Secure Channel Protocols (SCP02/SCP03)
{# Answer-first lead — frontend-gold-standard §1.1. Expects `lead` (plain text, already resolved by apps.content.leads). Rendered directly under the h1 so the self-contained answer is the first prose a reader, a SERP snippet, or an AI extractor meets. No curated-data gate: the view always supplies either curated content_summary or a computed fallback. #}GlobalPlatform Secure Channel Protocol 02 and 03: key derivation, mutual authentication, and encrypted APDU wrapping. It covers Secure Channel Protocols (SCP02/SCP03), Why a Secure Channel?, SCP02 Architecture, SCP02 Session Establishment, and SCP03 Architecture. The guide is part of the มาตรฐานและโพรโทคอล series and about 3 minutes of reading.
Secure Channel Protocols (SCP02/SCP03)
GlobalPlatform Secure Channel Protocols establish a mutually authenticated, encrypted communication channel between a card management system (off-card entity, OCE) and a card's Security Domain (SD). SCP02 and AES-based secure channel protocol." data-category="Software">SCP03 are the two production-grade variants; understanding their key structures and session establishment is essential for card personalisation and post-issuance application management.
Why a Secure Channel?
Raw APDU traffic can be observed if the card-reader link is intercepted. During personalisation, key injection, or application loading, the commands carry sensitive data (keys, PINs, executable code). SCP provides:
- C-MAC (Command MAC): integrity of every command
- C-ENC (Command Encryption): confidentiality of sensitive command data
- R-MAC / R-ENC (Response MAC/ENC): integrity and optionally encryption of card responses
SCP02 Architecture
SCP02 uses 3DES (Triple DES) with 16-byte static keys. The Issuer Security Domain (ISD) holds three static base keys:
| Key | Usage |
|---|---|
| S-ENC (Static Encryption) | Derives session encryption key |
| S-MAC (Static MAC) | Derives session MAC key |
| DEK (Data Encryption Key) | Encrypts sensitive data (key material) |
Session key derivation (3DES ECB):
S-ENC_session = 3DES_ECB(S-ENC, 0x0182 || Sequence_Counter || 00..00)
S-MAC_session = 3DES_ECB(S-MAC, 0x0101 || Sequence_Counter || 00..00)
R-MAC_session = 3DES_ECB(S-MAC, 0x0102 || Sequence_Counter || 00..00)
SCP02 Session Establishment
# INITIALIZE UPDATE (INS=50)
Command: 80 50 00 00 08 [8-byte host challenge] 00
Response: [28 bytes]
Key Diversification Data (10 bytes)
Key Information (2 bytes)
Sequence Counter (2 bytes)
Card Challenge (6 bytes)
Card Cryptogram (8 bytes)
SW1 SW2: 90 00
# Compute host cryptogram, verify card cryptogram
# EXTERNAL AUTHENTICATE (INS=82)
Command: 84 82 [security_level] 00 10
[8-byte host cryptogram] [8-byte C-MAC over preceding APDUs]
SW1 SW2: 90 00 <- secure channel established
Security levels in P1 of EXTERNAL AUTHENTICATE:
- 00: C-MAC only
- 01: C-MAC + C-ENC
- 03: C-MAC + C-ENC + R-MAC
SCP03 Architecture
SCP03 replaces 3DES with AES-128 (or AES-256) and CMAC for integrity — a significant security improvement. It is mandatory for Java Card 3.0.5+ platforms.
