ACR83 PINeasy Reference Manual V1.05 Subject to change without prior notice info@acs.com.hk www.acs.com.
Table of Contents 1.0. Introduction ............................................................................................................... 4 1.1. 1.2. Reference Documents ........................................................................................................... 4 Symbols and Abbreviations ...................................................................................................4 2.0. Features ............................................................................
List of Figures Figure 1 : PIN Verification and Modification Operation Flowchart ....................................................... 13 Page 3 of 49 ACR83 – Reference Manual Version 1.05 info@acs.com.hk www.acs.com.
1.0. Introduction The ACR83, a cost-effective PC-linked PINpad Reader, serves as an interface for the communication between a computer (for example, a PC) and a smart card. Different types of smart cards have different commands and communication protocols, and the ACR83 PINeasy establishes a uniform interface from the computer to the smart card for a wide variety of cards. The ACR83 is connected to the computer through a USB interface and uses the CCID interface to communicate with the USB port.
2.0. Features • 14-key keypad • 2 rows x 16 characters dot matrix LCD, each character has 5x8 dots • Supports ISO 7816 Microprocessor Smart Cards with the following features: o Class A, B, C (5 V, 3 V and 1.8 V respectively) o T=0 and/or T=1 protocol • Supports Secure PIN Entry (SPE) • EMV Level 1 Certified • Full-speed USB Interface (12 Mbps) • Compliant to the following standards: o PC/SC o WHQL o CCID o CE/FCC o RoHS Page 5 of 49 ACR83 – Reference Manual Version 1.05 info@acs.
3.0. Supported Card Types The ACR83 supports MCU cards with either T=0 or T=1 protocol. The card ATR indicates the specific operation mode (TA2 present; bit b5 of TA2 must be 0) and when that the particular mode is not supported by the ACR83 PINeasy, the reader will reset the card to a negotiable mode. If the card cannot be set to negotiable mode, the reader will then reject the card.
4.0. Smart Card Interface ACR83 PINeasy Smart Card Reader has a 14-key keypad and LCD display consisting of 2 rows with 16 characters dot matrix. 4.1. Smart Card Power Supply VCC (C1) The current consumption of the inserted card must not be higher than 100 mA. 4.2. Programming Voltage VPP C6 According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the smart card.
5.0. Power Supply The ACR83 (CCID) requires a voltage of 5 V DC, 100 mA regulated power supply. The ACR83 (CCID) gets the power from PC through the cable supplied along with each type of reader. Page 8 of 49 ACR83 – Reference Manual Version 1.05 info@acs.com.hk www.acs.com.
6.0. USB Interface The ACR83 (CCID) is connected to a computer through a USB port following the USB standard. 6.1. Communication Parameters The ACR83 (CCID) is connected to a computer through USB as specified in the USB Specification 1.1. The ACR83 (CCID) is working in full-speed mode, i.e. 12 Mbps.
7.0. Communication Protocol ACR83 (CCID) shall interface with the host with USB connection. A specification, namely CCID, has been released within the industry defining such a protocol for the USB chip-card interface devices. CCID covers all the protocols required for operating smart cards and PIN. The configurations and usage of USB endpoints on ACR83 (CCID) shall follow CCID Section 3. An overview is summarized below: • Control Commands are sent on control pipe (default pipe).
Offset Field Size Value Description 36 dwMechanical 4 00000000h ACR83 (CCID) does not support special mechanical characteristics ACR83 (CCID) supports the following features: 40 dwFeatures 4 00010030h • Automatic ICC clock frequency change according to parameters • Automatic baud rate change according to frequency and FI,DI parameters • TPDU level exchange with ACR83 (CCID) Maximum message length accepted by ACR83 (CCID) is 271 bytes 44 dwMaxCCIDMessageLength 4 0000010Fh 48 bClassG
8.0. PC/SC SCardControl Application Programming Interface 1. IOCTL_SMARTCARD_GET_FIRMWARE_VERSION 2. IOCTL_SMARTCARD_DISPLAY_LCD_MESSAGE 3. IOCTL_SMARTCARD_READ_KEY 4. CM_IOCTL_GET_FEATURE_REQUEST (PC/SC 2.0 Part 10) 5. FEATURE_VERIFY_PIN_DIRECT 6. FEATURE_MODIFY_PIN_DIRECT 7. FEATURE_IFD_PIN_DROP Page 12 of 49 ACR83 – Reference Manual Version 1.05 info@acs.com.hk www.acs.com.
9.0. Operation Flow for PIN Verification and Modification (PC/SC 2.0 Part 10) ACR83 reader supports PC/SC 2.0 Part 10. The flowchart below shows the PIN verification and modification operation.
