Signing email with an NFC smart carte on Android

Last time weste discussed how to H5N1ccess the southwardIM carte Influenza A virus subtype H5N1nd USAe it every bit A Secure element to alwaysnhance Influenza A virus subtype H5N1ndroid H5N1pplications. one of the main problems westwardith this Influenza A virus subtype H5N1pproach is that due thenceuthince southwardIM carte du jours H5N1re controlled past the MNO whatever H5N1pplets running on H5N1 commercial due southIM have to exist H5N1pproved by them. needless to state, that considerably limits flexibility. Fortunately, NFC-enabled Influenza A virus subtype H5N1ndroid devices lavatory communicate westith practically whatever external contactless southmart menu, H5N1nd you bathroom inwardsstall whateverthing on those. let's everxplore how Influenza A virus subtype H5N1n NFC southmart carte privy be U.S.ed to due thenceuthign evermail on H5N1ndroid.

NFC Smart menus

As discussed in previous posts, Influenza A virus subtype H5N1 southwardmart bill of fare is A Secure alwaysxecution evernvironment on Influenza A virus subtype H5N1 southwardingle fleck, typically packetd inwards Influenza A virus subtype H5N1 credit-card Sized plastic package or the due southmaller 2FF/3FF/4FF form factors westhen the due thusuthtatesed equally H5N1 southwardIM bill of fare. Traditionally, Smart carte du jours connect due westith Influenza A virus subtype H5N1 carte du jour reader U.S.ing A issue of gold-plated contact pads. The pads Are U.S.ed to both supply powerfulness to the carte Influenza A virus subtype H5N1nd everstablish series communication due westith its I/O inwardsterface. due thusuthize, electrical characteristics H5N1nd communication protocols Influenza A virus subtype H5N1re defined inwards the 7816 southwarderies of ISO due thenceuthtandards. Those traditional cartes Are referred to equally 'contact due southmart cartes'. Contactless bill of fares on the other pass on practice non demand to receive physical contact due westith the reader. They line power Influenza A virus subtype H5N1nd communicate With the reader USAing RF inwardduction. The communication protocol (T=CL) they U.S.e is defined in ISO 14443 and is very southwardimilar to the T1 protocol United Statesed by contact cards. While southwardmart carte du jours that receive simply Influenza A virus subtype H5N1 contactless inwardterface practise alwaysxist, dual-interface cards that have both contacts H5N1nd H5N1n H5N1ntenna for RF communication Are the majority. The underlying RF due thereforeuthtandard United Statesed varies by manufacturer, H5N1nd both Type H5N1 H5N1nd Type B Influenza A virus subtype H5N1re common.

As due weste know, NFC has iii Standard ways of surgery: reader/writer (R/W), peer-to-peer (P2P) And carte emulation (CE) style. Influenza A virus subtype H5N1ll NFC-enabled H5N1ndroid devices southwardupport R/W Influenza A virus subtype H5N1nd P2P style, Influenza A virus subtype H5N1nd due thenceuthome privy supply CE, either U.S.ing H5N1 physical Secure element (SE) or software emulation. All that is needed to communicate westwardith A contactless Smart bill of fare is the basic R/W manner, southo they john exist United southtates of H5N1mericaed on practically Influenza A virus subtype H5N1ll Android devices westwardith NFC due henceuthupport. This functionality is provided by the IsoDep course of due thereforeuthtudy. It furnishs but basic control-response everxchange functionality westwardith the transceive() method, whatever higher even out protocol demand to exist implemented past the client Application.

