AID A000000308000010000100 seems mandatory to communicate with any smart card through TKSmartCardSlotNFCSession

Question

Created 4d

Replies 3

Boosts 0

Participants 2

I am using the CryptoTokenKit API in order to communicate with smart cards through NFC, with TKSmartCardSlotNFCSession. I call the createNFCSlotWithMessage method from TKSmartCardSlotManager, which displays successfuly the NFC dialog. However, when I put any smart card next to the phone, the NFC dialog shuts down instantly. I notice the following log in the system console:

-[_NFReaderSession(Entitlement) validateAID:allowsPrefixMatch:]:317 Non-permissible identifier: A000000308000010000100

When I add the A000000308000010000100 AID mentioned in the error message to the Info.plist of my application, the NFC dialog does not shut down anymore and I am able to communicate with the smart card (using TKSmartCard).

This behavior has been reproduced on an iPhone 16e, iOS 26.4.

This AID does not correspond to anything in the smart card. It seems to be related to PIV, but this behavior also occurs with cards that are not PIV (PKCS#15...). Also, with an implementation using CoreNFC API instead of CryptoTokenKit API, this AID is not needed to be able to communicate with the card, so it seems CryptoTokenKit-specific. I did not find anything related to this in the documentation, have I missed something here ? Is this a special AID that is required all the time to work with NFC through CryptoTokenKit ?

Answered by DTS Engineer in 884554022

I’m not entirely sure who allocates AID values, but some rummaging around on the ’net confirms that AID A000000308000010000100 is definitely associated with PIV.

As to your current issue, the doc comments in <CryptoTokenKit/TKSmartCard.h> for the -[TKSmartCardSlotManager createNFCSlotWithMessage:completion:] method says:

Warning Caller requires com.apple.developer.nfc.readersession.iso7816.select-identifiers Info.plist record which specifies application identifiers of the NFC cards link

which suggests that your solution is the right one.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

2d

Recommended

I’m not entirely sure who allocates AID values, but some rummaging around on the ’net confirms that AID A000000308000010000100 is definitely associated with PIV.

As to your current issue, the doc comments in <CryptoTokenKit/TKSmartCard.h> for the -[TKSmartCardSlotManager createNFCSlotWithMessage:completion:] method says:

Warning Caller requires com.apple.developer.nfc.readersession.iso7816.select-identifiers Info.plist record which specifies application identifiers of the NFC cards link

which suggests that your solution is the right one.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

idopte OP

2d

The thing is com.apple.developer.nfc.readersession.iso7816.select-identifiers Info.plist record is also needed in order to work with smart cards through CoreNFC API, but the specific A000000308000010000100 is not required in this record, whereas it seems to be the case with CryptoTokenKit API.

It seems weird to me that this behavior occurs on every smart card, independently of what it contains, whereas an AID it the Info.plist record should be needed only if corresponds to an application in the smart card. I can ensure this issue happens on a smart card which does not contain any application with the A000000308000010000100 ID.

I understand by reading the Apple documentation (https://support.apple.com/en-gb/guide/deployment/depd0b888248/web), that PIV smart cards have a native support from iOS 16.1. Thus, I believe it is not a coincidence that this AID, which seems to be mandatory for every smart card, is related to PIV. Could it be possible that there is a kind of "system default" CryptoTokenKit supporting PIV cards which could have an influence on the behavior of other apps/CTK extensions ?

My main concern is that as this specific AID is not mentioned in the Apple documentation, there could be other hidden ones which would be mandatory in some cases in order to work with any smart card.

0

Answer 3

DTS Engineer OP

Apple

1d

My main concern is that …

I’m not sure what I can do to alleviate that concern here on the forums. Given that you have a working system but you’re concerned that the documentation is not sufficiently clear to determine whether that’s correct, I think your best option is to file a bug for better documentation.

Please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0