src/com/makina/security/OpenFIPS201/PIV.java
public void verify(byte id, byte[] buffer, short offset, short length) {

        //
        // PRE-CONDITIONS
        //

        // PRE-CONDITION 1 - The PIN reference must point to a valid PIN
        OwnerPIN pin = null;

        switch (id) {

        case ID_KEY_GLOBAL_PIN:
            // Make sure FEATURE_PIN_GLOBAL_ENABLED is set
            if (!Config.FEATURE_PIN_GLOBAL_ENABLED) ISOException.throwIt(SW_REFERENCE_NOT_FOUND);

            pin = cspPIV.globalPIN;
            break;

        case ID_KEY_PIN:

            // Make sure FEATURE_PIN_CARD_ENABLED is set
            if (!Config.FEATURE_PIN_CARD_ENABLED) ISOException.throwIt(SW_REFERENCE_NOT_FOUND);

            pin = cspPIV.cardPIN;
            break;

        default:
            ISOException.throwIt(SW_REFERENCE_NOT_FOUND);
        }

        // PRE-CONDITION 2 - If FEATURE_PIN_OVER_CONTACTLESS is not set, the interface must be contact
        if (!Config.FEATURE_PIN_OVER_CONTACTLESS && cspPIV.getIsContactless()) ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);

        // PRE-CONDITION 3 - The supplied PIN format must be valid
        // If the key reference is '00' or '80' and the authentication data in the command data
        // field does not satisfy the criteria in Section 2.4.3, then the card command shall fail
        // and the PIV Card Application shall return either the status word '6A 80' or '63 CX'.
        // If status word '6A 80' is returned, the security status and the retry counter of the key
        // reference shall remain unchanged. If status word '63 CX' is returned, the security
        // status of the key reference shall be set to FALSE and the retry counter associated with
        // the key reference shall be decremented by one.
        // NOTE: We return 6A80 (WRONG DATA) and therefore do NOT decrement the counter or block
        if (!verifyPinFormat(id, buffer, offset, length)) {
            ISOException.throwIt(ISO7816.SW_WRONG_DATA);
        }

        // PRE-CONDITION 4 - The PIN must not be blocked
        if (pin.getTriesRemaining() == (byte)0) ISOException.throwIt(SW_OPERATION_BLOCKED);

        // PRE-CONDITION 5 - If using the contactless interface, the pin retries remaining must not
        //					 fall below the specified intermediate retry amount

        // In order to protect against blocking over the contactless interface, PIV Card Applications
        // that implement secure messaging shall define an issuer-specified intermediate retry value for
        // each of these key references and return '69 83' if the command is submitted over the contactless
        // interface (over secure messaging or the VCI, as required for the key reference) and the current value
        // of the retry counter associated with the key reference is at or below the issuer-specified intermediate
        // retry value. If status word '69 83' is returned, then the comparison shall not be made, and the
        // security status and the retry counter of the key reference shall remain unchanged.
        if ((pin.getTriesRemaining() <= Config.PIN_RETRIES_INTERMEDIATE) && cspPIV.getIsContactless()) {
            ISOException.throwIt(SW_OPERATION_BLOCKED);
        }

        //
        // EXECUTION STEPS
        //

        // Verify the PIN
        if (!pin.check(buffer, offset, (byte)length)) {

            // Check for blocked again
            if (pin.getTriesRemaining() == (byte)0) ISOException.throwIt(SW_OPERATION_BLOCKED);

            // Return the number of retries remaining
            ISOException.throwIt((short)(SW_RETRIES_REMAINING | (short)pin.getTriesRemaining()));
        }

        // Verified, set the PIN ALWAYS flag
        cspPIV.setPINAlways(true);
    }
/**
     * The VERIFY card command initiates the comparison in the card of the reference data indicated
     * by the key reference with authentication data in the data field of the command.
     *
     * @param id The requested PIN reference
     * @param buffer The incoming APDU buffer
     * @param offset The starting offset of the CDATA element
     * @param length The length of the CDATA element
     */
The VERIFY card command initiates the comparison in the card of the reference data indicated
by the key reference with authentication data in the data field of the command.