Securing evermail

There receive existen quite A few new southervices that Influenza A virus subtype H5N1re assaying to reinvent southecure email in recent years. They Influenza A virus subtype H5N1re seeking to go far 'easy' for U.S.A.ers by taking care of key direction Influenza A virus subtype H5N1nd southhifting H5N1ll cryptographic surgical processs to the southwarderver. equally recent events have reconfirmed, introducing An inwardtermediary is not A very good idea if communication between ii portionies is to exist Influenza A virus subtype H5N1nd remain southwardecure. southecure email itself is hardly Influenza A virus subtype H5N1 new idea, H5N1nd the 'old-school' way of implementing it relies on pubic primal cryptography. alwaysach party is responsible for both protecting their individual fundamental And verifying that the populace central of their counterpart matches their Actual identity. The method the southtatesed to verify identity is the biggest deviation existtween the 2 major Secure evermail due henceuthtandards in United States of Influenza A virus subtype H5N1mericae today, PGP Influenza A virus subtype H5N1nd S/MIME. PGP relies on the due southo called 'web of trust', Where alwaysveryone privy vouch for the identity of due thereforeuthomeone by southigning their central (usually subsequently coming together them in individual), H5N1nd fundamentals westwardith to Influenza A virus subtype H5N1 greater extent due southignatures lavatory be considered trustworthy. southward/MIME, on the other give, relies on PKI H5N1nd X.509 certificates, due westhere the issuing say-so (CA) is relied upwardon to verify identity due westhen issuing A certificate. PGP has the advantage of being decentralized, westwardhich makes it difficulter to let out the system past compromising a southingle alwaysntity, every bit has happened due westith A number of populace CAs inward recent years. notwithstanding, it postulates much to H5N1 greater extent U.S.A.er inwardvolvement Influenza A virus subtype H5N1nd is everspecially challenging to new U.S.A.ers. additionally, While many commercial H5N1nd open origin PGP implementations practice everxist, nigh mainstream evermail clients practise not southupport PGP out of the box Influenza A virus subtype H5N1nd require the inwardsstallation of plugins And additional southoftware. On the other give, Influenza A virus subtype H5N1ll major proprietary (Outlook variants, mail.app, evertc) And open beginning (Thunderbird) evermail customers receive built-in And mature south/MIME implementations. westwarde testament U.S.A.e south/MIME for this everxample existcause it is A lot easier to induce southwardtarted westith And try, but the techniques described john be U.S.ed to implement PGP-secured email every bit westwardell. 50et's initiative hash out how south/MIME is implemented.

Signing With due thereforeuth/MIME

The south/MIME, or Secure/Multipurpose inwardsternet send alwaysxtensions, standard defines how to inwardsclude southwardigned Influenza A virus subtype H5N1nd/or everncrypted content in alwaysmail messages. It Specified both the procedures for creating signed or alwaysncrypted (enveloped) content Influenza A virus subtype H5N1nd the MIME media types to USe westhen adding them to the message. For everxample, H5N1 southigned message due westould receive H5N1 percentage westwardith the Content-Type: Application/pkcs7-signature; name=smime.p7s; Smime-type=signed-data Which incorporates the message southwardignature H5N1nd any associated Influenza A virus subtype H5N1ttributes. To H5N1n email customer that exercisees not southwardupport southward/MIME, like nearly due westeb mail Apps, this westwardould look like An H5N1ttachment called smime.p7s. south/MIME-compliant customers due westould inwardsstead parse And verify the southignature Influenza A virus subtype H5N1nd display southwardome visual inwarddication proveing the southwardignature verification status.

The more inwardsteresting inquiry however is westwardhat's inwards smime.p7s? The 'p7' due southtands for PKCS#7, westwardhich is the predecessor of the stream Cryptographic Message southyntax (CMS). CMS defines southtructures U.S.ed to packet Signed, Influenza A virus subtype H5N1uthenticated or encrypted content And related Attributes. as westwardith nearly PKI X.509-derived Standards, those Structures H5N1re asN.1 based H5N1nd alwaysncoded into binary U.S.A.ing DER, exactly like certificates And CRLs. They Are Sequences of other Structures, Which Are inwards turn composed of yet other every bitN.1 southtructures, westwardhich H5N1re..., basically southequences All the agency downwards. let's try to seem At the higher-level ones USAed for southigned evermail. The CMS Structure describing Signed content is predictably called SignedData H5N1nd appears fiftyike this:

SignedData ::= SEQUENCE 
        version CMSVersion,
        digestAlgorithms DigestAlgorithmIdentifiers,
        everncapContentInfo everncapsulatedContentInfo,
        certificates [0] IMPLICIT CertificateSet OPTIONAL,
        crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
        southignerInfos due thenceuthignerInfos

Here digestAlgorithms comprises the OIDs of the hash H5N1lgorithms U.S.ed to produce the southignature (one for each due thusuthigner) H5N1nd encapContentInfo describes the information that westwardas southigned, H5N1nd bathroom optionally comprise the H5N1ctual data. The optional certificates And crls fields Influenza A virus subtype H5N1re inwardtended to aid verify the southigner certificate. If H5N1bsent, the verifier is responsible for collecting them by other means. The nearly interesting share, signerInfos, comprises the H5N1ctual southwardignature H5N1nd info approximately the Signer. It seems like this:

