From 32d17447a258188b2d534bcb0bf65a659ba7b7d0 Mon Sep 17 00:00:00 2001
From: mcentner <mcentner@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Fri, 29 Aug 2008 12:11:34 +0000
Subject: Initial import.

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@1 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../src/test/java/at/gv/egiz/smcc/ASN1Test.java    | 105 +++++++++++++++++++++
 1 file changed, 105 insertions(+)
 create mode 100644 smccSTAL/src/test/java/at/gv/egiz/smcc/ASN1Test.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/ASN1Test.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/ASN1Test.java
new file mode 100644
index 00000000..f2d61e7f
--- /dev/null
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/ASN1Test.java
@@ -0,0 +1,105 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import iaik.me.asn1.ASN1;
+import iaik.me.utils.Base64;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Vector;
+
+import org.junit.Ignore;
+
+@Ignore
+public class ASN1Test {
+
+  public static void main(String[] args) throws IOException {
+
+    ClassLoader classLoader = ASN1Test.class.getClassLoader();
+
+    InputStream stream = classLoader.getResourceAsStream("IdentityLink.bin");
+
+    if (stream != null) {
+
+      ASN1 identityLink = new ASN1(stream);
+      System.out.println("BaseId:" + getBaseId(identityLink));
+      identityLink = replaceBaseId(identityLink, "test");
+      System.out.println("BaseId:" + getBaseId(identityLink));
+
+      String bpk = "hansi";
+      MessageDigest sha = null;
+      try {
+        sha = MessageDigest.getInstance("SHA");
+      } catch (NoSuchAlgorithmException e) {
+        // TODO Auto-generated catch block
+        e.printStackTrace();
+      }
+      sha.update((identityLink + "+" + bpk).getBytes());
+      String bpkStr = new String(Base64.encode(sha.digest()));
+      System.out.println("bpk: "+bpkStr);
+      identityLink = replaceBaseId(identityLink, bpkStr);
+      System.out.println(getBaseId(identityLink));
+
+    } else {
+      System.out.println("Not found.");
+    }
+
+  }
+
+  private static String getBaseId(ASN1 identityLink) throws IOException {
+
+    if (identityLink.getType() == ASN1.TYPE_SEQUENCE) {
+      ASN1 personData = identityLink.getElementAt(4);
+      if (personData.getType() == ASN1.TAG_CONTEXT_SPECIFIC) {
+        ASN1 physicalPersonData = personData.gvASN1();
+        ASN1 baseId = physicalPersonData.getElementAt(0);
+        return baseId.gvString();
+      }
+      throw new IOException("Invalid structure.");
+
+    }
+    throw new IOException("Invalid structure.");
+
+  }
+
+  private static ASN1 replaceBaseId(ASN1 identityLink, String newBaseId)
+      throws IOException {
+
+    ASN1 newIdentityLink = new ASN1(ASN1.TYPE_SEQUENCE, new Vector<ASN1>());
+    for (int i = 0; i < identityLink.getSize(); i++) {
+      ASN1 asn1 = identityLink.getElementAt(i);
+      if (i == 4 && asn1.getType() == ASN1.TAG_CONTEXT_SPECIFIC) {
+        ASN1 physicalPersonData = asn1.gvASN1();
+        ASN1 newPhysicalPersonData = new ASN1(ASN1.TYPE_SEQUENCE,
+            new Vector<ASN1>());
+        newPhysicalPersonData.addElement(new ASN1(ASN1.TYPE_UTF8_STRING,
+            newBaseId));
+        for (int j = 1; j < physicalPersonData.getSize(); j++) {
+          newPhysicalPersonData.addElement(physicalPersonData.getElementAt(j));
+        }
+        asn1 = new ASN1(ASN1.TAG_CONTEXT_SPECIFIC, newPhysicalPersonData);
+      }
+      newIdentityLink.addElement(asn1);
+    }
+    return newIdentityLink;
+
+  }
+
+}
-- 
cgit v1.2.3


From 16b188bae57cfc10c94a0e251a815ab35345e113 Mon Sep 17 00:00:00 2001
From: wbauer <wbauer@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Mon, 3 Nov 2008 11:11:30 +0000
Subject: git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@139
 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4

---
 .../at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java  | 127 ++++++++++++---------
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java | 110 ++++++++++++++++++
 2 files changed, 183 insertions(+), 54 deletions(-)
 create mode 100644 smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
index cf524737..f310dd42 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
@@ -18,22 +18,22 @@ package at.gv.egiz.bku.smccstal;
 
 import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Set;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.smcc.SignatureCard;
-import at.gv.egiz.smcc.util.SMCCHelper;
 import at.gv.egiz.stal.ErrorResponse;
 import at.gv.egiz.stal.InfoboxReadRequest;
 import at.gv.egiz.stal.STAL;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
-import at.gv.egiz.stal.SignRequest;
 
 public abstract class AbstractSMCCSTAL implements STAL {
   private static Log log = LogFactory.getLog(AbstractSMCCSTAL.class);
@@ -45,9 +45,11 @@ public abstract class AbstractSMCCSTAL implements STAL {
   protected Map<String, SMCCSTALRequestHandler> handlerMap = new HashMap<String, SMCCSTALRequestHandler>();
 
   protected int maxRetries = DEFAULT_MAX_RETRIES;
+  protected Set<Integer> unrecoverableErrors = new HashSet<Integer>();
 
   protected AbstractSMCCSTAL() {
     addRequestHandler(InfoboxReadRequest.class, new InfoBoxReadRequestHandler());
+    unrecoverableErrors.add(6001);
   }
 
   /**
@@ -59,66 +61,76 @@ public abstract class AbstractSMCCSTAL implements STAL {
 
   protected abstract BKUGUIFacade getGUI();
 
+  private STALResponse getRespone(STALRequest request) {
+    log.info("Processing: " + request.getClass());
+    int retryCounter = 0;
+    while (retryCounter < maxRetries) {
+      log.info("Retry #" + retryCounter + " of " + maxRetries);
+      SMCCSTALRequestHandler handler = null;
+      handler = handlerMap.get(request.getClass().getSimpleName());
+      if (handler != null) {
+        if (handler.requireCard()) {
+          if (waitForCard()) {
+            return new ErrorResponse(6001);
+          }
+        }
+        try {
+          handler.init(signatureCard, getGUI());
+          STALResponse response = handler.handleRequest(request);
+          if (response != null) {
+            if (response instanceof ErrorResponse) {
+              log.info("Got an error response");
+              ErrorResponse err = (ErrorResponse) response;
+              if (unrecoverableErrors.contains(err.getErrorCode())) {
+                return response;
+              }
+              if ((++retryCounter < maxRetries) && (handler.requireCard())) {
+                signatureCard.disconnect(true);
+                signatureCard = null;
+              } else {
+                log.info("Exceeded max retries, returning error "
+                    + err.getErrorMessage());
+                return response;
+              }
+            } else {
+              return response;
+            }
+          } else {
+            log.info("Got null response from handler, assuming quit");
+            return null;
+          }
+        } catch (Exception e) {
+          log.info("Error while handling STAL request:" + e);
+          if (++retryCounter < maxRetries) {
+            signatureCard.disconnect(true);
+            signatureCard = null;
+          } else {
+            log.info("Exceeded max retries, returning error.");
+            return new ErrorResponse(6000);
+          }
+        }
+      } else {
+        log.error("Cannot find a handler for STAL request: " + request);
+        return new ErrorResponse();
+      }
+    }
+    return new ErrorResponse(6000);
+  }
+
   @Override
   public List<STALResponse> handleRequest(List<STALRequest> requestList) {
     log.debug("Got request list containing " + requestList.size()
         + " STAL requests");
     List<STALResponse> responseList = new ArrayList<STALResponse>(requestList
         .size());
-
     for (STALRequest request : requestList) {
       log.info("Processing: " + request.getClass());
-      int retryCounter = 0;
-      while (retryCounter < maxRetries) {
-        log.info("Number of retries: " + retryCounter);
-        SMCCSTALRequestHandler handler = null;
-        handler = handlerMap.get(request.getClass().getSimpleName());
-        if (handler != null) {
-          if (handler.requireCard()) {
-            if (waitForCard()) {
-              responseList.add(new ErrorResponse(6001));
-              break;
-            }
-          }
-          try {
-            handler.init(signatureCard, getGUI());
-            STALResponse response = handler.handleRequest(request);
-            if (response != null) {
-              if (response instanceof ErrorResponse) {
-                log.info("Got an error response");
-                ErrorResponse err = (ErrorResponse) response;
-                if (err.getErrorCode() == 6001) {
-                  retryCounter = Integer.MAX_VALUE - 1;
-                }
-                if (++retryCounter < maxRetries) {
-                  log.info("Retrying");
-                  signatureCard.disconnect(true);
-                  signatureCard = null;
-                } else {
-                  responseList.add(response);
-                }
-              } else {
-                responseList.add(response);
-                retryCounter = Integer.MAX_VALUE;
-                break;
-              }
-            } else {
-              log.info("Got null response from handler, assuming quit");
-              retryCounter = Integer.MAX_VALUE;
-            }
-          } catch (Exception e) {
-            log.info("Error while handling STAL request:" + e);
-            if (++retryCounter < maxRetries) {
-              log.info("Retrying");
-              signatureCard.disconnect(true);
-              signatureCard = null;
-            } else {
-              responseList.add(new ErrorResponse(6000));
-            }
-          }
-        } else {
-          log.error("Cannot find a handler for STAL request: " + request);
-          responseList.add(new ErrorResponse());
+      STALResponse response = getRespone(request);
+      if (response != null) {
+        responseList.add(response);
+        if (response instanceof ErrorResponse) {
+          log.info("Got an error response, don't process remaining requests");
+          break;
         }
       }
     }
@@ -148,4 +160,11 @@ public abstract class AbstractSMCCSTAL implements STAL {
     this.maxRetries = maxRetries;
   }
 
+  public Set<Integer> getUnrecoverableErrors() {
+    return unrecoverableErrors;
+  }
+
+  public void setUnrecoverableErrors(Set<Integer> unrecoverableErrors) {
+    this.unrecoverableErrors = unrecoverableErrors;
+  }
 }
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
new file mode 100644
index 00000000..59ea141c
--- /dev/null
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -0,0 +1,110 @@
+package at.gv.egiz.smcc;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+import javax.smartcardio.Card;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.smccstal.AbstractSMCCSTAL;
+import at.gv.egiz.bku.smccstal.SMCCSTALRequestHandler;
+import at.gv.egiz.stal.ErrorResponse;
+import at.gv.egiz.stal.InfoboxReadRequest;
+import at.gv.egiz.stal.InfoboxReadResponse;
+import at.gv.egiz.stal.STALRequest;
+import at.gv.egiz.stal.STALResponse;
+
+public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
+    SMCCSTALRequestHandler {
+  private int errorConter;
+
+  @Override
+  protected BKUGUIFacade getGUI() {
+    // TODO Auto-generated method stub
+    return null;
+  }
+
+  @Override
+  protected boolean waitForCard() {
+   signatureCard = new SignatureCard() {
+
+    @Override
+    public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
+        PINProvider provider) throws SignatureCardException {
+      // TODO Auto-generated method stub
+      return null;
+    }
+
+    @Override
+    public void disconnect(boolean reset) {
+      // TODO Auto-generated method stub
+      
+    }
+
+    @Override
+    public byte[] getCertificate(KeyboxName keyboxName)
+        throws SignatureCardException {
+      // TODO Auto-generated method stub
+      return null;
+    }
+
+    @Override
+    public byte[] getInfobox(String infobox, PINProvider provider,
+        String domainId) throws SignatureCardException {
+      // TODO Auto-generated method stub
+      return null;
+    }
+
+    @Override
+    public void init(Card card) {
+      // TODO Auto-generated method stub
+      
+    }
+
+    @Override
+    public void setLocale(Locale locale) {
+      // TODO Auto-generated method stub
+      
+    }
+     
+   };
+    return false;
+  }
+
+  @Before
+  public void setUp() {
+    addRequestHandler(InfoboxReadRequest.class, this);
+  }
+
+  @Test
+  public void testRetry() {
+    InfoboxReadRequest irr = new InfoboxReadRequest();
+    List<STALRequest> irrl = new ArrayList<STALRequest>();
+    irrl.add(irr);
+    List<STALResponse> list = handleRequest(irrl);
+    Assert.assertFalse(list.get(0) instanceof ErrorResponse);
+  }
+
+  @Override
+  public STALResponse handleRequest(STALRequest request) {
+    if (++errorConter < 3) {
+      return new ErrorResponse(400);
+    }
+    return new InfoboxReadResponse();
+  }
+
+  @Override
+  public void init(SignatureCard sc, BKUGUIFacade gui) {
+  }
+
+  @Override
+  public boolean requireCard() {
+    return true;
+  }
+
+}
-- 
cgit v1.2.3


From 2df9621154ad057f6cace73efe49c9ef42515fde Mon Sep 17 00:00:00 2001
From: mcentner <mcentner@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Tue, 9 Dec 2008 08:14:43 +0000
Subject: Refactored STAL interface. Additional infobox functionality.

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@236 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../at/gv/egiz/bku/local/stal/LocalBKUWorker.java  |   4 +-
 .../src/main/webapp/WEB-INF/applicationContext.xml |   9 +-
 .../stal/service/impl/STALRequestBrokerImpl.java   |   2 +-
 STAL/src/main/java/at/gv/egiz/stal/STAL.java       |   2 +-
 .../gv/egiz/bku/slcommands/SLCommandFactory.java   |  38 +++-
 .../slcommands/impl/AbstractBinaryFileInfobox.java |   4 +-
 .../impl/AbstractInfoboxCommandImpl.java           |   9 +
 .../bku/slcommands/impl/AbstractInfoboxImpl.java   |  19 ++
 .../slcommands/impl/CardChannelInfoboxImpl.java    | 235 +++++++++++++++++++++
 .../at/gv/egiz/bku/slcommands/impl/Infobox.java    |  21 +-
 .../slcommands/impl/InfoboxReadCommandImpl.java    |   9 -
 .../bku/slcommands/impl/InfoboxReadResultImpl.java |  12 ++
 .../slcommands/impl/InfoboxUpdateCommandImpl.java  | 124 ++---------
 .../gv/egiz/bku/slcommands/impl/SLResultImpl.java  |  56 +++++
 .../at/gv/egiz/bku/slcommands/impl/STALHelper.java |   2 +-
 .../test/java/at/gv/egiz/stal/dummy/DummySTAL.java |   2 +-
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     |  30 ++-
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |  12 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |  12 +-
 .../java/at/gv/egiz/smcc/SignatureCardFactory.java |   8 +-
 .../main/java/at/gv/egiz/smcc/util/SMCCHelper.java |   4 +-
 .../java/at/gv/egiz/smcc/util/SmartCardIO.java     |   9 +-
 .../at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java  |   2 +-
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |  15 +-
 .../at/gv/egiz/bku/utils/DebugOutputStream.java    |  48 +++++
 .../java/at/gv/egiz/bku/utils/DebugReader.java     |  58 +++++
 .../java/at/gv/egiz/bku/utils/DebugWriter.java     |  55 +++++
 27 files changed, 657 insertions(+), 144 deletions(-)
 create mode 100644 bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/CardChannelInfoboxImpl.java
 create mode 100644 utils/src/main/java/at/gv/egiz/bku/utils/DebugOutputStream.java
 create mode 100644 utils/src/main/java/at/gv/egiz/bku/utils/DebugReader.java
 create mode 100644 utils/src/main/java/at/gv/egiz/bku/utils/DebugWriter.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java
index 57b159ad..91d0aba0 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java
@@ -22,6 +22,8 @@ import at.gv.egiz.stal.QuitRequest;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
 import at.gv.egiz.stal.SignRequest;
+import at.gv.egiz.stal.ext.APDUScriptRequest;
+
 import java.util.List;
 import javax.swing.JDialog;
 
@@ -40,7 +42,7 @@ public class LocalBKUWorker extends AbstractBKUWorker {
   }
 
   @Override
-  public List<STALResponse> handleRequest(List<STALRequest> requestList) {
+  public List<STALResponse> handleRequest(List<? extends STALRequest> requestList) {
     signatureCard = null;
     List<STALResponse> responses = super.handleRequest(requestList);
     // container.setVisible(false);
diff --git a/BKULocal/src/main/webapp/WEB-INF/applicationContext.xml b/BKULocal/src/main/webapp/WEB-INF/applicationContext.xml
index 5ac12ece..eb7d5b7a 100644
--- a/BKULocal/src/main/webapp/WEB-INF/applicationContext.xml
+++ b/BKULocal/src/main/webapp/WEB-INF/applicationContext.xml
@@ -59,6 +59,9 @@
         <entry
           key="http://www.buergerkarte.at/namespaces/securitylayer/1.2#:InfoboxReadRequest"
           value="at.gv.egiz.bku.slcommands.impl.InfoboxReadCommandImpl" />
+        <entry
+          key="http://www.buergerkarte.at/namespaces/securitylayer/1.2#:InfoboxUpdateRequest"
+          value="at.gv.egiz.bku.slcommands.impl.InfoboxUpdateCommandImpl" />
         <entry
           key="http://www.buergerkarte.at/namespaces/securitylayer/1.2#:CreateXMLSignatureRequest"
           value="at.gv.egiz.bku.slcommands.impl.CreateXMLSignatureCommandImpl" />
@@ -76,9 +79,9 @@
         <entry
           key="IdentityLink"
           value="at.gv.egiz.bku.slcommands.impl.IdentityLinkInfoboxImpl" />
-<!--        <entry-->
-<!--          key="CardChannel"-->
-<!--          value="at.gv.egiz.bku.slcommands.impl.CardChannelInfoboxImpl" />-->
+        <entry
+          key="CardChannel"
+          value="at.gv.egiz.bku.slcommands.impl.CardChannelInfoboxImpl" />
       </map>
     </property>
   </bean>
diff --git a/BKUOnline/src/main/java/at/gv/egiz/stal/service/impl/STALRequestBrokerImpl.java b/BKUOnline/src/main/java/at/gv/egiz/stal/service/impl/STALRequestBrokerImpl.java
index e7fb928a..5e3a1a99 100644
--- a/BKUOnline/src/main/java/at/gv/egiz/stal/service/impl/STALRequestBrokerImpl.java
+++ b/BKUOnline/src/main/java/at/gv/egiz/stal/service/impl/STALRequestBrokerImpl.java
@@ -85,7 +85,7 @@ public class STALRequestBrokerImpl implements STALRequestBroker {
      * @pre requests: either single SignRequest, QuitRequest or multiple ReadInfoboxRequests
      */
     @Override
-    public List<STALResponse> handleRequest(List<STALRequest> stalRequests) {
+    public List<STALResponse> handleRequest(List<? extends STALRequest> stalRequests) {
       if (interrupted) {
         return null;
       }
diff --git a/STAL/src/main/java/at/gv/egiz/stal/STAL.java b/STAL/src/main/java/at/gv/egiz/stal/STAL.java
index de29de9a..7fa7cb45 100644
--- a/STAL/src/main/java/at/gv/egiz/stal/STAL.java
+++ b/STAL/src/main/java/at/gv/egiz/stal/STAL.java
@@ -32,7 +32,7 @@ public interface STAL {
    * @param aRequestList
    * @return
    */
-  public List<STALResponse> handleRequest(List<STALRequest> aRequestList);
+  public List<STALResponse> handleRequest(List<? extends STALRequest> aRequestList);
   
   /**
    * Sets the preferred locale for userinteraction (e.g. PIN dialogs).
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/SLCommandFactory.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/SLCommandFactory.java
index 9c98ef8a..bec2b253 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/SLCommandFactory.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/SLCommandFactory.java
@@ -17,6 +17,7 @@
 package at.gv.egiz.bku.slcommands;
 
 import java.io.IOException;
+import java.io.Reader;
 import java.net.URL;
 import java.util.HashMap;
 import java.util.Map;
@@ -41,10 +42,12 @@ import org.apache.commons.logging.LogFactory;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXParseException;
 
+import at.buergerkarte.namespaces.cardchannel.ObjectFactory;
 import at.gv.egiz.bku.slexceptions.SLCommandException;
 import at.gv.egiz.bku.slexceptions.SLExceptionMessages;
 import at.gv.egiz.bku.slexceptions.SLRequestException;
 import at.gv.egiz.bku.slexceptions.SLRuntimeException;
+import at.gv.egiz.bku.utils.DebugReader;
 import at.gv.egiz.slbinding.RedirectEventFilter;
 import at.gv.egiz.slbinding.RedirectUnmarshallerListener;
 
