MeridianMeridian

Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges

A detailed technical guide demonstrates how to create a Supplementary Security Domain (SSD) on Java Card platforms to isolate applet management from the Issuer Security Domain (ISD). The approach prevents full card compromise if ISD keys are exposed by restricting SSD privileges to specific functions such as accepting extradition only from the ISD. Using the FunGP library and SCP02 protocol, the tutorial walks through installation, personalization with encrypted keys, and extradition of applets under the new domain. GlobalPlatform specifications including GP CS v2.3 and GP CIC v2.0 are followed for install parameters, privileges, and STORE DATA commands. After personalization the SSD reaches the PERSONALIZED lifecycle state, allowing secure delegation of applet control while the ISD retains overall card management rights. The method eliminates the need for custom operating systems and provides a standards-compliant way to enforce least-privilege access on smart cards.

HabrTranslated from Russian

Read at source

A new technical tutorial explains how to create a Supplementary Security Domain (SSD) on Java Card platforms, addressing the risk that full Issuer Security Domain (ISD) keys grant unrestricted control over the entire card.

The architecture places the SSD between the applet and the ISD. The ISD continues to manage card contents but loses direct interaction with the applet, which is now handled exclusively by the SSD. This design ensures that even if an attacker obtains SSD keys, privileges remain strictly limited.

The process begins with installation of the SSD instance from the package AID A0000001515350 and module AID A000000151535041. Install parameters include the tag 8102 0255 for SCP02 with configuration i=55 and the tag 8201 20 to accept extradition only from the ISD. The privilege byte is set to 80 for Security Domain rights.

After installation the domain reaches the SELECTABLE lifecycle state. Personalization follows with the INSTALL [for personalization] command and subsequent STORE DATA operations that deliver encrypted ENC, MAC and DEK keys along with their key check values, all formatted according to GP CS v2.3 section 11.11.4.

Once the SSD is in the PERSONALIZED state, an applet is installed under the ISD and then moved to the SSD using the INSTALL [for extradition] command. The resulting hierarchy shows the applet parent changed to the new SSD AID while the original package relationships remain intact.

The tutorial provides five Python scripts based on the FunGP library that automate reader initialization, mutual authentication over SCP02, SSD creation, key loading, and applet extradition, offering a reproducible reference implementation for developers working with GlobalPlatform-compliant smart cards.

Issuer Security DomainGlobalPlatformSCP02Java CardFunGPSupplementary Security Domain
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria
Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian