search

darconeous / gauss-key-card

Open source Java Card applet that allows you to unlock, start, or lock a Tesla Model 3 just like the official key card
Apache License 2.0
167 stars 26 forks source link

New compatible card suggestions? #4

Open twofieros opened 3 years ago

twofieros commented 3 years ago

I'm trying to program a few cards but this is my first foray into this java card stuff. I'm unable to locate a source for the two known working cards. Do you know of any other cards that would work? If not, can you maybe suggest your best guess as to which ones should work? I can report back here what I find. Thanks!

mattdibi commented 3 years ago

@twofieros Did you take a look here?

twofieros commented 3 years ago

Yup. The first working card shows unavailable and the second shows out of stock. I then googled the part number and I can't find the same. I can find cards without the last two letters in the part number but looking over the data sheets I can't tell if one will work vs another. I'm hoping someone has a good idea for other cards.

mattdibi commented 3 years ago

@twofieros Note that Smartcard Focus also sells J3H145-DI under "J3H145 Dual Interface" name.

darconeous commented 3 years ago

The worldwide chip shortage is likely contributing to card unavailability.

It's important to point out that just because a card is a "J3H145" doesn't mean that it will work with the card reader on a Tesla. The J3H145 can be "prepersonalized" (an irreversible step that sets the operating parameters of the secure element) in such a way that makes it incompatible.

~For example: this J3H145 card is NOT expected to work: it supports DESFire emulation and, thus, likely has an FSCI of 5—which was incompatible with the Tesla key readers the last time I tried. Otherwise the card would be perfect, it's really a shame. (Note that it is technically possible that a card might accept larger frames while advertising an FSCI of 5, or that a card that supports DESFire emulation might have an FSCI of 6 or larger, but I've never seen that in practice)~ Apparently, this card does work!

If you intend to buy some cards that aren't on the known-good list (even if the cards are advertised as J3H145) then you need to email the vendor and ask some very specific questions to make sure the card meets the requirements:

If the vendor can assure you that the card meets those requirements then it should work. Otherwise you are rolling the dice.

I think the ACOSJ cards should work, but I had fried my only sample ACOSJ card before I had a chance to test it.

darconeous commented 3 years ago

If you end up buying some cards to try out, make sure you write back here and let us know! I'll update the list with the results.

darconeous commented 3 years ago

Maybe this card would do the trick. It looks like they can prepersonalize it however you want, too:

The J3H082 is stocked in an un-initialized state, therefore certain features can be turn off and on, and a specific ATR can be set and need to be specified before purchasing.

So if you ask them to pre-personalize it in a way that ensures the FSCI is 8 and that it is Type-A, and that all of the EC stuff is enabled, then it should work. Hopefully they will sell to an individual.

darconeous commented 3 years ago

Argh, they only sell in quantities of 10 or more. Bulk order of their J3H145 variant, anyone?

mattdibi commented 3 years ago

@darconeous Actually I bought those cards I mentioned above and successfully used with your software (I should have mentioned it before sorry).

This is the card I used: https://www.smartcardfocus.com/shop/ilp/id~879/nxp-j3h145-dual-interface-java-card-144k/p/index.shtml

I can provide more informations about them if you need it.

darconeous commented 3 years ago

Oh excellent! Yes, if you could get me the FSCI value I'd be interested in seeing it. I'll add it to the list.

twofieros commented 3 years ago

@twofieros Note that Smartcard Focus also sells J3H145-DI under "J3H145 Dual Interface" name.

Thanks. Those are nearly the same price as an original Tesla keycard.

twofieros commented 3 years ago

@darconeous Actually I bought those cards I mentioned above and successfully used with your software (I should have mentioned it before sorry).

This is the card I used: https://www.smartcardfocus.com/shop/ilp/id~879/nxp-j3h145-dual-interface-java-card-144k/p/index.shtml

I can provide more informations about them if you need it.

I have to contact them. Their website isn't generating a shipping option to my house. If I can order these and someone else wants one I can ship some. They have a ten card minimum order.

Is there a way to order just the chips for these? Preferably by a count less than a roll of 40,000. Would the chips work or do they need to be preloaded with something?

mattdibi commented 3 years ago

@darconeous I might need some help to extract the information you requested (I'm still a noob in this field).