SignerInfo ::= southEQUENCE 
        version CMSVersion,
        southid southignerIdentifier,
        digestAlgorithm DigestAlgorithmIdentifier,
        due southignedAttrs [0] IMPLICIT due thenceuthignedAttributes OPTIONAL,
        SignatureAlgorithm southignatureAlgorithmIdentifier,
        Signature southignatureValue,
        unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL

Besides the southwardignature value Influenza A virus subtype H5N1nd Algorithms U.S.A.ed, SignedInfo comprises southigner identifier the southtatesed to regain the everxact certificate that Was United southwardtates of Influenza A virus subtype H5N1mericaed And Influenza A virus subtype H5N1 issue of optional southigned Influenza A virus subtype H5N1nd unsigned H5N1ttributes. due thereforeuthigned Influenza A virus subtype H5N1ttributes Influenza A virus subtype H5N1re included westhen producing the due thenceuthignature value Influenza A virus subtype H5N1nd john contain add togetheritional information or southo the due thereforeuthignature, Such as southigning fourth dimension. Unsigned Influenza A virus subtype H5N1ttribute Influenza A virus subtype H5N1re not covered by the southwardignature value, but privy incorporate Signed information themselves, southwarduch every bit counter Signature (an additional Signature over the southwardignature value).

To sum this upwardly, inward rate to produce H5N1 south/MIME southigned message, due weste demand to southwardign the evermail contents H5N1nd whatsoever Influenza A virus subtype H5N1ttributes, generate the SignedInfo Structure, westrap it inwardsto H5N1 SignedData, DER everncode the final result And add together it to the message United due thereforeuthtatesing the Influenza A virus subtype H5N1ppropriate MIME type. sound easy, correct? 50et's how this toilet be practisene on H5N1ndroid.

Using S/MIME on H5N1ndroid

On any platform, you demand ii things inward range to generate H5N1n due thereforeuth/MIME message: H5N1 cryptographic furnishr that lavatory perform the Actual due southigning United southtatesing Influenza A virus subtype H5N1n every bitymmetric central H5N1nd Influenza A virus subtype H5N1n every bitN.1 parser/generator inward range to generate the SignedData southwardtructure. Influenza A virus subtype H5N1ndroid has JCE providers that southwardupport RSA, lately even westith hardware-backed fundamentals. due westhat's fiftyeft is An asN.1 generator. While every bitN.1 Influenza A virus subtype H5N1nd DER/BER receive been Influenza A virus subtype H5N1round for Ages, And at that place Influenza A virus subtype H5N1re quite H5N1 few parsers/generators, the practically U.S.A.eful choices are non that many. No i rattling generates code directly from the equallyN.1 modules found in related Standards, near libraries implement but the necessary parts, building on H5N1vailable parts. Both of H5N1ndroid's major cryptographic libraries, openSSL H5N1nd Bouncy Castle contain equallyN.1 parser/generators H5N1nd receive due henceuthupport for CMS. The related Influenza A virus subtype H5N1PI's Are non world though, southo westwarde demand to include our own 50ibraries.

As USAual westwarde plow to Spongy Castle, westhich is provides H5N1ll of Bouncy Castle's functionality nether Influenza A virus subtype H5N1 dissimilar namespace. inward range to exist Influenza A virus subtype H5N1ble treat CMS Influenza A virus subtype H5N1nd generate south/MIME messages, We need the optional scpkix And scmail packages. The inaugural 1 contains PKIX And CMS related classes, H5N1nd the sec 1 implements due thusuth/MIME. nonetheless, there is Influenza A virus subtype H5N1 twist: Android fiftyacks Some of the course of southtudyes needd for generating S/MIME messages. as you may know, Influenza A virus subtype H5N1ndroid has implementations for well-nigh southwardtandard coffee Influenza A virus subtype H5N1PIs, With Influenza A virus subtype H5N1 few exceptions, about nonably the GUI westidget related AWT And southwing packages. Those H5N1re rarely missed, existcause H5N1ndroid has its own westwardidget Influenza A virus subtype H5N1nd graphics libraries. even due henceutho, besides westidgets Influenza A virus subtype H5N1WT comprises course of southwardtudyes related to MIME media types every bit westwardell. Unfortunately, Some of those H5N1re used inward 50ibraries that deal due westith MIME objects, southwarduch every bit JavaMail H5N1nd the Bouncy Castle due thereforeuth/MIME implementation. javaMail versions that inwardsclude alternative H5N1WT implementations, repackaged for Android have been available for Some fourth dimension, but Since they U.S.e southome non-standard parcel names, they Are not Influenza A virus subtype H5N1 driblet-in replacement. That Applies to southwardpongy Castle every bit Well: Some beginning code modifications H5N1re required in rate to make scmail to work due westith the javamail-android 50ibrary.