@@ -163,8 +166,9 @@ public class SLCommandFactory {
         if (jaxbContext == null) {
             try {
                 String slPkg = at.buergerkarte.namespaces.securitylayer._1.ObjectFactory.class.getPackage().getName();
-                String xmldsigPkg = org.w3._2000._09.xmldsig_.ObjectFactory.class.getPackage().getName();
-                setJaxbContext(JAXBContext.newInstance(slPkg + ":" + xmldsigPkg));
+                String xmldsigPkg = org.w3._2000._09.xmldsig_.ObjectFactory.class.getPackage().getName();
+                String cardChannelPkg = at.buergerkarte.namespaces.cardchannel.ObjectFactory.class.getPackage().getName();
+                setJaxbContext(JAXBContext.newInstance(slPkg + ":" + xmldsigPkg + ":" + cardChannelPkg));
             } catch (JAXBException e) {
                 log.error("Failed to setup JAXBContext security layer request.", e);
                 throw new SLRuntimeException(e);
@@ -325,12 +329,31 @@ public class SLCommandFactory {
      */
     @SuppressWarnings("unchecked")
     public SLCommand createSLCommand(Source source, SLCommandContext context)
-      throws SLCommandException, SLRuntimeException, SLRequestException {
+      throws SLCommandException, SLRuntimeException, SLRequestException {
+      
+        DebugReader dr = null;
+        if (log.isTraceEnabled() && source instanceof StreamSource) {
+          StreamSource streamSource = (StreamSource) source;
+          if (streamSource.getReader() != null) {
+            dr = new DebugReader(streamSource.getReader(), "SLCommand unmarshalled from:\n");
+            streamSource.setReader(dr);
+          }
+        }
 
-        Object object = unmarshal(source);
+        Object object;
+        try {
+          object = unmarshal(source);
+        } catch (SLRequestException e) {
+          throw e;
+        } finally {
+          if (dr != null) {
+            log.trace(dr.getCachedString());
+          }
+        }
+        
         if (!(object instanceof JAXBElement)) {
             // invalid request
-            log.info("Invalid security layer request. " + object.toString());
+            log.info("Invalid security layer request. " + object.toString());
             throw new SLRequestException(3002, SLExceptionMessages.EC3002_INVALID,
               new Object[]{object.toString()});
         }
@@ -343,7 +366,9 @@ public class SLCommandFactory {
             throw new SLCommandException(4011,
               SLExceptionMessages.EC4011_NOTIMPLEMENTED, new Object[]{qName.toString()});
         }
-
+
+        
+        
         // try to instantiate
         SLCommand slCommand;
         try {
@@ -360,6 +385,7 @@ public class SLCommandFactory {
               e);
             throw new SLRuntimeException(e);
         }
+
         slCommand.init(context, (JAXBElement) object);
 
         return slCommand;
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractBinaryFileInfobox.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractBinaryFileInfobox.java
index 07ca639c..23394bd5 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractBinaryFileInfobox.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractBinaryFileInfobox.java
@@ -37,7 +37,7 @@ public abstract class AbstractBinaryFileInfobox extends AbstractInfoboxImpl impl
   /**
    * Is this infobox' content an XML entity?
    */
-  private boolean isXMLEntity = false;
+  protected boolean isXMLEntity = false;
   
   /**
    * @return <code>true</code> if this infobox' content is an XML entity or <code>false</code> otherwise.
@@ -61,8 +61,6 @@ public abstract class AbstractBinaryFileInfobox extends AbstractInfoboxImpl impl
     }
     
   }
-
-  
   
 
 }
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxCommandImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxCommandImpl.java
index 305769a8..8a7edb71 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxCommandImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxCommandImpl.java
@@ -52,4 +52,13 @@ public abstract class AbstractInfoboxCommandImpl<T> extends SLCommandImpl<T> {
    */
   protected abstract String getInfoboxIdentifier(T request);
 
+
+  public String getInfoboxIdentifier() {
+    if (infobox != null) {
+      return infobox.getIdentifier();
+    } else {
+      return null;
+    }
+  }
+  
 }
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxImpl.java
index e5c7afcc..564cb8ff 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/AbstractInfoboxImpl.java
@@ -16,6 +16,13 @@
  */
 package at.gv.egiz.bku.slcommands.impl;
 
+import at.buergerkarte.namespaces.securitylayer._1.InfoboxReadRequestType;
+import at.buergerkarte.namespaces.securitylayer._1.InfoboxUpdateRequestType;
+import at.gv.egiz.bku.slcommands.InfoboxReadResult;
+import at.gv.egiz.bku.slcommands.InfoboxUpdateResult;
+import at.gv.egiz.bku.slcommands.SLCommandContext;
+import at.gv.egiz.bku.slexceptions.SLCommandException;
+
 /**
  * An abstract base class for {@link Infobox} implementations.
  * 
@@ -23,4 +30,16 @@ package at.gv.egiz.bku.slcommands.impl;
  */
 public abstract class AbstractInfoboxImpl implements Infobox {
 
+  @Override
+  public InfoboxReadResult read(InfoboxReadRequestType request,
+      SLCommandContext cmdCtx) throws SLCommandException {
+    throw new SLCommandException(4011);
+  }
+
+  @Override
+  public InfoboxUpdateResult update(InfoboxUpdateRequestType request,
+      SLCommandContext cmdCtx) throws SLCommandException {
+    throw new SLCommandException(4011);
+  }
+  
 }
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/CardChannelInfoboxImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/CardChannelInfoboxImpl.java
new file mode 100644
index 00000000..4b1cc779
--- /dev/null
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/CardChannelInfoboxImpl.java
@@ -0,0 +1,235 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.bku.slcommands.impl;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.UnsupportedEncodingException;
+import java.math.BigInteger;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.WeakHashMap;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBElement;
+import javax.xml.bind.JAXBException;
+import javax.xml.bind.Unmarshaller;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.buergerkarte.namespaces.cardchannel.ATRType;
+import at.buergerkarte.namespaces.cardchannel.CommandAPDUType;
+import at.buergerkarte.namespaces.cardchannel.ObjectFactory;
+import at.buergerkarte.namespaces.cardchannel.ResetType;
+import at.buergerkarte.namespaces.cardchannel.ResponseAPDUType;
+import at.buergerkarte.namespaces.cardchannel.ResponseType;
+import at.buergerkarte.namespaces.cardchannel.ScriptType;
+import at.buergerkarte.namespaces.cardchannel.VerifyAPDUType;
+import at.buergerkarte.namespaces.securitylayer._1.Base64XMLContentType;
+import at.buergerkarte.namespaces.securitylayer._1.InfoboxReadRequestType;
+import at.buergerkarte.namespaces.securitylayer._1.InfoboxUpdateRequestType;
+import at.buergerkarte.namespaces.securitylayer._1.XMLContentType;
+import at.gv.egiz.bku.slcommands.InfoboxReadResult;
+import at.gv.egiz.bku.slcommands.InfoboxUpdateResult;
+import at.gv.egiz.bku.slcommands.SLCommandContext;
+import at.gv.egiz.bku.slexceptions.SLCommandException;
+import at.gv.egiz.bku.slexceptions.SLRuntimeException;
+import at.gv.egiz.stal.STAL;
+import at.gv.egiz.stal.ext.APDUScriptRequest;
+import at.gv.egiz.stal.ext.APDUScriptResponse;
+import at.gv.egiz.stal.ext.APDUScriptRequest.RequestScriptElement;
+import at.gv.egiz.stal.ext.APDUScriptResponse.ResponseScriptElement;
+
+public class CardChannelInfoboxImpl extends AbstractBinaryFileInfobox {
+  
+  private static Log log = LogFactory.getLog(CardChannelInfoboxImpl.class);
+  
+  private static WeakHashMap<STAL, JAXBElement<ResponseType>> scriptResults = new WeakHashMap<STAL, JAXBElement<ResponseType>>();
+  
+  private static JAXBContext jaxbContext; 
+  
+  static {
+    try {
+      jaxbContext = JAXBContext.newInstance(ObjectFactory.class.getPackage().getName());
+    } catch (JAXBException e) {
+      throw new SLRuntimeException("Failed to initalize CardChannel infobox.", e);
+    }
+  }
+
+  public CardChannelInfoboxImpl() {
+    isXMLEntity = true;
+  }
+  
+  @Override
+  public String getIdentifier() {
+    return "CardChannel";
+  }
+
+  @Override
+  public InfoboxReadResult read(InfoboxReadRequestType request,
+      SLCommandContext cmdCtx) throws SLCommandException {
+    
+    at.buergerkarte.namespaces.securitylayer._1.ObjectFactory objectFactory 
+    = new at.buergerkarte.namespaces.securitylayer._1.ObjectFactory();
+
+    Base64XMLContentType content = objectFactory.createBase64XMLContentType();
+    XMLContentType xmlContent = objectFactory.createXMLContentType();
+    content.setXMLContent(xmlContent);
+
+    JAXBElement<ResponseType> response = scriptResults.get(cmdCtx.getSTAL());
+    if (response != null) {
+      xmlContent.getContent().add(response);
+    }
+
+    return new InfoboxReadResultImpl(content);
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Override
+  public InfoboxUpdateResult update(InfoboxUpdateRequestType request,
+      SLCommandContext cmdCtx) throws SLCommandException {
+
+    Base64XMLContentType binaryFileParameters = request.getBinaryFileParameters();
+    
+    if (binaryFileParameters.getBase64Content() != null) {
+      log.info("Got Base64Content but ContentIsXMLEntity is true.");
+      throw new SLCommandException(4010);
+    }
+    
+    XMLContentType content = binaryFileParameters.getXMLContent();
+    if (content instanceof at.gv.egiz.slbinding.impl.XMLContentType) {
+
+      ByteArrayOutputStream redirectedStream = ((at.gv.egiz.slbinding.impl.XMLContentType) content).getRedirectedStream();
+      if (redirectedStream != null) {
+        
+        if (log.isDebugEnabled()) {
+
+          StringBuilder sb = new StringBuilder();
+          sb.append("CardChannel script:\n");
+          try {
+            sb.append(new String(redirectedStream.toByteArray(), "UTF-8"));
+          } catch (UnsupportedEncodingException e) {
+            sb.append(e.getMessage());
+          }
+          log.debug(sb.toString());
+        }
+        
+        Object object;
+        try {
+          Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
+          object = unmarshaller.unmarshal(new ByteArrayInputStream(redirectedStream.toByteArray()));
+        } catch (JAXBException e) {
+          log.info("Failed to parse CardChannel script.", e);
+          throw new SLCommandException(4011);
+        }
+        
+        if (object instanceof JAXBElement) {
+          executeCardChannelScript(((JAXBElement<ScriptType>) object).getValue(), cmdCtx);
+          return new InfoboxUpdateResultImpl();
+        }
+        
+      }
+
+    
+    }
+    log.info("Infobox identifier is '" + getIdentifier() + "' but XMLContent does not contain 'Script'.");
+    throw new SLCommandException(4010);
+    
+  }
+
+  protected void executeCardChannelScript(ScriptType script,
+      SLCommandContext cmdCtx) throws SLCommandException {
+    
+    List<Object> resetOrCommandAPDUOrVerifyAPDU = script.getResetOrCommandAPDUOrVerifyAPDU();
+    List<RequestScriptElement> requestScript = new ArrayList<RequestScriptElement>();
+    
+    for (Object element : resetOrCommandAPDUOrVerifyAPDU) {
+      
+      if (element instanceof ResetType) {
+      
+        requestScript.add(new APDUScriptRequest.Reset());
+      
+      } else if (element instanceof CommandAPDUType) {
+      
+        CommandAPDUType commandAPDU = (CommandAPDUType) element;
+        int sequence = (commandAPDU.getSequence() != null) 
+              ? commandAPDU.getSequence().intValue() 
+              : 0;
+
+        requestScript.add(
+            new APDUScriptRequest.Command(
+                sequence, 
+                commandAPDU.getValue(), 
+                commandAPDU.getExpectedSW()));
+        
+      } else if (element instanceof VerifyAPDUType) {
+        log.warn("CardChannel script command 'VerifyAPDU' not implemented.");
+        throw new SLCommandException(4011);
+      }
+    }
+    
+    APDUScriptRequest scriptRequest = new APDUScriptRequest(requestScript);
+    
+    STAL stal = cmdCtx.getSTAL();
+    STALHelper helper = new STALHelper(stal);
+    
+    helper.transmitSTALRequest(Collections.singletonList(scriptRequest));
+    
+    List<ResponseScriptElement> responseScript = ((APDUScriptResponse) helper
+        .nextResponse(APDUScriptResponse.class)).getScript();
+    
+    ObjectFactory objectFactory = new ObjectFactory();
+    
+    ResponseType responseType = objectFactory.createResponseType();
+    
+    
+    for (ResponseScriptElement element : responseScript) {
+      
+      if (element instanceof APDUScriptResponse.ATR) {
+        
+        byte[] atr = ((APDUScriptResponse.ATR) element).getAtr();
+        
+        ATRType atrType = objectFactory.createATRType();
+        atrType.setValue(atr);
+        atrType.setRc(BigInteger.ZERO);
+        responseType.getATROrResponseAPDU().add(atrType);
+        
+      } else if (element instanceof APDUScriptResponse.Response) {
+        
+        APDUScriptResponse.Response response = (APDUScriptResponse.Response) element;
+        
+        ResponseAPDUType responseAPDUType = objectFactory.createResponseAPDUType();
+        responseAPDUType.setSequence(BigInteger.valueOf(response.getSequence()));
+//        if (response.getRc() != 0) {
+          responseAPDUType.setRc(BigInteger.valueOf(response.getRc()));
+//        }
+        responseAPDUType.setSw(response.getSw());
+        responseAPDUType.setValue(response.getApdu());
+        
+        responseType.getATROrResponseAPDU().add(responseAPDUType);
+      }
+      
+    }
+    
+    scriptResults.put(stal, objectFactory.createResponse(responseType));
+  }
+
+  
+}
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/Infobox.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/Infobox.java
index a6f8cbb2..99d62721 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/Infobox.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/Infobox.java
@@ -17,7 +17,9 @@
 package at.gv.egiz.bku.slcommands.impl;
 
 import at.buergerkarte.namespaces.securitylayer._1.InfoboxReadRequestType;
+import at.buergerkarte.namespaces.securitylayer._1.InfoboxUpdateRequestType;
 import at.gv.egiz.bku.slcommands.InfoboxReadResult;
+import at.gv.egiz.bku.slcommands.InfoboxUpdateResult;
 import at.gv.egiz.bku.slcommands.SLCommandContext;
 import at.gv.egiz.bku.slexceptions.SLCommandException;
 
@@ -44,10 +46,25 @@ public interface Infobox {
    * 
    * @return the data read from this infobox as InfoboxReadResult
    * 
-   * @throws SLCommandException
-   *           if reading from this infobox fails
+   * @throws SLCommandException 
+   * 
+   *            if reading from this infobox fails
    */
   public InfoboxReadResult read(InfoboxReadRequestType request,
       SLCommandContext cmdCtx) throws SLCommandException;
 
+  /**
+   * Update data in this infobox.
+   * 
+   * @param request
+   *          the InfoboxUpdateRequest
+   * @param cmdCtx
+   *          the command context
+   * @return a corresponding InfoboxUpdateResult
+   * @throws SLCommandException
+   *           if updating this infobox fails
+   */
+  public InfoboxUpdateResult update(InfoboxUpdateRequestType request,
+      SLCommandContext cmdCtx) throws SLCommandException;
+
 }
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadCommandImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadCommandImpl.java
index aaa786a6..693f444f 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadCommandImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadCommandImpl.java
@@ -83,7 +83,6 @@ public class InfoboxReadCommandImpl extends AbstractInfoboxCommandImpl<InfoboxRe
     }
     
   }
- 
 
   @Override
   public String getIdentityLinkDomainId() {
@@ -94,12 +93,4 @@ public class InfoboxReadCommandImpl extends AbstractInfoboxCommandImpl<InfoboxRe
     }
   }
 
-  @Override
-  public String getInfoboxIdentifier() {
-    if (infobox != null) {
-      return infobox.getIdentifier();
-    } else {
-      return null;
-    }
-  }
 }
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadResultImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadResultImpl.java
index a2b8ac9f..e508941d 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadResultImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxReadResultImpl.java
@@ -20,6 +20,7 @@ import javax.xml.bind.JAXBElement;
 import javax.xml.transform.Result;
 import javax.xml.transform.Templates;
 
+import at.buergerkarte.namespaces.securitylayer._1.Base64XMLContentType;
 import at.buergerkarte.namespaces.securitylayer._1.InfoboxReadDataAssocArrayType;
 import at.buergerkarte.namespaces.securitylayer._1.InfoboxReadResponseType;
 import at.buergerkarte.namespaces.securitylayer._1.ObjectFactory;
@@ -41,6 +42,17 @@ public class InfoboxReadResultImpl extends SLResultImpl implements InfoboxReadRe
     
     this.infoboxReadResponse = infoboxReadResponseType;
   }
+  
+  public InfoboxReadResultImpl(Base64XMLContentType value) {
+    
+    ObjectFactory objectFactory = new ObjectFactory();
+    InfoboxReadResponseType infoboxReadResponseType = objectFactory.createInfoboxReadResponseType();
+    
+    infoboxReadResponseType.setBinaryFileData(value);
+    
+    this.infoboxReadResponse = infoboxReadResponseType;
+    
+  }
 
   @Override
   public void writeTo(Result result, Templates templates) {
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxUpdateCommandImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxUpdateCommandImpl.java
index 6d281686..1cdeda94 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxUpdateCommandImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/InfoboxUpdateCommandImpl.java
@@ -16,143 +16,59 @@
 */
 package at.gv.egiz.bku.slcommands.impl;
 
-import java.util.List;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import at.buergerkarte.namespaces.cardchannel.CommandAPDUType;
-import at.buergerkarte.namespaces.cardchannel.ResetType;
-import at.buergerkarte.namespaces.cardchannel.ScriptType;
-import at.buergerkarte.namespaces.cardchannel.VerifyAPDUType;
-import at.buergerkarte.namespaces.securitylayer._1.Base64XMLContentType;
 import at.buergerkarte.namespaces.securitylayer._1.InfoboxUpdateRequestType;
 import at.gv.egiz.bku.slcommands.InfoboxUpdateCommand;
 import at.gv.egiz.bku.slcommands.SLCommandContext;
 import at.gv.egiz.bku.slcommands.SLResult;
 import at.gv.egiz.bku.slexceptions.SLCommandException;
-import at.gv.egiz.bku.slexceptions.SLExceptionMessages;
 
 public class InfoboxUpdateCommandImpl extends
-    SLCommandImpl<InfoboxUpdateRequestType> implements InfoboxUpdateCommand {
+    AbstractInfoboxCommandImpl<InfoboxUpdateRequestType> implements InfoboxUpdateCommand {
   
   private static Log log = LogFactory.getLog(InfoboxUpdateCommandImpl.class);
 
-  public static final String INFOBOX_IDENTIFIER_CARD_CHANNEL = "CardChannel";
+  @Override
+  public String getName() {
+    return "InfoboxUpdateRequest";
+  }
 
-  protected String infoboxIdentifier;
-  
-  protected List<Object> cardChannelScript;
-  
   @Override
-  public String getInfoboxIdentifier() {
-    return infoboxIdentifier;
+  protected String getInfoboxIdentifier(InfoboxUpdateRequestType request) {
+    return request.getInfoboxIdentifier();
   }
-  
+
   @Override
-  public void init(SLCommandContext ctx, Object request)
-      throws SLCommandException {
+  public void init(SLCommandContext ctx, Object request) throws SLCommandException {
     super.init(ctx, request);
     
     InfoboxUpdateRequestType req = getRequestValue();
     
-    infoboxIdentifier = req.getInfoboxIdentifier();
+    if (req.getAssocArrayParameters() != null && 
+        !(infobox instanceof AssocArrayInfobox)) {
+      log.info("Got AssocArrayParameters but Infobox type is not AssocArray.");
+      throw new SLCommandException(4010);
+    }
     
-    if (INFOBOX_IDENTIFIER_CARD_CHANNEL.equals(infoboxIdentifier)) {
-
-      if (req.getAssocArrayParameters() != null) {
-        log.info("Got AssocArrayParameters but Infobox type is BinaryFile.");
-        throw new SLCommandException(4010);
-      }
-      
-      Base64XMLContentType binaryFileParameters = req.getBinaryFileParameters();
-      if (binaryFileParameters == null) {
-        log.info("Got no BinaryFileParameters but Infobox type is BinaryFile.");
-        throw new SLCommandException(4010);
-      }
-
-      if (binaryFileParameters.getBase64Content() == null) {
-        log.info("Got Base64Content but ContentIsXMLEntity is true.");
-        throw new SLCommandException(4010);
-      }
-      
-      List<Object> content = binaryFileParameters.getXMLContent().getContent();
-      if (content.isEmpty()) {
-        log.info("Got no XMLContent but ContentIsXMLEntity is true.");
-        throw new SLCommandException(4010);
-      }
-      
-      for (Object element : content) {
-        if (!(element instanceof ScriptType)) {
-          log.info("Infobox identifier is '" + infoboxIdentifier + "' but XMLContent does not contain 'Script'.");
-          throw new SLCommandException(4010);
-        }
-        
-        setCardChannelScript(((ScriptType) element).getResetOrCommandAPDUOrVerifyAPDU());
-      }
-      
-      if (getCardChannelScript() == null) {
-        log.info("Infobox identifier is '" + infoboxIdentifier + "' but XMLContent does not contain 'Script'.");
-        throw new SLCommandException(4010);
-      }
-      
-    } else {
-      throw new SLCommandException(4002,
-          SLExceptionMessages.EC4002_INFOBOX_UNKNOWN,
-          new Object[] { infoboxIdentifier });
+    if (req.getBinaryFileParameters() != null &&
+        !(infobox instanceof BinaryFileInfobox)) {
+      log.info("Got BinaryFileParameters but Infobox type is not BinaryFile.");
+      throw new SLCommandException(4010);
     }
     
