1. Manuals
  2. Brands
  3. Advanced Card Systems Ltd. Manuals
  4. Card Reader
  5. ACR3901T-W1
  6. Reference manual

Advanced Card Systems Ltd. ACR3901T-W1 Reference Manual

Acs secure bluetooth contact card reader
Hide thumbs
Table of Contents

Advertisement

Quick Links

Download this manual
ACR3901T-W1
ACS Secure Bluetooth
®
Contact Card Reader
Reference Manual V1.02
Subject to change without prior notice
info@acs.com.hk
www.acs.com.hk

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the ACR3901T-W1 and is the answer not in the manual?

Questions and answers

Related Manuals for Advanced Card Systems Ltd. ACR3901T-W1

Summary of Contents for Advanced Card Systems Ltd. ACR3901T-W1

  • Page 1 ACR3901T-W1 ACS Secure Bluetooth ® Contact Card Reader Reference Manual V1.02 Subject to change without prior notice info@acs.com.hk www.acs.com.hk...
  • Page 2 Updated Section 7.1.1 Get Serial Number Command ● Removed Section 10.0: Other Commands Access via PC_to_RDR_XfrBlock ● Removed Appendix A. Supported Card Types ● Updated Appendix A. Error Codes ● Updated Product Marketing Name Page 2 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 3: Table Of Contents

    Get Card Reset Simulation Option ................56 7.1.11. Set Card Response Time Interval ................57 7.1.12. Get Card Response Time Interval ................58 7.1.13. Check Button Status ....................59 Page 3 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 4 Table 3 : USB Interface Wiring ......................10 Table 4 : LED Status ..........................11 Table 5 : ACR3901T-W1 Service Handles and UUID Information List ..........15 Table 6 : Bluetooth Frame Format ......................17 Table 7 : Encrypted Frame Format after Mutual Authentication ............17 Table 8 : Command Code Summary ....................

  • Page 5: Introduction

    1.0. Introduction The ACR3901T-W1 ACS Secure Bluetooth® SIM-sized Contact Card Reader acts as an interface for the communication between a smart card and a computer/mobile device. The direct communication, in most cases, is prevented by various types of smart cards that have commands and communication protocols different from each other.

  • Page 6: Features

    Compliant with the following standards: EN 60950/IEC 60950 ISO 7816 Bluetooth PC/SC CCID RoHS 2 REACH Microsoft® WHQL Applicable under PC-linked mode Uses an ACS-defined Android Library Uses an ACS-defined iOS Library Page 6 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 7: Smart Card Support

    3.1. MCU Cards ACR3901T-W1 is a PC/SC-compliant smart card reader that supports ISO 7816 Class A, B, and C (5 V, 3 V, and 1.8 V) smart cards. It also works with MCU cards following either the T=0 and T=1 protocol.

  • Page 8: System Block Diagram

    SAM card Battery Charge Management IC Rechargeable Li- ion Battery Buttons Bluetooth Module Bluetooth External devices, External device, e.g computer or e.g. computer mobile phone Figure 1: ACR3901T-W1 Architecture Page 8 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 9: Hardware Design

    The ACR3901T-W1 is using a rechargeable Lithium-ion battery which has a capacity of 70 mAh. 5.1.1. Battery charging Once the battery of ACR3901T-W1 runs out, it may be charged in any of the following modes: OFF, USB, and Bluetooth; as long as it is connected to a power outlet. 5.1.2.

  • Page 10: Usb Interface

    5.3. USB Interface The micro-USB port is used to connect the ACR3901T-W1 to the computer as battery charging port. This port is also used in order for the ACR3901T-W1 to operate in PC-linked mode. 5.3.1. Communication Parameters ACR3901T-W1 is connected to a computer through USB as specified in the USB Specification 2.0.