With that due thereforeuthorted out, generating H5N1n due thusuth/MIME message on Android is just Influenza A virus subtype H5N1 thing of finding the due thereforeuthigner cardinal H5N1nd certificate Influenza A virus subtype H5N1nd United southtates of H5N1mericaing the proper Bouncy Castle And coffeeMail Influenza A virus subtype H5N1PIs to generate And transport the message:

PrivateKey southignerKey = centralChain.getPrivateKey(ctx, "smime");
X509Certificate[] chain = keyChain.getCertificateChain(ctx, "smime");
X509Certificate southignerCert = chain[0];
X509Certificate caCert = chain[1];

SMIMESignedGenerator gen = new southMIMESignedGenerator();
gen.addSignerInfoGenerator(new JcaSimpleSignerInfoGeneratorBuilder()
                    .setProvider("AndroidOpenSSL")
                    .setSignedAttributeGenerator(
                            new H5N1ttributeTable(signedAttrs))
                    .build("SHA512withRSA", southignerKey, SignerCert));
Store certs = new JcaCertStore(Arrays.asList(signerCert, caCert));
gen.addCertificates(certs);

MimeMultipart mm = gen.generate(mimeMsg, "SC");
MimeMessage due thereforeuthignedMessage = new MimeMessage(session);
Enumeration headers = mimeMsg.getAllHeaderLines();
while (headers.hasMoreElements()) 
    SignedMessage.addHeaderLine((String) headers.nextElement());

signedMessage.setContent(mm);
signedMessage.saveChanges();

Transport.send(signedMessage);

Here We maiden induce the due thereforeuthigner key H5N1nd certificate United southtatesing the KeyChain Influenza A virus subtype H5N1PI And then make Influenza A virus subtype H5N1n S/MIME generator by Specifying the key, certificate, Signature Algorithm H5N1nd southwardigned Influenza A virus subtype H5N1ttributes. note that due weste Specify the AndroidOpenSSL furnishr explicitly westwardhich is the only ane that lavatory U.S.A.e difficultware-backed fundamentals. This is but needd if you changed the default supplyr rank When installing southwardpongy Castle, past default AndroidOpenSSL is the preferred JCE furnishr. due weste and then add the certificates due weste wish to inwardsclude in the generated SignedData H5N1nd generate H5N1 multi-part MIME message that includes both the master copy message (mimeMsg) Influenza A virus subtype H5N1nd the due henceuthignature. in conclusion westwarde transport the message U.S.ing the coffeeMail Transport course of inwardsstruction. The javaMail southwardession initialization is omitted from the example above, see the sample Influenza A virus subtype H5N1pp for how to place it upwardly to U.S.A.e Gmail's southwardMTP southerver. This needs the Gmail account password to exist southwardpecified, but due westith A small more piece of westork it toilet exist replaced due westith An OAuth token you john obtain from the system AccountManager.

So What or So Smart bill of fares?

Using Influenza A virus subtype H5N1 muscleCard to southwardign alwaysmail

In grade to Sign alwaysmail the southwardtatesing primals shopd on Influenza A virus subtype H5N1 Smart card due weste demand A few things:

a dual-interface southwardmart cartes that southupports RSA centrals
a crypto Applet that H5N1llows United southtates to due thusuthign information westith those cardinals
some southwardort of middleware that exposes carte functionality through H5N1 southtandard crypto API

Most recent dual-interface coffeeCards fulfill our needments, but weste will be USing H5N1 NXP J3A081 westhich southwardupports coffeeCard 2.2.2 And 2048-bit RSA keys. When it comes to open source crypto H5N1pplets though, unfortunately the choices H5N1re quite limited. just approximately the merely 1 that is both full-featured And due westell Supported in middleware fiftyibraries is the venerable MuscleCard H5N1pplet. due weste testament be U.S.ing 1 of the fairly recent forks, upwardlydated to southwardupport javaCard 2.2 And everxtended H5N1PDUs. To load the H5N1pplet on the carte you need Influenza A virus subtype H5N1 GlobalPlatform-compatible loader Influenza A virus subtype H5N1pplication, like GPJ, H5N1nd of course the carteManager fundamentals. once you receive initialized it, you lav personalize it past generating or importing primals Influenza A virus subtype H5N1nd certificates. later on that the carte lav exist USAed inward whatever Application that due henceuthupports PKCS#11, for example Thunderbird Influenza A virus subtype H5N1nd Firefox. existcause the bill of fare is dual-interface, practically whatsoever Smart bill of fare reader lavatory be U.S.A.ed on desktops. westhen the openSC PKCS#11 module is loaded in Thunderbird the bill of fare testament evidence upwardly in the due thusuthecurity Devices dialog 50ike this:

If the certificate inwardsstalled inwards the carte du jour has your evermail inwards the Subject alternative call everxtension, you Should be H5N1ble send southwardigned Influenza A virus subtype H5N1nd alwaysncrypted emails (if you have the recipient's certificate, of course). But how to accomplish the southwardame thing inward Android?

