashLength	[in] The length of the Load File Data Block Hash.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.
signature	[out] Output buffer for the raw DAP signature bytes.
signatureLength	[in,out] Input: size of signature buffer. Output: generated signature length.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_calculate_update_registry_token()

OPGP_API OPGP_ERROR_STATUS GP211_calculate_update_registry_token	(	PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		PBYTE	registryUpdateParameters,
		DWORD	registryUpdateParametersLength,
		PBYTE	registryUpdateToken,
		PDWORD	registryUpdateTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Calculates a Registry Update Token using PKCS#1.

The parameters must match the parameters of a later GP211_install_for_registry_update() method.

Parameters

securityDomainAID	[in] A buffer containing the target Security Domain AID.
securityDomainAIDLength	[in] The length of the target Security Domain AID.
applicationAID	[in] The AID of the application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges.
registryUpdateParameters	[in] The Registry Update Parameters.
registryUpdateParametersLength	[in] The length of the Registry Update Parameters.
registryUpdateToken	[out] The calculated Registry Update Token.
registryUpdateTokenLength	[in, out] The length of the registryUpdateToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_close_implicit_secure_channel()

OPGP_API OPGP_ERROR_STATUS GP211_close_implicit_secure_channel

(

GP211_SECURITY_INFO *

secInfo

)

GlobalPlatform2.1.1: Closes a Secure Channel implicitly.

Parameters

*secInfo

[out] The returned GP211_SECURITY_INFO structure.

GP211_delete_application()

OPGP_API OPGP_ERROR_STATUS GP211_delete_application	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		OPGP_AID *	AIDs,
		DWORD	AIDsLength,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable,
		PBYTE	deleteToken,
		DWORD	deleteTokenLength
	)

GlobalPlatform2.1.1: Deletes a Executable Load File or an application.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
AIDs	[in] A pointer to the an array of OPGP_AID structures describing the applications and load files to delete.
AIDsLength	[in] The number of OPGP_AID structures.
*receiptData	[out] A GP211_RECEIPT_DATA structure. If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.
deleteToken	[in] Optional delete token value. If present, it is encoded with tag '9F'.
deleteTokenLength	[in] The length of the deleteToken buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_delete_key()

OPGP_API OPGP_ERROR_STATUS GP211_delete_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex
	)

GlobalPlatform2.1.1: deletes a key or multiple keys.

If keyIndex is 0xFF all keys within a keySetVersion are deleted. If keySetVersion is 0x00 all keys with the specified keyIndex are deleted.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] An existing key index.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_EMV_CPS11_derive_keys()

OPGP_API OPGP_ERROR_STATUS GP211_EMV_CPS11_derive_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the EMV CPS 1.1 key derivation scheme.

E.g. Sm@rtCafe Expert 3.0 cards use this scheme.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_end_R_MAC()

OPGP_API OPGP_ERROR_STATUS GP211_end_R_MAC	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	secureChannelProtocol
	)

Terminates a R-MAC session.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
secureChannelProtocol	[in] The security channel protocol.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_card_capability_information()

OPGP_API OPGP_ERROR_STATUS GP211_get_card_capability_information	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		GP211_CARD_CAPABILITY_INFORMATION *	cardCapabilityInfo
	)

GlobalPlatform2.3.1: Return the card capability information.

Can only be executed before a secure channel is created.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
*cardCapabilityInfo	[out] A pointer to the card capability information.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_card_recognition_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_card_recognition_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		GP211_CARD_RECOGNITION_DATA *	cardData
	)

GlobalPlatform2.1.1: Return the card recognition data.

Can only be executed before a secure channel is created.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
*cardData	[out] A pointer to the card recognition data.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_confirmation_counter()

OPGP_API OPGP_ERROR_STATUS GP211_get_confirmation_counter	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		DWORD *	confirmationCounter
	)

GlobalPlatform2.1.1: This returns the confirmation counter.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
confirmationCounter	[out] The confirmation counter.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	identifier[2],
		PBYTE	recvBuffer,
		PDWORD	recvBufferLength
	)

GlobalPlatform2.1.1: Retrieve card data.

Retrieves a single card data object from the card identified by identifier. Some cards do not provide some data objects. Some possible identifiers are predefined. See GP211_GET_DATA_CPLC_WHOLE_CPLC and so on. For details about the coding of the response see the programmer's manual of your card. There is a convenience method get_key_information_templates() to get the key information template(s) containing key set version, key index, key type and key length of the keys.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
identifier	[in] Two byte buffer with high and low order tag value for identifying card data object.
recvBuffer	[out] The buffer for the card data object.
recvBufferLength	[in, out] The length of the received card data object.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_data_iso7816_4()

OPGP_API OPGP_ERROR_STATUS GP211_get_data_iso7816_4	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		BYTE	identifier[2],
		PBYTE	recvBuffer,
		PDWORD	recvBufferLength
	)

Retrieve card data according ISO/IEC 7816-4 command not within a secure channel.

This command is useful to return the Card Data with identifier 0x0066 containing the Card Recognition Data with tag 0x73 containing among others the Secure Channel Protocol and the eventual implementations. For getting the Secure Channel Protocol and Secure Channel Protocol implementation there is the convenience function get_secure_channel_protocol_details(). See also data objects identified in ISO 7816-6.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
identifier	[in] Two byte buffer with high and low order tag value for identifying card data.
recvBuffer	[out] The buffer for the card data.
recvBufferLength	[in, out] The length of the received card data.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_delete_token_signature_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_delete_token_signature_data	(	OPGP_AID *	AIDs,
		DWORD	AIDsLength,
		PBYTE	deleteTokenSignatureData,
		PDWORD	deleteTokenSignatureDataLength
	)

GlobalPlatform2.3.1: Function to retrieve the data to sign for delegated management in a Delete Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the signature of the data, i.e., the Delete Token. The parameters must match the parameters of a later GP211_delete_application() method.

Parameters

AIDs	[in] A pointer to an array of OPGP_AID structures describing the applications and load files to delete.
AIDsLength	[in] The number of OPGP_AID structures.
deleteTokenSignatureData	[out] The data to sign in a Delete Token.
deleteTokenSignatureDataLength	[in, out] The length of the deleteTokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_diversification_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_diversification_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	recvBuffer,
		PDWORD	recvBufferLength
	)

GlobalPlatform2.1.1: Retrieve diversification data (tag 0xCF).

Retrieves the GlobalPlatform diversification data object with GET DATA tag CF. The returned buffer receives the value of the CF TLV, without the outer tag and length bytes.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
recvBuffer	[out] The buffer for the diversification data value.
recvBufferLength	[in, out] The length of the receive buffer and, on success, the number of bytes copied to recvBuffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_get_ecka_certificate()

OPGP_API OPGP_ERROR_STATUS GP211_get_ecka_certificate	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keyVersionNumber,
		BYTE	keyIdentifier,
		PBYTE	recvBuffer,
		PDWORD	recvBufferLength
	)

SCP11: Retrieves the ECKA certificate store (GET DATA with tag BF21).

Retrieves the SCP11 ECKA certificate store with GET DATA tag BF21. The command data contains a Control Reference Template (A6) with the key identifier and key version number. The returned data is copied without the status word and may contain the complete certificate store TLV.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
keyVersionNumber	[in] Key Version Number (KVN) of the ECKA certificate store to retrieve.
keyIdentifier	[in] Key Identifier (KID) of the ECKA certificate store to retrieve.
recvBuffer	[out] The buffer for the ECKA certificate store response data.
recvBufferLength	[in, out] The length of the receive buffer and, on success, the number of bytes copied to recvBuffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_get_extradition_token_signature_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_extradition_token_signature_data	(	PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		PBYTE	extraditionTokenSignatureData,
		PDWORD	extraditionTokenSignatureDataLength
	)

GlobalPlatform2.1.1: Function to retrieve the data to sign by the Card Issuer in an Extradition Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the RSA signature of the data, i.e. the Extradition Token. The parameters must match the parameters of a later GP211_install_for_extradition() method.

Parameters

securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.
extraditionTokenSignatureData	[out] The data to sign in a Install Token.
extraditionTokenSignatureDataLength	[in, out] The length of the installTokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_install_token_signature_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_install_token_signature_data	(	BYTE	P1,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	executableModuleAID,
		DWORD	executableModuleAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	installParameters,
		DWORD	installParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installTokenSignatureData,
		PDWORD	installTokenSignatureDataLength
	)

GlobalPlatform2.1.1: Function to retrieve the data to sign by the Card Issuer in an Install Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the RSA signature of the data, i.e. the Install Token. volatileDataSpaceLimit can be 0, if the card does not need or support this tag. The parameters must match the parameters of a later GP211_install_for_install() and GP211_install_for_make_selectable() method.

Parameters

P1	[in] The parameter P1 in the APDU command. 0x04 for a INSTALL [for install] command 0x08 for an INSTALL [for make selectable] command 0x0C for an INSTALL [for install and make selectable]
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for load].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
executableModuleAID	[in] The AID of the application class in the package.
executableModuleAIDLength	[in] The length of the executableModuleAID buffer.
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See GP211_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
installParameters	[in] Applet install parameters for the install() method of the application.
installParametersLength	[in] The length of the installParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installTokenSignatureData	[out] The data to sign in a Install Token.
installTokenSignatureDataLength	[in, out] The length of the installTokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_key_information_templates()

OPGP_API OPGP_ERROR_STATUS GP211_get_key_information_templates	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keyInformationTemplate,
		GP211_KEY_INFORMATION *	keyInformation,
		PDWORD	keyInformationLength
	)

GlobalPlatform2.1.1: Retrieves key information of keys on the card.

The card must support the optional report of key information templates.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keyInformationTemplate	[in] The number of the key information template.
*keyInformation	[out] A pointer to an array of GP211_KEY_INFORMATION structures.
keyInformationLength	[in, out] The number of GP211_KEY_INFORMATION structures.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_load_token_signature_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_load_token_signature_data	(	PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		DWORD	nonVolatileCodeSpaceLimit,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	loadTokenSignatureData,
		PDWORD	loadTokenSignatureDataLength
	)

GlobalPlatform2.1.1: Function to retrieve the data to sign by the Card Issuer in a Load Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the RSA signature of the data, i.e. the Load Token. volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tags. The parameters must match the parameters of a later GP211_install_for_load() command.

Parameters

executableLoadFileAID	[in] A buffer containing the Executable Load File AID.
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
loadFileDataBlockHash	[in] The Load File Data Block Hash. The same calculated as in GP211_install_for_load().
loadFileDataBlockHashLength	[in] The length of the loadFileDataBlockHash buffer.
nonVolatileCodeSpaceLimit	[in] The minimum space required to store the application code.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
loadTokenSignatureData	[out] The data to sign in a Load Token.
loadTokenSignatureDataLength	[in, out] The length of the loadTokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_registry_update_token_signature_data()

OPGP_API OPGP_ERROR_STATUS GP211_get_registry_update_token_signature_data	(	PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		PBYTE	registryUpdateParameters,
		DWORD	registryUpdateParametersLength,
		PBYTE	tokenSignatureData,
		PDWORD	tokenSignatureDataLength
	)

GlobalPlatform2.3.1: Function to retrieve the data to sign for delegated management in a Registry Update Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the signature of the data, i.e., the Registry Update Token. The parameters must match the parameters of a later GP211_install_for_registry_update() method.

