Use the Detail control in the header to switch every explanation between Beginner, Intermediate and Expert. Then jump to the Lab to watch these ideas happen on a real or simulated card.
Chapter 1What is the Oman eID?
It's the Omani national ID card — but with a tiny secure computer (a chip) inside. The chip can prove who you are online, hold a digital signature, and act as an e-passport, all protected so it can't be copied.
Chapter 2Anatomy of a smart card
The chip is a complete little computer with no screen or battery. It only wakes up in a reader, and it only ever receives a request, thinks, and sends an answer back.
Chapter 3APDUs — how we talk to a card
Every message to the card is a small command packet, and the card replies with data plus a 2-byte 'verdict' code. 9000 means OK.
Chapter 4TLV — how data is stored
Data on the card is packed as labelled boxes: a Tag (what it is), a Length (how big), and the Value (the contents).
Chapter 5GlobalPlatform & Java Card
Think of the card as a phone and the features as pre-installed apps. GlobalPlatform is the 'device admin + app store' that installs them and decides who's allowed to.
A0 00 00 00 18 43 4D 00A0 00 00 00 18 52 4F 50 01A0 00 00 00 18 0C 00 00 01 63 42 00A0 00 00 00 30 80 00 00 00 0A B1 00 01A0 00 00 06 47 2F 00 01A0 00 00 02 47 10 01Chapter 6Identifying a card
Before doing anything, we read three harmless things: the card's 'hello' (ATR), its 'birth certificate' (CPLC), and an identity tag that says Citizen vs Resident and Test vs real.
Chapter 7Keys & diversification
Every card shares one factory ‘master key’ family — but it would be dangerous if they were all identical. So each card mixes the master key with its own serial number to make keys that are unique to it. We never see the keys; we only see a short ‘fingerprint’ that proves they’re right.
Chapter 8SCP03 & staying safe
To manage the card you must prove you know its secret key. Both sides swap random numbers and compute a matching proof. The big danger: guessing wrong locks the card forever after only 3 tries. So our tool checks the card's proof first and only sends our reply when it already knows it will succeed — it can never lock the card.
Chapter 9Writing data & the safety gate
Reading is safe; writing changes the card. Personalization means writing the cardholder's details into little files on the chip. To make sure nothing happens by accident, the tool always asks you to confirm first — and real cards are protected until you deliberately turn writes on.
Chapter 10IAS, PKI & secure messaging
IAS is the part of the card that does digital signatures and proves your identity online, using public-key cryptography (PKI). Installing it is a card-management job done over the encrypted admin channel — so every command is signed to prove it really came from us and wasn't tampered with on the way.
→ Run IAS install in the Lab (sim)Chapter 11Lifecycle & dangerous operations
A card has a “life cycle” — stages from factory-fresh to retired. Some moves forward can never be undone, and a few operations can permanently brick the card. The tool is built so you can explore all of this safely, but it's important to know which actions are the dangerous ones.
Chapter 12e-Passport (eTravel) & PACE
The card can also act as an e-passport. To stop anyone secretly reading it over the air, the chip only opens up after you prove you can physically see the document — by entering a password printed on it (the machine-readable text, or a 6-digit number). Then the reader can fetch the holder's details and photo, and check the issuer's signature to be sure nothing was changed.
→ Run the eTravel read walkthrough in the Lab