title: How can I check INITIALIZE UPDATE and EXTERNAL AUTHENTICATE correctness?
body: <p><img src="https://i.stack.imgur.com/nXsBP.jpg" alt="enter image description here"></p>
  
  <p>I sent <code>80 50 00 00 08 00 00 00 00 00 00 00 00</code> [<strong>INITILIZE UPDATE</strong> Command] via opensc-tool to my java card and received <code>00 00 11 60 01 00 8A 79 0A F9 FF 02 00 11 79 11 36 5D 71 00 A5 A5 EC 63 BB DC 05 CC</code> [<strong>Init Response</strong>] as its response from the card.</p>
  
  <p>As you see:</p>
  
  <p>In the command,I send <code>00 00 00 00 00 00 00 00</code> as <strong>Host Challenge</strong>, And in the response : </p>
  
  <p><code>00 00 11 60 01 00 8A 79 0A F9</code> = <strong>Key diversification data</strong></p>
  
  <p><code>FF 02</code> = <strong>Key information</strong></p>
  
  <p><code>00 11 79 11 36 5D 71 00</code> = <strong>Card challenge</strong>  </p>
  
  <p><code>A5 A5 EC 63 BB DC 05 CC</code> = <strong>Card cryptogram</strong></p>
  
  <p>Now I want to check myself,if the card cryptogram is OK or not. How I can do it? for example I encrypt <code>00 00 00 00 00 00 00 00</code> in <a href="http://tripledes.online-domain-tools.com/" rel="nofollow noreferrer">this</a> site under a 3DES cryptography algorithm [with keys of my card = <code>4041...4F</code>], but the output is not equal with card cryptogram that I wrote above. Why?</p>
  
  <p>And the next question is, if I want to send <strong>EXTERNAL AUTHENTICATION</strong> command to the card, what is its data field (after the above INITILIZE UPDATE)?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>This is GPJ output :</p>
  
  <pre><code>C:\Users\ghasemi\Desktop\gpj-20120310&gt;GPJ
  C:\Users\ghasemi\Desktop\gpj-20120310&gt;java -jar gpj.jar
  Found terminals: [PC/SC terminal ACS CCID USB Reader 0]
  Found card in terminal: ACS CCID USB Reader 0
  ATR: 3B 68 00 00 00 73 C8 40 12 00 90 00
  .
  .
  .
  DEBUG: Command  APDU: 00 A4 04 00 08 A0 00 00 00 03 00 00 00
  DEBUG: Response APDU: 6F 10 84 08 A0 00 00 00 03 00 00 00 A5 04 9F 65 01 FF 90 00
  Successfully selected Security Domain OP201a A0 00 00 00 03 00 00 00
  
  DEBUG: Command  APDU: 80 50 00 00 08 7F 41 A9 E7 19 37 83 FA
  DEBUG: Response APDU: 00 00 11 60 01 00 8A 79 0A F9 FF 02 00 1B 9B 95 B9 5E 5E BC BA 51 34 84 D9 C1 B9 6E 90 00
  DEBUG: Command  APDU: 84 82 00 00 10 13 3B 4E C5 2C 9E D8 24 50 71 83 3A 78 AE 75 23
  DEBUG: Response APDU: 90 00
  DEBUG: Command  APDU: 84 82 00 00 08 13 3B 4E C5 2C 9E D8 24
  DEBUG: Response APDU: 90 00
  
  C:\Users\ghasemi\Desktop\gpj-20120310&gt;
  </code></pre>
  
  <p><strong>So :</strong> </p>
  
  <pre><code>Host_Challenge :: 7F41A9E7193783FA
  
  Diversification_Data :: 0000116001008A790AF9
  
  Key_Information :: FF02
  
  Sequence_Counter :: 001B
  
  Card_Challenge :: 9B95B95E5EBC
  
  Card_Cryptogram :: BA513484D9C1B96E
  
  Host_Cryptogram[16,24] = 13 3B 4E C5 2C 9E D8 24
  </code></pre>
  
  <p><strong>Now,lets make our Host_Cryptogram Manually :</strong></p>
  
  <pre><code>Derivation_data=derivation_const_ENC|sequence_counter|0000 0000 0000 0000 0000 0000
  
  Derivation_Data = 0182001B000000000000000000000000
  
  k_ENC :: 404142434445464748494A4B4C4D4E4F
  
  IV = 00 00 00 00 00 00 00 00
  
  S_ENC = encrypt(TDES_CBC, K_ENC, IV, derivation_data)
  </code></pre>
  
  <p><strong>So :</strong> </p>
  
  <p>I used <a href="http://tripledes.online-domain-tools.com/" rel="nofollow noreferrer">http://tripledes.online-domain-tools.com/</a> and its output for above values was : </p>
  
  <pre><code>S_ENC = 448b0a5967ca246d058703ff0c694f15
  </code></pre>
  
  <p><strong>And :</strong> </p>
  
  <pre><code>Padding_DES = 80 00 00 00 00 00 00 00
  Host_auth_data = sequence_counter | card_challenge | host_challenge | padding_DES
  IV = Card_Cryptogram :: BA513484D9C1B96E
  host_cryptogram = encrypt(TDES_CBC, S_ENC, IV, host_auth_data)
  </code></pre>
  
  <p><strong>So :</strong> </p>
  
  <pre><code>Host_Authentication_Data : 001B9B95B95E5EBC7F41A9E7193783FA8000000000000000
  </code></pre>
  
  <p>Again, I used <a href="http://tripledes.online-domain-tools.com/" rel="nofollow noreferrer">http://tripledes.online-domain-tools.com/</a></p>
  
  <p><strong>and :</strong></p>
  
  <pre><code>Host_Cryptogram : 3587b531db71ac52392493c08cff189ce7b9061029c63b62
  </code></pre>
  
  <p><strong>So :</strong></p>
  
  <pre><code>Host_Cryptogram[16,24] = e7b9061029c63b62
  </code></pre>
  
  <p><strong>Why these two way [manually and GPJ output] give us two host cryptogram?</strong></p>