From 141037ccd230ce22b10d6788b6ce557c91b094f9 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@uq.edu.au>
Date: Fri, 1 Jul 2022 15:00:54 +1000
Subject: [PATCH 1/7] Remove support for EC without precomphash

---
 build.rb                                 |  29 ++---
 build.xml                                |   9 +-
 src/net/cooperi/pivapplet/PivApplet.java | 156 -----------------------
 3 files changed, 15 insertions(+), 179 deletions(-)

diff --git a/build.rb b/build.rb
index fd6b743..e52aa4a 100755
--- a/build.rb
+++ b/build.rb
@@ -9,7 +9,6 @@
 	'R' => 'PIV_SUPPORT_RSA',
 	'E' => 'PIV_SUPPORT_EC',
 	'e' => 'PIV_SUPPORT_ECCP384',
-	'P' => 'PIV_USE_EC_PRECOMPHASH',
 	'S' => 'PIV_STRICT_CONTACTLESS',
 	'A' => 'YKPIV_ATTESTATION',
 	'x' => 'APPLET_EXTLEN',
@@ -46,20 +45,20 @@ def build(ver, jcver, flags)
 
 `rm -fr dist`
 `mkdir dist`
-build(VER, 'jc221', 'RESaD')
-build(VER, 'jc221', 'RESAaD')
-build(VER, 'jc221', 'RESLaD')
-build(VER, 'jc221', 'RESLD')
+build(VER, 'jc221', 'RSaD')
+build(VER, 'jc221', 'RSAaD')
+build(VER, 'jc221', 'RSLaD')
+build(VER, 'jc221', 'RSLD')
 
-build(VER, 'jc222', 'RESAaD')
-build(VER, 'jc222', 'RESAxaD')
-build(VER, 'jc222', 'REAxaD')
-build(VER, 'jc222', 'RESxLD')
+build(VER, 'jc222', 'RSAaD')
+build(VER, 'jc222', 'RSAxaD')
+build(VER, 'jc222', 'RAxaD')
+build(VER, 'jc222', 'RSxLD')
 
-build(VER, 'jc304', 'EPSxLaD')
+build(VER, 'jc304', 'ESxLaD')
 build(VER, 'jc304', 'RSxLaD')
-build(VER, 'jc304', 'REePSAa')
-build(VER, 'jc304', 'REePSAaD')
-build(VER, 'jc304', 'REePSAxa')
-build(VER, 'jc304', 'REePSAxaD')
-build(VER, 'jc304', 'REePAxaD')
+build(VER, 'jc304', 'REeSAa')
+build(VER, 'jc304', 'REeSAaD')
+build(VER, 'jc304', 'REeSAxa')
+build(VER, 'jc304', 'REeSAxaD')
+build(VER, 'jc304', 'REeAxaD')
diff --git a/build.xml b/build.xml
index c069f2c..068360b 100644
--- a/build.xml
+++ b/build.xml
@@ -26,19 +26,12 @@
   <property name="PIV_SUPPORT_AES" value="true"/>
   <property name="PIV_SUPPORT_3DES" value="true"/>
 
-  <!--
-    PIV_USE_EC_PRECOMPHASH: build with support for using signPreComputedHash()
-    for EC signing. This can only work with JC3.0.5, but will build an applet
-    that is capable of PIV standards-compliant EC signing.
-  -->
-  <property name="PIV_USE_EC_PRECOMPHASH" value="true"/>
-
   <!--
     PIV_STRICT_CONTACTLESS: if true, strictly enforce the PIV spec requirements
     around which slots and keys are allowed to be used over the contactless
     interface. If false, allow anything to be used over contactless.
   -->
-  <property name="PIV_STRICT_CONTACTLESS" value="true"/>
+  <property name="PIV_STRICT_CONTACTLESS" value="false"/>
   <!--
     YKPIV_ATTESTATION: whether to build support for YubicoPIV attestation.
     Without this, the attestation slots and commands will all return
diff --git a/src/net/cooperi/pivapplet/PivApplet.java b/src/net/cooperi/pivapplet/PivApplet.java
index ab89f49..74d7dce 100644
--- a/src/net/cooperi/pivapplet/PivApplet.java
+++ b/src/net/cooperi/pivapplet/PivApplet.java
@@ -60,9 +60,6 @@ public class PivApplet extends Applet
 //#if PIV_SUPPORT_ECCP384
 	    'e',
 //#endif
-//#if PIV_USE_EC_PRECOMPHASH
-	    'P',
-//#endif
 //#if PIV_STRICT_CONTACTLESS
 	    'S',
 //#endif
@@ -226,12 +223,6 @@ public class PivApplet extends Applet
 	private static final byte PIV_ALG_ECCP256 = (byte)0x11;
 	private static final byte PIV_ALG_ECCP384 = (byte)0x14;
 
