src/com/makina/security/OpenFIPS201/PIV.java
public void resetRetryCounter(byte id, byte[] buffer, short offset, short length) {

        //
        // PRE-CONDITIONS
        //

        // PRE-CONDITION 1 - Check if we are permitted to use this command over the contactless interface
        //					 NOTE: We must check this for both the PIN and the PUK
        if (!Config.FEATURE_PIN_OVER_CONTACTLESS && cspPIV.getIsContactless()) {
            ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
        }
        if (!Config.FEATURE_PUK_OVER_CONTACTLESS && cspPIV.getIsContactless()) {
            ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
        }

        // PRE-CONDITION 2 - The supplied ID must be the Card PIN
        // The only key reference allowed in the P2 parameter of the RESET RETRY COUNTER command is the
        // PIV Card Application PIN. If a key reference is specified in P2 that is not supported by the
        // card, the PIV Card Application shall return the status word '6A 88'.
        if (id != ID_KEY_PIN) ISOException.throwIt(SW_REFERENCE_NOT_FOUND);

        // PRE-CONDITION 3 - Check the PUK blocked status
        // If the current value of the PUK's retry counter is zero, then the PIN's retry counter shall not be
        // reset and the PIV Card Application shall return the status word '69 83'.
        if (cspPIV.cardPUK.getTriesRemaining() == (short)0) ISOException.throwIt(SW_OPERATION_BLOCKED);

        // PRE-CONDITION 3 - Check the format of the NEW pin value
        // If the new reference data (PIN) in the command data field of the command does not satisfy the
        // criteria in Section 2.4.3, then the PIV Card Application shall return the status word '6A 80'.
        if (!verifyPinFormat(id, buffer, (short)(offset + Config.PIN_LENGTH_MAX), Config.PIN_LENGTH_MAX)) {
            ISOException.throwIt(ISO7816.SW_WRONG_DATA);
        }

        // PRE-CONDITION 4 - Verify the PUK value
        // If the reset retry counter authentication data (PUK) in the command data field of the command does not
        // match reference data associated with the PUK, then the PIV Card Application shall return the status word
        // '63 CX'.
        if (!cspPIV.cardPUK.check(buffer, offset, Config.PIN_LENGTH_MAX)) {

            // Reset the PIN's security condition (see paragraph below for explanation)
            cspPIV.cardPIN.reset();

            // Check again if we are blocked
            if (cspPIV.cardPUK.getTriesRemaining() == (short)0) {
                ISOException.throwIt(SW_OPERATION_BLOCKED);
            } else {
                // Return the number of retries remaining
                ISOException.throwIt((short)(SW_RETRIES_REMAINING | (short)cspPIV.cardPUK.getTriesRemaining()));
            }
        }

        // If the reset retry counter authentication data (PUK) in the command data field of the command does not match
        // reference data associated with the PUK and the new reference data (PIN) in the command data field of the
        // command does not satisfy the criteria in Section 2.4.3, then the PIV Card Application shall return either
        // status word '6A 80' or '63 CX'. If the PIV Card Application returns status word '6A 80', then the retry
        // counter associated with the PIN shall not be reset, the security status of the PIN's key reference shall
        // remain unchanged, and the PUK's retry counter shall remain unchanged.11 If the PIV Card Application
        // returns status word '63 CX', then the retry counter associated with the PIN shall not be reset, the security
        // status of the PIN's key reference shall be set to FALSE, and the PUK's retry counter shall be
        // decremented by one.

        // NOTES:
        // - We implicitly decrement the PUK counter if the PUK is incorrect (63CX)
        // - Because we validate the PIN format before checking the PUK, we return WRONG DATA (6A80) in this case
        // - If the PUK check fails, we explicitly reset the PIN's security condition

        // If the card command succeeds, then the PIN's retry counter shall be set to its reset retry value. Optionally,
        // the PUK's retry counter may be set to its initial reset retry value. The security status of the PIN's key
        // reference shall not be changed.

        // NOTE: Since the PUK was verified, the OwnerPIN object automatically resets the PUK counter, which governs
        // 		 the above behaviour

        // Update, reset and unblock the PIN
		cspPIV.cardPIN.update(buffer, (short)(offset + Config.PIN_LENGTH_MAX), Config.PIN_LENGTH_MAX);
    }
/**
     * The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and
     * changes the reference data. The command enables recovery of the PIV Card Application PIN in the case
     * that the cardholder has forgotten the PIV Card Application PIN.
     *
     * @param id The requested PIN reference
     * @param buffer The incoming APDU buffer
     * @param offset The starting offset of the CDATA element
     * @param length The length of the CDATA element
     */
The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and
changes the reference data. The command enables recovery of the PIV Card Application PIN in the case
that the cardholder has forgotten the PIV Card Application PIN.

