Authors: Lukas Zaoral, Antonin Dufka, Petr Svenda
Primary contact: Petr Svenda <svenda@fi.muni.cz>
Conference: 22nd Smart Card Research and Advanced Application Conference 2023
@inproceedings{2023-cardis-javacard,
title = {The adoption rate of JavaCard features by certified products and open-source projects },
year = {2023},
author = {Zaoral, Lukas and Dufka, Antonin and Svenda, Petr},
booktitle = {Proceedings of the 22nd Smart Card Research and Advanced Application Conference, Lecture Notes in Computer Science, vol 14530},
doi = {10.1007/978-3-031-54409-5_9},
keywords = {Cryptographic Hardware, javacard, common criteria, fips140, smartcards},
language = {eng},
isbn = {978-3-031-54409-5},
pages = {169--189},
publisher = {Springer}
}
JavaCard is the most prevalent platform for cryptographic smartcards nowadays. Despite having more than 20 billion smartcards shipped with the JavaCard virtual machine and thirteen revisions since the JavaCard API specification was first published more than two decades ago, uptake of newly added features, cryptographic algorithms or their parameterizations, and systematic analysis of overall activity is missing. We aim to fill this gap by mapping the activity of the JavaCard ecosystem from publicly available sources with a focus on 1) information available from security certification documents available under Common Criteria and FIPS140 schemes and 2) activity and resources required by JavaCard applets released in an open-source domain.
The analysis performed on all certificates issued between the years 1997-2023 and on more than 200 public JavaCard applets shows that new features from JavaCard specification are adopted slowly. It typically takes six or more years before a majority of certified products add corresponding support. Open-source applets utilize new features even later, likely due to the unavailability of recent performant smartcards in smaller quantities. Additionally, almost 70\% of constants defined in JavaCard API specification are completely unused in open-source applets. The applet portability improves with recent cards, and transient and persistent memory requirements (scarce resources on smartcards) are typically small. While around twenty products have been consistently certified every year since 2009, the open-source ecosystem became more active around 2013 but seemed to decline in the past two years. As a result, the whole smartcard ecosystem is likely negatively impacted by limited exposure to new ideas and usage scenarios, serving only well-established domains and potentially harming its long-term competitiveness with other technologies.