-	private static final byte PIV_ALG_ECCP256_SHA1 = (byte)0xf0;
-	private static final byte PIV_ALG_ECCP256_SHA256 = (byte)0xf1;
-	private static final byte PIV_ALG_ECCP384_SHA1 = (byte)0xf2;
-	private static final byte PIV_ALG_ECCP384_SHA256 = (byte)0xf3;
-	private static final byte PIV_ALG_ECCP384_SHA384 = (byte)0xf4;
-
 	private static final byte GA_TAG_WITNESS = (byte)0x80;
 	private static final byte GA_TAG_CHALLENGE = (byte)0x81;
 	private static final byte GA_TAG_RESPONSE = (byte)0x82;
@@ -948,19 +939,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		if (ecdsaSha384 != null) {
 			pushAlgorithm(PIV_ALG_ECCP384);
 		}
-/*#if !PIV_USE_EC_PRECOMPHASH
-		if (ecdsaSha != null) {
-			pushAlgorithm(PIV_ALG_ECCP256_SHA1);
-		}
-		if (ecdsaSha256 != null) {
-			pushAlgorithm(PIV_ALG_ECCP256_SHA256);
-		}
-		if (ecdsaSha384 != null) {
-			pushAlgorithm(PIV_ALG_ECCP384_SHA1);
-			pushAlgorithm(PIV_ALG_ECCP384_SHA256);
-			pushAlgorithm(PIV_ALG_ECCP384_SHA384);
-		}
-#endif*/
 //#endif
 
 		wtlv.pop();
@@ -2099,7 +2077,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			return;
 		}
 
-//#if PIV_USE_EC_PRECOMPHASH
 		/* Are they asking for ECDH? */
 		if (tag == GA_TAG_EXP) {
 			final KeyAgreement ag = ecdh;
@@ -2174,12 +2151,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 
 		wtlv.end();
 		sendOutgoing(apdu);
-
-/*#else
-		tlv.abort();
-		ISOException.throwIt(ISO7816.SW_FUNC_NOT_SUPPORTED);
-		return;
-#endif*/
 	}
 