@param id The requested PIN reference
@param buffer The incoming APDU buffer
@param offset The starting offset of the CDATA element
@param length The length of the CDATA element
The VERIFY card command initiates the comparison in the card of the reference data indicated by the key reference with authentication data in the data field of the command . @param id The requested PIN reference @param buffer The incoming APDU buffer @param offset The starting offset of the CDATA element @param length The length of the CDATA element
public void verify(byte id, byte[] buffer, short offset, short length) {
         PRE-CONDITIONS
         PRE-CONDITION 1 - The PIN reference must point to a valid PIN
        OwnerPIN pin = null;
        switch (id) {
        case ID_KEY_GLOBAL_PIN:
             Make sure FEATURE_PIN_GLOBAL_ENABLED is set
            if (!Config.FEATURE_PIN_GLOBAL_ENABLED) ISOException.throwIt(SW_REFERENCE_NOT_FOUND);
            pin = cspPIV.globalPIN;
            break;
        case ID_KEY_PIN:
             Make sure FEATURE_PIN_CARD_ENABLED is set
            if (!Config.FEATURE_PIN_CARD_ENABLED) ISOException.throwIt(SW_REFERENCE_NOT_FOUND);
            pin = cspPIV.cardPIN;
            break;
        default:
            ISOException.throwIt(SW_REFERENCE_NOT_FOUND);
        }
         PRE-CONDITION 2 - If FEATURE_PIN_OVER_CONTACTLESS is not set, the interface must be contact
        if (!Config.FEATURE_PIN_OVER_CONTACTLESS && cspPIV.getIsContactless()) ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
         PRE-CONDITION 3 - The supplied PIN format must be valid
         If the key reference is '00' or '80' and the authentication data in the command data
         field does not satisfy the criteria in Section 2.4.3, then the card command shall fail
         and the PIV Card Application shall return either the status word '6A 80' or '63 CX'.
         If status word '6A 80' is returned, the security status and the retry counter of the key
         reference shall remain unchanged. If status word '63 CX' is returned, the security
         status of the key reference shall be set to FALSE and the retry counter associated with
         the key reference shall be decremented by one.
         NOTE: We return 6A80 (WRONG DATA) and therefore do NOT decrement the counter or block
        if (!verifyPinFormat(id, buffer, offset, length)) {
            ISOException.throwIt(ISO7816.SW_WRONG_DATA);
        }
         PRE-CONDITION 4 - The PIN must not be blocked
        if (pin.getTriesRemaining() == (byte)0) ISOException.throwIt(SW_OPERATION_BLOCKED);
         PRE-CONDITION 5 - If using the contactless interface, the pin retries remaining must not
        					 fall below the specified intermediate retry amount
         In order to protect against blocking over the contactless interface, PIV Card Applications
         that implement secure messaging shall define an issuer-specified intermediate retry value for
         each of these key references and return '69 83' if the command is submitted over the contactless
         interface (over secure messaging or the VCI, as required for the key reference) and the current value
         of the retry counter associated with the key reference is at or below the issuer-specified intermediate
         retry value. If status word '69 83' is returned, then the comparison shall not be made, and the
         security status and the retry counter of the key reference shall remain unchanged.
        if ((pin.getTriesRemaining() <= Config.PIN_RETRIES_INTERMEDIATE) && cspPIV.getIsContactless()) {
            ISOException.throwIt(SW_OPERATION_BLOCKED);
        }
         EXECUTION STEPS
         Verify the PIN
        if (!pin.check(buffer, offset, (byte)length)) {
             Check for blocked again
            if (pin.getTriesRemaining() == (byte)0) ISOException.throwIt(SW_OPERATION_BLOCKED);