  • Page 11: User Interface

    Blue). 5.4.1. Buttons ACR3901T-W1 has three modes: USB, Off, and Bluetooth. User can perform one mode at a time as a data transmission interface. • Button (Front) - Power On, Power Off or Wake Up the reader; Simulate SAM card removal event.

  • Page 12: Smart Card Interface

    The ACR3901T-W1 provides a mechanism to protect the inserted card when it is suddenly withdrawn while it is powered up. The power supply to the card and the signal lines between the ACR3901T-W1 and the card is immediately deactivated while the card is being removed. However, as a rule, to avoid any electrical damage, a card should only be removed from the reader while it is powered down.

  • Page 13: Software Design

    The program flow of a Bluetooth connection is shown below: Bluetooth Start (Reset/Power up) Successful Connection? Enable Service Authentication Successful Authentication? Smart Card Operation with Security Channel Disconnect? Reset Power Off Figure 2: Bluetooth Connection Flow Page 13 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 14: Profile Selection

    6.1.2. Profile Selection The ACR3901T-W1 is a smart card reader that is designed to use Bluetooth technology as an interface to transmit data. A customized service called Commands Communication with three pipes is used: one pipe is used for command request, the second pipe is for command response, and the third pipe is used to notify the paired device about the card and sleep mode status.

  • Page 15: Table 5: Acr3901T-W1 Service Handles And Uuid Information List

    Send (Reader → Paired device) 8002 Receive 8003 (Paired device →Reader) CardStatus 8004 BatteryLevel 2A19 Manufacturer 2A29 FW_Version 2A26 ModelNumber 2A24 SerialNumber 2A25 Table 5: ACR3901T-W1 Service Handles and UUID Information List Page 15 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 16: Authentication

    6.1.3. Authentication Before any sensitive data can be loaded into the ACR3901T-W1, the data processing server must be authenticated by the ACR3901T-W1 for the privilege to modify the secured data inside reader. In the ACR3901T-W1, a mutual authentication method is being used.

  • Page 17: Frame Format

    16*N bytes (N>0) Checksum XOR {Identifiers, Length, Payload} XOR {Header, Len, Encrypted(Identifiers, Length, Payload, Check byte Checksum)} Table 7: Encrypted Frame Format after Mutual Authentication Page 17 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 18: Bluetooth Communication Protocol

    6.1.5. Bluetooth Communication Protocol The ACR3901T-W1 communicates to the paired device using the Bluetooth interface with a predefined protocol. The protocol is similar to the formats of the CCID Command Pipe and Response Pipe. Command Mode supported Sender Description Paired...
  • Page 19 14 00 3B BE 11 00 00 41 01 38 00 00 00 00 12 34 56 78 01 90 00 73 ATR = 3B BE 11 00 00 41 01 38 00 00 00 00 12 34 56 78 01 Page 19 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 20 Error Code. Refer to Appendix A CSUM means the XOR values of all CSUM (wChecksum) bytes in the command Example: Request = 01 00 62 Response = 01 00 12 Page 20 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 21 Error Code. Refer to Appendix A CSUM means the XOR values of all CSUM (wChecksum) bytes in the command Example: Request = 01 00 64 Response = 02 00 03 15 Page 21 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 22 Example: Request = 06 00 80 84 00 00 08 65 Response = 0B 00 C1 7A 3B AA D6 5A FA CE 90 00 18 Page 22 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 23 APDU is expected in the next Response. APDU Command APDU CMD (Maximum length is 261) CSUM means the XOR values of all CSUM (wChecksum) bytes in the Data Page 23 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 24 02 = Card present but inactive 03 = Card present and active WTXM Waiting Time extension Multiplier CSUM means the XOR values of all CSUM (wChecksum) bytes in the command Page 24 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 25 Response = 17 02 01 ( 256 bytes data ) checksum 3. Command = 67 02 00 checksum Response = 17 5C 00 ( 88 bytes data ) 90 00 checksum Page 25 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 26 Number of extra bytes starting from the next field for this LEN1 LEN2 (wLength) 0200h message. It is expressed in two bytes long. LEN1 is LSB while LEN2 is MSB. Page 26 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 27 Offset Field Size Value Description Error Code (bErrorCode) Error Code. Refer to Appendix A CSUM means the XOR values of CSUM (wChecksum) all bytes in the command Page 27 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 28 00h = Structure for protocol T=0 abData2 01h = Structure for protocol T=1 ProtocolDataStructure Protocol Data Structure CSUM means the XOR values of CSUM (wChecksum) all bytes in the command Page 28 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 29 Extra Guardtime (0 to 254 etu between BGuardTimeT1 two characters). If value is FFh, then guardtime is reduced by 1 etu. B7-4 = BWI values 0-9 valid BwaitingIntegerT1 B3-0 = CWI values 0-Fh valid Page 29 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 30 11 00 00 0A 00 0A Example: (T1 protocol) Request = 09 00 96 10 00 45 00 FE 00 54 Response = 09 00 96 10 00 45 00 FE 00 23 Page 30 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 31: Mutual Authentication And Encryption Protocol