   }
 
-  public List<Object> getCardChannelScript() {
-    return cardChannelScript;
-  }
-
-  public void setCardChannelScript(List<Object> cardChannelScript) {
-    this.cardChannelScript = cardChannelScript;
-  }
-
   @Override
   public SLResult execute() {
     
     try {
-      if (INFOBOX_IDENTIFIER_CARD_CHANNEL.equals(getInfoboxIdentifier())) {
-        
-        executeCardChannelScript();
-        return new InfoboxUpdateResultImpl();
-        
-      } else {
-        throw new SLCommandException(4002,
-            SLExceptionMessages.EC4002_INFOBOX_UNKNOWN,
-            new Object[] { infoboxIdentifier });
-      }
+      return infobox.update(getRequestValue(), getCmdCtx());
     } catch (SLCommandException e) {
-      return new ErrorResultImpl(e, cmdCtx.getLocale());
+      return new ErrorResultImpl(e, getCmdCtx().getLocale());
     }
     
   }
-  
-  protected void executeCardChannelScript() throws SLCommandException {
-    
-    if (cardChannelScript != null) {
-      
-      for (Object element : cardChannelScript) {
-        if (element instanceof ResetType) {
-          
-        } else if (element instanceof CommandAPDUType) {
-          
-        } else if (element instanceof VerifyAPDUType) {
-          
-        }
-      }
-      
-    }
-    
-  }
-
-  @Override
-  public String getName() {
-    return "InfoboxUpdateRequest";
-  }
 
 }
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/SLResultImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/SLResultImpl.java
index 80bbdca8..99a3b119 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/SLResultImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/SLResultImpl.java
@@ -16,6 +16,7 @@
 */
 package at.gv.egiz.bku.slcommands.impl;
 
+import java.io.UnsupportedEncodingException;
 import java.util.Locale;
 
 import javax.xml.bind.JAXBContext;
@@ -32,6 +33,7 @@ import javax.xml.transform.TransformerFactoryConfigurationError;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.sax.SAXTransformerFactory;
 import javax.xml.transform.sax.TransformerHandler;
+import javax.xml.transform.stream.StreamResult;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -45,6 +47,8 @@ import at.gv.egiz.bku.slexceptions.SLBindingException;
 import at.gv.egiz.bku.slexceptions.SLCommandException;
 import at.gv.egiz.bku.slexceptions.SLException;
 import at.gv.egiz.bku.slexceptions.SLRuntimeException;
+import at.gv.egiz.bku.utils.DebugOutputStream;
+import at.gv.egiz.bku.utils.DebugWriter;
 
 /**
  * This class serves as an abstract base class for the implementation of a
@@ -128,6 +132,20 @@ public abstract class SLResultImpl implements SLResult {
    * @param templates
    */
   protected void writeTo(JAXBElement<?> response, Result result, Templates templates) {
+    
+    DebugWriter dw = null;
+    DebugOutputStream ds = null;
+    if (log.isTraceEnabled() && result instanceof StreamResult) {
+      StreamResult streamResult = (StreamResult) result;
+      if (streamResult.getOutputStream() != null) {
+        ds = new DebugOutputStream(streamResult.getOutputStream());
+        streamResult.setOutputStream(ds);
+      }
+      if (streamResult.getWriter() != null) {
+        dw = new DebugWriter(streamResult.getWriter());
+        streamResult.setWriter(dw);
+      }
+    }
 
     TransformerHandler transformerHandler = null;
     if (templates != null) {
@@ -151,10 +169,36 @@ public abstract class SLResultImpl implements SLResult {
       writeErrorTo(commandException, result, templates);
     }
     
+    if (ds != null) {
+      try {
+        log.trace("Marshalled result:\n" + new String(ds.getBufferedBytes(), "UTF-8"));
+      } catch (UnsupportedEncodingException e) {
+        log.trace(e.getMessage());
+      }
+    }
+    
+    if (dw != null) {
+      log.trace("Marshalled result:\n" + dw.getBufferedString());
+    }
+    
   }
   
   protected void writeTo(Node node, Result result, Templates templates) {
 
+    DebugWriter dw = null;
+    DebugOutputStream ds = null;
+    if (log.isTraceEnabled() && result instanceof StreamResult) {
+      StreamResult streamResult = (StreamResult) result;
+      if (streamResult.getOutputStream() != null) {
+        ds = new DebugOutputStream(streamResult.getOutputStream());
+        streamResult.setOutputStream(ds);
+      }
+      if (streamResult.getWriter() != null) {
+        dw = new DebugWriter(streamResult.getWriter());
+        streamResult.setWriter(dw);
+      }
+    }
+
     if (templates == null) {
       try {
         TransformerFactory transformerFactory = TransformerFactory.newInstance();
@@ -179,7 +223,19 @@ public abstract class SLResultImpl implements SLResult {
         writeErrorTo(new SLException(2008), result, templates);
       }
     }
+
+    if (ds != null) {
+      try {
+        log.trace("Marshalled result:\n" + new String(ds.getBufferedBytes(), "UTF-8"));
+      } catch (UnsupportedEncodingException e) {
+        log.trace(e.getMessage());
+      }
+    }
     
+    if (dw != null) {
+      log.trace("Marshalled result:\n" + dw.getBufferedString());
+    }
+
   }
   
   protected void writeErrorTo(SLException slException, Result result, Templates templates) {
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java
index 969288c1..0c7ce3f5 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java
@@ -85,7 +85,7 @@ public class STALHelper {
    * @param stalRequests
    * @throws SLCommandException
    */
-   public void transmitSTALRequest(List<STALRequest> stalRequests) throws SLCommandException {
+   public void transmitSTALRequest(List<? extends STALRequest> stalRequests) throws SLCommandException {
     List<STALResponse> responses = stal.handleRequest(stalRequests);
     if (responses == null) {
       Log log = LogFactory.getLog(this.getClass());
diff --git a/bkucommon/src/test/java/at/gv/egiz/stal/dummy/DummySTAL.java b/bkucommon/src/test/java/at/gv/egiz/stal/dummy/DummySTAL.java
index 2ea0bae0..dd8b8c8f 100644
--- a/bkucommon/src/test/java/at/gv/egiz/stal/dummy/DummySTAL.java
+++ b/bkucommon/src/test/java/at/gv/egiz/stal/dummy/DummySTAL.java
@@ -71,7 +71,7 @@ public class DummySTAL implements STAL {
   }
 
   @Override
-  public List<STALResponse> handleRequest(List<STALRequest> requestList) {
+  public List<STALResponse> handleRequest(List<? extends STALRequest> requestList) {
 
     List<STALResponse> responses = new ArrayList<STALResponse>();
     for (STALRequest request : requestList) {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index b828e8cd..e34c4899 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -36,6 +36,7 @@ import javax.smartcardio.ATR;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
 import javax.smartcardio.CommandAPDU;
 import javax.smartcardio.ResponseAPDU;
 
@@ -53,7 +54,12 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
   int ifs_ = 254;
 
-  Card card_;
+  private Card card_;
+  
+  /**
+   * The card terminal that connects the {@link #card_}.  
+   */
+  private CardTerminal cardTerminal;
 
   protected AbstractSignatureCard(String resourceBundleName) {
     this.resourceBundleName = resourceBundleName;
@@ -331,8 +337,9 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   }
 
   
-  public void init(Card card) {
+  public void init(Card card, CardTerminal cardTerminal) {
     card_ = card;
+    this.cardTerminal = cardTerminal;
     ATR atr = card.getATR();
     byte[] atrBytes = atr.getBytes();
     if (atrBytes.length >= 6) {
@@ -340,6 +347,11 @@ public abstract class AbstractSignatureCard implements SignatureCard {
       log.trace("Setting IFS (information field size) to " + ifs_);
     }
   }
+  
+  @Override
+  public Card getCard() {
+    return card_;
+  }
 
   protected CardChannel getCardChannel() {
     return card_.getBasicChannel();
@@ -372,4 +384,18 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     }
   }
 
+  @Override
+  public void reset() throws SignatureCardException {
+    try {
+      log.debug("Disconnect and reset smart card.");
+      card_.disconnect(true);
+      log.debug("Reconnect smart card.");
+      if (cardTerminal != null) {
+        card_ = cardTerminal.connect("*");
+      }
+    } catch (CardException e) {
+      throw new SignatureCardException("Failed to reset card.", e);
+    }
+  }
+
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index 42943541..439be034 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -40,6 +40,7 @@ import java.util.Enumeration;
 import java.util.Locale;
 
 import javax.smartcardio.Card;
+import javax.smartcardio.CardTerminal;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -102,7 +103,12 @@ public class SWCard implements SignatureCard {
     SWCard.swCardDir = swCardDir;
   }
 
-  public void init(Card card) {
+  public void init(Card card, CardTerminal cardTerminal) {
+  }
+  
+  @Override
+  public Card getCard() {
+    return null;
   }
 
   private String getFileName(String fileName) {
@@ -379,4 +385,8 @@ public class SWCard implements SignatureCard {
   public void disconnect(boolean reset) {    
   }
 
+  @Override
+  public void reset() throws SignatureCardException {
+  }
+
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index b6a453df..d7e76dd8 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -31,6 +31,7 @@ package at.gv.egiz.smcc;
 import java.util.Locale;
 
 import javax.smartcardio.Card;
+import javax.smartcardio.CardTerminal;
 
 public interface SignatureCard {
 
@@ -75,12 +76,21 @@ public interface SignatureCard {
 
   }
 
-  public void init(Card card);
+  public void init(Card card, CardTerminal cardTerminal);
+  
+  public Card getCard();
 
   public byte[] getCertificate(KeyboxName keyboxName)
       throws SignatureCardException, InterruptedException;
   
   public void disconnect(boolean reset);
+  
+  /**
+   * Performs a reset of the card.
+   * 
+   * @throws SignatureCardException if reset fails.
+   */
+  public void reset() throws SignatureCardException;
 
   /**
    * 
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
index 777299d9..ab66e9a1 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
@@ -34,6 +34,7 @@ import java.util.List;
 
 import javax.smartcardio.ATR;
 import javax.smartcardio.Card;
+import javax.smartcardio.CardTerminal;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -204,6 +205,7 @@ public class SignatureCardFactory {
    * @param card
    *          the smart card, or <code>null</code> if a software card should be
    *          created
+   * @param cardTerminal TODO
    * 
    * @return a SignatureCard instance
    * 
@@ -211,12 +213,12 @@ public class SignatureCardFactory {
    *           if no implementation of the given <code>card</code> could be
    *           found
    */
-  public SignatureCard createSignatureCard(Card card)
+  public SignatureCard createSignatureCard(Card card, CardTerminal cardTerminal)
       throws CardNotSupportedException {
     
     if(card == null) {
       SignatureCard sCard = new SWCard();
-      sCard.init(card);
+      sCard.init(card, cardTerminal);
       return sCard;
     }
 
@@ -231,7 +233,7 @@ public class SignatureCardFactory {
         try {
           Class<?> scClass = cl.loadClass(supportedCard.getImplementationClassName());
           sc = (SignatureCard) scClass.newInstance();
-          sc.init(card);
+          sc.init(card, cardTerminal);
           return sc;
 
         } catch (ClassNotFoundException e) {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/util/SMCCHelper.java b/smcc/src/main/java/at/gv/egiz/smcc/util/SMCCHelper.java
index 4dae7975..f7d3bab7 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/util/SMCCHelper.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/util/SMCCHelper.java
@@ -57,7 +57,7 @@ public class SMCCHelper {
     SignatureCardFactory factory = SignatureCardFactory.getInstance();
     if (useSWCard) {
       try {
-        signatureCard = factory.createSignatureCard(null);
+        signatureCard = factory.createSignatureCard(null, null);
         resultCode = CARD_FOUND;
       } catch (CardNotSupportedException e) {
         resultCode = CARD_NOT_SUPPORTED;
@@ -83,7 +83,7 @@ public class SMCCHelper {
             if (c == null) {
               throw new CardNotSupportedException();
             }
-            signatureCard = factory.createSignatureCard(c);
+            signatureCard = factory.createSignatureCard(c, cardTerminal);
             ATR atr = newCards.get(cardTerminal).getATR();
             log.trace("Found supported card (" + signatureCard.toString() + ") "
                 + "in terminal '" + cardTerminal.getName() + "', ATR = "
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/util/SmartCardIO.java b/smcc/src/main/java/at/gv/egiz/smcc/util/SmartCardIO.java
index b70b44a7..b1866894 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/util/SmartCardIO.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/util/SmartCardIO.java
@@ -16,6 +16,7 @@
 */
 package at.gv.egiz.smcc.util;
 
+import java.security.NoSuchAlgorithmException;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -54,7 +55,13 @@ public class SmartCardIO {
   CardTerminals cardTerminals_;
 
   private void updateTerminalFactory() {
-    TerminalFactory terminalFactory = TerminalFactory.getDefault();
+    TerminalFactory terminalFactory;
+    try {
+      terminalFactory = TerminalFactory.getInstance("PC/SC", null);
+    } catch (NoSuchAlgorithmException e) {
+      log.info("Failed to get TerminalFactory of type 'PC/SC'.", e);
+      terminalFactory = TerminalFactory.getDefault();
+    }
     log.debug("TerminalFactory : " + terminalFactory);
     if ("PC/SC".equals(terminalFactory.getType())) {
       terminalFactory_ = terminalFactory;
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
index 55f51b22..6f08a135 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
@@ -121,7 +121,7 @@ public abstract class AbstractSMCCSTAL implements STAL {
   }
 
   @Override
-  public List<STALResponse> handleRequest(List<STALRequest> requestList) {
+  public List<STALResponse> handleRequest(List<? extends STALRequest> requestList) {
     log.debug("Got request list containing " + requestList.size()
         + " STAL requests");
     List<STALResponse> responseList = new ArrayList<STALResponse>(requestList
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index 59ea141c..77997217 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -5,6 +5,7 @@ import java.util.List;
 import java.util.Locale;
 
 import javax.smartcardio.Card;
+import javax.smartcardio.CardTerminal;
 
 import org.junit.Assert;
 import org.junit.Before;
@@ -61,7 +62,7 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
     }
 
     @Override
-    public void init(Card card) {
+    public void init(Card card, CardTerminal cardTerminal) {
       // TODO Auto-generated method stub
       
     }
@@ -71,6 +72,18 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       // TODO Auto-generated method stub
       
     }
+
+    @Override
+    public Card getCard() {
+      // TODO Auto-generated method stub
+      return null;
+    }
+
+    @Override
+    public void reset() throws SignatureCardException {
+      // TODO Auto-generated method stub
+      
+    }
      
    };
     return false;
diff --git a/utils/src/main/java/at/gv/egiz/bku/utils/DebugOutputStream.java b/utils/src/main/java/at/gv/egiz/bku/utils/DebugOutputStream.java
new file mode 100644
index 00000000..8516b76c
--- /dev/null
+++ b/utils/src/main/java/at/gv/egiz/bku/utils/DebugOutputStream.java
@@ -0,0 +1,48 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.bku.utils;
+
+import java.io.ByteArrayOutputStream;
+import java.io.FilterOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+
+public class DebugOutputStream extends FilterOutputStream {
+
+  private ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+
+  public DebugOutputStream(OutputStream out) {
+    super(out);
+  }
+
+  @Override
+  public void write(byte[] b, int off, int len) throws IOException {
+    buffer.write(b, off, len);
+    super.write(b, off, len);
+  }
+
+  @Override
+  public void write(int b) throws IOException {
+    buffer.write(b);
+    super.write(b);
+  }
+  
+  public byte[] getBufferedBytes() {
+    return buffer.toByteArray();
+  }
+
+}
diff --git a/utils/src/main/java/at/gv/egiz/bku/utils/DebugReader.java b/utils/src/main/java/at/gv/egiz/bku/utils/DebugReader.java
new file mode 100644
index 00000000..cafe4a72
--- /dev/null
+++ b/utils/src/main/java/at/gv/egiz/bku/utils/DebugReader.java
@@ -0,0 +1,58 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.bku.utils;
+
+import java.io.FilterReader;
+import java.io.IOException;
+import java.io.Reader;
+import java.io.StringWriter;
+
+public class DebugReader extends FilterReader {
+  
+  private StringWriter buffer = new StringWriter();
+  
+  public DebugReader(Reader in) {
+    super(in);
+  }
+  
+  public DebugReader(Reader in, String start) {
+    super(in);
+    buffer.write(start);
+  }
+
+  @Override
+  public int read() throws IOException {
+    int c = super.read();
+    if (c != -1)
+      buffer.write(c);
+    return c;
+  }
+
+  @Override
+  public int read(char[] cbuf, int off, int len) throws IOException {
+    int l = super.read(cbuf, off, len);
+    if (l != -1 ) {
+      buffer.write(cbuf, off, l);
+    }
+    return l;
+  }
+
+  public String getCachedString() {
+    return buffer.toString();
+  }
+  
+}
diff --git a/utils/src/main/java/at/gv/egiz/bku/utils/DebugWriter.java b/utils/src/main/java/at/gv/egiz/bku/utils/DebugWriter.java
new file mode 100644
index 00000000..5566f927
--- /dev/null
+++ b/utils/src/main/java/at/gv/egiz/bku/utils/DebugWriter.java
@@ -0,0 +1,55 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.bku.utils;
+
+import java.io.FilterWriter;
+import java.io.IOException;
+import java.io.StringWriter;
+import java.io.Writer;
+
+public class DebugWriter extends FilterWriter {
+
+  private Writer buffer = new StringWriter();
+  
+  public DebugWriter(Writer out) {
+    super(out);
+  }
+
+  @Override
+  public void write(char[] cbuf, int off, int len) throws IOException {
+    buffer.write(cbuf, off, len);
+    super.write(cbuf, off, len);
+  }
+
+  @Override
+  public void write(String str, int off, int len) throws IOException {
+    buffer.write(str, off, len);
+    super.write(str, off, len);
+  }
+
+  @Override
+  public void write(int c) throws IOException {
+    buffer.write(c);
+    super.write(c);
+  }
+  
+  public String getBufferedString() {
+    return buffer.toString();
+  }
+  
+
+}
-- 
cgit v1.2.3


From f8daac3a191bcb0fe280ed0204f28f8edcfb3008 Mon Sep 17 00:00:00 2001
From: clemenso <clemenso@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Wed, 11 Feb 2009 20:11:05 +0000
Subject: GetStatusRequest

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@302 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java  |  4 +-
 .../gv/egiz/bku/smccstal/StatusRequestHandler.java | 72 ++++++++++++++++++++++
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java | 12 ++++
 smccSTAL/src/test/resources/log4j.properties       | 19 ++++++
 4 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/StatusRequestHandler.java
 create mode 100644 smccSTAL/src/test/resources/log4j.properties

(limited to 'smccSTAL/src/test/java/at')

diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
index 92491139..0074860f 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
@@ -34,11 +34,12 @@ import at.gv.egiz.stal.InfoboxReadRequest;
 import at.gv.egiz.stal.STAL;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
+import at.gv.egiz.stal.StatusRequest;
 
 public abstract class AbstractSMCCSTAL implements STAL {
   private static Log log = LogFactory.getLog(AbstractSMCCSTAL.class);
 
-  public final static int DEFAULT_MAX_RETRIES = 3;
+  public final static int DEFAULT_MAX_RETRIES = 1;
 
   protected Locale locale = Locale.getDefault();
   protected SignatureCard signatureCard = null;
@@ -49,6 +50,7 @@ public abstract class AbstractSMCCSTAL implements STAL {
 
   protected AbstractSMCCSTAL() {
     addRequestHandler(InfoboxReadRequest.class, new InfoBoxReadRequestHandler());
+    addRequestHandler(StatusRequest.class, new StatusRequestHandler());
     unrecoverableErrors.add(6001);
   }
 
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/StatusRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/StatusRequestHandler.java
new file mode 100644
index 00000000..56b24920
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/StatusRequestHandler.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.smccstal;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import at.gv.egiz.stal.ErrorResponse;
+import at.gv.egiz.stal.STALRequest;
+import at.gv.egiz.stal.STALResponse;
+import at.gv.egiz.stal.StatusRequest;
+import at.gv.egiz.stal.StatusResponse;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class StatusRequestHandler extends AbstractRequestHandler {
+
+  protected static final Log log = LogFactory.getLog(StatusRequestHandler.class);
+
+  @Override
+  public void init(SignatureCard sc, BKUGUIFacade gui) {
+    //nothing, avoid NullPointerEx since requireCard==false => sc==null
+  }
+
+
+  @Override
+  public STALResponse handleRequest(STALRequest request) throws InterruptedException {
+
+    if (request instanceof StatusRequest) {
+      log.info("handling STATUS request");
+      SMCCHelper smccHelper = new SMCCHelper();
+      StatusResponse response = new StatusResponse();
+      if (log.isTraceEnabled()) {
+        log.trace("SMCC result code: " + smccHelper.getResultCode() + 
+                ", cardReady: " +
+                (smccHelper.getResultCode() == SMCCHelper.CARD_FOUND));
+      }
+      if (smccHelper.getResultCode() == SMCCHelper.CARD_FOUND) {
+        response.setCardReady(Boolean.TRUE);
+      } else {
+        response.setCardReady(Boolean.FALSE);
+      }
+      return response;
+    } else {
+      log.error("Got unexpected STAL request: " + request);
+      return new ErrorResponse(1000);
+    }
+  }
+
+  @Override
+  public boolean requireCard() {
+    return false;
+  }
+}
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index 77997217..a5f8a771 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -19,6 +19,7 @@ import at.gv.egiz.stal.InfoboxReadRequest;
 import at.gv.egiz.stal.InfoboxReadResponse;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
+import org.junit.Ignore;
 
 public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
     SMCCSTALRequestHandler {
@@ -84,6 +85,16 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       // TODO Auto-generated method stub
       
