JavaCard OS

INITIALIZE UPDATE and EXTERNAL AUTHENTICATE commands are used to prove if we are the authentic user.

As GP2.1.1 said, INITIALIZE UPDATE and EXTERNAL AUTHENTICATE command is as follows





There is also a VERIFYING process with CLA 20 P1 P2 Lc Data Le

My question:
What is the difference between the two authentication process and the VERIFYING process?
In my opinion, any one process of them can meet the authentication need.

INITIALIZE UPDATE & EXTERNAL AUTHENTICATE are used for GP card content management to establish a secure channel protocol connection. After authentication is verified you can upload an applet (cap file). The VERIFYING command is an ISO7816-4 Interindustry command http://www.cardwerk.com/smartcards/smar ... x#chap6_12 used to verify a PIN. The GP command is supported by the A40CR because it's a JavaCard

rena2019 wrote:INITIALIZE UPDATE & EXTERNAL AUTHENTICATE are used for GP card content management to establish a secure channel protocol connection. After authentication is verified you can upload an applet (cap file). The VERIFYING command is an ISO7816-4 Interindustry command http://www.cardwerk.com/smartcards/smar ... x#chap6_12 used to verify a PIN. The GP command is supported by the A40CR because it's a JavaCard

Thanks for your detailed reply. And I have a A22 javacard. Do you know what is the default PIN for verifying?