<apps>
  <app name="starcos">

    <crypttoken typeName="starcoscard" subTypeName="starcos"
                name="STARCOSCard">

      <flags>
        <flag>manages_signseq</flag>
        <flag>predef_context_only</flag>
      </flags>
  
      <signinfos>

        <signinfo>
          <id>0x11</id>
          <hashalgo>sha1</hashalgo>
          <paddalgo>iso9796_2</paddalgo>
        </signinfo>

        <signinfo>
          <id>0x12</id>
          <hashalgo>sha1</hashalgo>
          <paddalgo>pkcs1_1</paddalgo>
        </signinfo>
        
        <signinfo>
          <id>0x21</id>
          <hashalgo>rmd160</hashalgo>
          <paddalgo>iso9796_2</paddalgo>
        </signinfo>

        <signinfo>
          <id>0x22</id>
          <hashalgo>rmd160</hashalgo>
          <paddalgo>pkcs1_1</paddalgo>
        </signinfo>

        <signinfo>
          <id>0x25</id>
          <hashalgo>rmd160</hashalgo>
          <paddalgo>iso9796_1a4</paddalgo>
        </signinfo>

        <signinfo>
          <id>0x26</id>
          <hashalgo>rmd160</hashalgo>
          <paddalgo>leftZero</paddalgo>
        </signinfo>

        <signinfo>
          <id>0x32</id>
          <hashalgo>md5</hashalgo>
          <paddalgo>pkcs1_1</paddalgo>
        </signinfo>

        <signinfo>
          <id>0x00</id>
          <hashalgo>any</hashalgo>
          <paddalgo>iso9796_1</paddalgo>
        </signinfo>

      </signinfos>
      

      <cryptinfos>

        <cryptinfo>
          <id>0x02</id>
          <cryptalgo>rsa</cryptalgo>
          <paddalgo>pkcs1_2</paddalgo>
        </cryptinfo>

        <cryptinfo>
          <id>0x03</id>
          <cryptalgo>rsa</cryptalgo>
          <paddalgo>leftZero</paddalgo>
        </cryptinfo>

      </cryptinfos>

      
      <keyinfos>

        <keyinfo>
          <keyId>0x81</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Signkey Account 1</keyDescription>
          <keyFlags>
            <flag>canSign</flag>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x82</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Signkey Account 2</keyDescription>
          <keyFlags>
            <flag>canSign</flag>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x83</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Signkey Account 3</keyDescription>
          <keyFlags>
            <flag>canSign</flag>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x84</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Signkey Account 4</keyDescription>
          <keyFlags>
            <flag>canSign</flag>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x85</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Signkey Account 5</keyDescription>
          <keyFlags>
            <flag>canSign</flag>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>


        <keyinfo>
          <keyId>0x86</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Cryptkey Account 1</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
            <flag>canDecrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x87</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Cryptkey Account 2</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
            <flag>canDecrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x88</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Cryptkey Account 3</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
            <flag>canDecrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x89</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Cryptkey Account 4</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
            <flag>canDecrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x8a</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>User Cryptkey Account 5</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
            <flag>canDecrypt</flag>
          </keyFlags>
        </keyinfo>


        <keyinfo>
          <keyId>0x91</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Signkey Account 1</keyDescription>
          <keyFlags>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x92</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Signkey Account 2</keyDescription>
          <keyFlags>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x93</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Signkey Account 3</keyDescription>
          <keyFlags>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x94</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Signkey Account 4</keyDescription>
          <keyFlags>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x95</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Signkey Account 5</keyDescription>
          <keyFlags>
            <flag>canVerify</flag>
            <flag>hasSignSeq</flag>
          </keyFlags>
        </keyinfo>


        <keyinfo>
          <keyId>0x96</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Cryptkey Account 1</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x97</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Cryptkey Account 2</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x98</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Cryptkey Account 3</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x99</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Cryptkey Account 4</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
          </keyFlags>
        </keyinfo>

        <keyinfo>
          <keyId>0x9a</keyId>
          <keySize>768</keySize>
          <minKeySize>768</minKeySize>
          <maxKeySize>768</maxKeySize>
          <chunksize>96</chunksize>
          <cryptalgo>rsa</cryptalgo>
          <keyDescription>Peer Cryptkey Account 5</keyDescription>
          <keyFlags>
            <flag>canEncrypt</flag>
          </keyFlags>
        </keyinfo>

      </keyinfos>
  
      <contexts>
        <!-- There are 5 contexts -->

        <context>
          <id>1</id>
          <description>Context for Account 1</description>
          
          <signkeyinfo id="0x81" />
          <verifykeyinfo id="0x91" />
  
          <signinfo>
            <id>0</id>
            <hashalgo>any</hashalgo>
            <paddalgo>any</paddalgo>
          </signinfo>
  
          <encryptKeyInfo id="0x96" />
          <decryptKeyInfo id="0x86" />
  
          <cryptinfo>
            <id>0</id>
            <cryptalgo>rsa</cryptalgo>
            <paddalgo>any</paddalgo>
          </cryptinfo>
        </context>

        <context>
          <id>2</id>
          <description>Context for Account 2</description>
          