     }
+
+      @Override
+      public byte[] getKIDs() {
+        return null;
+      }
+
+      @Override
+      public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
+        return 0;
+      }
      
    };
     return false;
@@ -95,6 +106,7 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
   }
 
   @Test
+  @Ignore
   public void testRetry() {
     InfoboxReadRequest irr = new InfoboxReadRequest();
     List<STALRequest> irrl = new ArrayList<STALRequest>();
diff --git a/smccSTAL/src/test/resources/log4j.properties b/smccSTAL/src/test/resources/log4j.properties
new file mode 100644
index 00000000..053eac17
--- /dev/null
+++ b/smccSTAL/src/test/resources/log4j.properties
@@ -0,0 +1,19 @@
+# loglever DEBUG, appender STDOUT
+log4j.rootLogger=TRACE, STDOUT
+#log4j.logger.at.gv.egiz.slbinding.RedirectEventFilter=DEBUG, STDOUT
+
+# STDOUT appender
+log4j.appender.STDOUT=org.apache.log4j.ConsoleAppender
+log4j.appender.STDOUT.layout=org.apache.log4j.PatternLayout
+#log4j.appender.STDOUT.layout.ConversionPattern=%5p | %d{dd HH:mm:ss,SSS} | %20c |  %10t | %m%n
+#log4j.appender.STDOUT.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n
+log4j.appender.STDOUT.layout.ConversionPattern=%-5p |%d | %t | %c %x- %m%n
+
+### FILE appender
+#log4j.appender.file=org.apache.log4j.RollingFileAppender
+#log4j.appender.file.maxFileSize=100KB
+#log4j.appender.file.maxBackupIndex=9
+#log4j.appender.file.File=egovbus_ca.log
+#log4j.appender.file.threshold=info
+#log4j.appender.file.layout=org.apache.log4j.PatternLayout
+#log4j.appender.file.layout.ConversionPattern=%d{ABSOLUTE} %5p %c{1}:%L - %m%n
\ No newline at end of file
-- 
cgit v1.2.3


From 6576428966f1e3d688269a407b072fb01f9f7647 Mon Sep 17 00:00:00 2001
From: clemenso <clemenso@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Thu, 26 Feb 2009 19:39:00 +0000
Subject: 1.1 candidate (activation)

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@309 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../gv/egiz/bku/online/applet/AppletBKUWorker.java |    9 +-
 .../java/at/gv/egiz/bku/gui/PINManagementGUI.java  |  519 ++++-
 .../at/gv/egiz/bku/gui/PINManagementGUIFacade.java |   47 +-
 .../java/at/gv/egiz/bku/gui/PINSpecRenderer.java   |   39 +
 .../java/at/gv/egiz/bku/gui/PINStatusProvider.java |   32 -
 .../java/at/gv/egiz/bku/gui/PINStatusRenderer.java |   63 +
 .../at/gv/egiz/bku/gui/PINStatusTableModel.java    |   60 +
 .../bku/online/applet/PINManagementApplet.java     |    3 +-
 .../bku/online/applet/PINManagementBKUWorker.java  |   82 +-
 .../smccstal/ext/PINManagementRequestHandler.java  |  331 ++++
 .../bku/smccstal/ext/PINMgmtRequestHandler.java    |   93 -
 .../gv/egiz/bku/gui/ActivationMessages.properties  |   28 +-
 .../egiz/bku/gui/ActivationMessages_en.properties  |   30 +-
 .../test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java |    4 +-
 BKUAppletExt/src/test/resources/appletTest.html    |    2 +-
 .../main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java   |    8 +-
 .../main/java/at/gv/egiz/bku/gui/PinDocument.java  |   28 +-
 .../at/gv/egiz/bku/gui/Messages.properties         |    4 +-
 .../test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java |    2 +-
 .../at/gv/egiz/stal/ext/ActivatePINRequest.java    |   28 -
 .../java/at/gv/egiz/stal/ext/ChangePINRequest.java |   28 -
 .../at/gv/egiz/stal/ext/PINManagementRequest.java  |   31 +
 .../at/gv/egiz/stal/ext/PINManagementResponse.java |   28 +
 .../at/gv/egiz/stal/ext/UnblockPINRequest.java     |   28 -
 .../egiz/bku/slcommands/impl/xsect/DataObject.java | 2078 ++++++++++----------
 .../egiz/bku/slcommands/impl/xsect/Signature.java  |    5 +-
 .../bku/slcommands/impl/xsect/SignatureTest.java   | 1505 +++++++-------
 .../egiz/bku/slcommands/impl/TransformsInfo_2.xml  |  397 ++++
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   |   25 +-
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     |   10 +
 smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java    |   30 +-
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java |   25 +-
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |   14 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |    5 +-
 .../at/gv/egiz/bku/smccstal/AbstractBKUWorker.java |    3 +
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |    9 +-
 .../java/at/gv/egiz/marshal/NamespacePrefix.java   |   34 +
 .../gv/egiz/marshal/NamespacePrefixMapperImpl.java |   16 +-
 .../at/gv/egiz/slbinding/RedirectEventFilter.java  |  389 ++--
 .../gv/egiz/slbinding/impl/TransformsInfoType.java |    1 +
 .../at/gv/egiz/slbinding/impl/XMLContentType.java  |    2 +-
 .../org/w3/_2000/_09/xmldsig_/ObjectFactory.java   |    1 +
 .../org/w3/_2000/_09/xmldsig_/TransformsType.java  |    2 +-
 .../java/at/gv/egiz/slbinding/RedirectTest.java    |   29 +-
 .../CreateXMLSignatureRequest02.xml_redirect.txt   |    5 +-
 45 files changed, 3813 insertions(+), 2299 deletions(-)
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINSpecRenderer.java
 delete mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusProvider.java
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
 delete mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINMgmtRequestHandler.java
 delete mode 100644 STALExt/src/main/java/at/gv/egiz/stal/ext/ActivatePINRequest.java
 delete mode 100644 STALExt/src/main/java/at/gv/egiz/stal/ext/ChangePINRequest.java
 create mode 100644 STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementRequest.java
 create mode 100644 STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementResponse.java
 delete mode 100644 STALExt/src/main/java/at/gv/egiz/stal/ext/UnblockPINRequest.java
 create mode 100644 bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/TransformsInfo_2.xml
 create mode 100644 utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
index 5a57ef18..8c1bd2bd 100644
--- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
+++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
@@ -195,11 +195,16 @@ public class AppletBKUWorker extends AbstractBKUWorker implements Runnable {
     }
   }
 
+  /**
+   *
+   * @param err_code
+   * @param ex if not null, the message will be appended as parameter to the error message
+   */
   protected void showErrorDialog(String err_code, Exception ex) {
     actionCommandList.clear();
     actionCommandList.add("ok");
-    gui.showErrorDialog(err_code,
-            new Object[]{ex.getMessage()}, this, "ok");
+    Object[] params = (ex != null) ? new Object[] { ex.getMessage() } : null;
+    gui.showErrorDialog(err_code, params, this, "ok");
     try {
       waitForAction();
     } catch (InterruptedException e) {
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
index 8acf051e..8eef8aea 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
@@ -17,15 +17,28 @@
 
 package at.gv.egiz.bku.gui;
 
+import at.gv.egiz.smcc.PINSpec;
 import java.awt.Container;
+import java.awt.Cursor;
+import java.awt.event.ActionEvent;
 import java.awt.event.ActionListener;
+import java.awt.event.MouseEvent;
+import java.awt.event.MouseMotionAdapter;
 import java.net.URL;
+import java.text.MessageFormat;
 import java.util.Locale;
+import java.util.Map;
 import javax.swing.GroupLayout;
 import javax.swing.JButton;
 import javax.swing.JLabel;
+import javax.swing.JPasswordField;
+import javax.swing.JScrollPane;
+import javax.swing.JTable;
 import javax.swing.LayoutStyle;
+import javax.swing.ListSelectionModel;
 import javax.swing.SwingUtilities;
+import javax.swing.event.ListSelectionEvent;
+import javax.swing.event.ListSelectionListener;
 
 /**
  * TODO pull out ResourceBundle to common superclass for activationGUI and pinMgmtGUI
@@ -33,9 +46,10 @@ import javax.swing.SwingUtilities;
  */
 public class PINManagementGUI extends ActivationGUI implements PINManagementGUIFacade {
 
-  public static final String BUTTON_ACTIVATE = "button.activate";
-  public static final String BUTTON_UNBLOCK = "button.unblock";
-  public static final String BUTTON_CHANGE = "button.change";
+  /** remember the pinfield to return to worker */
+  protected JPasswordField oldPinField;
+  /** remember the pinSpec to return to worker */
+  protected PINSpec pinSpec;
 
   public PINManagementGUI(Container contentPane,
           Locale locale,
@@ -46,12 +60,31 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
   }
 
   @Override
-  public void showPINManagementDialog(final PINStatusProvider pinStatusProvider,
-          final ActionListener activateListener, final String activateCmd,
-          final ActionListener changeListener, final String changeCmd,
-          final ActionListener unblockListener, final String unblockCmd,
-          final ActionListener cancelListener, final String cancelCmd) {
-//    try {
+  public char[] getOldPin() {
+    if (oldPinField != null) {
+      char[] pin = oldPinField.getPassword();
+      oldPinField = null;
+      return pin;
+    }
+    return null;
+  }
+
+  @Override
+  public PINSpec getSelectedPIN() {
+    return pinSpec;
+  }
+
+  @Override
+  public void showPINManagementDialog(final Map<PINSpec, STATUS> pins, 
+          final ActionListener activateListener,
+          final String activateCmd,
+          final String changeCmd,
+          final String unblockCmd,
+          final ActionListener cancelListener,
+          final String cancelCmd) {
+
+      log.debug("scheduling PIN managment dialog");
+    
       SwingUtilities.invokeLater(new Runnable() {
 
         @Override
@@ -68,13 +101,76 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
 
                 if (renderHeaderPanel) {
                   titleLabel.setText(cardmgmtMessages.getString(TITLE_PINMGMT));
-                  mgmtLabel.setText(cardmgmtMessages.getString(MESSAGE_PINMGMT));
+                  String infoPattern = cardmgmtMessages.getString(MESSAGE_PINMGMT);
+                  mgmtLabel.setText(MessageFormat.format(infoPattern, pins.size()));
                 } else {
                   mgmtLabel.setText(cardmgmtMessages.getString(TITLE_PINMGMT));
                 }
 
+                final PINStatusTableModel tableModel = new PINStatusTableModel(pins);
+                final JTable pinStatusTable = new JTable(tableModel);
+                pinStatusTable.setDefaultRenderer(PINSpec.class, new PINSpecRenderer());
+                pinStatusTable.setDefaultRenderer(STATUS.class, new PINStatusRenderer(cardmgmtMessages));
+                pinStatusTable.setTableHeader(null);
 
-                
+                pinStatusTable.addMouseMotionListener(new MouseMotionAdapter() {
+
+                  @Override
+                  public void mouseMoved(MouseEvent e) {
+                    if (pinStatusTable.columnAtPoint(e.getPoint()) == 0) {
+                      pinStatusTable.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+                    } else {
+                      pinStatusTable.setCursor(Cursor.getDefaultCursor());
+                    }
+                  }
+                });
+
+                final JButton activateButton = new JButton();
+                activateButton.setFont(activateButton.getFont().deriveFont(activateButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+                activateButton.addActionListener(activateListener);
+
+                pinStatusTable.setSelectionMode(ListSelectionModel.SINGLE_SELECTION);
+                pinStatusTable.getSelectionModel().addListSelectionListener(new ListSelectionListener() {
+
+                  @Override
+                  public void valueChanged(final ListSelectionEvent e) {
+                    //invoke later to allow thread to paint selection background
+                    SwingUtilities.invokeLater(new Runnable() {
+
+                      @Override
+                      public void run() {
+                        ListSelectionModel lsm = (ListSelectionModel) e.getSource();
+                        int selectionIdx = lsm.getMinSelectionIndex();
+                        if (selectionIdx >= 0) {
+                          pinSpec = (PINSpec) tableModel.getValueAt(selectionIdx, 0);
+                          STATUS status = (STATUS) tableModel.getValueAt(selectionIdx, 1);
+
+                          if (status == STATUS.NOT_ACTIV) {
+                            activateButton.setText(cardmgmtMessages.getString(BUTTON_ACTIVATE));
+                            activateButton.setEnabled(true);
+                            activateButton.setActionCommand(activateCmd);
+                          } else if (status == STATUS.BLOCKED) {
+                            activateButton.setText(cardmgmtMessages.getString(BUTTON_UNBLOCK));
+                            activateButton.setEnabled(true);
+                            activateButton.setActionCommand(unblockCmd);
+                          } else if (status == STATUS.ACTIV) {
+                            activateButton.setText(cardmgmtMessages.getString(BUTTON_CHANGE));
+                            activateButton.setEnabled(true);
+                            activateButton.setActionCommand(changeCmd);
+                          } else {
+                            activateButton.setText(cardmgmtMessages.getString(BUTTON_ACTIVATE));
+                            activateButton.setEnabled(false);
+                          }
+                        }
+                      }
+                    });
+                  }
+                });
+
+                //select first entry
+                pinStatusTable.getSelectionModel().setSelectionInterval(0, 0);
+
+                JScrollPane pinStatusScrollPane = new JScrollPane(pinStatusTable);
 
                 GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
                 mainPanel.setLayout(mainPanelLayout);
@@ -91,30 +187,16 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                           .addComponent(helpLabel);
                 }
 
-                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-                mainPanelLayout.setVerticalGroup(messageVertical);
+                mainPanelLayout.setHorizontalGroup(
+                mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                  .addGroup(messageHorizontal)
+                  .addComponent(pinStatusScrollPane, 0, 0, Short.MAX_VALUE));
 
-
-                JButton activateButton = new JButton();
-                activateButton.setFont(activateButton.getFont().deriveFont(activateButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                activateButton.setText(cardmgmtMessages.getString(BUTTON_ACTIVATE));
-                activateButton.setEnabled(true);//false);
-                activateButton.setActionCommand(activateCmd);
-                activateButton.addActionListener(activateListener);
-
-                JButton changeButton = new JButton();
-                changeButton.setFont(activateButton.getFont().deriveFont(activateButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                changeButton.setText(cardmgmtMessages.getString(BUTTON_CHANGE));
-                changeButton.setEnabled(false);
-                changeButton.setActionCommand(changeCmd);
-                changeButton.addActionListener(changeListener);
-
-                JButton unblockButton = new JButton();
-                unblockButton.setFont(activateButton.getFont().deriveFont(activateButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                unblockButton.setText(cardmgmtMessages.getString(BUTTON_UNBLOCK));
-                unblockButton.setEnabled(false);
-                unblockButton.setActionCommand(unblockCmd);
-                unblockButton.addActionListener(unblockListener);
+                mainPanelLayout.setVerticalGroup(
+                  mainPanelLayout.createSequentialGroup()
+                    .addGroup(messageVertical)
+                    .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                    .addComponent(pinStatusScrollPane, 0, 0, pinStatusTable.getPreferredSize().height+3));
 
                 JButton cancelButton = new JButton();
                 cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
@@ -129,30 +211,377 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                         .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                         .addComponent(activateButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
                         .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                        .addComponent(changeButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
-                        .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                        .addComponent(unblockButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
-                        .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
                         .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
 
                 GroupLayout.Group buttonVertical = buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
                           .addComponent(activateButton)
-                          .addComponent(changeButton)
-                          .addComponent(unblockButton)
                           .addComponent(cancelButton);
 
                 buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
                 buttonPanelLayout.setVerticalGroup(buttonVertical);
 
                 contentPanel.validate();
-
         }
       });
+  }
+
+  @Override
+  public void showActivatePINDialog(final PINSpec pin,
+          final ActionListener okListener, final String okCommand,
+          final ActionListener cancelListener, final String cancelCommand) {
+    log.debug("scheduling activate pin dialog");
+    showPINDialog(false, pin, okListener, okCommand, cancelListener, cancelCommand);
+  }
+
+
+  private void showPINDialog(final boolean changePin, final PINSpec pinSpec,
+          final ActionListener okListener, final String okCommand,
+          final ActionListener cancelListener, final String cancelCommand) {
+
+      SwingUtilities.invokeLater(new Runnable() {
+
+            @Override
+            public void run() {
+
+              String HELP_TOPIC, TITLE, MESSAGE_MGMT;
+              if (changePin) {
+                log.debug("show change pin dialog");
+                HELP_TOPIC = HELP_PINMGMT;
+                TITLE = TITLE_CHANGE_PIN;
+                MESSAGE_MGMT = MESSAGE_CHANGE_PIN;
+              } else {
+                log.debug("show activate pin dialog");
+                HELP_TOPIC = HELP_PINMGMT;
+                TITLE = TITLE_ACTIVATE_PIN;
+                MESSAGE_MGMT = MESSAGE_ACTIVATE_PIN;
+                oldPinField = null;
+              }
+
+                mainPanel.removeAll();
+                buttonPanel.removeAll();
+
+                helpListener.setHelpTopic(HELP_TOPIC);
+
+                JLabel mgmtLabel = new JLabel();
+                mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+
+                if (renderHeaderPanel) {
+                  titleLabel.setText(cardmgmtMessages.getString(TITLE));
+                  String mgmtPattern = cardmgmtMessages.getString(MESSAGE_MGMT);
+                  if (shortText) {
+                    mgmtLabel.setText(MessageFormat.format(mgmtPattern, "PIN"));
+                  } else {
+                    mgmtLabel.setText(MessageFormat.format(mgmtPattern, pinSpec.getLocalizedName()));
+                  }
+                } else {
+                  mgmtLabel.setText(cardmgmtMessages.getString(TITLE));
+                }
+
+                JButton okButton = new JButton();
+                okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+                okButton.setText(messages.getString(BUTTON_OK));
+                okButton.setEnabled(false);
+                okButton.setActionCommand(okCommand);
+                okButton.addActionListener(okListener);
+
+                JLabel pinLabel = new JLabel();
+                pinLabel.setFont(pinLabel.getFont().deriveFont(pinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                String pinLabelPattern = (changePin) ? cardmgmtMessages.getString(LABEL_NEW_PIN) : messages.getString(LABEL_PIN);
+                pinLabel.setText(MessageFormat.format(pinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
+
+                final JPasswordField repeatPinField = new JPasswordField();
+                pinField = new JPasswordField();
+                pinField.setText("");
+                pinField.setDocument(new PINDocument(pinSpec, null));
+                pinField.setActionCommand(okCommand);
+                pinField.addActionListener(new ActionListener() {
+
+                    @Override
+                    public void actionPerformed(ActionEvent e) {
+                        if (pinField.getPassword().length >= pinSpec.getMinLength()) {
+                          repeatPinField.requestFocusInWindow();
+                        }
+                    }
+                });
+                JLabel repeatPinLabel = new JLabel();
+                repeatPinLabel.setFont(pinLabel.getFont());
+                String repeatPinLabelPattern = cardmgmtMessages.getString(LABEL_REPEAT_PIN);
+                repeatPinLabel.setText(MessageFormat.format(repeatPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
+
+                repeatPinField.setText("");
+                repeatPinField.setDocument(new PINDocument(pinSpec, okButton, pinField.getDocument()));
+                repeatPinField.setActionCommand(okCommand);
+                repeatPinField.addActionListener(new ActionListener() {
+
+                    @Override
+                    public void actionPerformed(ActionEvent e) {
+                        if (pinField.getPassword().length >= pinSpec.getMinLength()) {
+                            okListener.actionPerformed(e);
+                        }
+                    }
+                });
+
+                JLabel oldPinLabel = null;
+                if (changePin) {
+                  oldPinLabel = new JLabel();
+                  oldPinLabel.setFont(oldPinLabel.getFont().deriveFont(oldPinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                  String oldPinLabelPattern = cardmgmtMessages.getString(LABEL_OLD_PIN);
+                  oldPinLabel.setText(MessageFormat.format(oldPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
+
+                  oldPinField = new JPasswordField();
+                  oldPinField.setText("");
+                  oldPinField.setDocument(new PINDocument(pinSpec, null));
+                  oldPinField.setActionCommand(okCommand);
+                  oldPinField.addActionListener(new ActionListener() {
+
+                      @Override
+                      public void actionPerformed(ActionEvent e) {
+                          if (oldPinField.getPassword().length >= pinSpec.getMinLength()) {
+                            pinField.requestFocusInWindow();
+                          }
+                      }
+                  });
+                }
+                
+                JLabel pinsizeLabel = new JLabel();
+                pinsizeLabel.setFont(pinsizeLabel.getFont().deriveFont(pinsizeLabel.getFont().getStyle() & ~java.awt.Font.BOLD, pinsizeLabel.getFont().getSize()-2));
+                String pinsizePattern = messages.getString(LABEL_PINSIZE);
+                String pinSize = String.valueOf(pinSpec.getMinLength());
+                if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+                    pinSize += "-" + pinSpec.getMaxLength();
+                }
+                pinsizeLabel.setText(MessageFormat.format(pinsizePattern, new Object[]{pinSize}));
+
+                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+                mainPanel.setLayout(mainPanelLayout);
+
+                GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
+                          .addComponent(mgmtLabel);
+                GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                          .addComponent(mgmtLabel);
+
+                if (!renderHeaderPanel) {
+                  infoHorizontal
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                          .addComponent(helpLabel);
+                  infoVertical
+                          .addComponent(helpLabel);
+                }
 