Parameters

securityDomainAID	[in] A buffer containing the target Security Domain AID.
securityDomainAIDLength	[in] The length of the target Security Domain AID.
applicationAID	[in] The AID of the application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges.
registryUpdateParameters	[in] The Registry Update Parameters.
registryUpdateParametersLength	[in] The length of the Registry Update Parameters.
tokenSignatureData	[out] The data to sign in a Registry Update Token.
tokenSignatureDataLength	[in, out] The length of the tokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_secure_channel_protocol_details()

OPGP_API OPGP_ERROR_STATUS GP211_get_secure_channel_protocol_details	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE *	secureChannelProtocol,
		BYTE *	secureChannelProtocolImpl
	)

GlobalPlatform2.1.1: This returns the Secure Channel Protocol and the Secure Channel Protocol implementation.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
*secureChannelProtocol	[out] A pointer to the Secure Channel Protocol to use.
*secureChannelProtocolImpl	[out] A pointer to the implementation of the Secure Channel Protocol.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_sequence_counter()

OPGP_API OPGP_ERROR_STATUS GP211_get_sequence_counter	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		DWORD *	sequenceCounter
	)

GlobalPlatform2.1.1: This returns the current Sequence Counter.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
sequenceCounter	[out] The sequence counter.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_status()

OPGP_API OPGP_ERROR_STATUS GP211_get_status	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	cardElement,
		BYTE	format,
		GP211_APPLICATION_DATA *	applData,
		GP211_EXECUTABLE_MODULES_DATA *	executableData,
		PDWORD	dataLength
	)

GlobalPlatform2.1.1: Gets the life cycle status of Applications, the Issuer Security Domains, Security Domains and Executable Load Files and their privileges or information about Executable Modules of the Executable Load Files.

It depends on the card element to retrieve if an array of GP211_APPLICATION_DATA structures or an array of GP211_EXECUTABLE_MODULES_DATA structures must be passed to this function. For the card element GP211_EXECUTABLE_MODULES_DATA executableData must not be NULL, else applData must not be NULL.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
cardElement	[in] Identifier to retrieve data for Load Files, Applications or the Card Manager.
format	[in] The GET STATUS output format. Newer cards might not support the legacy format. See GP211_STATUS_APPLICATIONS and related.
*applData	[out] The GP211_APPLICATION_DATA structure.
*executableData	[out] The GP211_APPLICATION_DATA structure.
dataLength	[in, out] The number of GP211_APPLICATION_DATA or GP211_EXECUTABLE_MODULES_DATA passed and returned.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_get_supported_ca_identifiers()

OPGP_API OPGP_ERROR_STATUS GP211_get_supported_ca_identifiers	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BOOL	returnCaKlccIdentifiers,
		PBYTE	recvBuffer,
		PDWORD	recvBufferLength
	)

SCP11: Retrieves supported CA identifiers (GET DATA with tag FF33 or FF34).

Retrieves SCP11 supported CA identifiers with GET DATA tags FF33 (CA-KLOC) and FF34 (CA-KLCC).

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
returnCaKlccIdentifiers	[in] FALSE for FF33 (CA-KLOC), TRUE for FF34 (CA-KLCC).
recvBuffer	[out] The buffer for the response data.
recvBufferLength	[in, out] The length of recvBuffer and, on success, the number of bytes copied.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_init_implicit_secure_channel()

OPGP_API OPGP_ERROR_STATUS GP211_init_implicit_secure_channel	(	PBYTE	AID,
		DWORD	AIDLength,
		BYTE	baseKey[16],
		BYTE	S_ENC[16],
		BYTE	S_MAC[16],
		BYTE	DEK[16],
		BYTE	secureChannelProtocolImpl,
		BYTE	sequenceCounter[2],
		GP211_SECURITY_INFO *	secInfo
	)

GlobalPlatform2.1.1: Inits a Secure Channel implicitly.

This is only supported in SCP02. It depends on the supported protocol implementation by the card what keys must be passed as parameters. baseKey must be NULL if the protocol uses 3 Secure Channel Keys (Secure Channel Encryption Key, Secure Channel Message Authentication Code Key and Data Encryption Key) and vice versa. Details about the supported Secure Channel Protocol and its implementation can be obtained by a call to the function GP211_get_secure_channel_protocol_details(). New cards usually use the VISA default key for all DES keys. See OPGP_VISA_DEFAULT_KEY. The current Sequence Counter can be obtained with a call to GP211_get_sequence_counter(). SCP02 is implicitly set and the security level is set to C-MAC only.

Parameters

AID	The AID needed for the calculation of the ICV.
AIDLength	The length of the AID buffer.
baseKey	[in] Secure Channel base key.
S_ENC	[in] Secure Channel Encryption Key.
S_MAC	[in] Secure Channel Message Authentication Code Key.
DEK	[in] Data Encryption Key.
secureChannelProtocolImpl	[in] The Secure Channel Protocol Implementation.
sequenceCounter	[in] The sequence counter.
*secInfo	[out] The returned GP211_SECURITY_INFO structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_extradition()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_extradition	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		PBYTE	extraditionToken,
		DWORD	extraditionTokenLength,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

GlobalPlatform2.1.1: Associates an application with another Security Domain.

In the case of delegated management an Extradition Token authorizing the INSTALL [for extradition] must be included. Otherwise extraditionToken must be NULL. See GP211_calculate_extradition_token().

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
securityDomainAID	[in] A buffer containing the target Security Domain AID.
securityDomainAIDLength	[in] The length of the target Security Domain AID.
applicationAID	[in] The AID of the installed application to be moved.
applicationAIDLength	[in] The length of the application instance AID to be moved.
extraditionToken	[in] The Extradition Token. This is an assymetric (e.g., ECC or RSA) Signature.
extraditionTokenLength	[in] The length of the extraditionToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_install()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_install	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	executableModuleAID,
		DWORD	executableModuleAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	installParameters,
		DWORD	installParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installToken,
		DWORD	installTokenLength,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

GlobalPlatform2.1.1: Installs an application on the card.

In the case of delegated management an Install Token authorizing the INSTALL [for install] must be included. Otherwise installToken must be NULL. See GP211_calculate_install_token(). volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tag. For Security domains look in your manual what parameters are necessary. If the tag for application install parameters is mandatory for your card, but you have no install parameters for the install() method of the application anyway you have to use at least a dummy parameter. If executableModuleAID is NULL and executableModuleAIDLength is 0 applicationAID is assumed for executableModuleAID.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
executableModuleAID	[in] The AID of the application class in the package.
executableModuleAIDLength	[in] The length of the executableModuleAID buffer.
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See GP211_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
installParameters	[in] Applet install parameters for the install() method of the application.
installParametersLength	[in] The length of the installParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installToken	[in] The Install Token. This is an assymetric (e.g., ECC or RSA) Signature.
installTokenLength	[in] The length of the installToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_install_and_make_selectable()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_install_and_make_selectable	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	executableModuleAID,
		DWORD	executableModuleAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	installParameters,
		DWORD	installParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installToken,
		DWORD	installTokenLength,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

GlobalPlatform2.1.1: Installs and makes an installed application selectable.

In the case of delegated management an Install Token authorizing the INSTALL [for install and make selectable] must be included. Otherwise installToken must be NULL. See GP211_calculate_install_token(). volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tag. For Security domains look in your manual what parameters are necessary. If the tag for application install parameters is mandatory for your card, but you have no install parameters for the install() method of the application anyway you have to use at least a dummy parameter. If executableModuleAID is NULL and executableModuleAIDLength is 0 applicationAID is assumed for executableModuleAID.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
executableModuleAID	[in] The AID of the application class in the package.
executableModuleAIDLength	[in] The length of the executableModuleAID buffer.
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See GP211_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
installParameters	[in] Applet install parameters for the install() method of the application.
installParametersLength	[in] The length of the installParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installToken	[in] The Install Token. This is an assymetric (e.g., ECC or RSA) Signature.
installTokenLength	[in] The length of the installToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_load()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_load	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		PBYTE	loadToken,
		DWORD	loadTokenLength,
		DWORD	nonVolatileCodeSpaceLimit,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit
	)

GlobalPlatform2.1.1: Prepares the card for loading an application.

The function assumes that the Issuer Security Domain or Security Domain uses an optional Load File Data Block Hash using the SHA-1 message digest algorithm. The loadFileDataBlockHash can be calculated using GP211_calculate_load_file_data_block_hash() or must be NULL, if the card does not need or support a Load File DAP in this situation, e.g. if you want to load a Executable Load File to the Card Manager Security Domain. In the case of delegated management a Load Token authorizing the INSTALL [for load] must be included. Otherwise loadToken must be NULL. See GP211_calculate_load_token(). The term Executable Load File is equivalent to the GlobalPlatform term Load File Data Block. volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tags.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for load].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the AID of the intended associated Security Domain.
securityDomainAIDLength	[in] The length of the Security Domain AID.
loadFileDataBlockHash	[in] The Load File Data Block Hash of the Executable Load File to INSTALL [for load].
loadFileDataBlockHashLength	[in] The length of the loadFileDataBlockHash buffer.
loadToken	[in] The Load Token. This is an assymetric (e.g., ECC or RSA) Signature.
loadTokenLength	[in] The length of the loadToken buffer.
nonVolatileCodeSpaceLimit	[in] The minimum amount of space that must be available to store the package.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_make_selectable()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_make_selectable	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		PBYTE	installToken,
		DWORD	installTokenLength,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

GlobalPlatform2.1.1: Makes an installed application selectable.

In the case of delegated management an Install Token authorizing the INSTALL [for make selectable] must be included. Otherwise installToken must be NULL. For Security domains look in your manual what parameters are necessary.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
applicationAID	[in] The AID of the installed application or security domain.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See GP211_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
installToken	[in] The Install Token. This is an assymetric (e.g., ECC or RSA) Signature.
installTokenLength	[in] The length of the installToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_personalization()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_personalization	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength
	)

GlobalPlatform2.1.1: Informs a Security Domain that a associated application will retrieve personalization data.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
applicationAID	[in] The AID of the installed application.
applicationAIDLength	[in] The length of the application instance AID.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_install_for_registry_update()

OPGP_API OPGP_ERROR_STATUS GP211_install_for_registry_update	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		DWORD	applicationPrivileges,
		PBYTE	registryUpdateParameters,
		DWORD	registryUpdateParametersLength,
		PBYTE	registryUpdateToken,
		DWORD	registryUpdateTokenLength,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

GlobalPlatform2.3.1: Updates the registry of an application or Security Domain.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
securityDomainAID	[in] A buffer containing the target Security Domain AID.
securityDomainAIDLength	[in] The length of the target Security Domain AID.
applicationAID	[in] The AID of the application.
applicationAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges.
registryUpdateParameters	[in] The Registry Update Parameters.
registryUpdateParametersLength	[in] The length of the Registry Update Parameters.
registryUpdateToken	[in] The Registry Update Token. This is an assymetric (e.g., ECC or RSA) Signature.
registryUpdateTokenLength	[in] The length of the Registry Update Token.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_load()

OPGP_API OPGP_ERROR_STATUS GP211_load	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		GP211_DAP_BLOCK *	loadFileDataBlockSignature,
		DWORD	loadFileDataBlockSignatureLength,
		OPGP_STRING	executableLoadFileName,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable,
		OPGP_PROGRESS_CALLBACK *	callback
	)

GlobalPlatform2.1.1: Loads a Executable Load File (containing an application) to the card.