          <signkeyinfo id="0x82" />
          <verifykeyinfo id="0x92" />
  
          <signinfo>
            <id>0</id>
            <hashalgo>any</hashalgo>
            <paddalgo>any</paddalgo>
          </signinfo>
  
          <encryptKeyInfo id="0x97" />
          <decryptKeyInfo id="0x87" />
  
          <cryptinfo>
            <id>0</id>
            <cryptalgo>rsa</cryptalgo>
            <paddalgo>any</paddalgo>
          </cryptinfo>
        </context>

        <context>
          <id>3</id>
          <description>Context for Account 3</description>
          
          <signkeyinfo id="0x83" />
          <verifykeyinfo id="0x93" />
  
          <signinfo>
            <id>0</id>
            <hashalgo>any</hashalgo>
            <paddalgo>any</paddalgo>
          </signinfo>
  
          <encryptKeyInfo id="0x98" />
          <decryptKeyInfo id="0x88" />
  
          <cryptinfo>
            <id>0</id>
            <cryptalgo>rsa</cryptalgo>
            <paddalgo>any</paddalgo>
          </cryptinfo>
        </context>

        <context>
          <id>4</id>
          <description>Context for Account 4</description>
          
          <signkeyinfo id="0x84" />
          <verifykeyinfo id="0x94" />
  
          <signinfo>
            <id>0</id>
            <hashalgo>any</hashalgo>
            <paddalgo>any</paddalgo>
          </signinfo>
  
          <encryptKeyInfo id="0x99" />
          <decryptKeyInfo id="0x89" />
  
          <cryptinfo>
            <id>0</id>
            <cryptalgo>rsa</cryptalgo>
            <paddalgo>any</paddalgo>
          </cryptinfo>
        </context>

        <context>
          <id>5</id>
          <description>Context for Account 5</description>
          
          <signkeyinfo id="0x85" />
          <verifykeyinfo id="0x95" />
  
          <signinfo>
            <id>0</id>
            <hashalgo>any</hashalgo>
            <paddalgo>any</paddalgo>
          </signinfo>
  
          <encryptKeyInfo id="0x9a" />
          <decryptKeyInfo id="0x8a" />
  
          <cryptinfo>
            <id>0</id>
            <cryptalgo>rsa</cryptalgo>
            <paddalgo>any</paddalgo>
          </cryptinfo>
        </context>

      </contexts>
      
    </crypttoken>




    <formats>

      <format name="EF_GD0">
        <ELEM name="ICCSN" type="tlv" minnum="1" maxnum="1" >
          <tlv id="0x5a">
            <ELEM name="branchKey" type="byte" bcd="1"  />
            <ELEM name="shortBankCode" type="bcd" size="3">
              <DESCR>
                First byte (BCD) shows the group:
                  21: oeffentlich-rechtliche und private banken
                  22: Privat- und Geschaeftsbanken
                  25: Sparkassen
                  26, 29: Genossenschaftsbanken
              </DESCR>
            </ELEM>
            <ELEM name="cardNumber" type="bcd" size="5" />
            <ELEM name="checksum" type="byte" bcd="1" />
          </tlv>
        </ELEM>
      </format>

      <format name="KeyLogDescr">
        <ELEM name="status" type="byte" >
          <DESCR>
            code ! key usable ! descr
            0x10 !    yes     ! key active
            0x0a !    no      ! inactive, use key with cert
            0x08 !    no      ! inactive, about to be overwritten
            0x07 !    no      ! (SK + PK neu beschrieben)
            0x02 !    yes     ! new key created
            0x01 !    yes     ! keynumber or -version missing
            0x00 !    yes     ! INI letter missing to activate
            Unused or deleted descriptors should be set to 
            08-5x-00-00-00-00-00-00
          </DESCR>
        </ELEM>
        <ELEM name="keyType" type="byte" >
          <DESCR>
            Signkey: 53, Cryptkey: 56
          </DESCR>
        </ELEM>
        <ELEM name="keyNum" type="ascii" size="3" lfiller="0x30" />
        <ELEM name="keyVer" type="ascii" size="3" lfiller="0x30" />
        
        <VALUES>
          <VALUE path="status">8</VALUE>
          <VALUE path="keyNum">0</VALUE>
          <VALUE path="keyVer">0</VALUE>
        </VALUES>
        
      </format>

      <format name="EF_KEY_LOG">
        <ELEM name="infoByte" type="byte" >
          <DESCR>
            Bit 7 6 5 4 3 2 1 0 descr
                1               buffer for old DS key: in use
                0               buffer for old DS key: free
                  x x x         max number of entries (1-5)
                        1       buffer for old EN key: in use
                        0       buffer for old EN key: free
                          x x x max number of entries (1-5)
            The maxmimum number of accounts can be derived from this:
            (max number of entries-2)/4
          </DESCR>
        </ELEM>
        <format type="KeyLogDescr" minnum="0" maxnum="0" />
      </format>