    Table 10: Summary of Mutual Authentication Commands 6.1.6.1. SPH_to_RDR_ReqAuth This command will request the ACR3901T-W1 to perform authentication with the paired key- generating device. After a successful authentication, the Customer Master Key can be modified by the paired key-generating device.
  • Page 32 All the 16-byte data must be abRndNum encrypted with the Customer Master Key currently stored in ACR3901T-W1. CSUM means the XOR values wChecksum of all bytes in the command Page 32 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 33 Customer Master Key and pads it to the end of the 16-byte of random numbers. The overall 32-byte random numbers will be decrypted using the Customer Master Key and return it to the ACR3901T-W1 using this command in order to have a successful authentication.
  • Page 34 All the 16-byte data must be encrypted with the Customer Master Key that is currently stored in ACR3901T-W1. CSUM means the XOR values wCheckSum of all bytes in the command Page 34 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 35 6.1.6.5. SPH_to_RDR_DataReq This command is sent from the paired device to the ACR3901T-W1 after the mutual authentication process. In Bluetooth mode, the communication protocol from Card Power On to Card Set Parameters will be encrypted and transmitted after a successful mutual authentication.
  • Page 36 Each 16 bytes of data will be encrypted with the Session Key abEncryptedData N*16 using AES128 CBC cipher mode CSUM means the XOR values 3 + N*16 wChecksum of all bytes in the command Page 36 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 37: Usb Communication Protocol

    CCID, has been released within the industry defining such a protocol for the USB chip-card interface devices. CCID covers all the protocols required for operating smart cards. The configurations and usage of USB endpoints on ACR3901T-W1 shall follow CCID Rev 1.0 Section An overview is summarized below: 1.
  • Page 38 Automatic baud rate change according to frequency and FI,DI parameters • Short and Extended APDU level exchange Maximum message length accepted by dwMaxCCIDMessageLength ACR3901T-W1 is 271 bytes bClassGetResponse Default value is 00h bClassEnvelope Default value is 00h wLCDLayout No LCD...

  • Page 39: Ccid Bulk-Out Messages

    Size of extra bytes of this message Identifies the slot number for this bSlot command bSeq Sequence number for command abRFU Reserved for future use The response to this message is the RDR_to_PC_SlotStatus message. Page 39 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 40 Size of extra bytes of this message Identifies the slot number for this BSlot command BSeq Sequence number for command AbRFU Reserved for future use The response to this message is the RDR_to_PC_Parameters message. Page 40 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 41 B7-4 – FI – Index into the table 7 in ISO/IEC 7816-3:1997 selecting a clock rate conversion factor. bmFindexDindex B3-0 – DI – Index into the table 8 in ISO/IEC 7816-3:1997 selecting a baud rate conversion factor. Page 41 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 42 03h = Stop with Clock either High or Low bIFSC Size of negotiated IFSC bNadValue Only support NAD = 00h The response to this message is the RDR_to_PC_Parameters message. Page 42 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 43 Sequence number for command. abRFU Reserved for Future Use. Byte abData Data block sent to the CCID. array The response to this message is the RDR_to_PC_Escape message. Page 43 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 44: Ccid Bulk-In Messages