@param id The requested PIN reference
@param buffer The incoming APDU buffer
@param offset The starting offset of the CDATA element
@param length The length of the CDATA element
The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and changes the reference data . The command enables recovery of the PIV Card Application PIN in the case that the cardholder has forgotten the PIV Card Application PIN . @param id The requested PIN reference @param buffer The incoming APDU buffer @param offset The starting offset of the CDATA element @param length The length of the CDATA element
public void resetRetryCounter(byte id, byte[] buffer, short offset, short length) {
         PRE-CONDITIONS
         PRE-CONDITION 1 - Check if we are permitted to use this command over the contactless interface
        					 NOTE: We must check this for both the PIN and the PUK
        if (!Config.FEATURE_PIN_OVER_CONTACTLESS && cspPIV.getIsContactless()) {
            ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
        }
        if (!Config.FEATURE_PUK_OVER_CONTACTLESS && cspPIV.getIsContactless()) {
            ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
        }
         PRE-CONDITION 2 - The supplied ID must be the Card PIN
         The only key reference allowed in the P2 parameter of the RESET RETRY COUNTER command is the
         PIV Card Application PIN. If a key reference is specified in P2 that is not supported by the
         card, the PIV Card Application shall return the status word '6A 88'.
        if (id != ID_KEY_PIN) ISOException.throwIt(SW_REFERENCE_NOT_FOUND);
         PRE-CONDITION 3 - Check the PUK blocked status
         If the current value of the PUK's retry counter is zero, then the PIN's retry counter shall not be
         reset and the PIV Card Application shall return the status word '69 83'.
        if (cspPIV.cardPUK.getTriesRemaining() == (short)0) ISOException.throwIt(SW_OPERATION_BLOCKED);
         PRE-CONDITION 3 - Check the format of the NEW pin value
         If the new reference data (PIN) in the command data field of the command does not satisfy the
         criteria in Section 2.4.3, then the PIV Card Application shall return the status word '6A 80'.
        if (!verifyPinFormat(id, buffer, (short)(offset + Config.PIN_LENGTH_MAX), Config.PIN_LENGTH_MAX)) {
            ISOException.throwIt(ISO7816.SW_WRONG_DATA);
        }
         PRE-CONDITION 4 - Verify the PUK value
         If the reset retry counter authentication data (PUK) in the command data field of the command does not
         match reference data associated with the PUK, then the PIV Card Application shall return the status word
         '63 CX'.
        if (!cspPIV.cardPUK.check(buffer, offset, Config.PIN_LENGTH_MAX)) {
             Reset the PIN's security condition (see paragraph below for explanation)
            cspPIV.cardPIN.reset();
             Check again if we are blocked
            if (cspPIV.cardPUK.getTriesRemaining() == (short)0) {
                ISOException.throwIt(SW_OPERATION_BLOCKED);
            } else {
                 Return the number of retries remaining
                ISOException.throwIt((short)(SW_RETRIES_REMAINING | (short)cspPIV.cardPUK.getTriesRemaining()));
            }
        }
         If the reset retry counter authentication data (PUK) in the command data field of the command does not match
         reference data associated with the PUK and the new reference data (PIN) in the command data field of the
         command does not satisfy the criteria in Section 2.4.3, then the PIV Card Application shall return either
         status word '6A 80' or '63 CX'. If the PIV Card Application returns status word '6A 80', then the retry
         counter associated with the PIN shall not be reset, the security status of the PIN's key reference shall
         remain unchanged, and the PUK's retry counter shall remain unchanged.11 If the PIV Card Application
         returns status word '63 CX', then the retry counter associated with the PIN shall not be reset, the security
         status of the PIN's key reference shall be set to FALSE, and the PUK's retry counter shall be
         decremented by one.
         NOTES:
         - We implicitly decrement the PUK counter if the PUK is incorrect (63CX)
         - Because we validate the PIN format before checking the PUK, we return WRONG DATA (6A80) in this case
         - If the PUK check fails, we explicitly reset the PIN's security condition
         If the card command succeeds, then the PIN's retry counter shall be set to its reset retry value. Optionally,
         the PUK's retry counter may be set to its initial reset retry value. The security status of the PIN's key