             Return the number of retries remaining
            ISOException.throwIt((short)(SW_RETRIES_REMAINING | (short)pin.getTriesRemaining()));
        }
         Verified, set the PIN ALWAYS flag
        cspPIV.setPINAlways(true);
    }
public void verify ( byte id , byte [ ] buffer , short offset , short length ) { OwnerPIN pin = null ; switch ( id ) { case ID_KEY_GLOBAL_PIN : if ( ! Config . FEATURE_PIN_GLOBAL_ENABLED ) ISOException . throwIt ( SW_REFERENCE_NOT_FOUND ) ; pin = cspPIV . globalPIN ; break ; case ID_KEY_PIN : if ( ! Config . FEATURE_PIN_CARD_ENABLED ) ISOException . throwIt ( SW_REFERENCE_NOT_FOUND ) ; pin = cspPIV . cardPIN ; break ; default : ISOException . throwIt ( SW_REFERENCE_NOT_FOUND ) ; } if ( ! Config . FEATURE_PIN_OVER_CONTACTLESS && cspPIV . getIsContactless ( ) ) ISOException . throwIt ( ISO7816 . SW_SECURITY_STATUS_NOT_SATISFIED ) ; if ( ! verifyPinFormat ( id , buffer , offset , length ) ) { ISOException . throwIt ( ISO7816 . SW_WRONG_DATA ) ; } if ( pin . getTriesRemaining ( ) == ( byte ) 0 ) ISOException . throwIt ( SW_OPERATION_BLOCKED ) ; if ( ( pin . getTriesRemaining ( ) <= Config . PIN_RETRIES_INTERMEDIATE ) && cspPIV . getIsContactless ( ) ) { ISOException . throwIt ( SW_OPERATION_BLOCKED ) ; } if ( ! pin . check ( buffer , offset , ( byte ) length ) ) { if ( pin . getTriesRemaining ( ) == ( byte ) 0 ) ISOException . throwIt ( SW_OPERATION_BLOCKED ) ; ISOException . throwIt ( ( short ) ( SW_RETRIES_REMAINING | ( short ) pin . getTriesRemaining ( ) ) ) ; } cspPIV . setPINAlways ( true ) ; }
The VERIFY card command initiates the comparison in the card of the reference data indicated
 by the key reference with authentication data in the data field of the command.
The VERIFY card command initiates the comparison in the card of the reference data indicated by the key reference with authentication data in the data field of the command .
// // PRE-CONDITIONS // // PRE-CONDITION 1 - The PIN reference must point to a valid PIN // Make sure FEATURE_PIN_GLOBAL_ENABLED is set // Make sure FEATURE_PIN_CARD_ENABLED is set // PRE-CONDITION 2 - If FEATURE_PIN_OVER_CONTACTLESS is not set, the interface must be contact // PRE-CONDITION 3 - The supplied PIN format must be valid // If the key reference is '00' or '80' and the authentication data in the command data // field does not satisfy the criteria in Section 2.4.3, then the card command shall fail // and the PIV Card Application shall return either the status word '6A 80' or '63 CX'. // If status word '6A 80' is returned, the security status and the retry counter of the key // reference shall remain unchanged. If status word '63 CX' is returned, the security // status of the key reference shall be set to FALSE and the retry counter associated with // the key reference shall be decremented by one. // NOTE: We return 6A80 (WRONG DATA) and therefore do NOT decrement the counter or block // PRE-CONDITION 4 - The PIN must not be blocked // PRE-CONDITION 5 - If using the contactless interface, the pin retries remaining must not //					 fall below the specified intermediate retry amount // In order to protect against blocking over the contactless interface, PIV Card Applications // that implement secure messaging shall define an issuer-specified intermediate retry value for // each of these key references and return '69 83' if the command is submitted over the contactless // interface (over secure messaging or the VCI, as required for the key reference) and the current value // of the retry counter associated with the key reference is at or below the issuer-specified intermediate // retry value. If status word '69 83' is returned, then the comparison shall not be made, and the // security status and the retry counter of the key reference shall remain unchanged. // // EXECUTION STEPS // // Verify the PIN // Check for blocked again // Return the number of retries remaining // Verified, set the PIN ALWAYS flag