An GP211_install_for_load() must precede. The Load File Data Block Signature(s) must be the same block(s) and in the same order like in GP211_calculate_load_file_data_block_hash(). If no Load File Data Block Signatures are necessary the loadFileDataBlockSignature must be NULL and the loadFileDataBlockSignatureLength 0.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
*loadFileDataBlockSignature	[in] A pointer to GP211_DAP_BLOCK structure(s).
loadFileDataBlockSignatureLength	[in] The number of GP211_DAP_BLOCK structure(s).
executableLoadFileName	[in] The name of the CAP or IJC file (Executable Load File) to load.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data. Can be validated with validate_load_receipt().
receiptDataAvailable	[out] 0 if no receiptData is available.
*callback	[in] An optional callback for measuring the progress. Can be NULL if not needed.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_load_from_buffer()

OPGP_API OPGP_ERROR_STATUS GP211_load_from_buffer	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		GP211_DAP_BLOCK *	loadFileDataBlockSignature,
		DWORD	loadFileDataBlockSignatureLength,
		PBYTE	loadFileBuf,
		DWORD	loadFileBufSize,
		GP211_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable,
		OPGP_PROGRESS_CALLBACK *	callback
	)

GlobalPlatform2.1.1: Loads a Executable Load File (containing an application) from a buffer to the card.

An GP211_install_for_load() must precede. The Load File Data Block Signature(s) must be the same block(s) and in the same order like in calculate_load_file_data_block_hash(). If no Load File Data Block Signatures are necessary the loadFileDataBlockSignature must be NULL and the loadFileDataBlockSignatureLength 0.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
*loadFileDataBlockSignature	[in] A pointer to GP211_DAP_BLOCK structure(s).
loadFileDataBlockSignatureLength	[in] The number of GP211_DAP_BLOCK structure(s).
loadFileBuf	[in] buffer with the contents of a Executable Load File.
loadFileBufSize	[in] size of loadFileBuf.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data. Can be validated with validate_load_receipt().
receiptDataAvailable	[out] 0 if no receiptData is available.
*callback	[in] An optional callback for measuring the progress. Can be NULL if not needed.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_mutual_authentication()

OPGP_API OPGP_ERROR_STATUS GP211_mutual_authentication	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		PBYTE	baseKeyOrStaticOcePrivateKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK,
		DWORD	keyLength,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	secureChannelProtocol,
		BYTE	secureChannelProtocolImpl,
		BYTE	securityLevel,
		BYTE	derivationMethod,
		PBYTE	certOceEcka,
		DWORD	certOceEckaLength,
		PBYTE	sdPublicKeyOverride,
		DWORD	sdPublicKeyOverrideLength,
		OPGP_STRING	sdPublicKeyFileName,
		GP211_SECURITY_INFO *	secInfo
	)

GlobalPlatform2.1.1: Mutual authentication.

For SCP01, SCP02 and SCP03 the baseKeyOrStaticOcePrivateKey parameter is the Secure Channel base key, or the master key used by the selected key derivation method. Pass it as NULL when the selected protocol implementation uses separate Secure Channel keys via S_ENC, S_MAC and DEK.

For SCP11a the same parameter is the raw static OCE ECKA private key (SK.OCE.ECKA) used with the card SD ECKA public key from CERT.SD.ECKA during key agreement. The SCP11a private key length is determined from the card certificate key parameter reference; keyLength remains the requested AES session key length (16, 24 or 32 bytes). S_ENC, S_MAC and DEK are not used for SCP11a.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
baseKeyOrStaticOcePrivateKey	[in] SCP01/SCP02/SCP03 base or master key, or SCP11a static OCE ECKA private key.
S_ENC	[in] Secure Channel Encryption Key for SCP01/SCP02/SCP03 implementations with separate static keys.
S_MAC	[in] Secure Channel Message Authentication Code Key for SCP01/SCP02/SCP03 implementations with separate static keys.
DEK	[in] Data Encryption Key for SCP01/SCP02/SCP03 implementations with separate static keys.
keyLength	[in] Symmetric key length. 16, 24 or 32 bytes.
keySetVersion	[in] The key set version on the card to use for mutual authentication.
keyIndex	[in] The key index in the key set version on the card to use for mutual authentication.
secureChannelProtocol	[in] The Secure Channel Protocol. Use GP211_SCP11 explicitly for SCP11a. Passing 0 only auto-detects SCP01/SCP02/SCP03 via INITIALIZE UPDATE; callers may use GP211_get_secure_channel_protocol_details() before authentication for card-recognition based discovery.
secureChannelProtocolImpl	[in] The Secure Channel Protocol implementation. For SCP11a this is the SCP parameter byte; the SCP11a variant bits are applied by this function.
securityLevel	[in] The requested security level. See GP211_SCP01_SECURITY_LEVEL_C_DEC_C_MAC and others.
derivationMethod	[in] The derivation method to use. See OPGP_DERIVATION_METHOD_VISA2.
certOceEcka	[in] Optional SCP11 certificate chain data to submit before mutual authentication. The data must contain one or more 7F21 or X.509 DER certificates, optionally wrapped in BF21, and must end with CERT.OCE.ECKA.
certOceEckaLength	[in] Length of certOceEcka.
sdPublicKeyOverride	[in] Optional SCP11 PK.SD.ECKA public key as raw uncompressed EC point or B0-wrapped point.
sdPublicKeyOverrideLength	[in] Length of sdPublicKeyOverride.
sdPublicKeyFileName	[in] Optional PEM file containing PK.SD.ECKA. If set, this takes precedence over sdPublicKeyOverride.
secInfo	[out] The returned GP211_SECURITY_INFO structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_parse_card_capability_information()

OPGP_API OPGP_ERROR_STATUS GP211_parse_card_capability_information	(	const BYTE *	data,
		DWORD	dataLength,
		GP211_CARD_CAPABILITY_INFORMATION *	cardCapabilityInfo
	)

Parses the card capability information response.

Parses a GlobalPlatform Card Capability Information response. The input must contain tag 67 and may include supported SCP information, privilege masks, algorithm identifiers, key parameter references and policy flags.

Parameters

data	[in] The card capability information response.
dataLength	[in] The length of data.
cardCapabilityInfo	[out] The parsed card capability information.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_parse_card_recognition_data()

OPGP_API OPGP_ERROR_STATUS GP211_parse_card_recognition_data	(	const BYTE *	data,
		DWORD	dataLength,
		GP211_CARD_RECOGNITION_DATA *	cardData
	)

Parses the card recognition data response.

Parses a GlobalPlatform Card Recognition Data response. The parser accepts the GET DATA card data object and walks to the tag 73 Card Recognition Data template, then extracts the card management version, supported Secure Channel Protocol OIDs and optional card details.

Parameters

data	[in] The card recognition data response.
dataLength	[in] The length of data.
cardData	[out] The parsed card recognition data.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_parse_scp11_certificate()

OPGP_API OPGP_ERROR_STATUS GP211_parse_scp11_certificate	(	PBYTE	certificateData,
		DWORD	certificateDataLength,
		GP211_SCP11_CERTIFICATE *	certificate
	)

SCP11: Parses a certificate encoded according to table 6-12.

Parses an SCP11 certificate encoded according to table 6-12. The input must be a complete CERT.KA-KLOC.ECDSA or CERT.OCE.ECKA object encoded as tag 7F21.

Parameters

certificateData	[in] The encoded SCP11 certificate.
certificateDataLength	[in] The length of certificateData.
certificate	[out] The parsed certificate fields.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_perform_security_operation()

OPGP_API OPGP_ERROR_STATUS GP211_perform_security_operation	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	caKlocKeyVersionNumber,
		BYTE	caKlocKeyIdentifier,
		PBYTE	certificateData,
		DWORD	certificateDataLength,
		BOOL	moreCertificatesExpected
	)

SCP11: Submits CERT.OCE.ECKA (PERFORM SECURITY OPERATION, INS 2A).

Submits SCP11 certificate data with PERFORM SECURITY OPERATION. The input may contain a single certificate, consecutive certificates, or a BF21 wrapper containing those certificates. For certificate lists, P2.b8 is derived from each certificate's position in the list. For a single certificate, moreCertificatesExpected controls P2.b8.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
caKlocKeyVersionNumber	[in] CA-KLOC Key Version Number (KVN).
caKlocKeyIdentifier	[in] CA-KLOC Key Identifier (KID).
certificateData	[in] One or more 7F21 or 30 certificates, optionally wrapped in BF21.
certificateDataLength	[in] The length of certificateData.
moreCertificatesExpected	[in] TRUE if another certificate follows this single-certificate input, otherwise FALSE. Ignored for multi-certificate inputs.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_perform_security_operation_certificate_chain()

OPGP_API OPGP_ERROR_STATUS GP211_perform_security_operation_certificate_chain	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	caKlocKeyVersionNumber,
		BYTE	caKlocKeyIdentifier,
		PBYTE	certificateChainData,
		DWORD	certificateChainDataLength
	)

SCP11: Submits a certificate chain ending in CERT.OCE.ECKA with PERFORM SECURITY OPERATION.

Submits an SCP11 certificate chain with PERFORM SECURITY OPERATION. The input must contain either one or more consecutive certificates, or a BF21 wrapper containing those certificates. Supported certificate formats are legacy GP (tag 7F21) and X.509 DER (tag 30). The chain must contain exactly one format; mixed chains are rejected. For legacy GP certificates, key usage is validated locally (intermediate certificates must be digital signature verification; the final certificate must be key agreement). X.509 chains are ordered from issuer to subject and a self-issued trust anchor is omitted. Local X.509 key usage parsing is not performed. Each certificate is submitted separately; P2.b8 is set for every intermediate certificate and cleared for the final certificate.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
caKlocKeyVersionNumber	[in] CA-KLOC Key Version Number (KVN) used for verifying the first certificate.
caKlocKeyIdentifier	[in] CA-KLOC Key Identifier (KID) used for verifying the first certificate.
certificateChainData	[in] One or more 7F21 or 30 certificates, optionally wrapped in BF21.
certificateChainDataLength	[in] The length of certificateChainData.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_pin_change()

OPGP_API OPGP_ERROR_STATUS GP211_pin_change	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	tryLimit,
		PBYTE	newPIN,
		DWORD	newPINLength
	)

GlobalPlatform2.1.1: Changes or unblocks the global PIN.

The single numbers of the new PIN are encoded as single BYTEs in the newPIN buffer. The tryLimit must be in the range of 0x03 and x0A. The PIN must comprise at least 6 numbers and not exceeding 12 numbers. To unblock the PIN use tryLimit with a value of 0x00. In this case newPIN buffer and newPINLength are ignored.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
tryLimit	[in] The try limit for the PIN.
newPIN	[in] The new PIN.
newPINLength	[in] The length of the new PIN.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_put_3des_key()

OPGP_API OPGP_ERROR_STATUS GP211_put_3des_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		BYTE	_3DESKey[16]
	)

GlobalPlatform2.1.1: replaces a single 3DES key in a key set or adds a new 3DES key.

A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a new key belongs to. This can be the same key version or a new not existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The new key set version.
_3DESKey	[in] The new 3DES key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_put_aes_key()

OPGP_API OPGP_ERROR_STATUS GP211_put_aes_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		BYTE	aesKey[32],
		DWORD	keyLength
	)

GlobalPlatform2.1.1: replaces a single AES key in a key set or adds a new AES key.

A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a new key belongs to. This can be the same key version or a new not existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The new key set version.
aesKey	[in] The new AES key.
keyLength	[in] The key length. 16, 24 or 32 bytes.