-//    } catch (Exception ex) {
-//      log.error(ex.getMessage(), ex);
-//      showErrorDialog(ERR_UNKNOWN_WITH_PARAM, new Object[] {ex.getMessage()});
-//    }
+                GroupLayout.ParallelGroup pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
+                GroupLayout.SequentialGroup pinVertical = mainPanelLayout.createSequentialGroup();
+
+                if (pinLabelPos == PinLabelPosition.ABOVE) {
+                  if (changePin) {
+                    pinHorizontal
+                            .addComponent(oldPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                            .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE);
+                    pinVertical
+                            .addComponent(oldPinLabel)
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                            .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
+                  }
+                  pinHorizontal 
+                          .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                          .addComponent(repeatPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                          .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                            .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
+                  pinVertical
+                          .addComponent(pinLabel)
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(repeatPinLabel)
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(pinsizeLabel);
+                } else {
+                  if (changePin) {
+                    pinHorizontal
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                              .addComponent(oldPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                              .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                              .addComponent(repeatPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE))
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                            .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                              .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                              .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                              .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)));
+
+                    pinVertical
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(oldPinLabel)
+                            .addComponent(oldPinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
+                  } else {
+                    pinHorizontal
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                              .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                              .addComponent(repeatPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE))
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                            .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                              .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                              .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)));
+
+                  }
+                  pinHorizontal
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                            .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
+                  pinVertical
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(pinLabel)
+                            .addComponent(pinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(repeatPinLabel)
+                            .addComponent(repeatPinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(pinsizeLabel);
+                }
+
+                mainPanelLayout.setHorizontalGroup(
+                  mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                    .addGroup(infoHorizontal)
+                    .addGroup(pinHorizontal));
+
+                mainPanelLayout.setVerticalGroup(
+                  mainPanelLayout.createSequentialGroup()
+                    .addGroup(infoVertical)
+                    .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                    .addGroup(pinVertical));
+
+                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+                buttonPanel.setLayout(buttonPanelLayout);
+
+                GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
+                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                        .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
+                GroupLayout.Group buttonVertical;
+
+                JButton cancelButton = new JButton();
+                cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+                cancelButton.setText(messages.getString(BUTTON_CANCEL));
+                cancelButton.setActionCommand(cancelCommand);
+                cancelButton.addActionListener(cancelListener);
+
+                buttonHorizontal
+                        .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                        .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
+                buttonVertical = buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                        .addComponent(okButton)
+                        .addComponent(cancelButton);
+
+                buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
+                buttonPanelLayout.setVerticalGroup(buttonVertical);
+
+                if (oldPinField != null) {
+                  oldPinField.requestFocusInWindow();
+                } else {
+                  pinField.requestFocusInWindow();
+                }
+                contentPanel.validate();
+
+            }
+        });
+  }
+
+  @Override
+  public void showChangePINDialog(final PINSpec pin,
+          final ActionListener okListener, final String okCommand,
+          final ActionListener cancelListener, final String cancelCommand) {
+    
+      log.debug("scheduling change pin dialog");
+      showPINDialog(true, pin, okListener, okCommand, cancelListener, cancelCommand);
+  }
+
+  @Override
+  public void showUnblockPINDialog(final PINSpec pin,
+          final ActionListener okListener, final String okCommand,
+          final ActionListener cancelListener, final String cancelCommand) {
+
+      log.debug("scheduling unblock PIN dialog");
+
+      SwingUtilities.invokeLater(new Runnable() {
+
+          @Override
+            public void run() {
+
+                log.debug("show unblock PIN dialog");
+
+                log.error("unblock pin not supported");
+
+                mainPanel.removeAll();
+                buttonPanel.removeAll();
+
+                if (renderHeaderPanel) {
+                  titleLabel.setText(messages.getString(TITLE_ERROR));
+                }
+
+                helpListener.setHelpTopic(HELP_PINMGMT);
+
+                String errorMsgPattern = cardmgmtMessages.getString(ERR_UNBLOCK);
+                String errorMsg = MessageFormat.format(errorMsgPattern, pin.getLocalizedName());
+
+                JLabel errorMsgLabel = new JLabel();
+                errorMsgLabel.setFont(errorMsgLabel.getFont().deriveFont(errorMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                errorMsgLabel.setText(errorMsg);
+
+                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+                mainPanel.setLayout(mainPanelLayout);
+
+                GroupLayout.ParallelGroup mainHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
+                GroupLayout.SequentialGroup mainVertical = mainPanelLayout.createSequentialGroup();
+
+                if (!renderHeaderPanel) {
+                  JLabel errorTitleLabel = new JLabel();
+                  errorTitleLabel.setFont(errorTitleLabel.getFont().deriveFont(errorTitleLabel.getFont().getStyle() | java.awt.Font.BOLD));
+                  errorTitleLabel.setText(messages.getString(TITLE_ERROR));
+                  errorTitleLabel.setForeground(ERROR_COLOR);
+
+                  mainHorizontal
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addComponent(errorTitleLabel)
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                            .addComponent(helpLabel));
+                  mainVertical
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                            .addComponent(errorTitleLabel)
+                            .addComponent(helpLabel));
+                }
+
+                mainPanelLayout.setHorizontalGroup(mainHorizontal
+                        .addComponent(errorMsgLabel));
+                mainPanelLayout.setVerticalGroup(mainVertical
+                        .addComponent(errorMsgLabel));
+
+                JButton okButton = new JButton();
+                okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+                okButton.setText(messages.getString(BUTTON_OK));
+                okButton.setActionCommand(cancelCommand);
+                okButton.addActionListener(cancelListener);
+
+                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+                buttonPanel.setLayout(buttonPanelLayout);
+
+                buttonPanelLayout.setHorizontalGroup(
+                  buttonPanelLayout.createSequentialGroup()
+                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                        .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
+                buttonPanelLayout.setVerticalGroup(
+                  buttonPanelLayout.createSequentialGroup()
+                    .addComponent(okButton));
+
+                contentPanel.validate();
+            }
+        });
   }
 
 
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
index 3d653fab..2a8f28d2 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
@@ -17,7 +17,9 @@
 
 package at.gv.egiz.bku.gui;
 
+import at.gv.egiz.smcc.PINSpec;
 import java.awt.event.ActionListener;
+import java.util.Map;
 
 /**
  *
@@ -27,8 +29,49 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
 
   public static final String HELP_PINMGMT = "help.pin.mgmt";
   public static final String TITLE_PINMGMT = "title.pin.mgmt";
+  public static final String TITLE_ACTIVATE_PIN = "title.activate.pin";
+  public static final String TITLE_CHANGE_PIN = "title.change.pin";
+  public static final String TITLE_UNBLOCK_PIN = "title.unblock.pin";
   public static final String MESSAGE_PINMGMT = "message.pin.mgmt";
-  
-  public void showPINManagementDialog(PINStatusProvider pinStatusProvider, ActionListener activateListener, String activateCmd, ActionListener changeListener, String changeCmd, ActionListener unblockListener, String unblockCmd, ActionListener cancelListener, String cancelCmd);
+  public static final String MESSAGE_ACTIVATE_PIN = "message.activate.pin";
+  public static final String MESSAGE_CHANGE_PIN = "message.change.pin";
+  public static final String MESSAGE_UNBLOCK_PIN = "message.unblock.pin";
+  public static final String LABEL_OLD_PIN = "label.old.pin";
+  public static final String LABEL_NEW_PIN = "label.new.pin";
+  public static final String LABEL_REPEAT_PIN = "label.repeat.pin";
 
+  public static final String ERR_ACTIVATE = "err.activate";
+  public static final String ERR_CHANGE = "err.change";
+  public static final String ERR_UNBLOCK = "err.unblock";
+
+  public static final String BUTTON_ACTIVATE = "button.activate";
+  public static final String BUTTON_UNBLOCK = "button.unblock";
+  public static final String BUTTON_CHANGE = "button.change";
+
+  public static final String STATUS_ACTIVE = "status.active";
+  public static final String STATUS_BLOCKED = "status.blocked";
+  public static final String STATUS_NOT_ACTIVE = "status.not.active";
+  public static final String STATUS_UNKNOWN = "status.unknown";
+
+  public enum STATUS { ACTIV, NOT_ACTIV, BLOCKED, UNKNOWN };
+
+  public void showPINManagementDialog(Map<PINSpec, STATUS> pins,
+          ActionListener activateListener, String activateCmd, String changeCmd, String unblockCmd,
+          ActionListener cancelListener, String cancelCmd);
+
+  public void showActivatePINDialog(PINSpec pin,
+          ActionListener okListener, String okCmd,
+          ActionListener cancelListener, String cancelCmd);
+
+  public void showChangePINDialog(PINSpec pin,
+          ActionListener okListener, String okCmd,
+          ActionListener cancelListener, String cancelCmd);
+
+  public void showUnblockPINDialog(PINSpec pin,
+          ActionListener okListener, String okCmd,
+          ActionListener cancelListener, String cancelCmd);
+
+  public char[] getOldPin();
+
+  public PINSpec getSelectedPIN();
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINSpecRenderer.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINSpecRenderer.java
new file mode 100644
index 00000000..e3d73e1f
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINSpecRenderer.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.gui;
+
+import at.gv.egiz.smcc.PINSpec;
+import javax.swing.table.DefaultTableCellRenderer;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PINSpecRenderer extends DefaultTableCellRenderer {
+
+  private static final Log log = LogFactory.getLog(PINSpecRenderer.class);
+
+  @Override
+  protected void setValue(Object value) {
+    PINSpec pinSpec = (PINSpec) value;
+    super.setText(pinSpec.getLocalizedName());
+  }
+
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusProvider.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusProvider.java
deleted file mode 100644
index 73fa0920..00000000
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusProvider.java
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.bku.gui;
-
-import at.gv.egiz.smcc.SignatureCardException;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public interface PINStatusProvider {
-
-  public enum STATUS { ACTIV, NOT_ACTIV, BLOCKED };
-
-  public STATUS getPINStatus(int pin) throws SignatureCardException;
-
-}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
new file mode 100644
index 00000000..2f8852ff
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.gui;
+
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
+import java.awt.Color;
+import java.awt.Font;
+import java.util.ResourceBundle;
+import javax.swing.table.DefaultTableCellRenderer;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PINStatusRenderer extends DefaultTableCellRenderer {
+  
+  private static final Log log = LogFactory.getLog(PINStatusRenderer.class);
+
+  public static final Color RED = new Color(0.9f, 0.0f, 0.0f);
+  public static final Color GREEN = new Color(0.0f, 0.8f, 0.0f);
+  protected ResourceBundle messages;
+
+  public PINStatusRenderer(ResourceBundle messages) {
+    this.messages = messages;
+  }
+
+  @Override
+  protected void setValue(Object value) {
+    STATUS pinStatus = (STATUS) value;
+    super.setFont(super.getFont().deriveFont(super.getFont().getStyle() | Font.BOLD));
+      
+    if (pinStatus == STATUS.NOT_ACTIV) {
+      super.setForeground(RED);
+      super.setText("<html>" + messages.getString(PINManagementGUIFacade.STATUS_NOT_ACTIVE) + "</html>");
+    } else if (pinStatus == STATUS.ACTIV) {
+      super.setForeground(GREEN);
+      super.setText("<html>" + messages.getString(PINManagementGUIFacade.STATUS_ACTIVE) + "</html>");
+    } else if (pinStatus == STATUS.BLOCKED) {
+      super.setForeground(RED);
+      super.setText("<html>" + messages.getString(PINManagementGUIFacade.STATUS_BLOCKED) + "</html>");
+    } else {
+      super.setForeground(Color.BLACK);
+      super.setText("<html>" + messages.getString(PINManagementGUIFacade.STATUS_UNKNOWN) + "</html>");
+    }
+  }
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java
new file mode 100644
index 00000000..feaa5072
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.gui;
+
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
+import at.gv.egiz.smcc.PINSpec;
+import java.util.Map;
+import javax.swing.table.DefaultTableModel;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PINStatusTableModel extends DefaultTableModel {
+
+  protected static final Log log = LogFactory.getLog(PINStatusTableModel.class);
+  protected Class[] types;
+
+  public PINStatusTableModel(Map<PINSpec, STATUS> pinStatuses) {
+    super(0, 2);
+    if (pinStatuses == null) {
+      throw new RuntimeException("pinStatuses must not be null");
+    }
+    log.trace(pinStatuses.size() + " PINs");
+    types = new Class[] { PINSpec.class, STATUS.class };
+    for (PINSpec pinSpec : pinStatuses.keySet()) {
+      addRow(new Object[] { pinSpec, pinStatuses.get(pinSpec) });
+    }
+//    PINSpec activePIN = new PINSpec(0, 1, null, "active-PIN", (byte) 0x01);
+//    PINSpec blockedPIN = new PINSpec(0, 1, null, "blocked-PIN", (byte) 0x01);
+//    addRow(new Object[] { activePIN, PINStatusProvider.STATUS.ACTIV });
+//    addRow(new Object[] { blockedPIN, PINStatusProvider.STATUS.BLOCKED });
+  }
+
+  @Override
+  public Class getColumnClass(int columnIndex) {
+    return types[columnIndex];
+  }
+
+  @Override
+  public boolean isCellEditable(int rowIndex, int columnIndex) {
+    return false;
+  }
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementApplet.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementApplet.java
index 72d06618..d948ac03 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementApplet.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementApplet.java
@@ -19,6 +19,7 @@ package at.gv.egiz.bku.online.applet;
 import at.gv.egiz.bku.gui.AbstractHelpListener;
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUI;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
 import java.awt.Container;
 import java.net.URL;
 import java.util.Locale;
@@ -45,6 +46,6 @@ public class PINManagementApplet extends BKUApplet {
 
   @Override
   protected AppletBKUWorker createBKUWorker(BKUApplet applet, BKUGUIFacade gui) {
-    return new PINManagementBKUWorker(applet, gui);
+    return new PINManagementBKUWorker(applet, (PINManagementGUIFacade) gui);
   }
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
index e65d98ca..ffd83e42 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
@@ -18,35 +18,28 @@ package at.gv.egiz.bku.online.applet;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade;
-import at.gv.egiz.bku.smccstal.ext.PINMgmtRequestHandler;
+import at.gv.egiz.bku.smccstal.ext.PINManagementRequestHandler;
+import at.gv.egiz.stal.ErrorResponse;
 import at.gv.egiz.stal.STALResponse;
-import at.gv.egiz.stal.ext.ActivatePINRequest;
-import at.gv.egiz.stal.ext.ChangePINRequest;
-import at.gv.egiz.stal.ext.UnblockPINRequest;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.util.Collection;
+import at.gv.egiz.stal.ext.PINManagementRequest;
+import at.gv.egiz.stal.ext.PINManagementResponse;
 import java.util.Collections;
 import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
 /**
- *
+ * This BKU Worker does not connect to STAL webservice
+ * (no Internet connection permitted while activating PINs).
+ * 
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
  */
 public class PINManagementBKUWorker extends AppletBKUWorker {
 
-  protected PINMgmtRequestHandler handler = new PINMgmtRequestHandler();
-  protected PINManagementActionListener listener = new PINManagementActionListener();
-
-  public PINManagementBKUWorker(BKUApplet applet, BKUGUIFacade gui) {
+  public PINManagementBKUWorker(BKUApplet applet, PINManagementGUIFacade gui) {
     super(applet, gui);
     handlerMap.clear();
-//    PINMgmtRequestHandler handler = new PINMgmtRequestHandler();
-//    addRequestHandler(ActivatePINRequest.class, handler);
-//    addRequestHandler(ChangePINRequest.class, handler);
-//    addRequestHandler(UnblockPINRequest.class, handler);
+    addRequestHandler(PINManagementRequest.class, new PINManagementRequestHandler());
   }
 
   @Override
@@ -54,22 +47,24 @@ public class PINManagementBKUWorker extends AppletBKUWorker {
     gui.showWelcomeDialog();
 
     try {
-
-      if (waitForCard()) {
-        gui.showErrorDialog("no card, canceled PIN mgmt dialog", null);
+      List<STALResponse> responses = handleRequest(Collections.singletonList(new PINManagementRequest()));
+
+      if (responses.size() == 1) {
+        STALResponse response = responses.get(0);
+        if (response instanceof PINManagementResponse) {
+          log.debug("PIN management dialog finished");
+        } else if (response instanceof ErrorResponse) {
+          showErrorDialog(BKUGUIFacade.ERR_UNKNOWN, null);
+        } else {
+          throw new RuntimeException("Invalid STAL response: " + response.getClass().getName());
+        }
+      } else {
+        throw new RuntimeException("invalid number of STAL responses: " + responses.size());
       }
 
-      actionCommandList.clear();
-      actionCommandList.add("cancel");
-
-      ((PINManagementGUIFacade) gui).showPINManagementDialog(handler,
-              listener, "activate",
-              listener, "change",
-              listener, "unblock",
-              this, "cancel");
-
-      waitForAction();
-
+    } catch (RuntimeException ex) {
+      log.error("unexpected error: " + ex.getMessage(), ex);
+      showErrorDialog(BKUGUIFacade.ERR_UNKNOWN, null);
     } catch (Exception ex) {
       log.error(ex.getMessage(), ex);
       showErrorDialog(BKUGUIFacade.ERR_UNKNOWN_WITH_PARAM, ex);
@@ -82,31 +77,4 @@ public class PINManagementBKUWorker extends AppletBKUWorker {
     applet.sendRedirect(sessionId);
   }
 