10.0. CCID SPE Data Structure The ACR83 SPE is based on the CCID SPE which is fully compatible to CCOD SPE. If the application program uses the CCID SPE, it must use the CCID PC_to_RDR_Secure to send the APDU. According to CCID specification, the SPE has two modes: 1. PIN Verification 2. PIN Modification The Modes setting is based on CCID abPINOperationDataStructure (Please refer to CCID specification 6.1.11.1).
11.0. PIN Verification Data Structure For PIN Verification, we need to understand the PIN Verification Data Structure.
bMsgIndex: 00h: LCD will display “Enter PIN:” Any other values will raise an error. If the data structure format error, the ACR83 will give “6B 80h.” For the system unit is bit (bmFormatString bit 7=0). The APDU formatting is total different with system unit is byte (bmFormatString bit 7=1). 11.1. Error Checking (Bit) Verification system unit is bit.
11.3. Verification Example 1 System unit is bit.
• Point 2: SpePINPos (7 bits) >= SpePinLenPos (2 bits) + SpePINSize (4 bits) • Point 3: SpePINLen (9h) – SpePinPos (7 bits)[act as 1 byte] >=[SpePinMax (0Ah) * 4bits (BCD)] = 5 bytes : 8 bytes >=5 bytes • Point 4: SpePinMax (0Ah) > SpePinMin (01h) • Point 5: SpePinMax (0Ah)< =10h • Point 6: SpePinMin (01h) >= 01h Command Header SpePINLen APDU Command Header APDU Length 00 20 00 01 09 Offset 2bits SpePINSize (4 bits) Not used field/may not exist PIN 00 20 00 01 09 01 Input 9 digits
11.4. Verification Example 2 System unit is bit. abPINApdu = 00 20 00 01 08 57 A5 30 30 30 30 30 30h After Lc (08h), the first 11 bits (01010111 101) is control character.
PIN (bits) Input PIN 0 0010 0100 0110 1000 101 0 0010 0100 0110 1000 1010 0011 0000 0011 0000 0011 0000 0011 0000 Result PIN Result APDU in bit format Result APDU in byte format 0101 0101 0110 0010 0100 0110 1000 1010 0011 0000 0011 0000 0011 0000 0011 0000 55 62 46 8A 30 30 30 30 The whole APDU in byte format will be: 00 20 00 01 08 55 62 46 8A 30 30 30 30h If arrangement is Right: bmFormatString change to=5Dh 00 20 00 01 08 55 65 30 30 30 31 23 45h 11.5.
bmPINBlockString=48h SpePINSize=4 bits SpePINLen=8 bytes bmPINLengthFormat=04h SpePINLenPos=4 bits wPINMaxExtraDigit=010ah SpePinMax=0ah SpePinMin=01h PIN Input = 1 2 3 4 5 6 7 8 0 • Point 1: SpePINLen (9) equal to SpePINLen (8) + SpePinPos (1) • Point 2: SpePINPos (1 Byte) >= SpePinLenPos (4 bits) + SpePINSize (4 bits) • Point 3: SpePINLen (9) – SpePinPos (1 Byte) >=[SpePinMax (0Ah) * 4bits(BCD)] = 5 Bytes : 8 Bytes >=5 Bytes • Point 4: SpePinMax (0Ah) > SpePinMin (01h) • Point 5: SpePinMax (0Ah)
The whole APDU in byte format will be: 00 20 00 01 09 59 12 34 56 78 00 30 30 30h If arrangement is Right: bmFormatString change to=8Dh 00 20 00 01 08 59 30 30 30 31 23 45 67 80h Page 22 of 49 ACR83 – Reference Manual Version 1.05 info@acs.com.hk www.acs.com.
12.0. PIN Modification Data Structure For PIN Modification, we need to understand the PIN Modification Data Structure.
bConfirmPIN: Bit 0: 0=no confirmation of New PIN request 1: Confirmation of New PIN request Bit 1: 0=no Old (current) PIN entry request 2: Old (current) PIN entry request 00h: bNumberMessage must be equal to 00h or 01h 01h: bNumberMessage must be equal to 02h 02h: bNumberMessage must be equal to 02h 03h: bNumberMessage must be equal to 03h Otherwise, it will raise an error.
• SpePINPos must be equal or larger than SpePINLenPos + SpePINSize • SpePINLen – SpePINPos must be larger or equal to SpePinMax(if BCD, need multiple 4) • SpePinMax must be equal or larger than SpePinMin • SpePinMax cannot be larger than 16 digits because LCD one row only have 16 digits • SpePinMin must be equal or larger than 1 12.3. Modification (Byte) bConfirmPIN Bit1=0 Modification bConfirmPIN Bit1 = 0 (No current/Old PIN entry requested) System unit is byte.
SpeOffsetNew SpePINLen Maybe not Offset SpePINPos Offset SpePINLenPos Exist SpePINSize New PIN Not used field New PIN 12.6.
• SpePINLen – SpePINPos must be larger or equal to SpePinMax(if BCD, need multiple 4) • SpePinMax must be equal or larger than SpePinMin • SpePinMax cannot be larger than 16 digits because LCD one row only have 16 digits • SpePinMin must be equal or larger than 1 12.9. Modification Example 1 Modification bConfirmPIN Bit1 = 0 (No current/Old PIN entry requested) System unit is bit.
wPINMaxExtraDigit=010Ah SpePinMax=0Ah SpePinMin=0Ah bInsertionOffsetNew(SpeOffsetNew)=01h SpeOffsetNew =1 byte bNumberMessage=01h Show “Enter New PIN:” If bNumberMessage=00h No message will be shown, but user needs to input the PIN.
PIN (bits) Original Input New PIN Result PIN Result APDU in bit format Result APDU in byte format 1 0011 0000 0011 0000 0011 0000 0011 0000 0011 0000 0011 0000 0011 0000 1100 0000 0 0010 0100 0110 1000 1010 1100 1111 0000 000 0 0010 0100 0110 1000 1010 1100 1111 0000 0001 0000 0011 0000 0011 0000 1100 0000 0110 0110 0010 0100 0110 1000 1010 1100 1111 0000 0001 0000 0011 0000 0011 0000 0011 0000 66 24 68 ac f0 10 30 30 30 The whole APDU in byte format will be: 00 24 00 01 0A 20 66 24 68 ac f0 10 30
wPINMaxExtraDigit=010Ah SpePinMax=0Ah SpePinMin=01h bInsertionOffsetNew (SpeOffsetNew)=01h SpeOffsetNew =1 byte bNumberMessage=02h Show “Enter New PIN:” and Show “Enter Confirm PIN” New PIN Input = 1 2 3 4 5 6 7 8 0 • Point 1: Lc (0Ah) equal to SpePINLen (09) + SpeOffsetNew (01h) • Point 2: SpePINPos (7 bits) >= SpePinLenPos (2 bits) + SpePINSize (4 bits) • Point 3: SpePINLen (9) – SpePinPos (7 bits) [act as 1 byte] >= [SpePinMax (0Ah) * 4bits(BCD)] = 5 bytes : 8 bytes >=5 bytes • Point 4: SpePinMax
PIN (bits) 1 0011 0000 0011 0000 0011 0000 0011 0000 0011 0000 0011 0000 0011 0000 1100 0000 Original Input New PIN 0 0010 0100 0110 1000 1010 1100 1111 0000 000 0 0010 0100 0110 1000 1010 1100 1111 0000 0001 0000 0011 0000 0011 0000 1100 0000 Result PIN Result APDU in bit format 0110 0110 0010 0100 0110 1000 1010 1100 1111 0000 0001 0000 0011 0000 0011 0000 0011 0000 Result APDU in byte format 66 24 68 AC F0 10 30 30 30 The whole APDU in byte format will be: 00 24 00 01 0A 20 66 24 68 ac f0
abPINApdu = 00 24 00 01 09 57 30 30 30 30 30 30 30 30h After Lc (09h), the first 1 byte 57h is control character bConfirmPIN = 01h (If bConfirmPIN=01h, bNumberMessage must equal to 02h) Enter the New Pin and confirm the New Pin bmFormatString=89h SpePinPos=1 byte because bmFormatString bit 7 = 1 SpeLeftRight=Left SpePINTyp=BCD bmPINBlockString=48h SpePINSize=4 bits SpePINLen=8 bytes bmPINLengthFormat=04h SpePINLenPos=4 bits wPINMaxExtraDigit=010Ah SpePinMax=0Ah SpePinMin=01h bInsertionOffsetNew (SpeOffsetNe
Command Header SpePINPos SpePINLen Offset SpePINPos 1 Byte PIN APDU Command Header Lc 00 24 00 01 09 Offset (4 bits) SpePINSize (4bits) Not used field PIN 00 24 00 01 09 57h Input 9 digits Does not exist PIN 00 24 00 01 09 0101=01010111 1001(bits) Does not exist PIN 00 24 00 01 09 - PIN 01011001 (59h) (1001 replace original 01010111) How about the PIN management? Because it is Left and BCD arrangement PIN (Byte) Original 00 24 00 01 09 57 30 30 30 30 30 30 30 30h Input 12 34
Check points in implementing the PIN Modification Data Structure: • SpePINLen + SpeOffsetNew must be equal to Lc • SpeOffsetNew > = SpeOffsetOld + SpePINLen • SpePINPos must be equal or larger than SpePINLenPos + SpePINSize • SpePINLen – SpePINPos must be larger or equal to SpePinMax (if BCD, need multiple 4) • SpePinMax must be equal or larger than SpePinMin • SpePinMax cannot be larger than 16 digits because LCD one row only have 16 digits • SpePinMin must be equal or larger than 1 abPINApdu
Show “Enter PIN:” means enter the old/current PIN and Show “Enter New PIN” • Point 1: Lc (12h) equal to SpeOffsetNew (0Ah) + SpePINLen (8) • Point 2: SpeOffsetNew (0Ah) >= SpeOffsetOld (1) + SpePINLen (8) • Point 3: SpePINPos (8 bits) >= SpePinLenPos (4 bits) + SpePINSize (4 bits) • Point 4: SpePINLen (8) – SpePinPos (4 bits) >=[SpePinMax (0Ah) * 4bits(BCD)] = 5 bytes : 7.
And then, handle the New PIN. New PIN (Byte) 00 24 00 01 12 08 06 12 34 56 30 30 30 30 09 03 30 30 30 30 30 30 30h Original Input 12 34 56 78 90h Result PIN 00 24 00 01 12 08 06 12 34 56 30 30 30 30 09 0A 12 34 56 78 90 30 30h The whole APDU after the format will be: 00 24 00 01 12 08 06 12 34 56 30 30 30 30 09 0A 12 34 56 78 90 30 30h 12.13. Modification Example 5 BConfirmPIN Bit1 = 1 (Current/Old PIN entry requested) System unit is byte.
bmFormatString=91h SpePinPos=2 bytes because bmFormatString bit 7 = 1 SpeLeftRight=Left SpePINTyp=BCD bmPINBlockString=46h SpePINSize=4 bits SpePINLen=6 bytes bmPINLengthFormat=11h SpePINLenPos=1 byte wPINMaxExtraDigit=010Ah SpePinMax=0Ah SpePinMin=01h bInsertionOffsetNew (SpeOffsetNew)=0Ah SpeOffsetNew =0Ah byte bInsertionOffsetOld (SpeOffsetOld)=01h SpeOffsetOld =00h byte PIN Input(Old/Current Pin) = 1 2 3 4 5 6 PIN Input(New Pin) = 1 2 3 4 5 6 7 8 9 0 bNumberMessage=03h or FFh Show “Enter PIN:” means ent
Command Header OffsetOld SpePINLen APDU Header APDU Lc OffsetOld 00 24 00 01 12 Offset Offset (1 Byte) SpePINSize (4 bits) Not used field Old PIN 00 24 00 01 12 1 byte 0A Input 6 digits 0110 Old PIN 00 24 00 01 12 2F 0A 0110 (bits) 0110 Old PIN 00 24 00 01 12 2F 0A 66 replace A6 0110 Old PIN Offset SpePINPos = 2 bytes OffsetNew Old PIN SpePINLen Offset SpePINPos 8 bits = 1 byte OffsetNew New PIN Offset Offset (1 Byte) SpePINSize (4 bits) Not used field New PIN 0A
Appendix A. bmFormatString Description Bit Number Bit 7 Bit 6 – 3 Description The system units’ type indicator: If 0h: the system units are bits If 1h: the system units are bytes This bit quantifies the next parameter (unit moving). Define the PIN position after format in the APDU command (relative to the first data after Lc). The position is based on the system units’ type indicator (maximum 1111 for 15 system units).
Appendix B. bmPINBlockString Description Bit Number Description Bit 7 - 4 Size in bits of the PIN length inserted in the APDU command. (If 0h, then the effective pin length is not inserted in the APDU command) Bit 3 - 0 PIN length information: PIN block size in bytes after justification and formatting Page 40 of 49 ACR83 – Reference Manual Version 1.05 info@acs.com.hk www.acs.com.
Appendix C. bmPINLengthFormat Bit Number Bit 7-5 Bit 4 Bit 3 - 0 Description RFU The system units’ type indicator: If 0h: the system units are bits If 1h: the system units are bytes Indicates the PIN length position in the APDU command according to the previous parameters (maximum 1111 for 15 system units) Page 41 of 49 ACR83 – Reference Manual Version 1.05 info@acs.com.hk www.acs.com.
Appendix D. Sample Code (PC/SC 2.0 Part 10) #include #include #include #include #define #define #define #define #define #define #define #define #define #define #define
BYTE abData[1]; } PIN_MODIFY_STRUCTURE, *PPIN_MODIFY_STRUCTURE; typedef struct _PIN_PROPERTIES_STRUCTURE { USHORT wLcdLayout; BYTE bEntryValidationCondition; BYTE bTimeOut2; } PIN_PROPERTIES_STRUCTURE, *PPIN_PROPERTIES_STRUCTURE; typedef struct _READ_KEY_OPTION { BYTE bTimeOut; WORD wPINMaxExtraDigit; BYTE bKeyReturnCondition; BYTE bEchoLCDStartPosition; BYTE bEchoLCDMode; } READ_KEY_OPTION; #pragma pack(pop) int main(int argc, char *argv[]) { SCARDCONTEXT hSCardContext; LONG lReturn; lReturn = SCardEstabli
} exit(1); i = 0; pReader = pmszReaders; while (*pReader != '\0') { readerName[i] = new char[strlen(pReader) + 1]; if (readerName[i] == NULL) { printf("Error: not enough memory\n"); exit(1); } strcpy(readerName[i], pReader); i++; } } // Advance to the next value pReader = pReader + strlen(pReader) + 1; // Free the memory SCardFreeMemory(hSCardContext, pmszReaders); if (numReaders == 0) { printf("Error: cannot find reader in the system\n"); return 1; } SCARDHANDLE hCard; DWORD dwAP; const int BUFFER_S
if (lReturn != SCARD_S_SUCCESS) printf("Error: SCardControl failed lReturn); else { printf("Response: "); for (i = 0; i < dwRecvBufferLen; i++) printf("%02X ", bRecvBuffer[i]); printf("\n"); with error 0x%08x\n", memset(featureControlCodes, 0, sizeof(featureControlCodes)); i = 0; while (i < dwRecvBufferLen) { // Get the feature if ((bRecvBuffer[i] >= FEATURE_VERIFY_PIN_START) (bRecvBuffer[i] <= FEATURE_ABORT)) { // Get the TLV if (i + 1 + 4 < dwRecvBufferLen) { // Get the length field if (bRecvBuffer[i
} printf("Error: not enough memory\n"); exit(1); // Initialize PIN verify structure (ACOS3) pPinVerify->bTimeOut = 0; pPinVerify->bTimeOut2 = 0; pPinVerify->bmFormatString = 0; pPinVerify->bmPINBlockString = 0x08; pPinVerify->bmPINLengthFormat = 0; pPinVerify->wPINMaxExtraDigit = 0x0408; pPinVerify->bEntryValidationCondition = 0x03; pPinVerify->bNumberMessage = 0x01; pPinVerify->wLangId = 0x0409; pPinVerify->bMsgIndex = 0; pPinVerify->bTeoPrologue[0] = 0; pPinVerify->bTeoPrologue[1] = 0; pPinVerify->bTeoP
pPinModify->bmPINLengthFormat = 0; pPinModify->bInsertionOffsetOld = 0; pPinModify->bInsertionOffsetNew = 0; pPinModify->wPINMaxExtraDigit = 0x0408; pPinModify->bConfirmPIN = 0x01; pPinModify->bEntryValidationCondition = 0x03; pPinModify->bNumberMessage = 0x02; pPinModify->wLangId = 0x0409; pPinModify->bMsgIndex1 = 0; pPinModify->bMsgIndex2 = 1; pPinModify->bMsgIndex3 = 0; pPinModify->bTeoPrologue[0] = 0; pPinModify->bTeoPrologue[1] = 0; pPinModify->bTeoPrologue[2] = 0; pPinModify->ulDataLength = dwSendBuff
// Display LCD message to ACR83 char *msg = "Hello"; printf("Displaying message (%s) to LCD...
printf("Key Return Condition: 0x%02x, Key String: %s\n", keyReturnCondition, keyString); } } else printf("Error: cannot read key\n"); lReturn = SCardDisconnect(hCard, SCARD_LEAVE_CARD); if (lReturn != SCARD_S_SUCCESS) printf("Error: SCardDisconnect failed with error lReturn); } lReturn = SCardReleaseContext(hSCardContext); if (lReturn != SCARD_S_SUCCESS) printf("Error: SCardReleaseContext failed lReturn); with error 0x%08x\n", 0x%08x\n", // Deallocate reader name for (i = 0; i < numReaders; i++) del