    6.2.2. CCID Bulk-IN Messages 6.2.2.1. RDR_to_PC_DataBlock This message is sent by ACR3901T-W1 in response to PC_to_RDR_IccPowerOn, and PC_to_RDR_XfrBlock messages. Offset Field Size Value Description Indicates that a data block is being sent bMessageType from the CCID dwLength Size of extra bytes of this message...
  • Page 45 80h = Structure for 2-wire protocol 81h = Structure for 3-wire protocol 82h = Structure for I2C protocol Byte Protocol Data Structure as summarized abProtocolDataStructure array in CCID Rev 1.0 Section 5.2.3 Page 45 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 46 6.2.2.4. RDR_to_PC_Escape This message is sent by ACR3901T-W1 in response to PC_to_RDR_Escape message. Offset Field Size Value Description bMessageType dwLength Size of extra bytes of this message bSlot Same value as in Bulk-OUT message bSeq Same value as in Bulk-OUT message...

  • Page 47: Host Programming Api

    Request = 02 00 Response = 82 0A FF FF FF FF FF FF FF FF FF FF Serial Number = FF FF FF FF FF FF FF FF FF FF Page 47 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 48: Get Random Number Command

    16 bytes of Random Number Example: Request = 03 00 Response = 83 10 F2 8F B7 EF BA 43 C4 6B 85 D8 51 7B 84 08 C3 25 Page 48 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 49: Get Firmware Version Command

    Response = 84 08 56 36 2E 30 30 2E 30 30 Firmware Version (HEX) = 56 36 2E 30 30 2E 30 30 Firmware Version (ASCII) = “V6.00.00” Page 49 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 50: Rewrite Master Key Command

    Master Key Len (CommandLength) Number of extra bytes of data abData2 00h = Success Data 01h = Fail Example: Refer to Customer Master Key Reset Request for more details. Page 50 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 51: Sleep Mode Option

    Len (CommandLength) Number of extra bytes of data abData2 00h = Success Data 01h = Fail Example: Request to set 90s = 0D 01 Response = 8D 01 00 Page 51 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 52: Get Device Address

    6 bytes of Bluetooth address Example: Request = 0E 00 Response = 8E 06 AA BB CC DD EE FF Device address: AA BB CC DD EE FF Page 52 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 53: Set Tx Power

    Power Len (CommandLength) Number of extra bytes of data abData2 00h = Success Data 01h = Fail Example: Request = 08 01 00 Response = 88 01 00 Page 53 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 54: Read Tx Power Value

    Distance: ~7 meters Data 02h = -6 dBm Distance: ~16 meters 03h = 0 dBm Distance: ~25 meters Example: Request = 09 00 Response = 89 01 00 Page 54 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 55: Set Card Reset Simulation Option

    Reset Simulation Option Len (CommandLength) Number of extra bytes of data abData2 00h = Disable Data 01h = Enable Example: Request = 1A 01 01 Response = 9A 01 01 Page 55 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 56: Get Card Reset Simulation Option

    Reset Simulation Option Len (CommandLength) Number of extra bytes of data abData2 00h = Disable Data 01h = Enable Example: Request = 1A 00 Response = 9A 01 01 Page 56 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 57: Set Card Response Time Interval

    Response Time Interval Len (CommandLength) Number of extra bytes of data abData2 00h = Success Data 01h = Fail Example: Request = 18 01 00 Response = 98 01 00 Page 57 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 58: Get Card Response Time Interval