         reference shall not be changed.
         NOTE: Since the PUK was verified, the OwnerPIN object automatically resets the PUK counter, which governs
         		 the above behaviour
         Update, reset and unblock the PIN
		cspPIV.cardPIN.update(buffer, (short)(offset + Config.PIN_LENGTH_MAX), Config.PIN_LENGTH_MAX);
    }
public void resetRetryCounter ( byte id , byte [ ] buffer , short offset , short length ) { if ( ! Config . FEATURE_PIN_OVER_CONTACTLESS && cspPIV . getIsContactless ( ) ) { ISOException . throwIt ( ISO7816 . SW_SECURITY_STATUS_NOT_SATISFIED ) ; } if ( ! Config . FEATURE_PUK_OVER_CONTACTLESS && cspPIV . getIsContactless ( ) ) { ISOException . throwIt ( ISO7816 . SW_SECURITY_STATUS_NOT_SATISFIED ) ; } if ( id != ID_KEY_PIN ) ISOException . throwIt ( SW_REFERENCE_NOT_FOUND ) ; if ( cspPIV . cardPUK . getTriesRemaining ( ) == ( short ) 0 ) ISOException . throwIt ( SW_OPERATION_BLOCKED ) ; if ( ! verifyPinFormat ( id , buffer , ( short ) ( offset + Config . PIN_LENGTH_MAX ) , Config . PIN_LENGTH_MAX ) ) { ISOException . throwIt ( ISO7816 . SW_WRONG_DATA ) ; } if ( ! cspPIV . cardPUK . check ( buffer , offset , Config . PIN_LENGTH_MAX ) ) { cspPIV . cardPIN . reset ( ) ; if ( cspPIV . cardPUK . getTriesRemaining ( ) == ( short ) 0 ) { ISOException . throwIt ( SW_OPERATION_BLOCKED ) ; } else { ISOException . throwIt ( ( short ) ( SW_RETRIES_REMAINING | ( short ) cspPIV . cardPUK . getTriesRemaining ( ) ) ) ; } } cspPIV . cardPIN . update ( buffer , ( short ) ( offset + Config . PIN_LENGTH_MAX ) , Config . PIN_LENGTH_MAX ) ; }
The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and
 changes the reference data.
The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and changes the reference data .
// // PRE-CONDITIONS // // PRE-CONDITION 1 - Check if we are permitted to use this command over the contactless interface //					 NOTE: We must check this for both the PIN and the PUK // PRE-CONDITION 2 - The supplied ID must be the Card PIN // The only key reference allowed in the P2 parameter of the RESET RETRY COUNTER command is the // PIV Card Application PIN. If a key reference is specified in P2 that is not supported by the // card, the PIV Card Application shall return the status word '6A 88'. // PRE-CONDITION 3 - Check the PUK blocked status // If the current value of the PUK's retry counter is zero, then the PIN's retry counter shall not be // reset and the PIV Card Application shall return the status word '69 83'. // PRE-CONDITION 3 - Check the format of the NEW pin value // If the new reference data (PIN) in the command data field of the command does not satisfy the // criteria in Section 2.4.3, then the PIV Card Application shall return the status word '6A 80'. // PRE-CONDITION 4 - Verify the PUK value // If the reset retry counter authentication data (PUK) in the command data field of the command does not // match reference data associated with the PUK, then the PIV Card Application shall return the status word // '63 CX'. // Reset the PIN's security condition (see paragraph below for explanation) // Check again if we are blocked // Return the number of retries remaining // If the reset retry counter authentication data (PUK) in the command data field of the command does not match // reference data associated with the PUK and the new reference data (PIN) in the command data field of the // command does not satisfy the criteria in Section 2.4.3, then the PIV Card Application shall return either // status word '6A 80' or '63 CX'. If the PIV Card Application returns status word '6A 80', then the retry // counter associated with the PIN shall not be reset, the security status of the PIN's key reference shall // remain unchanged, and the PUK's retry counter shall remain unchanged.11 If the PIV Card Application // returns status word '63 CX', then the retry counter associated with the PIN shall not be reset, the security // status of the PIN's key reference shall be set to FALSE, and the PUK's retry counter shall be // decremented by one. // NOTES: // - We implicitly decrement the PUK counter if the PUK is incorrect (63CX) // - Because we validate the PIN format before checking the PUK, we return WRONG DATA (6A80) in this case // - If the PUK check fails, we explicitly reset the PIN's security condition // If the card command succeeds, then the PIN's retry counter shall be set to its reset retry value. Optionally, // the PUK's retry counter may be set to its initial reset retry value. The security status of the PIN's key // reference shall not be changed. // NOTE: Since the PUK was verified, the OwnerPIN object automatically resets the PUK counter, which governs // 		 the above behaviour // Update, reset and unblock the PIN