9F2C Card Qualifier

The Card Qualifier is a 7-byte data object a Kernel 8 card returns to tell the kernel which version and features it supports. It matters because Kernel 8 protects card data with a secure channel, and the Card Qualifier is where the card says which algorithms it can use for it.

Byte by byte

• Byte 1, Version: 01 version 1, 02 version 2. 00 is not allowed; other values are reserved.
• Bytes 2–4, secure channel ASIs: up to three Algorithm Suite Indicators the card supports for the secure channel, in its order of preference, starting at byte 2. Unused bytes are FF.
• Byte 5: b8 support for field off detection; other bits reserved.
• Bytes 6–7: reserved.

Secure channel ASIs

An Algorithm Suite Indicator names a full set of algorithms. Book C-8 defines secure channel ASI 00: blinded Diffie-Hellman key agreement and key derivation on the P-256 curve, AES-CMAC for integrity and AES-CTR for encryption. Values from 80 to FF are for domestic or proprietary use, for example 88 with SM2, SM4-CMAC and SM4-CTR. Version 1.0 of the specification supports ASI 00 only.

The kernel walks the card's list in order and picks the first ASI it also supports. If there is none, the secure channel cannot be set up and the transaction fails.

Example

9F2C 07 01 00 FF FF 80 00 00: version 1; the card supports secure channel ASI 00 only; it supports field off detection.

Common mistakes

• Treating FF in bytes 2–4 as an ASI. It only fills unused positions.
• Ignoring the card's order of preference when choosing the ASI.
• Confusing secure channel ASIs with certificate ASIs, which are a separate list: 01 for RSA and 10 for ECC certificates.