| Feature | SCP02 | SCP03 |
|---|---|---|
| Symmetric cipher | 3DES | AES-128/256 |
| MAC algorithm | CBC-MAC (3DES) | CMAC (AES) |
| Key derivation | ECB with constant derivation data | KDF using AES-CMAC |
| Counter management | 2-byte sequence counter | 3-byte AES-CTR IV |
| Replay protection | Sequence counter | IV-based |
SCP03 session key derivation (AES-CMAC-based KDF, per GPC_SPE_014):
derivation_data = derivation_constant(1B) || 00(1B) || usage(1B) || 00..00(11B) || L(2B) || i(1B)
S-ENC_session = AES-CMAC(S-ENC_static, derivation_data[ENC])
S-MAC_session = AES-CMAC(S-MAC_static, derivation_data[MAC])
S-RMAC_session = AES-CMAC(S-MAC_static, derivation_data[RMAC])
Key Diversification
In a deployment with millions of cards, each card must have unique session keys derived from shared master keys. Key diversification computes:
card_S-ENC = 3DES(master_S-ENC, diversification_data)
Diversification data is typically built from the CPLC (Card Production Life Cycle)
data — IC Serial Number, batch identifier — retrieved via GET DATA (80 CA 9F 7F).
The secure-element architecture ensures that master keys
never leave the HSM.
Sending a Secured APDU
With SCP02 C-MAC active, every command gets an 8-byte MAC appended:
Original: 80 E8 00 00 10 [16 bytes load block data]
Secured: 84 E8 00 00 18 [16 bytes load block data] [8-byte C-MAC]
The recipient SD verifies the C-MAC using the session MAC key before processing
the command. A MAC failure returns SW 69 88 (Incorrect MAC).
For the key injection infrastructure behind diversification, see HSM Integration. For the SCP03 usage in SIM chip." data-category="Application">eSIM profile packaging, see eSIM Remote Provisioning.
(frontend-gold-standard §1.7): the answer text is in
the initial HTML and stays reachable with JavaScript disabled, so crawlers and
AI extractors read answer-shaped chunks without depending on Alpine. #}
Frequently Asked Questions
What protection does a GlobalPlatform secure channel provide?
A secure channel supplies C-MAC for integrity of every command, C-ENC for confidentiality of sensitive command data, and R-MAC with optional R-ENC for integrity and encryption of card responses. This matters because personalisation, key injection, and applet loading carry keys, PINs, and executable code that would otherwise be readable on an intercepted link.
Which static keys does SCP02 use?
The Issuer Security Domain holds three 16-byte static 3DES keys: S-ENC, from which the session encryption key is derived; S-MAC, from which the session MAC and R-MAC keys are derived; and DEK, which encrypts sensitive data such as key material. Session keys derive by 3DES in ECB mode over a constant and the sequence counter.
What does INITIALIZE UPDATE return?
INITIALIZE UPDATE, instruction byte 50, carries an 8-byte host challenge and returns 28 bytes: 10 bytes of key diversification data, 2 bytes of key information, a 2-byte sequence counter, a 6-byte card challenge, and an 8-byte card cryptogram.
Who are the smart card guides written for?
Our guides cover a range of experience levels. Getting Started guides introduce smart card fundamentals. Security guides address Common Criteria certification and key management. Programming guides target developers working with APDU commands, JavaCard applets, and GlobalPlatform card management.
Frequently Asked Questions
What protection does a GlobalPlatform secure channel provide?
A secure channel supplies C-MAC for integrity of every command, C-ENC for confidentiality of sensitive command data, and R-MAC with optional R-ENC for integrity and encryption of card responses. This matters because personalisation, key injection, and applet loading carry keys, PINs, and executable code that would otherwise be readable on an intercepted link.
Which static keys does SCP02 use?
The Issuer Security Domain holds three 16-byte static 3DES keys: S-ENC, from which the session encryption key is derived; S-MAC, from which the session MAC and R-MAC keys are derived; and DEK, which encrypts sensitive data such as key material. Session keys derive by 3DES in ECB mode over a constant and the sequence counter.
What does INITIALIZE UPDATE return?
INITIALIZE UPDATE, instruction byte 50, carries an 8-byte host challenge and returns 28 bytes: 10 bytes of key diversification data, 2 bytes of key information, a 2-byte sequence counter, a 6-byte card challenge, and an 8-byte card cryptogram.
Who are the smart card guides written for?
Our guides cover a range of experience levels. Getting Started guides introduce smart card fundamentals. Security guides address Common Criteria certification and key management. Programming guides target developers working with APDU commands, JavaCard applets, and GlobalPlatform card management.