Smart Card Knowledge Base
Tutorials, guides, and references for smart card engineers and embedded security developers.
Whether you are just starting with smart card development or need a deep reference for ISO 7816 and eSIM architecture, these guides cover the foundational protocols that every card engineer should know — from physical layer specifications to application-level security domains.
Protocols & Architecture
Smart Card Tutorial for Beginners
Complete beginner's guide: types, APDU commands, file system, security, and real-world applications. No prior knowledge required.
Read →ISO 7816 Protocol Reference
All 15 parts: physical characteristics, T=0/T=1, APDU protocol, file system, secure messaging.
Read →eSIM & eUICC Architecture
GSMA SGP.22 consumer eSIM, LPA, ISD-R/ISD-P security domains, SM-DP+, profile download, BPP.
Read →FIDO2 & CTAP Protocol
WebAuthn API, CTAP2 commands, authData byte structure, attestation formats, resident keys, hmac-secret.
Read →PC/SC & CCID Reader Programming
WinSCard API, pcsc-lite, CCID USB, ATR parsing, T=0 vs T=1, pyscard, javax.smartcardio.
Read →Once you understand the protocols, the next step is building and deploying applications. These tutorials cover secure channel protocols (SCP02/SCP03), Java Card applet development, and the EMV data object system used in payment cards worldwide.
Smart Card Development
GlobalPlatform SCP02 vs SCP03
Secure channel deep comparison: 3DES vs AES, Retail-MAC vs CMAC, key derivation, migration.
Read →Java Card Applet Tutorial
Build your first smart card app: JCIDE setup, APDU handling, CAP file, GlobalPlatform deployment.
Read →EMV Tag Reference
Full EMV data object list with search: PAN, expiry, AIP, AFL, terminal capabilities, ATC, CVM.
Read →Practical code tutorials for reading and writing smart cards from your preferred programming language. Each guide includes working code samples, troubleshooting tips, and real APDU traces you can reproduce.
Programming Tutorials
Python pyscard — Read Smart Cards
Python tutorial: list readers, connect, send APDUs, parse ATR, handle T=0 GET RESPONSE.
Read →Android NFC NDEF — Read & Write Tags
Read and write NDEF messages on Android: foreground dispatch, Ndef, NdefFormatable, record types.
Read →NFC tags are everywhere — from smart posters to access badges to home automation triggers. These step-by-step guides walk you through the NDEF data format, tag selection, and practical read/write workflows across different platforms.
How-To Guides — NFC & NDEF
How to Parse NDEF Messages
Parse NFC Data Exchange Format: TNF types, record headers (MB/ME/CF/SR/IL), Text/URI/Smart Poster decode, chunked records.
Read →How to Write NDEF to NFC Tags
Encode NDEF records to binary: Text, URI, Smart Poster, WiFi, Bluetooth. Write via Android, iOS, Web NFC, PC/SC.
Read →How to Choose the Right NFC Tag
NTAG 213 vs 215 vs 216, MIFARE Classic vs DESFire, ICODE SLIX. Memory capacity, read range, price by use case.
Read →How to Identify NFC Tag Types
Decode ATQA, SAK, ATS from anti-collision bytes. Identify NTAG, MIFARE Classic, DESFire, FeliCa, ICODE chips.
Read →NFC Smart Home Automation Guide
Automate your home with NFC tags: iPhone Shortcuts, Android Tasker, Home Assistant. Scene triggers, tag placement, NTAG215 vs NTAG216 for home use.
Read →How to Clone an RFID Card
Step-by-step RFID cloning: 125kHz T5577 and 13.56MHz MIFARE, Proxmark3 and ACR1252U workflow, read-dump-write, security considerations.
Read →APDU commands are the language of smart cards. These guides help you construct, send, and debug command-response pairs — from basic SELECT and READ BINARY to extended APDUs and status word interpretation.
How-To Guides — Smart Card Commands
How to Build APDU Commands
Master C-APDU construction: CLA/INS/P1/P2, Lc/Le encoding, case 1-4, extended APDU, command chaining.
Read →How to Debug APDU Responses
Decode SW1 SW2 status words: 9000, 61XX, 6982, 6A82, 6D00. T=0 GET RESPONSE flow, error recovery strategies.
Read →How to Calculate MIFARE Access Bits
C1/C2/C3 encoding, sector trailer bytes 6-9, transport configuration, access condition rules for Key A and Key B.
Read →How to Navigate a Smart Card File System
SELECT, READ BINARY, READ RECORD: navigate MF/DF/EF hierarchy, parse FCI, decode file descriptors. Real APDU traces for EMV, SIM, PIV.
Read →Smart Card Filesystem Internals
ISO 7816-4 MF/DF/EF hierarchy, transparent/linear/cyclic structures, access control, GlobalPlatform ISD/SSD, Java Card file API.