GP211_put_asymmetric_keys()

OPGP_API OPGP_ERROR_STATUS GP211_put_asymmetric_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		BYTE	keyType
	)

GlobalPlatform2.3.1: replaces a single public asymmetric key in a key set or adds a new public asymmetric key.

A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a new key belongs to. This can be the same key version or a new not existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The new key set version.
PEMKeyFileName	[in] A PEM file name with the public asymmetric key.
*passPhrase	[in] The passphrase. Must be an ASCII string.
keyType	[in] The asymmetric key type (RSA or ECC).

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_put_dap_keys()

OPGP_API OPGP_ERROR_STATUS GP211_put_dap_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		BYTE	keyType,
		BYTE	key[32],
		DWORD	keyLength
	)

GlobalPlatform2.3.1: Adds a DAP verification key set (asymmetric or symmetric).

Adds or replaces a DAP Verification Key. RSA and ECC DAP keys are loaded as asymmetric public keys at key index 0x01; AES and 3DES DAP keys are loaded as symmetric keys.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] Existing key set version, or 0x00 to add a new key.
newKeySetVersion	[in] The key set version assigned to the new key.
PEMKeyFileName	[in] A PEM file name with the public asymmetric DAP key.
passPhrase	[in] The passphrase, or NULL if not needed.
keyType	[in] The DAP key type. See GP211_KEY_TYPE_RSA, GP211_KEY_TYPE_ECC, GP211_KEY_TYPE_AES and GP211_KEY_TYPE_3DES.
key	[in] The symmetric DAP key when keyType is AES or 3DES.
keyLength	[in] The symmetric DAP key length in bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_put_data()

OPGP_API OPGP_ERROR_STATUS GP211_put_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	identifier[2],
		PBYTE	dataObject,
		DWORD	dataObjectLength
	)

GlobalPlatform2.1.1: Put card data.

Puts a single card data object identified by identifier. Some cards do not provide some data objects. Some possible identifiers are predefined. See GP211_GET_DATA_CPLC_WHOLE_CPLC. For details about the coding of the dataObject see the programmer's manual of your card.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
identifier	[in] Two byte buffer with high and low order tag value for identifying card data object.
dataObject	[in] The coded data object.
dataObjectLength	[in] The length of the data object.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_put_delegated_management_receipt_keys()

OPGP_API OPGP_ERROR_STATUS GP211_put_delegated_management_receipt_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	newKeySetVersion,
		BYTE	receiptKey[32],
		DWORD	keyLength,
		BYTE	receiptKeyType
	)

GlobalPlatform2.1.1: Adds a receipt generation key set for Delegated Management.

Adds or replaces a Delegated Management Receipt Key.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] Existing key set version, or 0x00 to add a new key.
newKeySetVersion	[in] The key set version assigned to the new key.
receiptKey	[in] The receipt key.
keyLength	[in] The receipt key length in bytes.
receiptKeyType	[in] The receipt key type. See GP211_KEY_TYPE_AES and GP211_KEY_TYPE_3DES.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_put_delegated_management_token_keys()

OPGP_API OPGP_ERROR_STATUS GP211_put_delegated_management_token_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		BYTE	tokenKeyType
	)

GlobalPlatform2.1.1: Adds a token verification key set for Delegated Management.

Adds or replaces a Delegated Management Token Verification Key. RSA and ECC token keys are loaded as asymmetric public keys at key index 0x01.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] Existing key set version, or 0x00 to add a new key.
newKeySetVersion	[in] The key set version assigned to the new key.
PEMKeyFileName	[in] A PEM file name with the public token key.
passPhrase	[in] The passphrase, or NULL if not needed.
tokenKeyType	[in] The token key type. See GP211_KEY_TYPE_RSA and GP211_KEY_TYPE_ECC.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_put_ecc_key()

OPGP_API OPGP_ERROR_STATUS GP211_put_ecc_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: replaces a single public ECC key in a key set or adds a new public ECC key.

A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a new key belongs to. This can be the same key version or a new not existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The new key set version.
PEMKeyFileName	[in] A PEM file name with the public ECC key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_put_ecc_key_with_curve_parameter_reference()

OPGP_API OPGP_ERROR_STATUS GP211_put_ecc_key_with_curve_parameter_reference	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: replaces or adds a public ECC key using a curve parameter reference.

Adds or replaces an ECC public key using a curve parameter reference instead of embedding the curve parameters.

GP211_put_ecc_private_key_with_curve_parameter_reference()

OPGP_API OPGP_ERROR_STATUS GP211_put_ecc_private_key_with_curve_parameter_reference	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		BYTE	privateKey[32],
		DWORD	privateKeyLength
	)

GlobalPlatform2.3.1: replaces or adds a raw private ECC key using a curve parameter reference.

Adds or replaces an ECC private key using a curve parameter reference.

GP211_put_rsa_key()

OPGP_API OPGP_ERROR_STATUS GP211_put_rsa_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.1.1: replaces a single public RSA key in a key set or adds a new public RSA key.

Adds or replaces an RSA public key in a key set. A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] Existing key set version, or 0x00 to add a new key.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The key set version assigned to the new key.
PEMKeyFileName	[in] A PEM file name with the public RSA key.
passPhrase	[in] The passphrase, or NULL if not needed.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_put_secure_channel_keys()

OPGP_API OPGP_ERROR_STATUS GP211_put_secure_channel_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	newKeySetVersion,
		PBYTE	newBaseKey,
		PBYTE	newS_ENC,
		PBYTE	newS_MAC,
		PBYTE	newDEK,
		DWORD	keyLength,
		BYTE	keyType
	)

GlobalPlatform2.1.1: replaces or adds a secure channel key set consisting of S-ENC, S-MAC and DEK.

A keySetVersion value of 0x00 adds a new secure channel key set. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version the new secure channel keys belongs to. This can be the same key version or a new not existing key set version. It depends on the supported protocol implementation by the card what keys must be passed as parameters. baseKey must be NULL if the protocol uses 3 Secure Channel Keys (Secure Channel Encryption Key, Secure Channel Message Authentication Code Key and Data Encryption Key) and vice versa. Details about the supported Secure Channel Protocol and its implementation can be obtained by a call to the function GP211_get_secure_channel_protocol_details(). Sometimes a key derivation of the put keys might be necessary so it is necessary to call GP211_EMV_CPS11_derive_keys() or any other derivation function. If this is the newBaseKey must be NULL and the derived keys are passed as the 3 Secure Channel Keys.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] An existing key set version.
newKeySetVersion	[in] The new key set version.
newBaseKey	[in] The new Secure Channel base key.
newS_ENC	[in] The new S-ENC key.
newS_MAC	[in] The new S-MAC key.
newDEK	[in] The new DEK.
keyLength	[in] The key length. 16, 24 or 32 bytes.
keyType	[in] The key type or 0 for implicit selection based on the SCP. See GP211_KEY_TYPE_AES.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_put_symmetric_key()

OPGP_API OPGP_ERROR_STATUS GP211_put_symmetric_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		BYTE	key[32],
		DWORD	keyLength,
		BYTE	keyType
	)

GlobalPlatform2.1.1: replaces a single symmetric key in a key set or adds a new key.

Adds or replaces a symmetric key in a key set. A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keySetVersion	[in] Existing key set version, or 0x00 to add a new key.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The key set version assigned to the new key.
key	[in] The new symmetric key.
keyLength	[in] The key length in bytes.
keyType	[in] The key type. See GP211_KEY_TYPE_AES and GP211_KEY_TYPE_3DES.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_send_APDU()

OPGP_API OPGP_ERROR_STATUS GP211_send_APDU	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	capdu,
		DWORD	capduLength,
		PBYTE	rapdu,
		PDWORD	rapduLength
	)

Sends an application protocol data unit.

The secInfo pointer can also be null and so this function can be used for arbitrary cards.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
capdu	[in] The command APDU.
capduLength	[in] The length of the command APDU.
rapdu	[out] The response APDU.
rapduLength	[in, out] The length of the response APDU.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_set_status()

OPGP_API OPGP_ERROR_STATUS GP211_set_status	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	statusType,
		PBYTE	AID,
		DWORD	AIDLength,
		BYTE	lifeCycleState
	)

GlobalPlatform2.1.1: Sets the life cycle status of Applications, Security Domains or the Card Manager.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
statusType	[in] Status type. See GP211_STATUS_TYPE_APPLICATIONS.
AID	[in] The AID.
AIDLength	[in] The length of the AID.
lifeCycleState	[in] The new life cycle state.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_store_data()

OPGP_API OPGP_ERROR_STATUS GP211_store_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	encryptionFlags,
		BYTE	formatFlags,
		BOOL	responseDataExpected,
		PBYTE	data,
		DWORD	dataLength
	)

GlobalPlatform2.1.1: The STORE DATA command is used to transfer data to an Application or the Security Domain processing the command.

If STORE DATA is used for personalizing an application, a GP211_install_for_personalization() must be called first.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
encryptionFlags	[in] Flag defining the encryption settings. See STORE_DATA_ENCRYPTION_NO_INFORMATION.
formatFlags	[in] Flag defining the format settings. See STORE_DATA_FORMAT_DGI.
responseDataExpected	[in] TRUE if response data is expected. In this case a case 4 APDU is used. FALSE to use a case 3 APDU.
*data	[in] Data to send to application or Security Domain.
dataLength	[in] The length of the data buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_store_data_ca_kloc_kid_kvn()

OPGP_API OPGP_ERROR_STATUS GP211_store_data_ca_kloc_kid_kvn	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	caKlocIdentifier,
		DWORD	caKlocIdentifierLength,
		BYTE	keyIdentifier,
		BYTE	keyVersionNumber
	)

SCP11: STORE DATA for a CA-KLOC Identifier to PK.CA-KLOC.ECDSA mapping (section 6.9).

Stores an SCP11 CA-KLOC Identifier to KID/KVN mapping using STORE DATA. The CA-KLOC Identifier is encoded in tag 42 and the key reference in tag 83, both inside a Control Reference Template.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
caKlocIdentifier	[in] The CA-KLOC Identifier value.
caKlocIdentifierLength	[in] The length of caKlocIdentifier.
keyIdentifier	[in] Key Identifier (KID) to map.
keyVersionNumber	[in] Key Version Number (KVN) to map.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_store_data_ecka_certificate()

OPGP_API OPGP_ERROR_STATUS GP211_store_data_ecka_certificate	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keyVersionNumber,
		BYTE	keyIdentifier,
		OPGP_STRING	certificateStoreFileName
	)

SCP11: STORE DATA for the ECKA certificate store (section 6.7).

Stores an SCP11 ECKA certificate store using STORE DATA. The input file must contain either DER or PEM encoded certificate data. For PEM input, CERTIFICATE blocks are converted to DER first. The resulting data must contain either a complete BF21 certificate store TLV or a certificate list value for BF21 according to section 7.2 table 7-4. The certificate list must contain homogeneous certificates in either legacy GP format (7F21) or X.509 DER format (30), but not both. The command data also includes a Control Reference Template for KID/KVN.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keyVersionNumber	[in] Key Version Number (KVN) assigned to the certificate store.
keyIdentifier	[in] Key Identifier (KID) assigned to the certificate store.
certificateStoreFileName	[in] File name of the encoded SCP11 certificate store.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_store_data_whitelist()

OPGP_API OPGP_ERROR_STATUS GP211_store_data_whitelist	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	keyVersionNumber,
		BYTE	keyIdentifier,
		BOOL	whitelistCounterPresent,
		USHORT	whitelistCounter,
		PBYTE *	certificateSerialNumbers,
		PDWORD	certificateSerialNumberLengths,
		DWORD	certificateSerialNumberCount
	)

SCP11: STORE DATA for a whitelist linked to a PK.CA-KLOC.ECDSA (section 6.8).