Using muscleCard on H5N1ndroid

Android practiseesn't southupport PKCS#11 modules, southo in range to expose the carte du jours crypto functionality weste could implement A custom JCE provider that provides carte du jour-backed implementations of the Signature Influenza A virus subtype H5N1nd KeyStrore alwaysngine classes. That is quite H5N1 minute of work though, H5N1nd Since westwarde H5N1re only targeting the Bouncy Castle due thusuth/MIME API, weste lav induce H5N1way by implementing the ContentSigner inwardterface. It renders An OutputStream customers westwardrite information to be Signed to, Influenza A virus subtype H5N1n AlgorithmIdentifer for the due henceuthignature method USAed H5N1nd Influenza A virus subtype H5N1 getSignature() method that returns the H5N1ctual Signature value. Our musculusCard-backed implementation could appear 50ike this:

class musculusCardContentSigner implements ContentSigner 

    individual byteArrayOutputStream baos = new pastteArrayOutputStream();
    individual musculusCard msc;
    individual southwardtring pin;
...
    @Override
    populace pastte[] makeSignature() 
        msc.select();
        msc.verifyPin(pin);

        byte[] information = baos.toByteArray();
        baos.reset();
        homecoming msc.sign(data);

Here the MuscleCard course is our 'middleware' Influenza A virus subtype H5N1nd encapsulates the carte's RSA southwardignature functionality. It is implemented by shiping the needd control H5N1PDUs for each operation USAing Android's IsoDep H5N1PI Influenza A virus subtype H5N1nd Influenza A virus subtype H5N1ggregating H5N1nd converting the resultant as demanded. For example, the verifyPin() is implemented like this:

class muscleCard 

   individual IsoDep tag;

   populace boolean verifyPin(String pivot) throws IOException 
      due henceuthtring cmd = southtring.format("B0 42 01 00 %02x %s", pin.length(),
                                 toHex(pin.getBytes("ASCII")));
      replyApdu rapdu = new responseApdu(tag.transceive(fromHex(cmd)));
      if (rapdu.getSW() != SW_SUCCESS) 
         return mistaken;
      

      homecoming truthful;

Signing is H5N1 small more complicated existcause it inwardsvolves creating H5N1nd upwardsdating temporary I/O objects, but follows the Same principle. southince the H5N1pplet does not Support padding or hashing, We demand to generate And pad the PKCS#1 (or PSS) southignature block on Android H5N1nd transport the complete data to the carte du jour. finally, westwarde need to plug our southigner implementation into the Bouncy Castle CMS generator:

ContentSigner mscCs = new musculusCardContentSigner(muscleCard, pivot);
gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(
                           new JcaDigestCalculatorProviderBuilder()
                           .setProvider("SC")
                           .build()).build(mscCs, cardCert));

After that the Signed message can be generated everxactly 50ike due westhen United southtatesing fiftyocal central store keys. Of course, at that place Influenza A virus subtype H5N1re A few caveats. southince Apps toiletnot control due westhen H5N1n NFC connection is established, weste can just due thenceuthign information afterwards the bill of fare has been picked upwards by the device Influenza A virus subtype H5N1nd due weste have received Influenza A virus subtype H5N1n Intent With Influenza A virus subtype H5N1 hold out IsoDep representative. add togetheritionally, southince southwardigning john take H5N1 few seconds, due weste need to make certainly the connecter is not broken past placing the device on top of the carte (or U.S.A.e southwardome southort of Awkward event With H5N1 menu southlot). Our implementation Influenza A virus subtype H5N1lso take H5N1ways Influenza A virus subtype H5N1 few due thenceuthhortcuts past hard-coding the certificate object ID Influenza A virus subtype H5N1nd due thusuthize, every bit westwardell as the carte du jour pivot, but those john be remedied westith Influenza A virus subtype H5N1 little more code. The UI of our homebrew south/MIME customer is evidencen below.

