JCMathLib: Wrapper Cryptographic Library for Transparent and Certifiable JavaCard Applets

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F20%3A00117152" target="_blank" >RIV/00216224:14330/20:00117152 - isvavai.cz</a>

Result on the web

<a href="http://dx.doi.org/10.1109/EuroSPW51379.2020.00022" target="_blank" >http://dx.doi.org/10.1109/EuroSPW51379.2020.00022</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/EuroSPW51379.2020.00022" target="_blank" >10.1109/EuroSPW51379.2020.00022</a>

Result language

angličtina

Original language name

JCMathLib: Wrapper Cryptographic Library for Transparent and Certifiable JavaCard Applets

Original language description

The JavaCard multi-application platform is now deployed to over twenty billion smartcards, used in various applications ranging from banking payments and authentication tokens to SIM cards and electronic documents. In most of those use cases, access to various cryptographic primitives is required. The standard JavaCard API provides a basic level of access to such functionality (e.g., RSA encryption) but does not expose low-level cryptographic primitives (e.g., elliptic curve operations) and essential data types (e.g., Integers). Developers can access such features only through proprietary, manufacturer-specific APIs. Unfortunately, such APIs significantly reduce the interoperability and certification transparency of the software produced as they require non-disclosure agreements (NDA) that prohibit public sharing of the applet’s source code. We introduce JCMathLib, an open library that provides an intermediate layer realizing essential data types and lowlevel cryptographic primitives from high-level operations. To achieve this, we introduce a series of optimization techniques for resource-constrained platforms that make optimal use of the underlying hardware, while having a small memory footprint. To the best of our knowledge, it is the first generic library for low-level cryptographic operations in JavaCards that does not rely on a proprietary API. Without any disclosure limitations, JCMathLib has the potential to increase transparency by enabling open code sharing, release of research prototypes, and public code audits. Moreover, JCMathLib can help resolve the conflict between strict open-source licenses such as GPL and proprietary APIs available only under an NDA. This is of particular importance due to the introduction of JavaCard API v3.1, which targets specifically IoT devices, where open-source development might be more common than in the relatively closed world of government-issued electronic documents.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2020

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

ISBN

9781728185972

ISSN

—

e-ISSN

—

Number of pages

8

Pages from-to

89-96

Publisher name

IEEE

Place of publication

Genoa, Italy

Event location

Genoa, Italy

Event date

Jan 1, 2020

Type of event by nationality

CST - Celostátní akce

UT code for WoS article

000630275400013