Stores an SCP11 whitelist using STORE DATA. The whitelist is linked to the KID/KVN in the Control Reference Template and encoded in tag 70. Each Certificate Serial Number is encoded as a tag 93 TLV inside tag 70. If present, the whitelist counter is encoded in tag 92.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keyVersionNumber	[in] Key Version Number (KVN) of the related CA-KLOC key.
keyIdentifier	[in] Key Identifier (KID) of the related CA-KLOC key.
whitelistCounterPresent	[in] TRUE to include the whitelist counter.
whitelistCounter	[in] The whitelist counter value when whitelistCounterPresent is TRUE.
certificateSerialNumbers	[in] Array of Certificate Serial Number byte arrays. May be NULL when certificateSerialNumberCount is 0.
certificateSerialNumberLengths	[in] Lengths of the Certificate Serial Number byte arrays. Each length must be 1..16. May be NULL when certificateSerialNumberCount is 0.
certificateSerialNumberCount	[in] Number of Certificate Serial Numbers. Use 0 to remove the whitelist.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

GP211_store_secure_channel_keys()

OPGP_API OPGP_ERROR_STATUS GP211_store_secure_channel_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	AID,
		DWORD	AIDLength,
		BYTE	keyType,
		PBYTE	baseKey,
		PBYTE	newS_ENC,
		PBYTE	newS_MAC,
		PBYTE	newDEK,
		DWORD	keyLength,
		BYTE	keySetVersion,
		BYTE	keyAccessCondition
	)

GlobalPlatform2.3.1: STORE DATA command for storing secure channel keys using the symmetric key format.

Stores secure channel keys using STORE DATA command with symmetric key format according to GlobalPlatform v2.3.1.49 section 11.11.4.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
AID	[in] The AID of the Security Domain.
AIDLength	[in] The length of the AID.
keyType	[in] The key type. See GP211_KEY_TYPE_AES.
baseKey	[in] The base key (optional, can be NULL).
newS_ENC	[in] The new S-ENC key.
newS_MAC	[in] The new S-MAC key.
newDEK	[in] The new DEK key.
keyLength	[in] The key length in bytes.
keySetVersion	[in] The key set version.
keyAccessCondition	[in] The key access condition. See GP211_KEY_ACCESS_SD_AND_APPS.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_validate_delete_receipt()

OPGP_API OPGP_ERROR_STATUS GP211_validate_delete_receipt	(	PBYTE	receiptKey,
		DWORD	keyLength,
		GP211_RECEIPT_DATA	receiptData,
		PBYTE	AID,
		DWORD	AIDLength,
		BYTE	receiptKeyType,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Validates a Delete Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys.

Validates a GlobalPlatform 2.3.1 Delete Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) keys.

GP211_validate_extradition_receipt()

OPGP_API OPGP_ERROR_STATUS GP211_validate_extradition_receipt	(	PBYTE	receiptKey,
		DWORD	keyLength,
		GP211_RECEIPT_DATA	receiptData,
		PBYTE	oldSecurityDomainAID,
		DWORD	oldSecurityDomainAIDLength,
		PBYTE	newSecurityDomainAID,
		DWORD	newSecurityDomainAIDLength,
		PBYTE	applicationOrExecutableLoadFileAID,
		DWORD	applicationOrExecutableLoadFileAIDLength,
		BYTE	receiptKeyType,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Validates an Extradition Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys.

Validates a GlobalPlatform 2.3.1 Extradition Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) keys.

GP211_validate_install_receipt()

OPGP_API OPGP_ERROR_STATUS GP211_validate_install_receipt	(	PBYTE	receiptKey,
		DWORD	keyLength,
		GP211_RECEIPT_DATA	receiptData,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		BYTE	receiptKeyType,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Validates an Install Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys.

Validates a GlobalPlatform 2.3.1 Install Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) keys.

GP211_validate_load_receipt()

OPGP_API OPGP_ERROR_STATUS GP211_validate_load_receipt	(	PBYTE	receiptKey,
		DWORD	keyLength,
		GP211_RECEIPT_DATA	receiptData,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		BYTE	receiptKeyType,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Validates a Load Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys.

Validates a GlobalPlatform 2.3.1 Load Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) keys.

GP211_validate_registry_update_receipt()

OPGP_API OPGP_ERROR_STATUS GP211_validate_registry_update_receipt	(	PBYTE	receiptKey,
		DWORD	keyLength,
		GP211_RECEIPT_DATA	receiptData,
		PBYTE	oldSecurityDomainAID,
		DWORD	oldSecurityDomainAIDLength,
		PBYTE	applicationAID,
		DWORD	applicationAIDLength,
		PBYTE	newSecurityDomainAID,
		DWORD	newSecurityDomainAIDLength,
		DWORD	applicationPrivileges,
		PBYTE	registryUpdateParameters,
		DWORD	registryUpdateParametersLength,
		BYTE	receiptKeyType,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

GlobalPlatform2.3.1: Validates a Registry Update Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) receipt keys.

Validates a GlobalPlatform 2.3.1 Registry Update Receipt with symmetric (DES/AES) or asymmetric (RSA/ECC) keys.

GP211_VISA1_derive_keys()

OPGP_API OPGP_ERROR_STATUS GP211_VISA1_derive_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the VISA 1 key derivation scheme.

E.g. GemXpresso cards use this scheme.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

GP211_VISA2_derive_keys()

OPGP_API OPGP_ERROR_STATUS GP211_VISA2_derive_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	AID,
		DWORD	AIDLength,
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the VISA 2 key derivation scheme.

E.g. GemXpresso cards, JCOP-10 cards or Palmera Protect V5 cards use this scheme.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
AID	[in] The AID of the Card Manager.
AIDLength	[in] The length of the Card Manager AID / Issuer Security Domain AID.
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_calculate_3des_DAP()

OPGP_API OPGP_ERROR_STATUS OP201_calculate_3des_DAP	(	PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		OPGP_STRING	executableLoadFileName,
		BYTE	DAP_verification_key[16],
		OP201_DAP_BLOCK *	dapBlock
	)

Open Platform: Calculates a Load File Data Block DAP using 3DES.

If a security domain has DAP verification privilege the security domain validates this DAP.

Parameters

securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
executableLoadFileName	[in] The name of the CAP or IJC file to calculate the DAP for.
DAP_verification_key	[in] The key to calculate the DAP.
*dapBlock	[out] A pointer to the returned OP201_DAP_BLOCK structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_calculate_install_token()

OPGP_API OPGP_ERROR_STATUS OP201_calculate_install_token	(	BYTE	P1,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	AIDWithinLoadFileAID,
		DWORD	AIDWithinLoadFileAIDLength,
		PBYTE	applicationInstanceAID,
		DWORD	applicationInstanceAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	applicationInstallParameters,
		DWORD	applicationInstallParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installToken,
		PDWORD	installTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

Open Platform: Calculates an Install Token using PKCS#1.

The parameters must match the parameters of a later install_for_install(), install_for_make_selectable() and install_for_install_and_make_selectable() method.

Parameters

P1	[in] The parameter P1 in the APDU command. 0x04 for a INSTALL [for install] command 0x08 for an INSTALL [for make selectable] command 0x0C for an INSTALL [for install and make selectable]
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
AIDWithinLoadFileAID	[in] The AID of the application class in the package.
AIDWithinLoadFileAIDLength	[in] The length of the AIDWithinLoadFileAID buffer.
applicationInstanceAID	[in] The AID of the installed application.
applicationInstanceAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See OP201_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
applicationInstallParameters	[in] Applet install parameters for the install() method of the application.
applicationInstallParametersLength	[in] The length of the applicationInstallParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installToken	[out] The calculated Install Token. A 1024 bit RSA signature.
installTokenLength	[in, out] The length of the installToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_calculate_load_file_DAP()

OPGP_API OPGP_ERROR_STATUS OP201_calculate_load_file_DAP	(	OP201_DAP_BLOCK *	dapBlock,
		DWORD	dapBlockLength,
		OPGP_STRING	executableLoadFileName,
		BYTE	hash[20]
	)

Open Platform: Calculates a Load File DAP.

This is a hash of the Load File with SHA-1. A Load File consists of 0 to n Load File Data Block DAP blocks and a mandatory Load File Data Block, e.g. a CAP file. If no Load File Data Block DAP blocks are necessary the dapBlock must be NULL and the dapBlockLength 0. The dapBlock(s) can be calculated using calculate_3des_dap() or calculate_rsa_dap(). If the Load File Data Block DAP block(s) are already calculated they must be parsed into a OP201_DAP_BLOCK structure. If the Load File Data Block DAP block(s) are already prefixing the CAPFile following the Open Platform Specification 2.0.1', the whole CAPFile including the Load File Data Block DAP block(s) is sufficient, the dapBlock must be NULL and the dapBlockLength 0.

Parameters

*dapBlock	[in] A pointer to OP201_DAP_BLOCK structure(s).
dapBlockLength	[in] The number of OP201_DAP_BLOCK structure(s).
executableLoadFileName	[in] The name of the CAP or IJC file to hash.
hash	[out] The hash value. This are 20 bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_calculate_load_token()

OPGP_API OPGP_ERROR_STATUS OP201_calculate_load_token	(	PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	loadFileDAP,
		DWORD	loadFileDAPLength,
		DWORD	nonVolatileCodeSpaceLimit,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	loadToken,
		PDWORD	loadTokenLength,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

Open Platform: Calculates a Load Token using PKCS#1.

The parameters must match the parameters of a later install_for_load() method.

Parameters

executableLoadFileAID	[in] A buffer containing the Executable Load File AID.
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
loadFileDAP	[in] The Load File DAP. The same calculated as in install_for_load().
loadFileDAPLength	[in] The length of the loadFileDAP buffer.
nonVolatileCodeSpaceLimit	[in] The minimum space required to store the package.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
loadToken	[out] The calculated Load Token. A 1024 bit RSA signature.
loadTokenLength	[in, out] The length of the loadToken buffer.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_calculate_rsa_DAP()

OPGP_API OPGP_ERROR_STATUS OP201_calculate_rsa_DAP	(	PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		OPGP_STRING	executableLoadFileName,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		OP201_DAP_BLOCK *	dapBlock
	)

Open Platform: Calculates a Load File Data Block DAP using SHA-1 and PKCS#1 (RSA).

If a security domain has DAP verification privilege the security domain validates this DAP.

Parameters

securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
executableLoadFileName	[in] The name of the CAP or IJC file to calculate the DAP for.
PEMKeyFileName	[in] A PEM file name with the private RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.
*dapBlock	[out] A pointer to the returned OP201_DAP_BLOCK structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_delete_application()

OPGP_API OPGP_ERROR_STATUS OP201_delete_application	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		OPGP_AID *	AIDs,
		DWORD	AIDsLength,
		OP201_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataLength
	)

Open Platform: Deletes a Executable Load File or an application.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
AIDs	[in] A pointer to the an array of OPGP_AID structures describing the applications and load files to delete.
AIDsLength	[in] The number of OPGP_AID structures.
*receiptData	[out] A OP201_RECEIPT_DATA array. If the deletion is performed by a security domain with delegated management privilege this structure contains the according data for each deleted application or package.
receiptDataLength	[in, out] A pointer to the length of the receiptData array. If no receiptData is available this length is 0;

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_delete_key()

OPGP_API OPGP_ERROR_STATUS OP201_delete_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex
	)

Open Platform: deletes a key or multiple keys.

If keyIndex is 0xFF all keys within a keySetVersion are deleted. If keySetVersion is 0x00 all keys with the specified keyIndex are deleted.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] An existing key index.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_EMV_CPS11_derive_keys()

OPGP_API OPGP_ERROR_STATUS OP201_EMV_CPS11_derive_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the EMV CPS 1.1 key derivation scheme.

E.g. Sm@rtCafe Expert 3.0 and later cards use this scheme.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_get_data()

OPGP_API OPGP_ERROR_STATUS OP201_get_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	identifier[2],
		PBYTE	recvBuffer,
		PDWORD	recvBufferLength
	)

Open Platform: Retrieve card data.

Retrieves a single card data object from the card identified by identifier. Some cards do not provide some data objects. Some possible identifiers are predefined. See OP201_GET_DATA_ISSUER_BIN and so on. For details about the coding of the response see the programmer's manual of your card. There is a convenience method get_key_information_templates() to get the key information template(s) containing key set version, key index, key type and key length of the keys.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
identifier	[in] Two byte buffer with high and low order tag value for identifying card data object.
recvBuffer	[in] The buffer for the card data object.
recvBufferLength	[in] The length of the received card data object.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_get_install_token_signature_data()

OPGP_API OPGP_ERROR_STATUS OP201_get_install_token_signature_data	(	BYTE	P1,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	AIDWithinLoadFileAID,
		DWORD	AIDWithinLoadFileAIDLength,
		PBYTE	applicationInstanceAID,
		DWORD	applicationInstanceAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	applicationInstallParameters,
		DWORD	applicationInstallParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installTokenSignatureData,
		PDWORD	installTokenSignatureDataLength
	)

Open Platform: Function to retrieve the data to sign for delegated management in an Install Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the RSA signature of the data, i.e. the Install Token. volatileDataSpaceLimit can be 0, if the card does not need or support this tag. The parameters must match the parameters of a later install_for_install() and install_for_make_selectable() method.

Parameters

P1	[in] The parameter P1 in the APDU command. 0x04 for a INSTALL [for install] command 0x08 for an INSTALL [for make selectable] command 0x0C for an INSTALL [for install and make selectable]
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for load].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
AIDWithinLoadFileAID	[in] The AID of the application class in the package.
AIDWithinLoadFileAIDLength	[in] The length of the AIDWithinLoadFileAID buffer.
applicationInstanceAID	[in] The AID of the installed application.
applicationInstanceAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See OP201_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
applicationInstallParameters	[in] Applet install parameters for the install() method of the application.
applicationInstallParametersLength	[in] The length of the applicationInstallParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installTokenSignatureData	[out] The data to sign in a Install Token.
installTokenSignatureDataLength	[in, out] The length of the installTokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_get_key_information_templates()

OPGP_API OPGP_ERROR_STATUS OP201_get_key_information_templates	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	keyInformationTemplate,
		OP201_KEY_INFORMATION *	keyInformation,
		PDWORD	keyInformationLength
	)

Open Platform: Retrieves key information of keys on the card.

The card must support the optional report of key information templates.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
keyInformationTemplate	[in] The number of the key information template.
*keyInformation	[out] A pointer to an array of OP201_KEY_INFORMATION structures.
keyInformationLength	[in, out] The number of OP201_KEY_INFORMATION structures.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_get_load_token_signature_data()

OPGP_API OPGP_ERROR_STATUS OP201_get_load_token_signature_data	(	PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		DWORD	nonVolatileCodeSpaceLimit,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	loadTokenSignatureData,
		PDWORD	loadTokenSignatureDataLength
	)

Open Platform: Function to retrieve the data to sign for delegated management in a Load Token.

If you are not the Card Issuer and do not know the token verification private key send this data to the Card Issuer and obtain the RSA signature of the data, i.e. the Load Token. volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tags. The parameters must match the parameters of a later install_for_load() command.

Parameters

executableLoadFileAID	[in] A buffer containing the Executable Load File AID.
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the Security Domain AID.
securityDomainAIDLength	[in] The length of the Security Domain AID.
loadFileDataBlockHash	[in] The Load File DAP. The same calculated as in install_for_load().
loadFileDataBlockHashLength	[in] The length of the loadFileDataBlockHash buffer.
nonVolatileCodeSpaceLimit	[in] The minimum space required to store the application code.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
loadTokenSignatureData	[out] The data to sign in a Load Token.
loadTokenSignatureDataLength	[in, out] The length of the loadTokenSignatureData buffer.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_get_status()

OPGP_API OPGP_ERROR_STATUS OP201_get_status	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	cardElement,
		OP201_APPLICATION_DATA *	applData,
		PDWORD	applDataLength
	)

Open Platform: Gets the life cycle status of Applications, the Card Manager and Executable Load Files and their privileges.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
cardElement	[in] Identifier to retrieve data for Load Files, Applications or the Card Manager.
*applData	[out] The OP201_APPLICATION_DATA structure containing AID, life cycle state and privileges.
applDataLength	[in, out] The number of OP201_APPLICATION_DATA passed and returned.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_install_for_install()

OPGP_API OPGP_ERROR_STATUS OP201_install_for_install	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	AIDWithinLoadFileAID,
		DWORD	AIDWithinLoadFileAIDLength,
		PBYTE	applicationInstanceAID,
		DWORD	applicationInstanceAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	applicationInstallParameters,
		DWORD	applicationInstallParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installToken,
		DWORD	installTokenLength,
		OP201_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

Open Platform: Installs an application on the card.

In the case of delegated management an Install Token authorizing the INSTALL [for install] must be included. See OP201_calculate_install_token(). Otherwise installToken must be NULL. See calculate_install_token(). volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tag. For Security domains look in your manual what parameters are necessary. If the tag for application install parameters is mandatory for your card, but you have no install parameters for the install() method of the application anyway you have to use at least a dummy parameter. If AIDWithinLoadFileAID is NULL and AIDWithinLoadFileAIDLength is 0 applicationInstanceAID is assumed for AIDWithinLoadFileAID

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
AIDWithinLoadFileAID	[in] The AID of the application class in the package.
AIDWithinLoadFileAIDLength	[in] The length of the AIDWithinLoadFileAID buffer.
applicationInstanceAID	[in] The AID of the installed application.
applicationInstanceAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See OP201_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
applicationInstallParameters	[in] Applet install parameters for the install() method of the application.
applicationInstallParametersLength	[in] The length of the applicationInstallParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installToken	[in] The Install Token. This is an assymetric (e.g., ECC or RSA) Signature.
installTokenLength	[in] The length of the installToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_install_for_install_and_make_selectable()

OPGP_API OPGP_ERROR_STATUS OP201_install_for_install_and_make_selectable	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	AIDWithinLoadFileAID,
		DWORD	AIDWithinLoadFileAIDLength,
		PBYTE	applicationInstanceAID,
		DWORD	applicationInstanceAIDLength,
		DWORD	applicationPrivileges,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit,
		PBYTE	applicationInstallParameters,
		DWORD	applicationInstallParametersLength,
		PBYTE	sdParameters,
		DWORD	sdParametersLength,
		PBYTE	uiccSystemSpecParams,
		DWORD	uiccSystemSpecParamsLength,
		PBYTE	simSpecParams,
		DWORD	simSpecParamsLength,
		PBYTE	installToken,
		DWORD	installTokenLength,
		OP201_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

Open Platform: Installs and makes an installed application selectable.

In the case of delegated management an Install Token authorizing the INSTALL [for install and make selectable] must be included. See OP201_calculate_install_token(). Otherwise installToken must be NULL. See calculate_install_token(). volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tag. For Security domains look in your manual what parameters are necessary. If the tag for application install parameters is mandatory for your card, but you have no install parameters for the install() method of the application anyway you have to use at least a dummy parameter. If AIDWithinLoadFileAID is NULL and AIDWithinLoadFileAIDLength is 0 applicationInstanceAID is assumed for AIDWithinLoadFileAID.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
AIDWithinLoadFileAID	[in] The AID of the application class in the package.
AIDWithinLoadFileAIDLength	[in] The length of the AIDWithinLoadFileAID buffer.
applicationInstanceAID	[in] The AID of the installed application.
applicationInstanceAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See OP201_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.
applicationInstallParameters	[in] Applet install parameters for the install() method of the application.
applicationInstallParametersLength	[in] The length of the applicationInstallParameters buffer.
sdParameters	[in] Security Domain install parameters encoded for tag C9 (e.g., tag 'C1' with tags '81','82','83','84','86','87').
sdParametersLength	[in] The length of the sdParameters buffer.
uiccSystemSpecParams	[in] UICC System Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.2.
uiccSystemSpecParamsLength	[in] The length of the uiccSystemSpecParams buffer.
simSpecParams	[in] SIM File Access and Toolkit Application Specific Parameters according to ETSI TS 102 226, sect. 8.2.1.3.2.1.
simSpecParamsLength	[in] The length of the simSpecParams buffer.
installToken	[in] The Install Token. This is an assymetric (e.g., ECC or RSA) Signature.
installTokenLength	[in] The length of the installToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_install_for_load()

OPGP_API OPGP_ERROR_STATUS OP201_install_for_load	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength,
		PBYTE	loadFileDataBlockHash,
		DWORD	loadFileDataBlockHashLength,
		PBYTE	loadToken,
		DWORD	loadTokenLength,
		DWORD	nonVolatileCodeSpaceLimit,
		DWORD	volatileDataSpaceLimit,
		DWORD	nonVolatileDataSpaceLimit
	)

Open Platform: Prepares the card for loading an application.

The function assumes that the Card Manager or Security Domain uses an optional load file DAP using the SHA-1 message digest algorithm. The loadFileDAP can be calculated using calculate_load_file_DAP() or must be NULL, if the card does not need or support a Load File DAP in this situation, e.g. if you want to load a Executable Load File to the Card Manager Security Domain. In the case of delegated management a Load Token authorizing the INSTALL [for load] must be included. Otherwise loadToken must be NULL. See OP201_calculate_load_token(). The term Executable Load File is equivalent to the Open Platform term Load File Data Block. volatileDataSpaceLimit and nonVolatileDataSpaceLimit can be 0, if the card does not need or support this tags.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
executableLoadFileAID	[in] A buffer with AID of the Executable Load File to INSTALL [for load].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the AID of the intended associated Security Domain.
securityDomainAIDLength	[in] The length of the Security Domain AID.
loadFileDataBlockHash	[in] The load file DAP of the Executable Load File to INSTALL [for load].
loadFileDataBlockHashLength	[in] The length of the loadFileDataBlockHash buffer.
loadToken	[in] The Load Token. This is an assymetric (e.g., ECC or RSA) Signature.
loadTokenLength	[in] The length of the loadToken buffer.
nonVolatileCodeSpaceLimit	[in] The minimum amount of space that must be available to store the package.
volatileDataSpaceLimit	[in] The minimum amount of RAM space that must be available.
nonVolatileDataSpaceLimit	[in] The minimum amount of space for objects of the application, i.e. the data allocated in its lifetime.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_install_for_make_selectable()

OPGP_API OPGP_ERROR_STATUS OP201_install_for_make_selectable	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	applicationInstanceAID,
		DWORD	applicationInstanceAIDLength,
		DWORD	applicationPrivileges,
		PBYTE	installToken,
		DWORD	installTokenLength,
		OP201_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable
	)

Open Platform: Makes an installed application selectable.