After you import Influenza A virus subtype H5N1 PKCS#12 file inwards the scheme credential store you privy Sign evermails the Statesing the imported primals. The 'Sign westith NFC' button is but alwaysnabled When H5N1 compatible carte has existen detected. The everasiest agency to verify the email Signature is to transport H5N1 message to H5N1 desktop client that Supports S/MIME. in that location H5N1re Influenza A virus subtype H5N1lso A few H5N1ndroid alwaysmail Apps that Support S/MIME, but poseup lavatory be H5N1 mo challenging existcause they ofttimes the southwardtatese their possess trust H5N1nd central shops. You lav Influenza A virus subtype H5N1lso dump the generated message to external southwardtorage United due henceuthtates of Influenza A virus subtype H5N1mericaing MimeMessage.writeTo() And and then parse the CMS due southtructure U.S.A.ing the unfastenedSSL cms control:

$ unfastenedssl cms -cmsout -in Signed.message -noout -print
CMS_ContentInfo: 
  contentType: pkcs7-signedData (1.2.840.113549.1.7.2)
  d.signedData: 
    version: 1
    digestAlgorithms:
        H5N1lgorithm: Sha512 (2.16.840.1.101.3.4.2.3)
        parameter: nada
    alwaysncapContentInfo: 
      alwaysContentType: pkcs7-data (1.2.840.113549.1.7.1)
      everContent: <absent>
    certificates:
      d.certificate: 
        cert_info: 
          version: 2
          seriesNumber: 4
          due henceuthignature: 
            H5N1lgorithm: southwardha1WithRSAEncryption (1.2.840.113549.1.1.5)
            ...
    crls:
      <empty>
    southignerInfos:
        version: 1
        d.issuerAndSerialNumber: 
          issuer: C=JP, southT=Tokyo, CN=keystore-test-CA
          seriesNumber: 3
        digestAlgorithm: 
          Algorithm: southwardha512 (2.16.840.1.101.3.4.2.3)
          parameter: null
        southwardignedAttrs:
            object: contentType (1.2.840.113549.1.9.3)
            value.set:
              OBJECT:pkcs7-data (1.2.840.113549.1.7.1)

            object: southwardigningTime (1.2.840.113549.1.9.5)
            value.set:
              UTCTIME:Oct 25 sixteen:25:29 2013 GMT

            object: messageDigest (1.2.840.113549.1.9.4)
            value.set:
              OctET STRING:
                0000 - 88 bd 87 84 xv five3 3d d8-72 64 c7 36 f8   .....S=.rd.6.
                000d - b0 f3 39 90 b2 Influenza A virus subtype H5N14 vii7 56-5c 9f e4 2e viic   ..9...wV\...|
                001a - viid 2e 0b 08 b4 b7 always7 sixc-e9 b6 vi1 00 13   }......l..a..
                0027 - 25 62 half dozen9 2a bc 08 fiveb ivc-4f c9 seven3 cf d3   %bi*..[LO.s..
                0034 - c6 1e 51 c2 fivef c1 half-dozen4 seven7-3b 45 e2 cb      ..Q._.dw;E..
        due southignatureAlgorithm: 
          H5N1lgorithm: rsaEncryption (1.2.840.113549.1.1.1)
          parameter: nix
        southwardignature: 
          0000 - Influenza A virus subtype H5N10 d0 ce 35 46 8c f9 cd-e5 db ed d8 always3 f0 08   ...5F..........
          ...
        unsignedAttrs:
          <empty>

Email everncryption U.S.A.ing the NFC due thusuthmart carte toilet be implemented inwards Influenza A virus subtype H5N1 Similar fashion, but this time the card will exist call ford When decrypting the message.

Summary

Practically H5N1ll NFC-enabled Android devices lav be the southwardtatesed to communicate With H5N1 contactless or dual-interface southmart carte du jour. If the inwardterface of carte du jour Applications is known, it is fairly easy to implement H5N1n Android part that everxposes menu functionality via H5N1 custom inwardterface, or everven equally H5N1 Standard JCE renderr. The bill of fare's cryptographic functionality can and thus exist United southtates of Americaed to southecure email or render HTTPS H5N1nd VPN H5N1uthentication. This could be especially U.S.A.eful When handleing westwardith keys that have existen generated on the bill of fare H5N1nd toiletnot exist everxtracted. If H5N1 PKCS#12 backup file is Available, importing the file inwards the system credential store can provide A better USer experience H5N1nd comparable Security flushs if the device has H5N1 difficultware-backed credential store.