How to send response APDU containing return data AND status word other than 0x9000?

Question

I would like to send a response APDU containing a response data field as well as a status word that is not 0x9000. Considering my understanding of ISO 7816-4 this should be possible in general.

However, whenever I specify return data and try to send it, I do not see any possibility to explicitly set a status word other than 0x9000.

On the contrary I can explicitly set arbitrary status words and send them as ISOException but have no possibility of attaching return data.

This behavior is ok for errors, i.e. status words 0x64XX - 0x69XX but what is for 0x63XX? It should be ok to send a warning and still convey return data.

So is it possible to send response APDUs containing return data AND a status word other than 0x9000 and how do I do this?

Herr

Answer 1

Simply make sure that you send the data before throwing the exception. You may of course want to remember the status word you want to throw until the end. Then you can simply use ISOException.throwIt(short sw) to create the status word.

Note that - as you indicated - you should only return data if your status word indicates either 9000 or a warning (i. e. in the range 62xx up to 63xx). Returning data and a status word that indicates an error is a misinterpretation of ISO 7816-4.

I agree that throwing an exception to generate a warning does not feel right, but that's how it currently is.

Ottie

Hey, that was quick ;-) ... and solved my problem although intuition told me otherwise or I would have tried this obvious? mix of both approaches myself. – Herr

Apparently the APDU is not sent until the process method has finished. Never thought about this but seems plausible. – Herr

Answer 2

This is an old topic which has already been answered but I would like to update at the current moment in time of this posting, I am not sure if the optional data can be sent together with SW (non-0x9000) anymore with exception of 0x6D00. I have tested on an Infineon (Feitian A22CR), Infineon SECORA ID and an NXP JCOP4 P71 for both JC 2.2.2 and JC 3.0.4. JavaCards.

I have created a simple applet code requiring only a single Java class file that will return 'hello' together with the SW (enter the SW inside the Command APDU's data as shown in screenshot below) and it will attempt to return both the text 'hello' and the SW.

Seems like only 0x9000 and 0x6D00 seems to return the 'hello' text.

Has anyone that have gotten 0x6200 and 0x6300 to work with sending data as well, please post a sample code as I think it will benefit many of us here.

Applet code:

package TestAPDU;

import javacard.framework.APDU;
import javacard.framework.Applet;
import javacard.framework.ISO7816;
import javacard.framework.ISOException;
import javacard.framework.JCSystem;
import javacard.framework.Util;

public class TestAPDU extends Applet {
    
    public byte[] swStore = JCSystem.makeTransientByteArray((short) 2, JCSystem.CLEAR_ON_DESELECT);

    public static void install(byte[] bArray, short bOffset, byte bLength) {
        new TestAPDU().register(bArray, (short) (bOffset + 1), bArray[bOffset]);
    }

    public void process(APDU apdu) {
        if (selectingApplet()) {
            return;
        }

        byte[] buf = apdu.getBuffer();
        switch (buf[ISO7816.OFFSET_INS]) {
            case (byte) 0x00:
                apdu.setIncomingAndReceive();
                swStore[0] = buf[5];
                swStore[1] = buf[6];
                buf[0] = (byte) 0x68;
                buf[1] = (byte) 0x65;
                buf[2] = (byte) 0x6C;
                buf[3] = (byte) 0x6C;
                buf[4] = (byte) 0x6F;
                apdu.setOutgoing();
                apdu.setOutgoingLength((short) 5);
                apdu.sendBytes((short) 0, (short) 5);
                ISOException.throwIt(Util.makeShort(swStore[0], swStore[1]));
                break;
            default:
                ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
        }
    }
}

Rockefeller

It depends on what you are trying to do. Are you maybe trying to implement chaining? If that's the case, Java Card should automatically perform that for you. – Ottie