In the case of delegated management an Install Token authorizing the INSTALL [for make selectable] must be included. See OP201_calculate_install_token(). Otherwise installToken must be NULL. For Security domains look in your manual what parameters are necessary.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
applicationInstanceAID	[in] The AID of the installed application or security domain.
applicationInstanceAIDLength	[in] The length of the application instance AID.
applicationPrivileges	[in] The application privileges. Can be an OR of multiple privileges. See OP201_APPLICATION_PRIVILEGE_SECURITY_DOMAIN.
installToken	[in] The Install Token. This is an assymetric (e.g., ECC or RSA) Signature.
installTokenLength	[in] The length of the installToken buffer.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data.
receiptDataAvailable	[out] 0 if no receiptData is available.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_load()

OPGP_API OPGP_ERROR_STATUS OP201_load	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		OP201_DAP_BLOCK *	dapBlock,
		DWORD	dapBlockLength,
		OPGP_STRING	executableLoadFileName,
		OP201_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable,
		OPGP_PROGRESS_CALLBACK *	callback
	)

Open Platform: Loads a Executable Load File (containing an application) to the card.

An install_for_load() must precede. The Load File Data Block DAP block(s) must be the same block(s) and in the same order like in calculate_load_file_DAP(). If no Load File Data Block DAP blocks are necessary the dapBlock must be NULL and the dapBlockLength 0.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
*dapBlock	[in] A pointer to OP201_DAP_BLOCK structure(s).
dapBlockLength	[in] The number of OP201_DAP_BLOCK structure(s).
executableLoadFileName	[in] The name of the CAP or IJC file to load.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data. Can be validated with validate_load_receipt().
receiptDataAvailable	[out] 0 if no receiptData is available.
*callback	[in] A pointer to a OPGP_PROGRESS_CALLBACK defining the callback function and optional parameters for it.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_load_from_buffer()

OPGP_API OPGP_ERROR_STATUS OP201_load_from_buffer	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		OP201_DAP_BLOCK *	dapBlock,
		DWORD	dapBlockLength,
		PBYTE	loadFileBuf,
		DWORD	loadFileBufSize,
		OP201_RECEIPT_DATA *	receiptData,
		PDWORD	receiptDataAvailable,
		OPGP_PROGRESS_CALLBACK *	callback
	)

Open Platform: Loads a Executable Load File (containing an application) from a buffer to the card.

An install_for_load() must precede. The Load File Data Block DAP block(s) must be the same block(s) and in the same order like in calculate_load_file_DAP(). If no Load File Data Block DAP blocks are necessary the dapBlock must be NULL and the dapBlockLength 0.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
*dapBlock	[in] A pointer to OP201_DAP_BLOCK structure(s).
dapBlockLength	[in] The number of OP201_DAP_BLOCK structure(s).
loadFileBuf	[in] buffer with the contents of a Executable Load File.
loadFileBufSize	[in] size of loadFileBuf.
*receiptData	[out] If the deletion is performed by a security domain with delegated management privilege this structure contains the according data. Can be validated with validate_load_receipt().
receiptDataAvailable	[out] 0 if no receiptData is available.
*callback	[in] A pointer to a OPGP_PROGRESS_CALLBACK defining the callback function and optional parameters for it.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_mutual_authentication()

OPGP_API OPGP_ERROR_STATUS OP201_mutual_authentication	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		PBYTE	baseKey,
		PBYTE	encKey,
		PBYTE	macKey,
		PBYTE	kekKey,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	securityLevel,
		BYTE	derivationMethod,
		OP201_SECURITY_INFO *	secInfo
	)

Open Platform: Mutual authentication.

A keySetVersion and keyIndex of 0x00 selects the first available key set version and key index. If a derivation method is used the baseKey defines the master key.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
baseKey	[in] The master key used for the key derivation.
encKey	[in] The static encryption key.
macKey	[in] The static MAC key.
kekKey	[in] The static Key Encryption key.
keySetVersion	[in] The key set version on the card to use for mutual authentication.
keyIndex	[in] The key index of the encryption key in the key set version on the card to use for mutual authentication.
securityLevel	[in] The requested security level.
derivationMethod	[in] The derivation method to use for. See OPGP_DERIVATION_METHOD_VISA2.
*secInfo	[out] The returned OP201_SECURITY_INFO structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_pin_change()

OPGP_API OPGP_ERROR_STATUS OP201_pin_change	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	tryLimit,
		PBYTE	newPIN,
		DWORD	newPINLength,
		BYTE	KEK[16]
	)

Open Platform: Changes or unblocks the global PIN.

The single numbers of the new PIN are encoded as single BYTEs in the newPIN buffer. The tryLimit must be in the range of 0x03 and x0A. The PIN must comprise at least 6 numbers and not exceeding 12 numbers. To unblock the PIN use tryLimit with a value of 0x00. In this case newPIN buffer and newPINLength are ignored.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
tryLimit	[in] The try limit for the PIN.
newPIN	[in] The new PIN.
newPINLength	[in] The length of the new PIN.
KEK	[in] The Key Encryption key (KEK).

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_put_3desKey()

OPGP_API OPGP_ERROR_STATUS OP201_put_3desKey	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		BYTE	_3desKey[16]
	)

Open Platform: replaces a single 3DES key in a key set or adds a new 3DES key.

A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a new key belongs to. This can be the same key version or a new not yet existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The new key set version.
_3desKey	[in] The new 3DES key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_put_data()

OPGP_API OPGP_ERROR_STATUS OP201_put_data	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	identifier[2],
		PBYTE	dataObject,
		DWORD	dataObjectLength
	)

Open Platform: Put card data.

Puts a single card data object identified by identifier. Some cards do not provide some data objects. Some possible identifiers are predefined. See OP201_GET_DATA_ISSUER_BIN. For details about the coding of the dataObject see the programmer's manual of your card.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
identifier	[in] Two byte buffer with high and low order tag value for identifying card data object.
dataObject	[in] The coded data object.
dataObjectLength	[in] The length of the data object.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_put_delegated_management_keys()

OPGP_API OPGP_ERROR_STATUS OP201_put_delegated_management_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase,
		BYTE	receiptGenerationKey[16]
	)

Open Platform: Adds a key set for Delegated Management.

A keySetVersion value of 0x00 adds a new secure channel key set. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a the new secure channel keys belongs to. This can be the same key version or a new not existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
keySetVersion	[in] An existing key set version.
newKeySetVersion	[in] The new key set version.
PEMKeyFileName	[in] A PEM file name with the public RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.
receiptGenerationKey	[in] The new Receipt Generation key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_put_rsa_key()

OPGP_API OPGP_ERROR_STATUS OP201_put_rsa_key	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	keyIndex,
		BYTE	newKeySetVersion,
		OPGP_STRING	PEMKeyFileName,
		char *	passPhrase
	)

Open Platform: replaces a single public RSA key in a key set or adds a new public RSA key.

A keySetVersion value of 0x00 adds a new key. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version a new key belongs to. This can be the same key version or a new not existing key set version.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
keySetVersion	[in] An existing key set version.
keyIndex	[in] The position of the key in the key set version.
newKeySetVersion	[in] The new key set version.
PEMKeyFileName	[in] A PEM file name with the public RSA key.
*passPhrase	[in] The passphrase. Must be an ASCII string.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_put_secure_channel_keys()

OPGP_API OPGP_ERROR_STATUS OP201_put_secure_channel_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	keySetVersion,
		BYTE	newKeySetVersion,
		BYTE	new_encKey[16],
		BYTE	new_macKey[16],
		BYTE	new_KEK[16]
	)

Open Platform: replaces or adds a secure channel key set consisting of encryption key, MAC key and key encryption.

A keySetVersion value of 0x00 adds a new secure channel key set. Any other value between 0x01 and 0x7f must match an existing key set version. The new key set version defines the key set version the new secure channel keys belongs to. This can be the same key version or a new not existing key set version. Sometimes a key derivation of the put keys might be necessary so it is necessary to call OP201_EMV_CPS11_derive_keys() or any other derivation function.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
keySetVersion	[in] An existing key set version.
newKeySetVersion	[in] The new key set version.
new_encKey	[in] The new Encryption key.
new_macKey	[in] The new MAC key.
new_KEK	[in] The new key encryption key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_send_APDU()

OPGP_API OPGP_ERROR_STATUS OP201_send_APDU	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	capdu,
		DWORD	capduLength,
		PBYTE	rapdu,
		PDWORD	rapduLength
	)

Sends an application protocol data unit.

The secInfo pointer can also be null and so this function can be used for arbitrary cards.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
capdu	[in] The command APDU.
capduLength	[in] The length of the command APDU.
rapdu	[out] The response APDU.
rapduLength	[in, out] The length of the response APDU.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_set_status()

OPGP_API OPGP_ERROR_STATUS OP201_set_status	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		BYTE	statusType,
		PBYTE	AID,
		DWORD	AIDLength,
		BYTE	lifeCycleState
	)

Open Platform: Sets the life cycle status of Applications, Security Domains or the Card Manager.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
statusType	[in] Identifier for Load Files, Applications or the Card Manager.
AID	[in] The AID.
AIDLength	[in] The length of the AID.
lifeCycleState	[in] The new life cycle state.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_validate_delete_receipt()

OPGP_API OPGP_ERROR_STATUS OP201_validate_delete_receipt	(	DWORD	confirmationCounter,
		BYTE	cardUniqueData[10],
		BYTE	receiptGenerationKey[16],
		OP201_RECEIPT_DATA	receiptData,
		PBYTE	AID,
		DWORD	AIDLength
	)

Open Platform: Validates a Load Receipt.

Each time a receipt is generated the confirmation counter is incremented by the Card Manager. You may keep track of it. Returns OPGP_ERROR_SUCCESS if receipt is valid.

Parameters

confirmationCounter	[in] The confirmation counter.
cardUniqueData	[in] The card unique data (?).
receiptGenerationKey	[in] The 3DES key to generate the receipt.
receiptData	[in] The OP201_RECEIPT_DATA structure containing the receipt returned from delete_application() to verify.
AID	[in] A buffer with AID of the application which was deleted.
AIDLength	[in] The length of the AID.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_validate_install_receipt()

OPGP_API OPGP_ERROR_STATUS OP201_validate_install_receipt	(	DWORD	confirmationCounter,
		BYTE	cardUniqueData[10],
		BYTE	receiptGenerationKey[16],
		OP201_RECEIPT_DATA	receiptData,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	applicationInstanceAID,
		DWORD	applicationInstanceAIDLength
	)

Open Platform: Validates an Install Receipt.

Each time a receipt is generated the confirmation counter is incremented by the Card Manager. You may keep track of it. Returns OPGP_ERROR_SUCCESS if receipt is valid.

Parameters

confirmationCounter	[in] The confirmation counter.
cardUniqueData	[in] The card unique data (?).
receiptGenerationKey	[in] The 3DES key to generate the receipt.
receiptData	[in] The OP201_RECEIPT_DATA structure containing the receipt returned from install_for_install() to verify.
executableLoadFileAID	[in] A buffer with AID of the Executable Load File which was INSTALL [for install].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
applicationInstanceAID	[in] The AID of the installed application.
applicationInstanceAIDLength	[in] The length of the application instance AID.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_validate_load_receipt()

OPGP_API OPGP_ERROR_STATUS OP201_validate_load_receipt	(	DWORD	confirmationCounter,
		BYTE	cardUniqueData[10],
		BYTE	receiptGenerationKey[16],
		OP201_RECEIPT_DATA	receiptData,
		PBYTE	executableLoadFileAID,
		DWORD	executableLoadFileAIDLength,
		PBYTE	securityDomainAID,
		DWORD	securityDomainAIDLength
	)

Open Platform: Validates a Load Receipt.