Read →The EMV standard governs chip-based payment transactions globally. These deep-dive guides explain how to decode BER-TLV card data, trace a complete transaction flow, compute cryptograms, and understand CVM lists — essential knowledge for payment terminal developers and security auditors.
How-To Guides — EMV & Payment
How to Decode EMV Card Data
BER-TLV parsing: tag encoding (1-byte/2-byte), length encoding (short/long), AFL record navigation, AIP decoding.
Read →EMV Transaction Flow Explained
Step-by-step chip card payment: application selection, GPO, READ RECORD, CVM, GENERATE AC, online auth, issuer scripts. Complete APDU trace.
Read →How to Compute EMV Cryptograms
ARQC/ARPC/AAC/TC generation: CDOL1 data assembly, session key derivation, 3DES MAC computation, CID/CVR decode.
Read →EMV ARQC & ARPC Cryptograms
How payment card cryptograms work: ARQC generation, ARPC validation, SDA/DDA/CDA, and the online authorization flow.
Read →EMV PIN Block Format Guide
ISO Format 0 (ANSI X9.8), Format 1, Format 3 (DUKPT), IBM 3624: how PINs are encoded, encrypted, and transmitted for online verification.
Read →How to Read EMV CVM Lists
Cardholder Verification Method decode: CVM codes (offline PIN, online PIN, signature, CDCVM), conditions, fallback rules.
Read →How to Visualize Contactless Payment Flow
Full EMV contactless transaction: PPSE→SELECT AID→GPO→READ RECORD→GENERATE AC. Mastercard PayPass, Visa payWave.
Read →Credit Card Validation Guide
How to validate credit card numbers: Luhn algorithm, brand detection (Visa/Mastercard/Amex), BIN/IIN lookup, three-layer validation system with JavaScript and Python code.
Read →EMV Chip Card Technology Guide
What is an EMV chip card: 8-step transaction flow, ARQC cryptogram cryptography, SDA vs DDA vs CDA, contact vs contactless, comparison with magnetic stripe.
Read →How to Read NFC Tag NDEF Data
Read NDEF from NFC tags: NDEF record structure (MB/ME/CF/SR/IL), TNF types, Android Kotlin and Python pyscard code examples, Tag Type 1-5 comparison.
Read →Smart card security rests on cryptographic primitives: key derivation, MAC computation, certificate validation, and attestation verification. These guides explain the math and the implementation — with test vectors and code you can run.
How-To Guides — Cryptography & Security
How to Derive Smart Card Keys
Master Key→Card Key diversification, SCP02/SCP03 session keys, EMV issuer key hierarchy (IMK→MK→SK), 3DES and AES KDF.
Read →How to Verify Smart Card Checksums
CRC-16 (CCITT/XMODEM/ANSI), XOR LRC, 3DES Retail MAC (ISO 9797-1), AES-CMAC (NIST SP 800-38B). MIFARE, EMV, GP MACs.
Read →How to Parse ASN.1 DER
Decode DER tag-length-value: UNIVERSAL/APPLICATION tags, constructed vs primitive, OID parsing, X.509 certificate dissection.
Read →How to Debug FIDO2 Attestation
Parse authData byte-by-byte: RP ID hash, flags, signCount, AAGUID, COSE key. Packed, TPM, Android Key, Apple attestation.
Read →YubiKey PIV for SSH Authentication
Set up YubiKey PIV for SSH: generate keys, configure PIN, export certs, and connect to servers with hardware-backed keys.
Read →X.509 Certificates Explained
PEM vs DER formats, every certificate field decoded (SANs, key usage, basic constraints), SHA-256 fingerprints, OpenSSL and Python parsing, certificate chain validation, and common TLS errors.
Read →Understanding data encoding formats is essential for working with smart cards, certificates, and web tokens. These guides break down how Base64, TOTP/HOTP, AES, and JWT work — from algorithmic internals to common security pitfalls.
Encoding & Data Formats
Base64 Encoding Explained
How Base64 works: 3-byte-to-4-char algorithm, Standard vs URL-safe vs MIME variants, padding rules, and practical use cases from JWTs to PEM certificates.
Read →TOTP & HOTP from Scratch
How 2FA codes really work: HMAC-SHA1, dynamic truncation, time steps, Base32 secrets, clock drift handling, and RFC 4226/6238 test vectors in Python and JavaScript.
Read →AES Encryption Explained
Block cipher internals, key sizes (128/192/256), ECB vs CBC vs CTR vs GCM mode comparison, PKCS7 padding, IV and nonce requirements, authenticated encryption.
Read →JWT Anatomy and Security
JSON Web Token structure (header.payload.signature), HS256 vs RS256 vs ES256, alg:none attack, algorithm confusion, token storage, refresh tokens.
Read →Related Tools
Hands-on browser tools for smart card engineering: NDEF Parser, FIDO2 Parser, APDU Builder, EMV TLV Parser, NFC Capacity Calculator, APDU Reference.