Here's the information I was able to extract from a blank card:

nfc-poll
NFC reader: ACS / ACR122U PICC Interface opened
NFC device will poll during 36000 ms (20 pollings of 300 ms for 6 modulations)
ISO/IEC 14443A (106 kbps) target:
    ATQA (SENS_RES): 00  48  
       UID (NFCID1): 04  51  55  ea  1a  53  80  
      SAK (SEL_RES): 20  
                ATS: 78  77  71  02  
Waiting for card removing...nfc_initiator_target_is_present: Target Released
pcsc_scan
PC/SC device scanner
V 1.4.25 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.14
Using reader plug'n play mechanism
Scanning present readers...
0: ACS ACR122U 00 00

Sat May 22 10:26:44 2021
Reader 0: ACS ACR122U 00 00
  Card state: Card removed, 

Sat May 22 10:26:48 2021
Reader 0: ACS ACR122U 00 00
  Card state: Card inserted, 
  ATR: 3B 80 80 01 01

ATR: 3B 80 80 01 01
+ TS = 3B --> Direct Convention
+ T0 = 80, Y(1): 1000, K: 0 (historical bytes)
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0 
-----
  TD(2) = 01 --> Y(i+1) = 0000, Protocol T = 1 
-----
+ Historical bytes: 
+ TCK = 01 (correct checksum)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B 80 80 01 01
    ISO 14443 Type B without historical bytes
    Electronic Passport
    Spanish passport (2012)

Sat May 22 10:26:48 2021
Reader 0: ACS ACR122U 00 00
  Card state: Card removed,
twofieros commented 3 years ago

Can these dual interface cards be dissolved in acetone like the Tesla key? I'm trying to implant them into an object with a home made antenna.

mattdibi commented 3 years ago

@twofieros Haven't tested it but I'm fairly confident they do. Do you want me to try?

twofieros commented 3 years ago

@twofieros Haven't tested it but I'm fairly confident they do. Do you want me to try?

That would be great if you could try it.

mattdibi commented 3 years ago

@twofieros Here you go.

Two notes:

20210530_142451 20210530_142505 20210530_142523 20210530_142711 20210530_161710 20210530_161720

darconeous commented 3 years ago

Pure acetone works best. If you are making your own "antenna", you may want to invest in a small network analyzer (like the nanovna) and make a small single-loop antenna so that you can test your tuning. You want it to be resonant at something close to 13.5MHz. I'd suggest trying to make a few antennas for MiFare chips first so that you can get the hang of it (an antenna for a MIFARE chip is almost certain to work properly on these chips, too—the capacitance is very similar).

You might also want to have a look at this article: https://medium.com/@darconeous/authentication-rings-part-1-2fe85c5d9d1b

twofieros commented 3 years ago

Pure acetone works best. If you are making your own "antenna", you may want to invest in a small network analyzer (like the nanovna) and make a small single-loop antenna so that you can test your tuning. You want it to be resonant at something close to 13.5MHz. I'd suggest trying to make a few antennas for MiFare chips first so that you can get the hang of it (an antenna for a MIFARE chip is almost certain to work properly on these chips, too—the capacitance is very similar).

You might also want to have a look at this article: https://medium.com/@darconeous/authentication-rings-part-1-2fe85c5d9d1b

Thank you for all that. I have a nanovna to analyze the antennas. I found the Tesla card is quite higher than 13.56mhz. I wonder if the car transmits a different frequency. I'm going to be out of town for a while so this project will have to wait a little longer.

Thanks for testing the card in acetone. I'll probably order some while I'm away from the house so they can be waiting for me when I return.

darconeous commented 2 years ago

I found the Tesla card is quite higher than 13.56mhz.

NFC cards are typically detuned slightly to improve performance when multiple NFC cards are stacked. Ideally, if you know you won't have other NFC tags in the field, you should tune as close to 13.56MHz as you can, as this will maximize reading distance.

If you are making a ring, keep in mind that your finger itself might detune the coil somewhat, so some research might be needed to figure out how to best tune the antenna to make it close to resonant at 13.56MHz when worn.

neo7530 commented 6 months ago

Btw. I can Report, that ACOSJ DI cards are working flawlessly. Bought a bunch of them for 5 Euro each.