      <format name="IpfKey">
        <ELEM name="kid" type="byte" />
        <ELEM name="recordLen1" type="word" />
        <ELEM name="siAndCert" type="bytes" size="3">9a0f80</ELEM>
        <ELEM name="algoByte"  type="byte" >
          <DESCR>
            Bit 7 6 5 4 3 2 1 0 descr
                x x x x   x     RFU
                        1       modulus is in LSB first format (Intel)
                        0       modulus is in MSB first format
                            1 - DSA allowed
                            - 1 RSA allowed
            Mostly used:
            01: modulus is in MSB first format (big endian, 68000er)
            09: modulus is in LSB first format (little endian, Intel)
            The card stores the modulus in LSB first format so you might
            as well deliver it in that format.
          </DESCR>
        </ELEM>
        <ELEM name="akdByte" type="byte" >
          <DESCR>
            Bit 7 6 5 4 3 2 1 0 descr
                x x x           RFU
                      1         Compute signature allowed
                        1       Verify signature allowed
                          1     Read public key allowed
                            1   Decipher/encipher allowed
                              1 In/External authenticate allowed
            Mostly used:
            08: sign key
            02: crypt key
          </DESCR>
        </ELEM>
        <ELEM name="recordLen2" type="word" />
        <!-- Key Format List -->
        <ELEM name="kfl1" type="bytes" size="4">08010110</ELEM>
        <ELEM name="modLen" type="byte" />
        <ELEM name="kfl2" type="bytes" size="3">130300</ELEM>
        <ELEM name="emptyLen" type="byte">
          <DESCR>This is (0x60-modLen)</DESCR>
        </ELEM>
        <!-- Key -->
        <ELEM name="chid" type="byte" >
          <DESCR>This is the same as in kid</DESCR>
        </ELEM>
        <ELEM name="modAndExpo" type="bytes" size="101" filler="0x00" >
          <DESCR>
            The first modLen bytes belong to the modulus, followed by the 
            three byte exponent. The rest is empty space.
          </DESCR>
        </ELEM>
        
        <values>
          <value path="recordLen1">0x006d</value>
          <value path="recordLen2">0x806d</value>
        </values>
        
      </format>

      <format name="ipf" >
        <ELEM name="keyCount" type="byte" />
        <FORMAT type="IpfKey" minnum="0" maxnum="0" />
      </format>

      <format name="EF_CARD_VERSION">
        <ELEM name="publisherId" type="byte" >
          <descr>
            Publisher id:
              0x44: DSV
              0x47: DG (->VR-Networld)
          </descr>
        </ELEM>
        <ELEM name="version" type="word" />
        <ELEM name="askForPuk" type="byte" >
          <descr>
            Shows whether the user should be asked for the PUK when the error
            counter of the PIN as reached zero.
            0x00: no, 0x01: yes
          </descr>
        </ELEM>
      </format>

    </formats>


    <pins>
      <pin name="ch_pin" encoding="ascii" id="0x90" 
           minlen="4" maxlen="8" allowChange="1" filler="32" />
      <pin name="eg_pin" encoding="ascii" id="0x91" 
           minlen="4" maxlen="8" allowChange="1" filler="32" />
    </pins>

    <files>
      <ef name="EF_GD0" sid="0x2f02" 
          type="transparent"
          size="12" >
        <DESCR>
          This file contains the ICCSN according to ISO-7812-1
        </DESCR>
        <FORMAT type="EF_GD0" />
      </ef>

      <ef name="EF_CARD_VERSION" sid="0x2f05">
        <FORMAT type="EF_CARD_VERSION" />
      </ef>
  
      <df name="DF_BANKING" lid="d27600007448420110" >

        <files>
          <ef name="EF_IPF" sid="0xb300"
              type="transparent" >
            <DESCR>
              This file contains the public keys of the cardholder and the
              banks.
            </DESCR>
            <FORMAT type="ipf" />
          </ef>
          
          <ef name="EF_SEQ" sid="0xa601" 
              type="record" mode="linear" 
              size="4" minnum="1" >
            <DESCR>
              This file contains the signature counters for every account.
            </DESCR>
            <record>
              <ELEM name="seq" type="dword" />
            </record>
          </ef>
          
          <ef name="EF_BNK" sid="0xa603"
              type="record" mode="linear" 
              size="154" minnum="1" >
            <record>
              <ELEM name="country" type="ascii"
                    size="3" filler="32" condense="1" />
              <ELEM name="bankCode" type="ascii"   
                    size="30" filler="32" condense="1" />
              <ELEM name="userId" type="ascii"      
                    size="30" filler="32" condense="1" trust="3" />
              <ELEM name="comService" type="byte" bcd="1" />
              <ELEM name="comAddress" type="ascii"  
                    size="28" filler="32" condense="1" />
              <ELEM name="comSuffix" type="ascii"   
                    size="2" filler="32" condense="1" />
              <ELEM name="bankId" type="ascii"      
                    size="30" filler="32" condense="1" trust="3" />
              <ELEM name="systemId" type="ascii"      
                    size="30" filler="32" condense="1" trust="3" />
            </record>
          </ef>
  
          <ef name="EF_KEY_LOG" sid="0xa602"
              type="transparent">
          </ef>
          
        </files>  
      </df>
      
    </files>
  </app>
</apps>