    Data 03h = 1500 ms (Default) 04h = 2000 ms 05h = 2500 ms 06h = 3000 ms Example: Request = 19 00 Response = 99 01 03 Page 58 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 59: Check Button Status

    Len (CommandLength) Number of extra bytes of data abData2 00h = Release Data 01h = Pressed Example: Request = 1B 00 Response (Buttons is pressed) = 9B 01 01 Page 59 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 60: Customer Master Key Reset Request

    F1 9F D2 D2 BA 1C 22 E1 6D C1 FE 1B 4B 43 D5 30 27 E7 DA BE A6 1E 4B CD 29 F6 9B 36 25 05 8E 41 Rewrite Master Key Command Response = 87 01 Page 60 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 61: Memory Card Command Set

    = 03h for 8-byte page write = 04h for 16-byte page write = 05h for 32-byte page write = 06h for 64-byte page write = 07h for 128-byte page write Page 61 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 62 Memory address location of the memory card MEM_L Length of data to be written to the memory card Byte x Data to be written to the memory card Page 62 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 63 Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 63 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 64: Memory Card - 32, 64, 128, 256, 512, And 1024 Kilobit I2C Card

    = 03h for 8-byte page write = 04h for 16-byte page write = 05h for 32-byte page write = 06h for 64-byte page write = 07h for 128-byte page write Page 64 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 65 = D0h for 32 kilobit, 64 kilobit, 128 kilobit, 256 kilobit, 512 kilobit iic card = 1101 000*b for 1024 kilobit iic card, where * is the MSB of the 17 bit addressing Page 65 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 66 Length of data to be written to the memory card Byte x Data to be written to the memory card Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 66 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 67: Memory Card - Atmel At88Sc153

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 67 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 68 “rp” indicate the password to compare r = 0: Write password, r = 1: Read password, p : Password set number, rp = 01 for the secure code. Page 68 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 69 Pseudo-APDU Ch(0) Ch(1) … Ch(7) Where: Ch(0),Ch(1)…Ch(7) Host challenge, 8 bytes Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 69 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 70: Memory Card - Atmel At88C1608

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 70 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 71 “rp ” indicate the password to compare: r = 0: Write password, r = 1: Read password, : Password set number. = 0111 for the secure code) Page 71 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 72 VERIFY_AUTHENTICATION Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU Q1(0) Q1(1) … Q1(7) Where: Byte Address Memory address location of the memory card Q1(0),Q1(1)…Q1(7) Host challenge, 8 bytes Page 72 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 73 Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 73 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 74: Memory Card - Sle4418/Sle4428/Sle5518/Sle5528

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1, SW2 = 90 00h if no error Page 74 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 75 MEM_L = 1 + INT ( (number of bits - 1)/8 ) For example, to read 8 protection bits starting from memory 0010h, the following pseudo-APDU should be issued: FF B2 00 10 01h Page 75 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 76 Byte x Data to be written to the memory card Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error 7.2.5.6. WRITE_PROTECTION_MEMORY_CARD Page 76 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 77 3. Try to erase the presentation error counter. Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU CODE MEM_L Byte 1 Byte 2 Where: CODE Two bytes secret code (PIN) Page 77 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 78 = Error Counter. FFh indicates successful verification. 00h indicates that the password is locked (or exceeded the maximum number of retries). Other values indicate that current verification has failed. Page 78 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 79: Memory Card - Sle4432/Sle4442/Sle5532/Sle5542

