Android Software Card Emulation

Software Card Emulation on Android

Software CE is not possible yet on stock Android but patches [https://github.com/CyanogenMod/android_packages_apps_Nfc/commit/d41edfd794d4d0fedd91d561114308f0d5f83878

have] been made for CyanogenMod and they are integrated in the official release since v10.1.

Readings

Software Card Emulation in NFC-enabled Mobile Phones: Great Advantage or Security Nightmare? by Michael Roland, IWSSI2012 (pdf)

Requirements

Android phone with a PN544 NFC chipset

Limitations

Random ID, starting with "08"
ISO14443-4A
Fixed(?) ATS 0578338800 = ATR 3B80800101
Performances: on a Nexus S locked at 1000MHz and idle, a delay of about 30ms is still measured. It goes to 60ms if CPU is busy or occasionally even higher under "on demand" CPU scheduler.

Installation

Easiest is to install cyanogenmod 10.1 (or more recent if available), see instructions

Example

This example is taken from this very interesting post and its source code, adapted for CyanogenMod 10.1 and compiled under Linux in command line.
It's a small example emulating a card able to do a PIN verify then a signature, a bit like some eIDs.

Compile application

Following instructions how to compile Android app in command line

git clone https://github.com/nelenkov/virtual-pki-card
cd virtual-pki-card/se-emulator
JAVA_HOME=/usr/lib/jvm/java-6-sun-1.6.0.26/
ANDROID_HOME=/your_path_to/android-sdk-linux_x86/
PACKAGE=org.nick.se.emulator
PACKAGE_SLASH=${PACKAGE//.//}
DEV_HOME=$(pwd)
TARGET=android-17
mkdir -p $DEV_HOME/obj
mkdir -p $DEV_HOME/bin
mkdir -p $DEV_HOME/lib

Create dummy keystore

$JAVA_HOME/bin/keytool -genkeypair \
                -validity 10000 \
                -dname "CN=company name,
                        OU=organisational unit,
                        O=organisation,
                        L=location,
                        S=state,
                        C=country code" \
                -keystore $DEV_HOME/AndroidTest.keystore \
                -storepass password \
                -keypass password \
                -alias AndroidTestKey \
                -keyalg RSA \
                -v

Create R.java

$ANDROID_HOME/platform-tools/aapt package -v -f -m \
    -S $DEV_HOME/res -J $DEV_HOME/src -M $DEV_HOME/AndroidManifest.xml \
    -I $ANDROID_HOME/platforms/$TARGET/android.jar || exit 1

Compile Java

$JAVA_HOME/bin/javac -verbose -d $DEV_HOME/obj \
    -classpath "$ANDROID_HOME/platforms/$TARGET/android.jar:$DEV_HOME/obj" \
    -sourcepath $DEV_HOME/src \
    $DEV_HOME/src/$PACKAGE_SLASH/*.java || exit 1

Create DEX

$ANDROID_HOME/platform-tools/dx --dex --verbose \
    --output=$DEV_HOME/bin/classes.dex \
    $DEV_HOME/obj $DEV_HOME/lib || exit 1

Create APK

$ANDROID_HOME/platform-tools/aapt package -v -f \
    -S $DEV_HOME/res -M $DEV_HOME/AndroidManifest.xml \
    -I $ANDROID_HOME/platforms/$TARGET/android.jar \
    -F $DEV_HOME/bin/AndroidTest.unsigned.apk \
    $DEV_HOME/bin || exit 1

Sign APK

$JAVA_HOME/bin/jarsigner -verbose \
    -keystore $DEV_HOME/AndroidTest.keystore \
    -storepass password \
    -keypass password \
    -signedjar $DEV_HOME/bin/AndroidTest.signed.apk \
    $DEV_HOME/bin/AndroidTest.unsigned.apk \
    AndroidTestKey || exit 1

Zip-align APK

$ANDROID_HOME/tools/zipalign -v -f 4 \
    $DEV_HOME/bin/AndroidTest.signed.apk \
    $DEV_HOME/bin/AndroidTest.apk || exit 1

Install application

sudo adb install $DEV_HOME/bin/AndroidTest.apk

Create certificate

As this example is using a certificate to sign data, we need to create it.

cd virtual-pki-card
mkdir cert
cd cert

Create a template mykey.conf:

[ req ]
default_bits           = 1024
distinguished_name     = req_distinguished_name
prompt                 = no
output_password        = 1234

[ req_distinguished_name ]
C                      = BE
ST                     = MyCity
O                      = MyOrg

Create certificate:

openssl req -new -x509 -keyout mykey.pem -out mycert.pem -config mykey.conf
openssl pkcs12 -export -in mycert.pem -inkey mykey.pem -passin pass:1234 -passout pass: > mykey.pfx

Install it:

sudo adb push mykey.pfx /sdcard/
cp mycert.pem ../se-pki-client/

On the phone:
Run application "PKI Applet Emulator"

Install PKCS#12
- no passwd
- if needed create a lock PIN on the phone (to be able to store certs)
- choose cert: select this one, ok
Set PIN=1234

If reading cert fails, check in CyanogenMod developer options that "Protect USB storage" is not activated.
Storing certs require that you defined a screen lock PIN too, do it if needed.

Reader application

Compile:

cd se-pki-client
javac src/org/nick/sepkiclient/Main.java

Execute:

java -cp src org.nick.sepkiclient.Main 1234 mycert.pem

Place phone/card on reader to start
--> 00A4040006A0000000010101
<-- 9000
--> 800100000431323334
<-- 9000
--> 80020000087369676E206D6521
<-- 7C19AAE869DD6C2A9C4AAB98E65FEFDF88C0764EDDAD1BE660BBA220237BA7F4D46B08080E925737D7D ...

Got signature from card: 7C19AAE869DD6C2A9C4AAB98E65FEFDF88C0764EDDAD1BE660BBA220237BA7F4D46B08080E925737D7D ...
Will use certificate from 'mycert.pem' to verify signature
	Issuer: O=MyOrg, ST=MyCity, C=BE
	Subject: O=MyOrg, ST=Mycity, C=BE
	Not Before: Thu Sep 05 11:46:55 CEST 2013
	Not After: Sat Oct 05 11:46:55 CEST 2013

Signature is valid: true

Performances

Measured on a Nexus S, stats over 20 runs:

With CPU locked at 1000MHz (CPU sceduler = performance) and idle

Resp to SelectApp: 32ms (std. dev. 11%)
Resp to VerifyPIN*: 296ms (std. dev. 3%)
Resp to GetSign**: 67ms (std.dev. 18%)

With CPU locked at 1000MHz (CPU sceduler = performance) and busy with infinite loop

Resp to SelectApp: 63ms (std. dev. 15%)
Resp to VerifyPIN*: 600ms (std. dev. 4%)
Resp to GetSign**: 100ms (std.dev. 20%)

*  : the phone does a PBKDF2 on the PIN :  5000 x SHA1 hashes
** : the phone does a 1024-bit RSA signature