 	private void
@@ -2218,125 +2189,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		wtlv.end();
 		sendOutgoing(apdu);
 	}
-
-	private void
-	processGenAuthEcHash(final APDU apdu, final PivSlot slot,
-	    byte alg, final byte key, final Readable input,
-	    final byte wanted, final byte tag)
-	{
-		final byte baseAlg;
-		final Signature si;
-		short cLen;
-
-		switch (alg) {
-		case PIV_ALG_ECCP256_SHA1:
-			si = ecdsaSha;
-			baseAlg = PIV_ALG_ECCP256;
-			break;
-		case PIV_ALG_ECCP256_SHA256:
-			si = ecdsaSha256;
-			baseAlg = PIV_ALG_ECCP256;
-			break;
-		case PIV_ALG_ECCP384_SHA1:
-			si = ecdsaSha;
-			baseAlg = PIV_ALG_ECCP384;
-			break;
-		case PIV_ALG_ECCP384_SHA256:
-			si = ecdsaSha256;
-			baseAlg = PIV_ALG_ECCP384;
-			break;
-		case PIV_ALG_ECCP384_SHA384:
-			si = ecdsaSha384;
-			baseAlg = PIV_ALG_ECCP384;
-			break;
-		default:
-			tlv.abort();
-			ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2);
-			return;
-		}
-
-		if (slot.asymAlg != baseAlg || slot.asym == null) {
-			tlv.abort();
-			ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2);
-			return;
-		}
-
-		if (si == null) {
-			tlv.abort();
-			ISOException.throwIt(ISO7816.SW_FUNC_NOT_SUPPORTED);
-			return;
-		}
-
-		/* Are they asking for ECDH? */
-		if (tag == GA_TAG_EXP) {
-			final KeyAgreement ag = ecdhSha;
-			if (ag == null) {
-				tlv.abort();
-				ISOException.throwIt(
-				    ISO7816.SW_FUNC_NOT_SUPPORTED);
-				return;
-			}
-			if (alg != PIV_ALG_ECCP256_SHA1 &&
-			    alg != PIV_ALG_ECCP384_SHA1) {
-				tlv.abort();
-				ISOException.throwIt(
-				    ISO7816.SW_FUNC_NOT_SUPPORTED);
-				return;
-			}
-			processGenAuthEcdh(apdu, slot, ag);
-			return;
-		}
-
-		/* Otherwise they must be asking for a signature. */
-		if (tag != GA_TAG_CHALLENGE) {
-			tlv.abort();
-			ISOException.throwIt(ISO7816.SW_WRONG_DATA);
-			return;
-		}
-
-		final short sLen = tlv.tagLength();
-		cLen = sLen;
-		switch (baseAlg) {
-		case PIV_ALG_ECCP256:
-			cLen = (short)75;
-			break;
-		case PIV_ALG_ECCP384:
-			cLen = (short)107;
-			break;
-		}
-
-		if (!bufmgr.alloc(cLen, outBuf)) {
-			ISOException.throwIt(ISO7816.SW_FILE_FULL);
-			return;
-		}
-
-		si.init(slot.asym.getPrivate(), Signature.MODE_SIGN);
-		short done = (short)0;
-		while (done < sLen) {
-			final short read = tlv.readPartial(tempBuf, sLen);
-			si.update(tempBuf.data(), tempBuf.rpos(), read);
-			done += read;
-		}
-		tlv.end();
-		cLen = si.sign(null, (short)0, (short)0,
-		    outBuf.data(), outBuf.wpos());
-		outBuf.write(cLen);
-
-		incoming.resetAndFree();
-
-		outgoing.reset();
-		wtlv.start(outgoing);
-		outgoingLe = apdu.setOutgoing();
-		wtlv.useApdu((short)0, outgoingLe);
-
-		wtlv.writeTagRealLen((byte)0x7c,
-		    TlvWriter.sizeWithByteTag(cLen));
-		wtlv.writeTagRealLen(GA_TAG_RESPONSE, cLen);
-		wtlv.write(outBuf);
-
-		wtlv.end();
-		sendOutgoing(apdu);
-	}
 //#endif
 
 	private void
@@ -2492,14 +2344,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			processGenAuthEcPlain(apdu, slot, alg, key, input,
 			    wanted, tag);
 			break;
-		case PIV_ALG_ECCP256_SHA1:
-		case PIV_ALG_ECCP256_SHA256:
-		case PIV_ALG_ECCP384_SHA1:
-		case PIV_ALG_ECCP384_SHA256:
-		case PIV_ALG_ECCP384_SHA384:
-			processGenAuthEcHash(apdu, slot, alg, key, input,
-			    wanted, tag);
-			break;
 //#endif
 		default:
 			tlv.abort();

From 1cb2934ad5cdcc948122d914cd2d073af5a9b0e7 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@uq.edu.au>
Date: Fri, 1 Jul 2022 15:01:43 +1000
Subject: [PATCH 2/7] don't change serial number at reset

---
 src/net/cooperi/pivapplet/PivApplet.java | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/net/cooperi/pivapplet/PivApplet.java b/src/net/cooperi/pivapplet/PivApplet.java
index 74d7dce..578abb6 100644
--- a/src/net/cooperi/pivapplet/PivApplet.java
+++ b/src/net/cooperi/pivapplet/PivApplet.java
@@ -2662,9 +2662,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		randData.generateData(cardId, (short)CARD_ID_FIXED.length,
 		    (short)(21 - (short)CARD_ID_FIXED.length));
 
-		randData.generateData(serial, (short)0, (short)4);
-		serial[0] |= (byte)0x80;
-
 		/*
 		 * These can be changed during generate or import, so reset
 		 * them to defaults.

From 60fc61ac21fda3caf6cbd4c96f7a7e2db07f2a32 Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@uq.edu.au>
Date: Fri, 1 Jul 2022 15:06:36 +1000
Subject: [PATCH 3/7] read object: check security status before checking for
 data

fixes #65
---
 src/net/cooperi/pivapplet/PivApplet.java | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/net/cooperi/pivapplet/PivApplet.java b/src/net/cooperi/pivapplet/PivApplet.java
index 578abb6..c8f9341 100644
--- a/src/net/cooperi/pivapplet/PivApplet.java
+++ b/src/net/cooperi/pivapplet/PivApplet.java
@@ -2864,8 +2864,7 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			tlv.end();
 			tlv.finish();
 
-			if (file == null || file.data == null ||
-			    file.len == 0) {
+			if (file == null) {
 				ISOException.throwIt(ISO7816.SW_FILE_NOT_FOUND);
 				return;
 			}
@@ -2888,6 +2887,11 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 				return;
 			}
 
+			if (file.data == null || file.len == 0) {
+				ISOException.throwIt(ISO7816.SW_FILE_NOT_FOUND);
+				return;
+			}
+
 			outgoing.reset();
 			wtlv.start(outgoing);
 			outgoingLe = apdu.setOutgoing();

From c1dbe2ec014e812352d41b1da5fda72d7f1ea8dd Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@cooperi.net>
Date: Mon, 22 Aug 2022 12:58:05 +1000
Subject: [PATCH 4/7] PIN handling improvements

* PIN reset (with PUK) and PIN change commands should ignore cached state
* Command should return 6983 if PIN/PUK already blocked
* 6A88 should be returned for invalid key ref numbers

Closes #67
---
 src/net/cooperi/pivapplet/PivApplet.java | 40 ++++++++++++++++++++----
 1 file changed, 34 insertions(+), 6 deletions(-)

diff --git a/src/net/cooperi/pivapplet/PivApplet.java b/src/net/cooperi/pivapplet/PivApplet.java
index c8f9341..69ac7c5 100644
--- a/src/net/cooperi/pivapplet/PivApplet.java
+++ b/src/net/cooperi/pivapplet/PivApplet.java
@@ -2407,6 +2407,15 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			return;
 		}
 
+		/*
+		 * According to the PIV spec, if the PIN is blocked we should
+		 * return 0x6983 here (SW_FILE_INVALID).
+		 */
+		if (pin.getTriesRemaining() == 0) {
+			ISOException.throwIt(ISO7816.SW_FILE_INVALID);
+			return;
+		}
+
 		if (!pin.check(buffer, pinOff, (byte)8)) {
 			if (pukPin.getTriesRemaining() == 0) {
 				for (idx = (short)0; idx < MAX_SLOTS; ++idx) {
@@ -2454,7 +2463,7 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			pin = pukPin;
 			break;
 		default:
-			ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2);
+			ISOException.throwIt((short)0x6A88);
 			return;
 		}
 
@@ -2479,8 +2488,16 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			return;
 		}
 
-		if (!pin.isValidated() &&
-		    !pin.check(buffer, oldPinOff, (byte)8)) {
+		/*
+		 * According to the PIV spec, if the PIN is blocked we should
+		 * return 0x6983 here (SW_FILE_INVALID).
+		 */
+		if (pin.getTriesRemaining() == 0) {
+			ISOException.throwIt(ISO7816.SW_FILE_INVALID);
+			return;
+		}
+
+		if (!pin.check(buffer, oldPinOff, (byte)8)) {
 			ISOException.throwIt((short)(
 			    (short)0x63C0 | pin.getTriesRemaining()));
 			return;
@@ -2526,7 +2543,10 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			pin = pivPin;
 			break;
 		default:
-			ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2);
+			/*
+			 * 800-73-4 part 2 3.2.3
+			 */
+			ISOException.throwIt((short)0x6A88);
 			return;
 		}
 
@@ -2551,8 +2571,16 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			return;
 		}
 
-		if (!pukPin.isValidated() &&
-		    !pukPin.check(buffer, pukOff, (byte)8)) {
+		/*
+		 * According to the PIV spec, if the PUK is blocked we should
+		 * return 0x6983 here (SW_FILE_INVALID).
+		 */
+		if (pukPin.getTriesRemaining() == 0) {
+			ISOException.throwIt(ISO7816.SW_FILE_INVALID);
+			return;
+		}
+
+		if (!pukPin.check(buffer, pukOff, (byte)8)) {
 			ISOException.throwIt((short)(
 			    (short)0x63C0 | pukPin.getTriesRemaining()));
 			return;

From fd39765fb4aad70557dd666a1b6beb6e620394fd Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@cooperi.net>
Date: Mon, 22 Aug 2022 14:24:01 +1000
Subject: [PATCH 5/7] ykpivtool needs slashes at end of DNs now

---
 test/simulator-tests | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/test/simulator-tests b/test/simulator-tests
index f2c3b7e..048883a 100755
--- a/test/simulator-tests
+++ b/test/simulator-tests
@@ -10,6 +10,11 @@ TestDir = __dir__
 $pin = DefaultPin
 $guid = nil
 
+if Reader.nil?
+	STDERR.puts "requires reader name"
+	exit 1
+end
+
 def ykpivtool(*opts)
 	cmd = "yubico-piv-tool -r '#{Reader}'"
 	opts.each do |opt|
@@ -22,7 +27,7 @@ def ykpivtool(*opts)
 			cmd += " #{opt}"
 		end
 	end
-	`#{cmd} 2>/dev/null`
+	`#{cmd} 2>&1`
 end
 
 class TestYubicoBasic < Minitest::Test
@@ -62,7 +67,7 @@ class TestYubicoBasic < Minitest::Test
 
 	def test_05_selfsign
 		out = ykpivtool(:verify_pin, :selfsign_certificate,
-			'-s 9a', '-S "/CN=test"', "< #{TestDir}/pubkey-9a.pem")
+			'-s 9a', '-S "/CN=test/"', "< #{TestDir}/pubkey-9a.pem")
 		assert_equal(0, $?)
 		assert_match(/^-----BEGIN CERTIFICATE-----$/, out)
 
@@ -110,8 +115,8 @@ class TestYubicoAlgs < Minitest::Test
 
 	def test_02_selfsign_rsa1024
 		out = ykpivtool(:selfsign_certificate, '-s 9e',
-			'-S "/CN=test"', "< #{TestDir}/pubkey-9e.pem")
-		assert_equal(0, $?)
+			'-S "/CN=test/"', "< #{TestDir}/pubkey-9e.pem")
+		assert_equal(0, $?, out)
 		assert_match(/^-----BEGIN CERTIFICATE-----$/, out)
 
 		cert = OpenSSL::X509::Certificate.new(out)
@@ -136,7 +141,7 @@ class TestYubicoAlgs < Minitest::Test
 
 	def test_04_selfsign_rsa2048
 		out = ykpivtool(:selfsign_certificate, '-s 9e',
-			'-S "/CN=test"', "< #{TestDir}/pubkey-9e.pem")
+			'-S "/CN=test/"', "< #{TestDir}/pubkey-9e.pem")
 		assert_equal(0, $?)
 		assert_match(/^-----BEGIN CERTIFICATE-----$/, out)
 
@@ -162,7 +167,7 @@ class TestYubicoAlgs < Minitest::Test
 
 	def test_06_selfsign_eccp384
 		out = ykpivtool(:selfsign_certificate, '-s 9e',
-			'-S "/CN=test"', "< #{TestDir}/pubkey-9e.pem")
+			'-S "/CN=test/"', "< #{TestDir}/pubkey-9e.pem")
 		assert_equal(0, $?)
 		assert_match(/^-----BEGIN CERTIFICATE-----$/, out)
 
@@ -321,11 +326,11 @@ class TestPivyBasic < Minitest::Test
 		assert_equal(0, $?)
 		assert_match(/device: #{Reader}/, out)
 		assert_match(/applet: PivApplet v[0-9.]+/, out)
-		assert_match(/yubico: .* \(v5\.3\.0\)$/, out)
+		assert_match(/yubico: .* \(v5\.[0-9]+\.[0-9]+\)$/, out)
 	end
 
 	def test_02_set_admin
-		out = `pivy-tool -g #{$guid} set-admin random`
+		out = `pivy-tool -g #{$guid} -P #{DefaultPin} set-admin random`
 		assert_equal(0, $?)
 
 		ykpivtool(:generate, '-s 9e', '-A RSA1024')
@@ -388,7 +393,7 @@ class TestPivyBasic < Minitest::Test
 		assert(/^881a8918([0-9a-fA-F]+)$/.match(out))
 		@adminkey = $1
 
-		out = `pivy-tool -g #{$guid} -K #{@adminkey} set-admin default`
+		out = `pivy-tool -g #{$guid} -K #{@adminkey} -P #{DefaultPin} set-admin default`
 		assert_equal(0, $?)
 
 		ykpivtool(:generate, '-s 9e', '-A RSA1024')

From 472ac03427cf1d7b2e44b12d5379cfffd74d27dc Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@cooperi.net>
Date: Mon, 22 Aug 2022 14:26:43 +1000
Subject: [PATCH 6/7] simulator tests: let pivy get the admin key out of pinfo

---
 test/simulator-tests | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/test/simulator-tests b/test/simulator-tests
index 048883a..6daa66e 100755
--- a/test/simulator-tests
+++ b/test/simulator-tests
@@ -386,14 +386,7 @@ class TestPivyBasic < Minitest::Test
 	end
 
 	def test_07_reset_admin
-		# pivy-tool set-admin doesn't yet get the pinfo admin key in
-		# 0.5.0 :( change this after next ver?
-		out = ykpivtool(:verify_pin, :read_object, '--id 0x5FC109')
-		assert_equal(0, $?)
-		assert(/^881a8918([0-9a-fA-F]+)$/.match(out))
-		@adminkey = $1
-
-		out = `pivy-tool -g #{$guid} -K #{@adminkey} -P #{DefaultPin} set-admin default`
+		out = `pivy-tool -g #{$guid} -P #{DefaultPin} set-admin default`
 		assert_equal(0, $?)
 
 		ykpivtool(:generate, '-s 9e', '-A RSA1024')

From 5cb14a9e8d16e92fbad73dcad86a219a9210554f Mon Sep 17 00:00:00 2001
From: Alex Wilson <alex@cooperi.net>
Date: Mon, 22 Aug 2022 15:08:02 +1000
Subject: [PATCH 7/7] Don't allow PUK with VERIFY, support VERIFY with P1=FF

---
 src/net/cooperi/pivapplet/PivApplet.java | 111 +++++++++++++++--------
 1 file changed, 73 insertions(+), 38 deletions(-)

diff --git a/src/net/cooperi/pivapplet/PivApplet.java b/src/net/cooperi/pivapplet/PivApplet.java
index 69ac7c5..9abbfeb 100644
--- a/src/net/cooperi/pivapplet/PivApplet.java
+++ b/src/net/cooperi/pivapplet/PivApplet.java
@@ -780,7 +780,7 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			case PIV_ALG_ECCP384:
 				ECPublicKey epubk =
 				    (ECPublicKey)slot.asym.getPublic();
-				final short eclen = (short)(epubk.getSize() / 4);
+				final short eclen = (short)(epubk.getSize() / 2);
 
 				wtlv.push((byte)0x04, (short)(eclen + 4));
 				wtlv.push((byte)0x86, (short)(eclen + 1));
@@ -2358,6 +2358,7 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		final byte[] buffer = apdu.getBuffer();
 		short lc, pinOff, idx;
 		final OwnerPIN pin;
+		short sw = (short)0;
 
 		if (buffer[ISO7816.OFFSET_P1] != (byte)0x00 &&
 		    buffer[ISO7816.OFFSET_P1] != (byte)0xFF) {
@@ -2369,11 +2370,8 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		case (byte)0x80:
 			pin = pivPin;
 			break;
-		case (byte)0x81:
-			pin = pukPin;
-			break;
 		default:
-			ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2);
+			ISOException.throwIt((short)0x6A88);
 			return;
 		}
 
@@ -2393,20 +2391,6 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		pinOff = ISO7816.OFFSET_CDATA;
 #endif*/
 
-		if (lc == 0 && pin.isValidated()) {
-			ISOException.throwIt(ISO7816.SW_NO_ERROR);
-			return;
-		} else if (lc == 0) {
-			ISOException.throwIt((short)(
-			    (short)0x63C0 | pin.getTriesRemaining()));
-			return;
-		}
-
-		if (lc != 8) {
-			ISOException.throwIt(ISO7816.SW_WRONG_DATA);
-			return;
-		}
-
 		/*
 		 * According to the PIV spec, if the PIN is blocked we should
 		 * return 0x6983 here (SW_FILE_INVALID).
@@ -2416,31 +2400,42 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 			return;
 		}
 
-		if (!pin.check(buffer, pinOff, (byte)8)) {
-			if (pukPin.getTriesRemaining() == 0) {
-				for (idx = (short)0; idx < MAX_SLOTS; ++idx) {
-					final PivSlot slot = slots[idx];
-					if (slot == null)
-						continue;
-					if (slot.asym == null)
-						continue;
-					slot.asym.getPrivate().clearKey();
-				}
+		/* P1 = FF means "set security status to false" */
+		if (buffer[ISO7816.OFFSET_P1] == (byte)0xFF) {
+			if (pin.isValidated())
+				pin.reset();
+			syncSecurityStatus();
+			ISOException.throwIt(ISO7816.SW_NO_ERROR);
+			return;
+		}
+
+		if (lc == 0) {
+			/* P1 = 00 with Lc = 00 and no data: is PIN cached? */
+			if (pin.isValidated()) {
+				ISOException.throwIt(ISO7816.SW_NO_ERROR);
+				return;
+
+			} else {
+				ISOException.throwIt((short)(
+				    (short)0x63C0 | pin.getTriesRemaining()));
+				return;
 			}
+		}
+
+		if (lc != 8) {
+			ISOException.throwIt(ISO7816.SW_WRONG_DATA);
+			return;
+		}
+
+		if (!pin.check(buffer, pinOff, (byte)8)) {
+			eraseKeysIfPukPinBlocked();
+			syncSecurityStatus();
 			ISOException.throwIt((short)(
 			    (short)0x63C0 | pin.getTriesRemaining()));
 			return;
 		}
 
-		for (idx = (short)0; idx < MAX_SLOTS; ++idx) {
-			final PivSlot slot = slots[idx];
-			if (slot == null)
-				continue;
-			if (idx == SLOT_9B)
-				continue;
-			slot.flags[PivSlot.F_UNLOCKED] = true;
-			slot.flags[PivSlot.F_AFTER_VERIFY] = false;
-		}
+		syncSecurityStatus();
 	}
 
 	private void
@@ -2498,6 +2493,7 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		}
 
 		if (!pin.check(buffer, oldPinOff, (byte)8)) {
+			eraseKeysIfPukPinBlocked();
 			ISOException.throwIt((short)(
 			    (short)0x63C0 | pin.getTriesRemaining()));
 			return;
@@ -2581,6 +2577,7 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		}
 
 		if (!pukPin.check(buffer, pukOff, (byte)8)) {
+			eraseKeysIfPukPinBlocked();
 			ISOException.throwIt((short)(
 			    (short)0x63C0 | pukPin.getTriesRemaining()));
 			return;
@@ -2966,6 +2963,44 @@ else if (key == (byte)0x81 && pukPinIsDefault)
 		sendOutgoing(apdu);
 	}
 
+	private void
+	syncSecurityStatus()
+	{
+		short idx;
+
+		for (idx = (short)0; idx < MAX_SLOTS; ++idx) {
+			final PivSlot slot = slots[idx];
+			if (slot == null)
+				continue;
+			if (idx == SLOT_9B)
+				continue;
+			slot.flags[PivSlot.F_UNLOCKED] = pivPin.isValidated();
+			slot.flags[PivSlot.F_AFTER_VERIFY] = false;
+		}
+	}
+
+	private void
+	eraseKeysIfPukPinBlocked()
+	{
+		short idx;
+
+		if (pivPin.isValidated() || pukPin.isValidated())
+			return;
+		if (pivPin.getTriesRemaining() > (byte)0)
+			return;
+		if (pukPin.getTriesRemaining() > (byte)0)
+			return;
+
+		for (idx = (short)0; idx < MAX_SLOTS; ++idx) {
+			final PivSlot slot = slots[idx];
+			if (slot == null)
+				continue;
+			if (slot.asym == null)
+				continue;
+			slot.asym.getPrivate().clearKey();
+		}
+	}
+
 	private void
 	initCARDCAP()
 	{