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1, SW2 = 90 00h if no error Page 79 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 80 Response Data Format (abData field in the RDR_to_PC_DataBlock) PROT 1 PROT 2 PROT 3 PROT 4 Where: PROT y Bytes containing the protection bits from protection memory SW1, SW2 = 90 00h if no error Page 80 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 81 Byte Address = 000A b (00h to 1Fh) is the protection memory address location of the memory card MEM_L Length of data to be written to the memory card Page 81 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 82 = Error Counter. 07h indicates that the verification is correct. 00h indicates the password is locked (exceeded the maximum number of retries). Other values indicate that the current verification has failed. 7.2.6.8. CHANGE_CODE_MEMORY_CARD (SLE 4442 and SLE 5542) Page 82 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 83 Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU CODE MEM_L Byte Byte Byte Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 83 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 84: Memory Card - Sle 4406/Sle 4436/Sle 5536/Sle 6636

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1, SW2 = 90 00h if no error 7.2.7.3. WRITE_ONE_BYTE_MEMORY_CARD Page 84 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 85 03h: Write with carry and with backup enabled (SLE 4436, SLE 5536 and SLE 6636 only) BYTE Byte value to be written to the card Response Data Format (abData field in the RDR_to_PC_DataBlock) Page 85 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 86 AUTHENTICATE_MEMORY_CARD (SLE 4436, SLE 5536 and SLE 6636) To read a card authentication certificate from a SLE 5536 or SLE 6636 card, the ACR3901T-W1 executes the following actions: 1. Select Key 1 or Key 2 in the card as specified in the command.
  • Page 87 Pseudo-APDU MEM_L Response Data Format (abData field in the RDR_to_PC_DataBlock) CERT Where: CERT 16 bits of authentication data computed by the card. The LSB of BYTE 1 is Page 87 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 88 SW1 SW2 = 90 00h if no error Page 88 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 89: Memory Card - Sle 4404

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 89 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 90 VERIFY_USER_CODE. Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU Byte Address MEM_L Where: Byte Address = Memory byte address location of the scratch pad Typical value is 02h Page 90 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 91 Note: After SW1SW2 = 9000h has been received, read back the User Error Counter to check if the VERIFY_USER_CODE is correct. If User Error Counter is erased and is equal to “FFh,” the previous verification is successful. Page 91 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 92 Note: After SW1SW2 = 9000h has been received, read back the Application Area can check if the VERIFY_MEMORY_CODE is correct. If all data in Application Area is erased and is equal to “FFh,” the previous verification is successful. Page 92 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 93: Memory Card - At88Sc101/At88Sc102/At88Sc1003

    Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 93 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 94 1. ERASE_APPLICATION_ZONE_WITH_ERASE command as specified in: ERASE_APPLICATION_ZONE_WITH_ERASE 2. ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE command as specified in: ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE 3. VERIFY_SECURITY_CODE commands as specified in: VERIFY_SECURITY_CODE Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU Byte Address MEM_L Where: Page 94 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 95 Address AT88SC101: Erase Application Zone with EC function disabled AT88SC102: Erase Application Zone 1 AT88SC102: Erase Application Zone 2 with EC2 function disabled AT88SC1003: Erase Application Zone 1 Page 95 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 96 Error Counter LEN Length of presentation error counter in bits. The value should be 80h always. Byte Address Byte address of the Application Zone Key in the card Page 96 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 97 Length of presentation error counter in bits Byte Address Byte address of the key in the card CODE 2 bytes Security Code Response Data Format (abData field in the RDR_to_PC_DataBlock) Page 97 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 98 State of Addr Addr RST Pin (High) (Low) Manufacturer Fuse AT88SC101 EC_EN Fuse Issuer Fuse Manufacturer Fuse AT88SC102 EC2EN Fuse Issuer Fuse Manufacturer Fuse AT88SC1003 EC2EN Fuse Issuer Fuse Page 98 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...
  • Page 99 Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 99 of 100 ACR3901T-W1 – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.02...

  • Page 100: Appendix A. Error Codes

    Appendix A. Error Codes The following table summarizes all the error codes for ACR3901T-W1: Error Code Description Invalid checksum Invalid data length Invalid command format Invalid command/Unknown command ID Card operation error Authentication is required/Authentication error Low battery Authentication failed Exceeded max.

Table of Contents