Each time a receipt is generated the confirmation counter is incremented by the Card Manager. You may keep track of it. Returns OPGP_ERROR_SUCCESS if receipt is valid.

Parameters

confirmationCounter	[in] The confirmation counter.
cardUniqueData	[in] The card unique data (?).
receiptGenerationKey	[in] The 3DES key to generate the receipt.
receiptData	[in] The OP201_RECEIPT_DATA structure containing the receipt returned from load_application() to verify.
executableLoadFileAID	[in] A buffer with AID of the Executable Load File which was INSTALL [for load].
executableLoadFileAIDLength	[in] The length of the Executable Load File AID.
securityDomainAID	[in] A buffer containing the AID of the associated Security Domain.
securityDomainAIDLength	[in] The length of the Security Domain AID.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_VISA1_derive_keys()

OPGP_API OPGP_ERROR_STATUS OP201_VISA1_derive_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the VISA 1 key derivation scheme.

E.g. GemXpresso cards use this scheme.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OP201_VISA2_derive_keys()

OPGP_API OPGP_ERROR_STATUS OP201_VISA2_derive_keys	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		OP201_SECURITY_INFO *	secInfo,
		PBYTE	AID,
		DWORD	AIDLength,
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the VISA 2 key derivation scheme.

E.g. GemXpresso cards, JCOP-10 cards or Palmera Protect V5 cards use this scheme.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO cardInfo, structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the OP201_SECURITY_INFO structure returned by OP201_mutual_authentication().
AID	[in] The AID of the Card Manager.
AIDLength	[in] The length of the Card Manager AID / Issuer Security Domain AID.
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_build_bcd_encoding()

OPGP_API OPGP_ERROR_STATUS OPGP_build_bcd_encoding	(	const char *	numericString,
		PBYTE	bcdData,
		PDWORD	bcdDataLength
	)

BCD encodes a numeric string.

Encodes an ASCII decimal string as packed BCD. Digits are written high nibble first; odd length strings are padded with 0xF in the low nibble of the last byte.

Parameters

numericString	[in] Null terminated string containing only decimal digits.
bcdData	[out] The output buffer for the BCD encoded data.
bcdDataLength	[in, out] The length of bcdData and, on success, the number of encoded bytes.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

OPGP_calculate_key_check_value()

OPGP_ERROR_STATUS OPGP_calculate_key_check_value	(	GP211_SECURITY_INFO *	secInfo,
		BYTE	keyType,
		PBYTE	keyData,
		DWORD	keyDataLength,
		BYTE	keyCheckValue[3]
	)

Calculates the key check value of a key.

Parameters

*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
keyType	[in] The key type. See GP211_KEY_TYPE_AES.
keyData	[in] The key data.
keyDataLength	[in] The key data length.
keyCheckValue	[out] The key check value.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_cap_to_ijc()

OPGP_API OPGP_ERROR_STATUS OPGP_cap_to_ijc	(	OPGP_CSTRING	capFileName,
		OPGP_STRING	ijcFileName
	)

Converts a CAP file to an IJC file (Executable Load File).

Parameters

capFileName	[in] The name of the CAP file.
ijcFileName	[in] The name of the destination IJC file.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_encrypt_sensitive_data()

OPGP_ERROR_STATUS OPGP_encrypt_sensitive_data	(	GP211_SECURITY_INFO *	secInfo,
		PBYTE	data,
		DWORD	dataLength,
		PBYTE	encryptedData,
		PDWORD	encryptedDataLength
	)

Encrypts sensitive data like keys or other data which is used in STORE DATA.

Parameters

*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
data	[in] The data to encrypt.
dataLength	[in] The data length.
encryptedData	[out] The encrypted data. No length checking is done. The buffer must have sufficient size, e.g. the next block size or twice the data size if unsure.
encryptedDataLength	[out] The length of the encrypted data.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_extract_cap_file()

OPGP_API OPGP_ERROR_STATUS OPGP_extract_cap_file	(	OPGP_CSTRING	fileName,
		PBYTE	loadFileBuf,
		PDWORD	loadFileBufSize
	)

Extracts a CAP file into a buffer.

If loadFileBuf is NULL the loadFileBufSize is ignored and the necessary buffer size is returned in loadFileBufSize and the functions returns.

Parameters

fileName	[in] The name of the CAP file.
loadFileBuf	[out] The destination buffer with the Executable Load File contents.
loadFileBufSize	[in, out] The size of the loadFileBuf.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_get_cplc()

OPGP_API OPGP_ERROR_STATUS OPGP_get_cplc	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		OPGP_CPLC *	cplc
	)

Reads and parses the CPLC data.

Retrieves and parses the Card Production Life Cycle data object. The CPLC data is read with GET DATA tag 9F7F and parsed into OPGP_CPLC.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context().
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication(), or NULL if the command is sent without secure messaging.
cplc	[out] The parsed CPLC structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

OPGP_get_extended_card_resources_information()

OPGP_API OPGP_ERROR_STATUS OPGP_get_extended_card_resources_information	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		OPGP_EXTENDED_CARD_RESOURCE_INFORMATION *	extendedCardResourceInformation
	)

Reads the extended card resource information (number of applications + free memory).

The ISD must support the optional report of extended card resources information. The format is defined in ETSI TS 102 226, sect. 8.2.1.7.2.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
*extendedCardResourceInformation	[out] A pointer to an array of OPGP_EXTENDED_CARD_RESOURCE_INFORMATION structures.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_manage_channel()

OPGP_API OPGP_ERROR_STATUS OPGP_manage_channel	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO *	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		BYTE	openClose,
		BYTE	channelNumberToClose,
		BYTE *	channelNumberOpened
	)

ISO 7816-4 / GlobalPlatform2.1.1: Opens or closes a Logical Channel.

For an OPEN command, the channelNumberToClose is ignored. For an CLOSE command, the channelNumberOpened is returned. After closing a Logical Channel the Basic Logical Channel is assumed for the next transmissions.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
*cardInfo	[in, out] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure returned by GP211_mutual_authentication().
openClose	[in] Logical Channel should be opened or closed. See GP211_MANAGE_CHANNEL_OPEN.
channelNumberToClose	[in] The Logical Channel number to close.
channelNumberOpened	[out] The Logical Channel number opened.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_parse_cplc()

OPGP_API OPGP_ERROR_STATUS OPGP_parse_cplc	(	const BYTE *	data,
		DWORD	dataLength,
		OPGP_CPLC *	cplc
	)

Parses the CPLC data response.

Parses Card Production Life Cycle data. The input may be either the raw 42 byte CPLC value or a GET DATA response wrapped in tag 9F7F.

Parameters

data	[in] The raw CPLC value or the tag 9F7F wrapped CPLC data.
dataLength	[in] The length of data.
cplc	[out] The parsed CPLC structure.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

OPGP_parse_extended_card_resources_information()

OPGP_API OPGP_ERROR_STATUS OPGP_parse_extended_card_resources_information	(	const BYTE *	data,
		DWORD	dataLength,
		OPGP_EXTENDED_CARD_RESOURCE_INFORMATION *	extendedCardResourceInformation
	)

Parses the extended card resources information response.

Parses an Extended Card Resources Information response. The input must contain tag FF21 and may include the number of installed applications, free non-volatile memory and free volatile memory.

Parameters

data	[in] The extended card resources information response.
dataLength	[in] The length of data.
extendedCardResourceInformation	[out] The parsed extended card resources information.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct.

OPGP_read_executable_load_file_parameters()

OPGP_API OPGP_ERROR_STATUS OPGP_read_executable_load_file_parameters	(	OPGP_STRING	loadFileName,
		OPGP_LOAD_FILE_PARAMETERS *	loadFileParams
	)

Reads the parameters of an Executable Load File.

Parameters

loadFileName	[in] The load file name to parse.
*loadFileParams	[out] The parsed parameters.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_read_executable_load_file_parameters_from_buffer()

OPGP_API OPGP_ERROR_STATUS OPGP_read_executable_load_file_parameters_from_buffer	(	PBYTE	loadFileBuf,
		DWORD	loadFileBufSize,
		OPGP_LOAD_FILE_PARAMETERS *	loadFileParams
	)

Receives Executable Load File as a buffer instead of a FILE.

Parameters

loadFileBuf	[in] The load file buffer.
loadFileBufSize	[in] The size of the load file buffer.
*loadFileParams	[out] The parsed parameters.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_select_application()

OPGP_API OPGP_ERROR_STATUS OPGP_select_application	(	OPGP_CARD_CONTEXT	cardContext,
		OPGP_CARD_INFO	cardInfo,
		GP211_SECURITY_INFO *	secInfo,
		PBYTE	AID,
		DWORD	AIDLength
	)

GlobalPlatform2.1.1: Selects an application on a card by AID and resets secure channel state.

Parameters

cardContext	[in] The valid OPGP_CARD_CONTEXT returned by OPGP_establish_context()
cardInfo	[in] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
*secInfo	[in, out] The pointer to the GP211_SECURITY_INFO structure. If non-null, the secure channel state is reset after a successful select.
AID	[in] The AID.
AIDLength	[in] The length of the AID.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

OPGP_select_channel()

OPGP_API OPGP_ERROR_STATUS OPGP_select_channel	(	OPGP_CARD_INFO *	cardInfo,
		BYTE	channelNumber
	)

ISO 7816-4 / GlobalPlatform2.1.1: If multiple Logical Channels are open or a new Logical Channel is opened with select_application(), selects the Logical Channel.

You must track on your own, what channels are open.

Parameters

*cardInfo	[in, out] The OPGP_CARD_INFO structure returned by OPGP_card_connect().
channelNumber	[in] The Logical Channel number to select.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

VISA1_derive_keys()

OPGP_API OPGP_ERROR_STATUS VISA1_derive_keys	(	BYTE	cardSerialNumber[8],
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the VISA 1 key derivation scheme.

E.g. GemXpresso cards use this scheme.

Parameters

cardSerialNumber	[in] The card serial number.
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct

VISA2_derive_keys()

OPGP_API OPGP_ERROR_STATUS VISA2_derive_keys	(	BYTE	baseKeyDiversificationData[10],
		PBYTE	masterKey,
		PBYTE	S_ENC,
		PBYTE	S_MAC,
		PBYTE	DEK
	)

Derives the static keys from a master key according the VISA 2 key derivation scheme.

E.g. GemXpresso cards, JCOP-10 cards or Palmera Protect V5 cards use this scheme. The baseKeyDiversificationData must contain the rightmost two bytes of the Card Manager AID as first 2 bytes and starting at position 4 the 4 bytes of the IC serial number.

Parameters

baseKeyDiversificationData	[in] The key diversification data. This is returned by INITIALIZE UPDATE or can be constructed.
masterKey	[in] The master key.
S_ENC	[out] The static Encryption key.
S_MAC	[out] The static Message Authentication Code key.
DEK	[out] The static Key Encryption Key.

Returns

OPGP_ERROR_STATUS struct with error status OPGP_ERROR_STATUS_SUCCESS if no error occurs, otherwise error code and error message are contained in the OPGP_ERROR_STATUS struct