-  protected class PINManagementActionListener implements ActionListener {
-
-    @Override
-    public void actionPerformed(ActionEvent e) {
-      try {
-        String cmd = e.getActionCommand();
-        if ("activate".equals(cmd)) {
-          //create STAL request, call handle(req)
-          ActivatePINRequest stalReq = new ActivatePINRequest();
-          STALResponse stalResp = handler.handleRequest(stalReq);
-          gui.showErrorDialog(BKUGUIFacade.ERR_UNKNOWN_WITH_PARAM, new Object[]{"debug"}, this, "back");
-        } else if ("change".equals(cmd)) {
-        } else if ("unblock".equals(cmd)) {
-        } else if ("back".equals(cmd)) {
-
-          ((PINManagementGUIFacade) gui).showPINManagementDialog(handler,
-                  this, "activate",
-                  this, "change",
-                  this, "unblock",
-                  PINManagementBKUWorker.this, "cancel");
-
-        }
-      } catch (InterruptedException ex) {
-        log.fatal(ex);
-      }
-    }
   }
-}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
new file mode 100644
index 00000000..fcef3191
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
@@ -0,0 +1,331 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.smccstal.ext;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
+import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import at.gv.egiz.stal.ErrorResponse;
+import at.gv.egiz.stal.STALRequest;
+import at.gv.egiz.stal.STALResponse;
+import at.gv.egiz.stal.ext.PINManagementRequest;
+import at.gv.egiz.stal.ext.PINManagementResponse;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PINManagementRequestHandler extends AbstractRequestHandler {
+
+  public static final String ERR_NOPIN_SELECTED = "err.no.pin.selected";
+  protected static final Log log = LogFactory.getLog(PINManagementRequestHandler.class);
+
+//  protected ResourceBundle messages;
+
+//  public PINManagementRequestHandler(ResourceBundle messages) {
+//    this.messages = messages;
+//  }
+  @Override
+  public STALResponse handleRequest(STALRequest request) throws InterruptedException {
+    if (request instanceof PINManagementRequest) {
+
+      PINManagementGUIFacade gui = (PINManagementGUIFacade) this.gui;
+
+      showPINManagementDialog(gui);
+
+      while (true) {
+
+        waitForAction();
+
+        if ("cancel".equals(actionCommand)) {
+          return new PINManagementResponse();
+        } else if ("back".equals(actionCommand)) {
+          showPINManagementDialog(gui);
+        } else {
+          PINSpec selectedPIN = gui.getSelectedPIN();
+
+          if (selectedPIN == null) {
+            throw new RuntimeException("no PIN selected for activation/change");
+          }
+
+          if ("activate_enterpin".equals(actionCommand)) {
+            gui.showActivatePINDialog(selectedPIN, this, "activate", this, "back");
+          } else if ("change_enterpin".equals(actionCommand)) {
+            gui.showChangePINDialog(selectedPIN, this, "change", this, "back");
+          } else if ("unblock_enterpuk".equals(actionCommand)) {
+            gui.showUnblockPINDialog(selectedPIN, this, "unblock", this, "back");
+          } else if ("activate".equals(actionCommand)) {
+            try {
+              byte[] pin = encodePIN(gui.getPin());
+              activatePIN(selectedPIN.getKID(), selectedPIN.getContextAID(), pin);
+              showPINManagementDialog(gui);
+            } catch (SignatureCardException ex) {
+              log.error("failed to activate " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_ACTIVATE, 
+                      new Object[] {selectedPIN.getLocalizedName()},
+                      this, "cancel");
+            }
+          } else if ("change".equals(actionCommand)) {
+            try {
+              byte[] oldPin = encodePIN(gui.getOldPin()); //new byte[]{(byte) 0x25, (byte) 0x40, (byte) 0x01};
+              byte[] pin = encodePIN(gui.getPin()); //new byte[]{(byte) 0x25, (byte) 0x40};
+              changePIN(selectedPIN.getKID(), selectedPIN.getContextAID(), oldPin, pin);
+              showPINManagementDialog(gui);
+            } catch (SignatureCardException ex) {
+              log.error("failed to change " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_CHANGE, 
+                      new Object[] {selectedPIN.getLocalizedName()},
+                      this, "cancel");
+            }
+          } else if ("unblock".equals(actionCommand)) {
+            log.error("unblock PIN not implemented");
+            gui.showErrorDialog(PINManagementGUIFacade.ERR_UNBLOCK, null, this, "cancel");
+          } else {
+            throw new RuntimeException("unsupported action " + actionCommand);
+          }
+        }
+      }
+    } else {
+      log.error("Got unexpected STAL request: " + request);
+      return new ErrorResponse(1000);
+    }
+  }
+
+  @Override
+  public boolean requireCard() {
+    return true;
+  }
+
+  /**
+   * pin.length &lt; 4bit
+   * @param kid
+   * @param contextAID
+   * @param pin
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  private void activatePIN(byte kid, byte[] contextAID, byte[] pin) throws SignatureCardException {
+    try {
+      Card icc = card.getCard();
+      icc.beginExclusive();
+      CardChannel channel = icc.getBasicChannel();
+
+      if (contextAID != null) {
+        CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
+        ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
+        if (responseAPDU.getSW() != 0x9000) {
+          String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) +
+                  ": Failed to select AID " + SMCCHelper.toString(contextAID) +
+                  ": " + SMCCHelper.toString(responseAPDU.getBytes());
+          log.error(msg);
+          throw new SignatureCardException(msg);
+        }
+      }
+
+      if (pin.length > 7) {
+        log.error("Invalid PIN");
+        throw new SignatureCardException("Invalid PIN");
+      }
+      byte length = (byte) (0x20 | pin.length * 2);
+
+      byte[] apdu = new byte[]{
+        (byte) 0x00, (byte) 0x24, (byte) 0x01, kid, (byte) 0x08,
+        (byte) length, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF};
+      for (int i = 0; i < pin.length; i++) {
+        apdu[i + 6] = pin[i];
+      }
+
+      CommandAPDU verifyAPDU = new CommandAPDU(apdu);
+      ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
+
+      if (responseAPDU.getSW() != 0x9000) {
+        String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) + ": " + SMCCHelper.toString(responseAPDU.getBytes());
+        log.error(msg);
+        throw new SignatureCardException(msg);
+      }
+
+
+      icc.endExclusive();
+
+
+    } catch (CardException ex) {
+      log.error("Failed to get PIN status: " + ex.getMessage());
+      throw new SignatureCardException("Failed to get PIN status", ex);
+    }
+  }
+
+  private void changePIN(byte kid, byte[] contextAID, byte[] oldPIN, byte[] newPIN) throws SignatureCardException {
+    try {
+      Card icc = card.getCard();
+      icc.beginExclusive();
+      CardChannel channel = icc.getBasicChannel();
+
+      if (contextAID != null) {
+        CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
+        ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
+        if (responseAPDU.getSW() != 0x9000) {
+          String msg = "Failed to change PIN " + SMCCHelper.toString(new byte[]{kid}) +
+                  ": Failed to select AID " + SMCCHelper.toString(contextAID) +
+                  ": " + SMCCHelper.toString(responseAPDU.getBytes());
+          log.error(msg);
+          throw new SignatureCardException(msg);
+        }
+      }
+
+      if (oldPIN.length > 7 || newPIN.length > 7) {
+        log.error("Invalid PIN");
+        throw new SignatureCardException("Invalid PIN");
+      }
+      byte oldLength = (byte) (0x20 | oldPIN.length * 2);
+      byte newLength = (byte) (0x20 | newPIN.length * 2);
+
+      byte[] apdu = new byte[]{
+        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,
+        oldLength, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF,
+        newLength, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF};
+      for (int i = 0; i < oldPIN.length; i++) {
+        apdu[i + 6] = oldPIN[i];
+      }
+      for (int i = 0; i < newPIN.length; i++) {
+        apdu[i + 14] = newPIN[i];
+      }
+
+      CommandAPDU verifyAPDU = new CommandAPDU(apdu);
+      ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
+
+      if (responseAPDU.getSW() != 0x9000) {
+        String msg = "Failed to change PIN " + SMCCHelper.toString(new byte[]{kid}) + ": " + SMCCHelper.toString(responseAPDU.getBytes());
+        log.error(msg);
+        throw new SignatureCardException(msg);
+      }
+
+
+      icc.endExclusive();
+
+
+    } catch (CardException ex) {
+      log.error("Failed to get PIN status: " + ex.getMessage());
+      throw new SignatureCardException("Failed to get PIN status", ex);
+    }
+  }
+
+  public Map<PINSpec, STATUS> getPINStatuses() throws SignatureCardException {
+    try {
+      Card icc = card.getCard();
+      icc.beginExclusive();
+      CardChannel channel = icc.getBasicChannel();
+
+      HashMap<PINSpec, STATUS> pinStatuses = new HashMap<PINSpec, STATUS>();
+      List<PINSpec> pins = card.getPINSpecs();
+
+      //select DF_SichereSignatur 00 A4 04 0C 08 D0 40 00 00 17 00 12 01
+//      CommandAPDU selectAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0xa4, (byte) 0x04, (byte) 0x0c, (byte) 0x08,
+//                (byte) 0xd0, (byte) 0x40, (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01});
+//      ResponseAPDU rAPDU = channel.transmit(selectAPDU);
+//      log.debug("SELECT FILE DF_SichereSignatur: " + SMCCHelper.toString(rAPDU.getBytes()));
+
+      //select DF_SIG DF 70
+//      CommandAPDU selectAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0xa4, (byte) 0x00, (byte) 0x0c, (byte) 0x02,
+//                (byte) 0xdf, (byte) 0x70 });
+//      ResponseAPDU rAPDU = channel.transmit(selectAPDU);
+//      log.debug("SELECT FILE DF_SIG: " + SMCCHelper.toString(rAPDU.getBytes()));
+
+      //select DF_DEC DF 71
+//      CommandAPDU selectAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0xa4, (byte) 0x04, (byte) 0x0c, (byte) 0x08,
+//                (byte) 0xd0, (byte) 0x40, (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01});
+//      ResponseAPDU rAPDU = channel.transmit(selectAPDU);
+//      log.debug("SELECT FILE DF_SichereSignatur: " + SMCCHelper.toString(rAPDU.getBytes()));
+
+      for (PINSpec pinSpec : pins) {
+        byte kid = pinSpec.getKID();
+        byte[] contextAID = pinSpec.getContextAID();
+
+        if (contextAID != null) {
+          CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
+          ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
+          if (responseAPDU.getSW() != 0x9000) {
+            String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) +
+                    ": Failed to select AID " + SMCCHelper.toString(contextAID) +
+                    ": " + SMCCHelper.toString(responseAPDU.getBytes());
+            log.error(msg);
+            throw new SignatureCardException(msg);
+          }
+        }
+
+        CommandAPDU verifyAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0x20, (byte) 00, kid});
+        ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
+
+        STATUS status = STATUS.UNKNOWN;
+        if (responseAPDU.getSW() == 0x6984) {
+          status = STATUS.NOT_ACTIV;
+        } else if (responseAPDU.getSW() == 0x63c0) {
+          status = STATUS.BLOCKED;
+        } else if (responseAPDU.getSW1() == 0x63) {
+          status = STATUS.ACTIV;
+        }
+        if (log.isDebugEnabled()) {
+          log.debug("PIN " + pinSpec.getLocalizedName() + " status: " + SMCCHelper.toString(responseAPDU.getBytes()));
+        }
+
+        pinStatuses.put(pinSpec, status);
+      }
+      icc.endExclusive();
+
+      return pinStatuses;
+
+    } catch (CardException ex) {
+      log.error("Failed to get PIN status: " + ex.getMessage());
+      throw new SignatureCardException("Failed to get PIN status", ex);
+    }
+  }
+
+  private byte[] encodePIN(char[] pinChars) {
+    int length = (int) Math.ceil(pinChars.length/2);
+    byte[] pin = new byte[length];
+    for (int i = 0; i < length; i++) {
+      pin[i] = (byte) (16*Character.digit(pinChars[i*2], 16) + Character.digit(pinChars[i*2+1], 16));
+    }
+    log.trace("***** "  + SMCCHelper.toString(pin) + " ******");
+    return pin;
+  }
+
+  private void showPINManagementDialog(PINManagementGUIFacade gui) {
+    try {
+      Map<PINSpec, STATUS> pins = getPINStatuses();
+      gui.showPINManagementDialog(pins, 
+              this, "activate_enterpin", "change_enterpin", "unblock_enterpuk",
+              this, "cancel");
+    } catch (SignatureCardException ex) {
+      gui.showErrorDialog(BKUGUIFacade.ERR_UNKNOWN_WITH_PARAM, 
+              new Object[]{"FAILED TO GET PIN STATUSES: " + ex.getMessage()},
+              this, "cancel");
+    }
+  }
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINMgmtRequestHandler.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINMgmtRequestHandler.java
deleted file mode 100644
index b2d34ff2..00000000
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINMgmtRequestHandler.java
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.bku.smccstal.ext;
-
-import at.gv.egiz.bku.gui.PINStatusProvider;
-import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
-import at.gv.egiz.smcc.SignatureCardException;
-import at.gv.egiz.stal.ErrorResponse;
-import at.gv.egiz.stal.STALRequest;
-import at.gv.egiz.stal.STALResponse;
-import at.gv.egiz.stal.ext.ActivatePINRequest;
-import at.gv.egiz.stal.ext.ChangePINRequest;
-import at.gv.egiz.stal.ext.UnblockPINRequest;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import javax.smartcardio.Card;
-import javax.smartcardio.CardChannel;
-import javax.smartcardio.CardException;
-import javax.smartcardio.CommandAPDU;
-import javax.smartcardio.ResponseAPDU;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class PINMgmtRequestHandler extends AbstractRequestHandler implements PINStatusProvider {
-
-  protected static final Log log = LogFactory.getLog(PINMgmtRequestHandler.class);
-
-  @Override
-  public STALResponse handleRequest(STALRequest request) throws InterruptedException {
-    if (request instanceof ActivatePINRequest) {
-      log.error("not implemented yet");
-      return new ErrorResponse(1000);
-
-    } else if (request instanceof ChangePINRequest) {
-      log.error("not implemented yet");
-      return new ErrorResponse(1000);
-
-    } else if (request instanceof UnblockPINRequest) {
-      log.error("not implemented yet");
-      return new ErrorResponse(1000);
-
-    } else {
-      log.error("Got unexpected STAL request: " + request);
-      return new ErrorResponse(1000);
-    }
-  }
-
-  @Override
-  public boolean requireCard() {
-    return true;
-  }
-
-  @Override
-  public STATUS getPINStatus(int pin) throws SignatureCardException {
-    try {
-      Card icc = card.getCard();
-      icc.beginExclusive();
-      CardChannel channel = icc.getBasicChannel();
-      CommandAPDU verifyAPDU = new CommandAPDU(new byte[] {(byte) 0x00} );
-      ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
-      byte sw1 = (byte) responseAPDU.getSW1();
-      byte[] sw = new byte[] {
-                (byte) (0xFF & responseAPDU.getSW1()),
-                (byte) (0xFF & responseAPDU.getSW2()) };
-
-      icc.endExclusive();
-      return STATUS.ACTIV;
-    } catch (CardException ex) {
-      log.error("Failed to get PIN status: " + ex.getMessage());
-      throw new SignatureCardException("Failed to get PIN status", ex);
-    }
-  }
-
-}
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
index 469af15f..e51044af 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
@@ -15,10 +15,34 @@
 
 title.activation=<html>Aktivierung</html>
 title.pin.mgmt=<html>PIN Verwaltung</html>
-message.pin.mgmt=<html>under construction</html>
+title.activate.pin=<html>PIN Aktivieren</html>
+title.change.pin=<html>PIN \u00C4ndern</html>
+title.unblock.pin=<html>PIN Entsperren</html>
+
+message.pin.mgmt=<html>Die Karte verf\u00FCgt \u00FCber {0} PINs</html>
+message.activate.pin=<html>{0} eingeben und best\u00E4tigen</html>
+message.change.pin=<html>{0} eingeben und best\u00E4tigen</html>
+message.unblock.pin=<html>PUK zu {0} eingeben</html>
+
 label.activation=<html>e-card Aktivierungsprozess</html>
 label.activation.step=<html>Schritt {0}</html>
 label.activation.idle=<html>Warte auf Server...</html>
+label.old.pin=<html>Alte {0}:</html>
+label.new.pin=<html>Neue {0}:</html>
+label.repeat.pin=<html>Best\u00E4tigung:</html>
+
 button.activate=Aktivieren
 button.change=\u00C4ndern
-button.unblock=Entsperren
\ No newline at end of file
+button.unblock=Entsperren
+
+help.activation=help.activation
+help.pin.mgmt=help.pin.mgmt
+
+err.activate=<html>Beim Aktivieren der {0} trat ein Fehler auf.</html>
+err.change=<html>Beim \u00C4ndern der {0} trat ein Fehler auf.</html>
+err.unblock=<html>Das Entsperren der {0} wird nicht unterst\u00FCtzt.</html>
+
+status.not.active=NICHT AKTIV
+status.active=AKTIV
+status.blocked=GESPERRT
+status.unknown=UNBEKANNT
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
index 16ac7d0b..1cf4a102 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
@@ -13,12 +13,36 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-title.activation=<html>Aktivation</html>
+title.activation=<html>Activation</html>
 title.pin.mgmt=<html>PIN Management</html>
-message.pin.mgmt=<html>under construction</html>
+title.activate.pin=<html>Activate PIN</html>
+title.change.pin=<html>Change PIN</html>
+title.unblock.pin=<html>Unblock PIN</html>
+
+message.pin.mgmt=<html>The smartcard has {0} PINs</html>
+message.activate.pin=<html>Enter and confirm {0}</html>
+message.change.pin=<html>Enter and confirm {0}</html>
+message.unblock.pin=<html>Enter PUK for {0}</html>
+
 label.activation=<html>e-card activation process</html>
 label.activation.step=<html>Step {0}</html>
 label.activation.idle=<html>Wait for server...</html>
+label.old.pin=<html>Old {0}:</html>
+label.new.pin=<html>New {0}:</html>
+label.repeat.pin=<html>Confirmation:</html>
+
 button.activate=Activate
 button.change=Change
-button.unblock=Unblock
\ No newline at end of file
+button.unblock=Unblock
+
+help.activation=help.activation
+help.pin.mgmt=help.pin.mgmt
+
+err.activate=<html>An error occured during activation of {0}.</html>
+err.change=<html>An error occured during changing of {0}.</html>
+err.unblock=<html>Unblocking of {0} is not supported.</html>
+
+status.not.active=Not active
+status.active=Active
+status.blocked=Blocked
+status.unknown=Unknown
diff --git a/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java b/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
index 669a63fc..ef8c87e4 100644
--- a/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
+++ b/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
@@ -25,8 +25,6 @@ import at.gv.egiz.stal.HashDataInput;
 import at.gv.egiz.stal.impl.ByteArrayHashDataInput;
 import java.awt.event.ActionEvent;
 import java.awt.event.ActionListener;
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -46,7 +44,7 @@ public class BKUGUIWorker implements Runnable {
   public void run() {
         try {
 
-    final PINSpec signPinSpec = new PINSpec(6, 10, "[0-9]", "Signatur-PIN");
+    final PINSpec signPinSpec = new PINSpec(6, 10, "[0-9]", "Signatur-PIN", (byte)0x00, null);
 
 
     final ActionListener cancelListener = new ActionListener() {
diff --git a/BKUAppletExt/src/test/resources/appletTest.html b/BKUAppletExt/src/test/resources/appletTest.html
index 9add4309..813ee1f0 100644
--- a/BKUAppletExt/src/test/resources/appletTest.html
+++ b/BKUAppletExt/src/test/resources/appletTest.html
@@ -19,7 +19,7 @@
     <center>
       <applet code="at.gv.egiz.bku.online.applet.PINManagementApplet.class"
               archive="../BKUAppletExt-1.0.2-SNAPSHOT.jar, commons-logging.jar , iaik_jce_me4se.jar"
-              width=152 height=145>
+              width=270 height=180>
               <param name="GuiStyle" value="simple"/>
               <param name="Locale" value="ja_JA"/>
               <!--param name="Background" value="jar:file:/home/clemens/workspace/mocca/BKUApplet/target/BKUApplet-1.0-SNAPSHOT.jar!/images/help.png"/-->
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
index f564c07a..1d5a2cf4 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
@@ -38,9 +38,6 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Locale;
 import java.util.ResourceBundle;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import javax.swing.CellRendererPane;
 import javax.swing.GroupLayout;
 import javax.swing.ImageIcon;
 import javax.swing.JButton;
@@ -51,7 +48,6 @@ import javax.swing.JPanel;
 import javax.swing.JPasswordField;
 import javax.swing.JScrollPane;
 import javax.swing.JTable;
-import javax.swing.JTextField;
 import javax.swing.LayoutStyle;
 import javax.swing.ListSelectionModel;
 import javax.swing.SwingUtilities;
@@ -1064,7 +1060,9 @@ public class BKUGUIImpl implements BKUGUIFacade {
     @Override
     public char[] getPin() {
         if (pinField != null) {
-            return pinField.getPassword();
+          char[] pin = pinField.getPassword();
+          pinField = null;
+          return pin;
         }
         return null;
     }
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
index 2054ae86..87b636f0 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
@@ -22,6 +22,7 @@ import java.util.regex.Pattern;
 import javax.swing.JButton;
 import javax.swing.text.AttributeSet;
 import javax.swing.text.BadLocationException;
+import javax.swing.text.Document;
 import javax.swing.text.PlainDocument;
 
 /**
@@ -30,9 +31,10 @@ import javax.swing.text.PlainDocument;
  */
 class PINDocument extends PlainDocument {
 
-        private PINSpec pinSpec;
-        private Pattern pinPattern;
-        private JButton enterButton;
+        protected PINSpec pinSpec;
+        protected Pattern pinPattern;
+        protected JButton enterButton;
+        protected Document compareTo;
 
         public PINDocument(PINSpec pinSpec, JButton enterButton) {
             this.pinSpec = pinSpec;
@@ -44,6 +46,11 @@ class PINDocument extends PlainDocument {
             this.enterButton = enterButton;
         }
 
+        public PINDocument(PINSpec pinSpec, JButton enterButton, Document compareTo) {
+          this(pinSpec, enterButton);
+          this.compareTo = compareTo;
+        }
+
         @Override
         public void insertString(int offs, String str, AttributeSet a) throws BadLocationException {
             if (pinSpec.getMaxLength() < 0 || pinSpec.getMaxLength() >= (getLength() + str.length())) {
@@ -58,12 +65,23 @@ class PINDocument extends PlainDocument {
                     super.insertString(offs, str, a);
                 }
             }
-            enterButton.setEnabled(getLength() >= pinSpec.getMinLength());
+            if (enterButton != null) {
+              enterButton.setEnabled(getLength() >= pinSpec.getMinLength() && compare());
+            }
         }
 
         @Override
         public void remove(int offs, int len) throws BadLocationException {
             super.remove(offs, len);
-            enterButton.setEnabled(getLength() >= pinSpec.getMinLength());
+            if (enterButton != null) {
+              enterButton.setEnabled(getLength() >= pinSpec.getMinLength() && compare());
+            }
+        }
+
+        private boolean compare() throws BadLocationException {
+          if (compareTo == null) {
+            return true;
+          }
+          return compareTo.getText(0, compareTo.getLength()).equals(getText(0, getLength()));
         }
     }
\ No newline at end of file
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
index 8436a730..1e0bc9f5 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
@@ -20,7 +20,7 @@ title.cardnotsupported=<html>Die Karte wird nicht unterst\u00FCtzt</html>
 title.cardpin=<html>Karte wird gelesen</html>
 title.sign=<html>Signatur erstellen</html>
 title.error=<html>Fehler</html>
-title.retry=<html>Falscher PIN</html>
+title.retry=<html>Falsche PIN</html>
 title.wait=<html>Bitte warten</html>
 title.hashdata=<html>Signaturdaten</html>
 windowtitle.save=Signaturdaten speichern
@@ -84,7 +84,7 @@ help.cardnotsupported=Nicht unterst\u00FCtzte B\u00FCrgerkarte
 help.insertcard=Keine B\u00FCrgerkarte im Kartenleser
 help.cardpin=Pineingabe
 help.signpin=Signatur-Pineingabe
-help.retry=Falscher Pin
+help.retry=Falsche Pin
 help.hashdata=Signierte Inhalte
 help.hashdatalist=Signierte Inhalte
 help.hashdataviewer=Anzeige signierter Inhalte
\ No newline at end of file
diff --git a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
index 73aaab46..08ecaa7f 100644
--- a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
+++ b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
@@ -46,7 +46,7 @@ public class BKUGUIWorker implements Runnable {
   public void run() {
 //        try {
 
