The adoption rate of JavaCard features by certified products and open-source projects [CARDIS 2023]

JavaCard is the most prevalent platform for cryptographic smartcards nowadays. Despite having more than 20 billion smartcards shipped with the JavaCard virtual machine and thirteen revisions since the JavaCard API specification was first published more than two decades ago, uptake of newly added features, cryptographic algorithms or their parameterizations, and systematic analysis of overall activity is missing. We aim to fill this gap by mapping the activity of the JavaCard ecosystem from publicly available sources with a focus on 1) information available from security certification documents available under Common Criteria and FIPS140 schemes and 2) activity and resources required by JavaCard applets released in an open-source domain.

The analysis performed on all certificates issued between the years 1997-2023 and on more than 200 public JavaCard applets shows that new features from JavaCard specification are adopted slowly. It typically takes six or more years before a majority of certified products add corresponding support. Open-source applets utilize new features even later, likely due to the unavailability of recent performant smartcards in smaller quantities. Additionally, almost 70\% of constants defined in JavaCard API specification are completely unused in open-source applets. The applet portability improves with recent cards, and transient and persistent memory requirements (scarce resources on smartcards) are typically small. While around twenty products have been consistently certified every year since 2009, the open-source ecosystem became more active around 2013 but seemed to decline in the past two years. As a result, the whole smartcard ecosystem is likely negatively impacted by limited exposure to new ideas and usage scenarios, serving only well-established domains and potentially harming its long-term competitiveness with other technologies.