-    final PINSpec signPinSpec = new PINSpec(6, 10, "[0-9]", "Signatur-PIN");
+    final PINSpec signPinSpec = new PINSpec(6, 10, "[0-9]", "Signatur-PIN", (byte) 0x81, null);
 
 
     final ActionListener cancelListener = new ActionListener() {
diff --git a/STALExt/src/main/java/at/gv/egiz/stal/ext/ActivatePINRequest.java b/STALExt/src/main/java/at/gv/egiz/stal/ext/ActivatePINRequest.java
deleted file mode 100644
index f2039388..00000000
--- a/STALExt/src/main/java/at/gv/egiz/stal/ext/ActivatePINRequest.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.stal.ext;
-
-import at.gv.egiz.stal.STALRequest;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class ActivatePINRequest extends STALRequest {
-
-}
diff --git a/STALExt/src/main/java/at/gv/egiz/stal/ext/ChangePINRequest.java b/STALExt/src/main/java/at/gv/egiz/stal/ext/ChangePINRequest.java
deleted file mode 100644
index ea508146..00000000
--- a/STALExt/src/main/java/at/gv/egiz/stal/ext/ChangePINRequest.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.stal.ext;
-
-import at.gv.egiz.stal.STALRequest;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class ChangePINRequest extends STALRequest {
-
-}
diff --git a/STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementRequest.java b/STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementRequest.java
new file mode 100644
index 00000000..87c53e24
--- /dev/null
+++ b/STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementRequest.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.stal.ext;
+
+import at.gv.egiz.stal.STALRequest;
+
+/**
+ * Dummy STAL request to trigger PIN Management. (no proper STAL requests
+ * for PIN activation, unblocking)
+ *
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PINManagementRequest extends STALRequest {
+
+}
diff --git a/STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementResponse.java b/STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementResponse.java
new file mode 100644
index 00000000..b8b90604
--- /dev/null
+++ b/STALExt/src/main/java/at/gv/egiz/stal/ext/PINManagementResponse.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.stal.ext;
+
+import at.gv.egiz.stal.STALResponse;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PINManagementResponse extends STALResponse {
+
+}
diff --git a/STALExt/src/main/java/at/gv/egiz/stal/ext/UnblockPINRequest.java b/STALExt/src/main/java/at/gv/egiz/stal/ext/UnblockPINRequest.java
deleted file mode 100644
index 543de31c..00000000
--- a/STALExt/src/main/java/at/gv/egiz/stal/ext/UnblockPINRequest.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.stal.ext;
-
-import at.gv.egiz.stal.STALRequest;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class UnblockPINRequest extends STALRequest {
-
-}
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/DataObject.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/DataObject.java
index ae4918ce..b64306aa 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/DataObject.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/DataObject.java
@@ -14,98 +14,105 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package at.gv.egiz.bku.slcommands.impl.xsect;
-
-import iaik.xml.crypto.dom.DOMCryptoContext;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.SequenceInputStream;
-import java.io.StringWriter;
-import java.io.UnsupportedEncodingException;
-import java.net.URISyntaxException;
-import java.nio.charset.Charset;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.NoSuchAlgorithmException;
-import java.util.ArrayList;
+package at.gv.egiz.bku.slcommands.impl.xsect;
+
+import iaik.xml.crypto.dom.DOMCryptoContext;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.SequenceInputStream;
+import java.io.StringWriter;
+import java.io.UnsupportedEncodingException;
+import java.net.URISyntaxException;
+import java.nio.charset.Charset;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import javax.xml.crypto.MarshalException;
-import javax.xml.crypto.dom.DOMStructure;
-import javax.xml.crypto.dsig.CanonicalizationMethod;
-import javax.xml.crypto.dsig.DigestMethod;
-import javax.xml.crypto.dsig.Reference;
-import javax.xml.crypto.dsig.Transform;
-import javax.xml.crypto.dsig.XMLObject;
-import javax.xml.crypto.dsig.spec.TransformParameterSpec;
-import javax.xml.crypto.dsig.spec.XPathFilter2ParameterSpec;
-import javax.xml.crypto.dsig.spec.XPathType;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.w3c.dom.DOMConfiguration;
-import org.w3c.dom.DOMException;
-import org.w3c.dom.Document;
-import org.w3c.dom.DocumentFragment;
-import org.w3c.dom.Element;
-import org.w3c.dom.Node;
-import org.w3c.dom.Text;
-import org.w3c.dom.bootstrap.DOMImplementationRegistry;
-import org.w3c.dom.ls.DOMImplementationLS;
-import org.w3c.dom.ls.LSException;
-import org.w3c.dom.ls.LSInput;
-import org.w3c.dom.ls.LSOutput;
-import org.w3c.dom.ls.LSParser;
-import org.w3c.dom.ls.LSSerializer;
-
-import at.buergerkarte.namespaces.securitylayer._1.Base64XMLLocRefOptRefContentType;
-import at.buergerkarte.namespaces.securitylayer._1.DataObjectInfoType;
-import at.buergerkarte.namespaces.securitylayer._1.MetaInfoType;
-import at.buergerkarte.namespaces.securitylayer._1.TransformsInfoType;
-import at.gv.egiz.bku.binding.HttpUtil;
-import at.gv.egiz.bku.slexceptions.SLCommandException;
-import at.gv.egiz.bku.slexceptions.SLRequestException;
-import at.gv.egiz.bku.slexceptions.SLRuntimeException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.xml.crypto.MarshalException;
+import javax.xml.crypto.dom.DOMStructure;
+import javax.xml.crypto.dsig.CanonicalizationMethod;
+import javax.xml.crypto.dsig.DigestMethod;
+import javax.xml.crypto.dsig.Reference;
+import javax.xml.crypto.dsig.Transform;
+import javax.xml.crypto.dsig.XMLObject;
+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
+import javax.xml.crypto.dsig.spec.XPathFilter2ParameterSpec;
+import javax.xml.crypto.dsig.spec.XPathType;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.w3._2000._09.xmldsig_.TransformType;
+import org.w3._2000._09.xmldsig_.TransformsType;
+import org.w3c.dom.DOMConfiguration;
+import org.w3c.dom.DOMException;
+import org.w3c.dom.Document;
+import org.w3c.dom.DocumentFragment;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+import org.w3c.dom.Text;
+import org.w3c.dom.bootstrap.DOMImplementationRegistry;
+import org.w3c.dom.ls.DOMImplementationLS;
+import org.w3c.dom.ls.LSException;
+import org.w3c.dom.ls.LSInput;
+import org.w3c.dom.ls.LSOutput;
+import org.w3c.dom.ls.LSParser;
+import org.w3c.dom.ls.LSSerializer;
+
+import at.buergerkarte.namespaces.securitylayer._1.Base64XMLLocRefOptRefContentType;
+import at.buergerkarte.namespaces.securitylayer._1.DataObjectInfoType;
+import at.buergerkarte.namespaces.securitylayer._1.MetaInfoType;
+import at.buergerkarte.namespaces.securitylayer._1.TransformsInfoType;
+import at.gv.egiz.bku.binding.HttpUtil;
+import at.gv.egiz.bku.slexceptions.SLCommandException;
+import at.gv.egiz.bku.slexceptions.SLRequestException;
+import at.gv.egiz.bku.slexceptions.SLRuntimeException;
 import at.gv.egiz.bku.slexceptions.SLViewerException;
-import at.gv.egiz.bku.utils.urldereferencer.StreamData;
-import at.gv.egiz.bku.utils.urldereferencer.URLDereferencer;
+import at.gv.egiz.bku.utils.urldereferencer.StreamData;
+import at.gv.egiz.bku.utils.urldereferencer.URLDereferencer;
 import at.gv.egiz.bku.viewer.ValidationException;
 import at.gv.egiz.bku.viewer.Validator;
 import at.gv.egiz.bku.viewer.ValidatorFactory;
-import at.gv.egiz.dom.DOMUtils;
-import at.gv.egiz.slbinding.impl.XMLContentType;
-
-/**
- * This class represents a <code>DataObject</code> of an XML-Signature
- * created by the security layer command <code>CreateXMLSignature</code>.
- * 
- * @author mcentner
- */
-public class DataObject {
-
-  /**
-   * Logging facility.
-   */
-  private static Log log = LogFactory.getLog(DataObject.class);
-  
-  /**
-   * DOM Implementation.
-   */
-  private static final String DOM_LS_3_0 = "LS 3.0";
-
-  /**
-   * The array of the default preferred MIME type order.
-   */
-  private static final String[] DEFAULT_PREFFERED_MIME_TYPES = 
-    new String[] {
+import at.gv.egiz.dom.DOMUtils;
+import at.gv.egiz.marshal.NamespacePrefix;
+import at.gv.egiz.marshal.NamespacePrefixMapperImpl;
+import at.gv.egiz.slbinding.impl.XMLContentType;
+import javax.xml.namespace.NamespaceContext;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+
+/**
+ * This class represents a <code>DataObject</code> of an XML-Signature
+ * created by the security layer command <code>CreateXMLSignature</code>.
+ * 
+ * @author mcentner
+ */
+public class DataObject {
+
+  /**
+   * Logging facility.
+   */
+  private static Log log = LogFactory.getLog(DataObject.class);
+  
+  /**
+   * DOM Implementation.
+   */
+  private static final String DOM_LS_3_0 = "LS 3.0";
+
+  /**
+   * The array of the default preferred MIME type order.
+   */
+  private static final String[] DEFAULT_PREFFERED_MIME_TYPES = 
+    new String[] {
       "text/plain",
-      "application/xhtml+xml" 
+      "application/xhtml+xml" 
     };
   
   /**
@@ -149,87 +156,87 @@ public class DataObject {
     validMimeTypes = mediaTypes;
   }
   
-  /**
-   * The DOM implementation used.
-   */
-  private DOMImplementationLS domImplLS;
-
-  /**
-   * The signature context.
-   */
-  private SignatureContext ctx;
-  
-  /**
-   * The Reference for this DataObject.
-   */
-  private XSECTReference reference;
-  
-  /**
-   * The XMLObject for this DataObject.
-   */
-  private XMLObject xmlObject;
-  
-  /**
-   * The MIME-Type of the digest input.
-   */
-  private String mimeType;
-  
-  /**
-   * An optional description of the digest input.
-   */
-  private String description;
-  
-  /**
-   * Creates a new instance.
-   * 
-   * @param document the document of the target signature
-   */
-  public DataObject(SignatureContext signatureContext) {
-    this.ctx = signatureContext;
-    
-    DOMImplementationRegistry registry;
-    try {
-      registry = DOMImplementationRegistry.newInstance();
-    } catch (Exception e) {
-      log.error("Failed to get DOMImplementationRegistry.", e);
-      throw new SLRuntimeException("Failed to get DOMImplementationRegistry.");
-    }
-
-    domImplLS = (DOMImplementationLS) registry.getDOMImplementation(DOM_LS_3_0);
-    if (domImplLS == null) {
-      log.error("Failed to get DOMImplementation " + DOM_LS_3_0);
-      throw new SLRuntimeException("Failed to get DOMImplementation " + DOM_LS_3_0);
-    }
-
-  }
-
-  /**
-   * @return the reference
-   */
-  public Reference getReference() {
-    return reference;
-  }
-
-  /**
-   * @return the xmlObject
-   */
-  public XMLObject getXmlObject() {
-    return xmlObject;
-  }
-
-  /**
-   * @return the mimeType
-   */
-  public String getMimeType() {
-    return mimeType;
-  }
-
-  /**
-   * @return the description
-   */
-  public String getDescription() {
-    return description;
-  }
+  /**
+   * The DOM implementation used.
+   */
+  private DOMImplementationLS domImplLS;
+
+  /**
+   * The signature context.
+   */
+  private SignatureContext ctx;
+  
+  /**
+   * The Reference for this DataObject.
+   */
+  private XSECTReference reference;
+  
+  /**
+   * The XMLObject for this DataObject.
+   */
+  private XMLObject xmlObject;
+  
+  /**
+   * The MIME-Type of the digest input.
+   */
+  private String mimeType;
+  
+  /**
+   * An optional description of the digest input.
+   */
+  private String description;
+  
+  /**
+   * Creates a new instance.
+   * 
+   * @param document the document of the target signature
+   */
+  public DataObject(SignatureContext signatureContext) {
+    this.ctx = signatureContext;
+    
+    DOMImplementationRegistry registry;
+    try {
+      registry = DOMImplementationRegistry.newInstance();
+    } catch (Exception e) {
+      log.error("Failed to get DOMImplementationRegistry.", e);
+      throw new SLRuntimeException("Failed to get DOMImplementationRegistry.");
+    }
+
+    domImplLS = (DOMImplementationLS) registry.getDOMImplementation(DOM_LS_3_0);
+    if (domImplLS == null) {
+      log.error("Failed to get DOMImplementation " + DOM_LS_3_0);
+      throw new SLRuntimeException("Failed to get DOMImplementation " + DOM_LS_3_0);
+    }
+
+  }
+
+  /**
+   * @return the reference
+   */
+  public Reference getReference() {
+    return reference;
+  }
+
+  /**
+   * @return the xmlObject
+   */
+  public XMLObject getXmlObject() {
+    return xmlObject;
+  }
+
+  /**
+   * @return the mimeType
+   */
+  public String getMimeType() {
+    return mimeType;
+  }
+
+  /**
+   * @return the description
+   */
+  public String getDescription() {
+    return description;
+  }
 
   public void validateHashDataInput() throws SLViewerException {
     
@@ -293,823 +300,920 @@ public class DataObject {
     }
     
   }
-  
-  /**
-   * Configures this DataObject with the information provided within the given
-   * <code>sl:DataObjectInfo</code>.
-   * 
-   * @param dataObjectInfo
-   *          the <code>sl:DataObjectInfo</code>
-   * 
-   * @throws SLCommandException
-   *           if configuring this DataObject with the information provided in
-   *           the <code>sl:DataObjectInfo</code> fails.
-   * @throws SLRequestException
-   *           if the information provided in the <code>sl:DataObjectInfo</code>
-   *           does not conform to the security layer specification.
-   * @throws NullPointerException
-   *           if <code>dataObjectInfo</code> is <code>null</code>
-   */
-  public void setDataObjectInfo(DataObjectInfoType dataObjectInfo) throws SLCommandException, SLRequestException {
-  
-    Base64XMLLocRefOptRefContentType dataObject = dataObjectInfo.getDataObject();
-    String structure = dataObjectInfo.getStructure();
-    
-    // select and unmarshal an appropriate transformation path if provided
-    // and set the final data meta information
-    XSECTTransforms transforms = createTransformsAndSetFinalDataMetaInfo(dataObjectInfo.getTransformsInfo());
-  
-    if ("enveloping".equals(structure)) {
-      
-      // configure this DataObject as an enveloped DataObject
-      setEnvelopedDataObject(dataObject, transforms);
-      
-    } else if ("detached".equals(structure)) {
-      
-      // configure this DataObject as an detached DataObject
-      setDetachedDataObject(dataObject, transforms);
-      
-    } 
-    // other values are not allowed by the schema and are therefore ignored
-    
-  }
-
-  /**
-   * Configures this DataObject as an enveloped DataObject with the information
-   * provided within the given <code>sl:DataObject</code>.
-   * 
-   * @param dataObject
-   *          the <code>sl:DataObject</code>
-   * @param transforms
-   *          an optional <code>Transforms</code> element (may be
-   *          <code>null</code>)
-   * 
-   * @throws SLCommandException
-   *           if configuring this DataObject with the information provided in
-   *           the <code>sl:DataObject</code> fails.
-   * @throws SLRequestException
-   *           if the information provided in the <code>sl:DataObject</code>
-   *           does not conform to the security layer specification.
-   * @throws NullPointerException
-   *           if <code>dataObject</code> is <code>null</code>
-   */
-  private void setEnvelopedDataObject(
-      Base64XMLLocRefOptRefContentType dataObject, XSECTTransforms transforms)
-      throws SLCommandException, SLRequestException {
-    
-    String reference = dataObject.getReference();
-    if (reference == null) {
-      //
-      // case A
-      //
-      // The Reference attribute is not used; the content of sl:DataObject represents the data object. 
-      // If the data object is XML-coded (the sl:XMLContent element is used in sl:DataObject), then it 
-      // must be incorporated in the signature structure as parsed XML.
-      //
-
-      if (dataObject.getBase64Content() != null) {
-
-        log.debug("Adding DataObject (Base64Content) without a reference URI.");
-
-        // create XMLObject
-        XMLObject xmlObject = createXMLObject(new ByteArrayInputStream(dataObject.getBase64Content()));
-
-        setXMLObjectAndReferenceBase64(xmlObject, transforms);
-        
-      } else if (dataObject.getXMLContent() != null) {
-        
-        log.debug("Adding DataObject (XMLContent) without a reference URI.");
-
-        // create XMLObject
-        DocumentFragment content = parseDataObject((XMLContentType) dataObject.getXMLContent());
-        XMLObject xmlObject = createXMLObject(content);
-        
-        setXMLObjectAndReferenceXML(xmlObject, transforms);
-        
-      } else if (dataObject.getLocRefContent() != null) {
-        
-        log.debug("Adding DataObject (LocRefContent) without a reference URI.");
-        
-        setEnvelopedDataObject(dataObject.getLocRefContent(), transforms);
-        
-      } else {
-        
-        // not allowed
-        log.info("XML structure of the command request contains an " +
-                "invalid combination of optional elements or attributes. " +
-            "DataObject of structure='enveloped' without a reference must contain content.");
-        throw new SLRequestException(3003);
-        
-      }
-      
-    } else {
-      
-      if (dataObject.getBase64Content() == null &&
-          dataObject.getXMLContent() == null &&
-          dataObject.getLocRefContent() == null) {
-
-        //
-        // case B
-        //
-        // The Reference attribute contains a URI that must be resolved by the 
-        // Citizen Card Environment to obtain the data object. 
-        // The content of sl:DataObject remains empty
-        //
-        
-        log.debug("Adding DataObject from reference URI '" + reference + "'.");
-        
-        setEnvelopedDataObject(reference, transforms);
-        
-      } else {
-        
-        // not allowed
-        log.info("XML structure of the command request contains an " +
-            "invalid combination of optional elements or attributes. " +
-        "DataObject of structure='enveloped' with reference must not contain content.");
-        throw new SLRequestException(3003);
-        
-      }
-      
-      
-    }
-    
-  }
-
-  /**
-   * Configures this DataObject as an enveloped DataObject with the content to
-   * be dereferenced from the given <code>reference</code>.
-   * 
-   * @param reference
-   *          the <code>reference</code> URI
-   * @param transforms
-   *          an optional <code>Transforms</code> element (may be
-   *          <code>null</code>)
-   * 
-   * @throws SLCommandException
-   *           if dereferencing the given <code>reference</code> fails, or if
-   *           configuring this DataObject with the data dereferenced from the
-   *           given <code>reference</code> fails.
-   * @throws NullPointerException
-   *           if <code>reference</code> is <code>null</code>
-   */
-  private void setEnvelopedDataObject(String reference, XSECTTransforms transforms) throws SLCommandException {
-
-    if (reference == null) {
-      throw new NullPointerException("Argument 'reference' must not be null.");
-    }
-    
-    // dereference URL
-    URLDereferencer dereferencer = URLDereferencer.getInstance();
-    
-    StreamData streamData;
-    try {
-      streamData = dereferencer.dereference(reference, ctx.getDereferencerContext());
-    } catch (IOException e) {
-      log.info("Failed to dereference XMLObject from '" + reference + "'.", e);
-      throw new SLCommandException(4110);
-    }
-
-    Node childNode;
-    
-    String contentType = streamData.getContentType();
-    if (contentType.startsWith("text/xml")) {
-  
-      // If content type is text/xml parse content.
-      String charset = HttpUtil.getCharset(contentType, true);
-      
-      Document doc = parseDataObject(streamData.getStream(), charset);
-      
-      childNode = doc.getDocumentElement();
-      
-      if (childNode == null) {
-        log.info("Failed to parse XMLObject from '" + reference + "'.");
-        throw new SLCommandException(4111);
-      }
-      
-      XMLObject xmlObject = createXMLObject(childNode);
-      
-      setXMLObjectAndReferenceXML(xmlObject, transforms);
-      
-    } else {
-  
-      // Include content Base64 encoded.
-      XMLObject xmlObject = createXMLObject(streamData.getStream());
-      
-      setXMLObjectAndReferenceBase64(xmlObject, transforms);
-      
-    }
-    
-  }
-
-  /**
-   * Configures this DataObject as an detached DataObject with the information
-   * provided in the given <code>sl:DataObject</code> and optionally
-   * <code>transforms</code>.
-   * 
-   * @param dataObject
-   *          the <code>sl:DataObject</code>
-   * @param transforms
-   *          an optional Transforms object, may be <code>null</code>
-   * 
-   * @throws SLCommandException
-   *           if configuring this DataObject with the information provided in
-   *           the <code>sl:DataObject</code> fails.
-   * @throws SLRequestException
-   *           if the information provided in the <code>sl:DataObject</code>
-   *           does not conform to the security layer specification.
-   * @throws NullPointerException
-   *           if <code>dataObject</code> is <code>null</code>
-   */
-  private void setDetachedDataObject(
-      Base64XMLLocRefOptRefContentType dataObject, XSECTTransforms transforms)
-      throws SLCommandException, SLRequestException {
-    
-    String referenceURI = dataObject.getReference();
-    
-    if (referenceURI == null) {
-      
-      // not allowed
-      log.info("XML structure of the command request contains an " +
-          "invalid combination of optional elements or attributes. " +
-      "DataObject of structure='detached' must contain a reference.");
-      throw new SLRequestException(3003);
-
-    } else {
-      
-      DigestMethod dm;
-      try {
-        dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
-      } catch (NoSuchAlgorithmException e) {
-        log.error("Failed to get DigestMethod.", e);
-        throw new SLCommandException(4006);
-      } catch (InvalidAlgorithmParameterException e) {
-        log.error("Failed to get DigestMethod.", e);
-        throw new SLCommandException(4006);
-      }
-      
-      String idValue = ctx.getIdValueFactory().createIdValue("Reference");
-      
-      reference = new XSECTReference(referenceURI, dm, transforms, null, idValue);
-      
-      // case D:
-      //
-      // The Reference attribute contains a URI that is used by the Citizen Card
-      // Environment to code the reference to the data object as part of the XML
-      // signature (attribute URI in the dsig:Reference) element. The content of
-      // sl:DataObject represents the data object.
-      
-      if (dataObject.getLocRefContent() != null) {
-        String locRef = dataObject.getLocRefContent();
-        try {
-          this.reference.setDereferencer(new LocRefDereferencer(ctx.getDereferencerContext(), locRef));
-        } catch (URISyntaxException e) {
-          log.info("Invalid URI '" + locRef + "' in DataObject.", e);
-          throw new SLCommandException(4003);
-        } catch (IllegalArgumentException e) {
-          log.info("LocRef URI of '" + locRef + "' not supported in DataObject. ", e);
-          throw new SLCommandException(4003);
-        }
-      } else if (dataObject.getBase64Content() != null) {
-        byte[] base64Content = dataObject.getBase64Content();
-        this.reference.setDereferencer(new ByteArrayDereferencer(base64Content));
-      } else if (dataObject.getXMLContent() != null) {
-        XMLContentType xmlContent = (XMLContentType) dataObject.getXMLContent();
-        byte[] bytes = xmlContent.getRedirectedStream().toByteArray();
-        this.reference.setDereferencer(new ByteArrayDereferencer(bytes));
-      } else {
-        
-        // case C:
-        //
-        // The Reference attribute contains a URI that must be resolved by the
-        // Citizen Card Environment to obtain the data object. The Reference
-        // attribute contains a URI that is used by the Citizen Card Environment
-        // to code the reference to the data object as part of the XML signature
-        // (attribute URI in the dsig:Reference) element. The content of
-        // sl:DataObject remains empty.
-
-      }
-      
-    }     
-  }
-
-  /**
-   * Returns the preferred <code>sl:TransformInfo</code> from the given list of
-   * <code>transformInfos</code>, or <code>null</code> if none of the given
-   * <code>transformInfos</code> is preferred over the others.
-   * 
-   * @param transformsInfos
-   *          a list of <code>sl:TransformInfo</code>s
-   * 
-   * @return the selected <code>sl:TransformInfo</code> or <code>null</code>, if
-   *         none is preferred over the others
-   */
-  private TransformsInfoType selectPreferredTransformsInfo(List<TransformsInfoType> transformsInfos) {
-    
-    Map<String, TransformsInfoType> mimeTypes = new HashMap<String, TransformsInfoType>();
-    
-    StringBuilder debugString = null;
-    if (log.isDebugEnabled()) {
-      debugString = new StringBuilder();
-      debugString.append("Got " + transformsInfos.size() + " TransformsInfo(s):");
-    }
-    
-    for (TransformsInfoType transformsInfoType : transformsInfos) {
-      MetaInfoType finalDataMetaInfo = transformsInfoType.getFinalDataMetaInfo();
-      String mimeType = finalDataMetaInfo.getMimeType();
-      String description = finalDataMetaInfo.getDescription();
-      mimeTypes.put(mimeType, transformsInfoType);
-      if (debugString != null) {
-        debugString.append("\n FinalDataMetaInfo: MIME-Type=");
-        debugString.append(mimeType);
-        if (description != null) {
-          debugString.append(" ");
-          debugString.append(description);
-        }
-      }
-    }
-
-    if (debugString != null) {
-      log.debug(debugString);
-    }
-
-    // look for preferred transform
-    for (String mimeType : DEFAULT_PREFFERED_MIME_TYPES) {
-      if (mimeTypes.containsKey(mimeType)) {
-        return mimeTypes.get(mimeType);
-      }
-    }
-    
-    // no preferred transform
-    return null;
-    
-  }
-
-  /**
-   * Create an instance of <code>ds:Transforms</code> from the given
-   * <code>sl:TransformsInfo</code>.
-   * 
-   * @param transformsInfo
-   *          the <code>sl:TransformsInfo</code>
-   * 
-   * @return a corresponding unmarshalled <code>ds:Transforms</code>, or
-   *         <code>null</code> if the given <code>sl:TransformsInfo</code> does
-   *         not contain a <code>dsig:Transforms</code> element
-   * 
-   * @throws SLRequestException
-   *           if the <code>ds:Transforms</code> in the given
-   *           <code>transformsInfo</code> are not valid or cannot be parsed.
-   * 
-   * @throws MarshalException
-   *           if the <code>ds:Transforms</code> in the given
-   *           <code>transformsInfo</code> cannot be unmarshalled.
-   */
-  private XSECTTransforms createTransforms(TransformsInfoType transformsInfo) throws SLRequestException, MarshalException {
-    
-    ByteArrayOutputStream redirectedStream = ((at.gv.egiz.slbinding.impl.TransformsInfoType) transformsInfo).getRedirectedStream();
-    byte[] transformBytes = (redirectedStream != null) ? redirectedStream.toByteArray() : null;
-    
-    if (transformBytes != null && transformBytes.length > 0) {
-
-      // debug
-      if (log.isTraceEnabled()) {
-        StringBuilder sb = new StringBuilder();
-        sb.append("Trying to parse transforms:\n");
-        sb.append(new String(transformBytes, Charset.forName("UTF-8")));
-        log.trace(sb);
-      }
-      
-      DOMImplementationLS domImplLS = DOMUtils.getDOMImplementationLS();
-      LSInput input = domImplLS.createLSInput();
-      input.setByteStream(new ByteArrayInputStream(transformBytes));
-
-      LSParser parser = domImplLS.createLSParser(
-          DOMImplementationLS.MODE_SYNCHRONOUS, null);
-      DOMConfiguration domConfig = parser.getDomConfig();
-      SimpleDOMErrorHandler errorHandler = new SimpleDOMErrorHandler();
-      domConfig.setParameter("error-handler", errorHandler);
-      domConfig.setParameter("validate", Boolean.FALSE);
-
-      Document document;
-      try {
-        document = parser.parse(input);
-      } catch (DOMException e) {
-        log.info("Failed to parse dsig:Transforms.", e);
-        throw new SLRequestException(3002);
-      } catch (LSException e) {
-        log.info("Failed to parse dsig:Transforms.", e);
-        throw new SLRequestException(3002);
-      }
-
-      // adopt ds:Transforms
-      Element documentElement = document.getDocumentElement();
-      Node adoptedTransforms = ctx.getDocument().adoptNode(documentElement);
-
-      DOMCryptoContext context = new DOMCryptoContext();
-
-      // unmarshall ds:Transforms
-      return new XSECTTransforms(context, adoptedTransforms);
-
-    } else {
-      return null;
-    }
-    
-  }
-  
-  /**
-   * Sets the <code>mimeType</code> and the <code>description</code> value
-   * for this DataObject.
-   * 
-   * @param metaInfoType the <code>sl:FinalMetaDataInfo</code>
-   * 
-   * @throws NullPointerException if <code>metaInfoType</code> is <code>null</code>
-   */
-  private void setFinalDataMetaInfo(MetaInfoType metaInfoType) {
-    
-    this.mimeType = metaInfoType.getMimeType();
-    this.description = metaInfoType.getDescription();
-    
-  }
-  
-  /**
-   * Selects an appropriate transformation path (if present) from the given list
-   * of <code>sl:TransformInfos</code>, sets the corresponding final data meta info and
-   * returns the corresponding unmarshalled <code>ds:Transforms</code>.
-   * 
-   * @param transformsInfos the <code>sl:TransformInfos</code>
-   * 
-   * @return the unmarshalled <code>ds:Transforms</code>, or <code>null</code> if
-   * no transformation path has been selected.
-   * 
-   * @throws SLRequestException if the given list <code>ds:TransformsInfo</code> contains
-   * an invalid <code>ds:Transforms</code> element, or no suitable transformation path
-   * can be found. 
-   */
-  private XSECTTransforms createTransformsAndSetFinalDataMetaInfo(
-      List<TransformsInfoType> transformsInfos) throws SLRequestException {
-
-    TransformsInfoType preferredTransformsInfo = selectPreferredTransformsInfo(transformsInfos);
-    // try preferred transform
-    if (preferredTransformsInfo != null) {
-
-      try {
-        XSECTTransforms transforms = createTransforms(preferredTransformsInfo);
-        setFinalDataMetaInfo(preferredTransformsInfo.getFinalDataMetaInfo());
-        return transforms;
-      } catch (MarshalException e) {
-      
-        String mimeType = preferredTransformsInfo.getFinalDataMetaInfo().getMimeType();
-        log.info("Failed to unmarshal preferred transformation path (MIME-Type="
-            + mimeType + ").", e);
-      
-      }
-
-    }
-
-    // look for another suitable transformation path
-    for (TransformsInfoType transformsInfoType : transformsInfos) {
-      
-      try {
-        XSECTTransforms transforms = createTransforms(transformsInfoType);
-        setFinalDataMetaInfo(transformsInfoType.getFinalDataMetaInfo());
-        return transforms;
-      } catch (MarshalException e) {
-
-        String mimeType = transformsInfoType.getFinalDataMetaInfo().getMimeType();
-        log.info("Failed to unmarshal transformation path (MIME-Type="
-            + mimeType + ").", e);
-      }
-      
-    }
-
-    // no suitable transformation path found
-    throw new SLRequestException(3003);
-    
-  }
-
-  /**
-   * Create an XMLObject with the Base64 encoding of the given
-   * <code>content</code>.
-   * 
-   * @param content
-   *          the to-be Base64 encoded content
-   * @return an XMLObject with the Base64 encoded <code>content</code>
-   */
-  private XMLObject createXMLObject(InputStream content) {
-    
-    Text textNode;
-    try {
-      textNode = at.gv.egiz.dom.DOMUtils.createBase64Text(content, ctx.getDocument());
-    } catch (IOException e) {
-      log.error(e);
-      throw new SLRuntimeException(e);
-    }
-
-    DOMStructure structure = new DOMStructure(textNode);
-    
-    String idValue = ctx.getIdValueFactory().createIdValue("Object");
-
-    return ctx.getSignatureFactory().newXMLObject(Collections.singletonList(structure), idValue, null, null);
-    
-  }
-  
-  /**
-   * Create an XMLObject with the given <code>content</code> node.
-   * 
-   * @param content the content node
-   * 
-   * @return an XMLObject with the given <code>content</code>
-   */
-  private XMLObject createXMLObject(Node content) {
-    
-    String idValue = ctx.getIdValueFactory().createIdValue("Object");
-    
-    List<DOMStructure> structures = Collections.singletonList(new DOMStructure(content));
-    
-    return ctx.getSignatureFactory().newXMLObject(structures, idValue, null, null);
-    
-  }
-
-  /**
-   * Sets the given <code>xmlObject</code> and creates and sets a corresponding
-   * <code>Reference</code>.
-   * <p>
-   * A transform to Base64-decode the xmlObject's content is inserted at the top
-   * of to the optional <code>transforms</code> if given, or to a newly created
-   * <code>Transforms</code> element if <code>transforms</code> is
-   * <code>null</code>.
-   * 
-   * @param xmlObject
-   *          the XMLObject
-   * @param transforms
-   *          an optional <code>Transforms</code> element (may be
-   *          <code>null</code>)
-   * 
-   * @throws SLCommandException
-   *           if creating the Reference fails
-   * @throws NullPointerException
-   *           if <code>xmlObject</code> is <code>null</code>
-   */
-  private void setXMLObjectAndReferenceBase64(XMLObject xmlObject, XSECTTransforms transforms) throws SLCommandException {
-    
-    // create reference URI
-    //
-    // NOTE: the ds:Object can be referenced directly, as the Base64 transform
-    // operates on the text() of the input nodelist.
-    //
-    String referenceURI = "#" + xmlObject.getId();
-  
-    // create Base64 Transform
-    Transform transform;
-    try {
-      transform = ctx.getSignatureFactory().newTransform(Transform.BASE64, (TransformParameterSpec) null);
-    } catch (NoSuchAlgorithmException e) {
-      // algorithm must be present
-      throw new SLRuntimeException(e);
-    } catch (InvalidAlgorithmParameterException e) {
-      // algorithm does not take parameters
-      throw new SLRuntimeException(e);
-    }
-    
-    if (transforms == null) {
-      transforms = new XSECTTransforms(Collections.singletonList(transform)); 
-    } else {
-      transforms.insertTransform(transform);
-    }
-  
-    DigestMethod dm;
-    try {
-      dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
-    } catch (NoSuchAlgorithmException e) {
-      log.error("Failed to get DigestMethod.", e);
-      throw new SLCommandException(4006);
-    } catch (InvalidAlgorithmParameterException e) {
-      log.error("Failed to get DigestMethod.", e);
-      throw new SLCommandException(4006);
-    }
-    String id = ctx.getIdValueFactory().createIdValue("Reference");
-    
-    this.xmlObject = xmlObject;
-    this.reference = new XSECTReference(referenceURI, dm, transforms, null, id);
-    
-  }
-
-  /**
-   * Sets the given <code>xmlObject</code> and creates and sets a corresponding
-   * <code>Reference</code>.
-   * <p>
-   * A transform to select the xmlObject's content is inserted at the top of to
-   * the optional <code>transforms</code> if given, or to a newly created
-   * <code>Transforms</code> element if <code>transforms</code> is
-   * <code>null</code>.
-   * </p>
-   * 
-   * @param xmlObject
-   *          the XMLObject
-   * @param transforms
-   *          an optional <code>Transforms</code> element (may be
-   *          <code>null</code>)
-   * 
-   * @throws SLCommandException
-   *           if creating the Reference fails
-   * @throws NullPointerException
-   *           if <code>xmlObject</code> is <code>null</code>
-   */
-  private void setXMLObjectAndReferenceXML(XMLObject xmlObject, XSECTTransforms transforms) throws SLCommandException {
-    
-    // create reference URI
-    String referenceURI = "#" + xmlObject.getId();
-    
-    // create Transform to select ds:Object's children
-    Transform xpathTransform;
-    Transform c14nTransform;
-    try {
-
-      XPathType xpath = new XPathType("id(\"" + xmlObject.getId() + "\")/node()", XPathType.Filter.INTERSECT);
-      List<XPathType> xpaths = Collections.singletonList(xpath);
-      XPathFilter2ParameterSpec params = new XPathFilter2ParameterSpec(xpaths);
-
-      xpathTransform = ctx.getSignatureFactory().newTransform(Transform.XPATH2, params);
-
-      // add exclusive canonicalization to avoid signing the namespace context of the ds:Object
-      c14nTransform = ctx.getSignatureFactory().newTransform(CanonicalizationMethod.EXCLUSIVE, (TransformParameterSpec) null);
-      
-    } catch (NoSuchAlgorithmException e) {
-      // algorithm must be present
-      throw new SLRuntimeException(e);
-    } catch (InvalidAlgorithmParameterException e) {
-      // params must be appropriate
-      throw new SLRuntimeException(e);
-    }
-  
-    if (transforms == null) {
-      List<Transform> newTransfroms = new ArrayList<Transform>();
-      newTransfroms.add(xpathTransform);
-      newTransfroms.add(c14nTransform);
-      transforms = new XSECTTransforms(newTransfroms);
-    } else {
-      transforms.insertTransform(xpathTransform);
-    }
-    
-    DigestMethod dm;
-    try {
-      dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
-    } catch (NoSuchAlgorithmException e) {
-      log.error("Failed to get DigestMethod.", e);
-      throw new SLCommandException(4006);
-    } catch (InvalidAlgorithmParameterException e) {
-      log.error("Failed to get DigestMethod.", e);
-      throw new SLCommandException(4006);
-    }
-    String id = ctx.getIdValueFactory().createIdValue("Reference");
-
-    this.xmlObject = xmlObject;
-    this.reference = new XSECTReference(referenceURI, dm, transforms, null, id);
-    
-  }
-
-  /**
-   * Parses the given <code>xmlContent</code> and returns a corresponding
-   * document fragment.
-   * 
-   * <p>
-   * The to-be parsed content is surrounded by <dummy> ... </dummy> elements to
-   * allow for mixed (e.g. Text and Element) content in XMLContent.
-   * </p>
-   * 
-   * @param xmlContent
-   *          the XMLContent to-be parsed
-   * 
-   * @return a document fragment containing the parsed nodes
-   * 
-   * @throws SLCommandException
-   *           if parsing the given <code>xmlContent</code> fails
-   * 
-   * @throws NullPointerException
-   *           if <code>xmlContent</code> is <code>null</code>
-   */
-  private DocumentFragment parseDataObject(XMLContentType xmlContent) throws SLCommandException {
-    
-    ByteArrayOutputStream redirectedStream =  xmlContent.getRedirectedStream();
-  
-    // Note: We can assume a fixed character encoding of UTF-8 for the
-    // content of the redirect stream as the content has already been parsed
-    // and serialized again to the redirect stream.
-    
-    List<InputStream> inputStreams = new ArrayList<InputStream>();
-    try {
-      // dummy start element
-      inputStreams.add(new ByteArrayInputStream("<dummy>".getBytes("UTF-8")));
-  
-      // content
-      inputStreams.add(new ByteArrayInputStream(redirectedStream.toByteArray()));
-      
-      // dummy end element
-      inputStreams.add(new ByteArrayInputStream("</dummy>".getBytes("UTF-8")));
-    } catch (UnsupportedEncodingException e) {
-      throw new SLRuntimeException(e);
-    }
-    
-    SequenceInputStream inputStream = new SequenceInputStream(Collections.enumeration(inputStreams));
-  
-    // parse DataObject
-    Document doc = parseDataObject(inputStream, "UTF-8");
-    
-    Element documentElement = doc.getDocumentElement();
-  
-    if (documentElement == null ||
-        !"dummy".equals(documentElement.getLocalName())) {
-      log.info("Failed to parse DataObject XMLContent.");
-      throw new SLCommandException(4111);
-    }
-    
-    DocumentFragment fragment = doc.createDocumentFragment();
-    while (documentElement.getFirstChild() != null) {
-      fragment.appendChild(documentElement.getFirstChild());
-    }
-    
-    // log parsed document
-    if (log.isTraceEnabled()) {
-      
-      StringWriter writer = new StringWriter();
-      
-      writer.write("DataObject:\n");
-      
-      LSOutput output = domImplLS.createLSOutput();
-      output.setCharacterStream(writer);
-      output.setEncoding("UTF-8");
-      LSSerializer serializer = domImplLS.createLSSerializer();
-      serializer.getDomConfig().setParameter("xml-declaration", Boolean.FALSE);
-      serializer.write(fragment, output);
-      
-      log.trace(writer.toString());
-    }
-    
-    return fragment;
-    
-  }
-
-  /**
-   * Parses the given <code>inputStream</code> using the given
-   * <code>encoding</code> and returns the parsed document.
-   * 
-   * @param inputStream
-   *          the to-be parsed input
-   * 
-   * @param encoding
-   *          the encoding to be used for parsing the given
-   *          <code>inputStream</code>
-   * 
-   * @return the parsed document
-   * 
-   * @throws SLCommandException
-   *           if parsing the <code>inputStream</code> fails.
-   * 
-   * @throws NullPointerException
-   *           if <code>inputStram</code> is <code>null</code>
-   */
-  private Document parseDataObject(InputStream inputStream, String encoding) throws SLCommandException {
-
-    LSInput input = domImplLS.createLSInput();
-    input.setByteStream(inputStream);
-
-    if (encoding != null) {
-      input.setEncoding(encoding);
-    }
-    
-    LSParser parser = domImplLS.createLSParser(DOMImplementationLS.MODE_SYNCHRONOUS, null);
-    DOMConfiguration domConfig = parser.getDomConfig();
-    SimpleDOMErrorHandler errorHandler = new SimpleDOMErrorHandler();
-    domConfig.setParameter("error-handler", errorHandler);
-    domConfig.setParameter("validate", Boolean.FALSE);
-
-    Document doc;
-    try {
-      doc = parser.parse(input);
-    } catch (DOMException e) {
-      log.info("Existing XML document cannot be parsed.", e);
-      throw new SLCommandException(4111);
-    } catch (LSException e) {
-      log.info("Existing XML document cannot be parsed. ", e);
-      throw new SLCommandException(4111);
-    }
-    
-    if (errorHandler.hasErrors()) {
-      // log errors
-      if (log.isInfoEnabled()) {
-        List<String> errorMessages = errorHandler.getErrorMessages();
-        StringBuffer sb = new StringBuffer();
-        for (String errorMessage : errorMessages) {
-          sb.append(" ");
-          sb.append(errorMessage);
-        }
-        log.info("Existing XML document cannot be parsed. " + sb.toString());
-      }
-      throw new SLCommandException(4111);
-    }
-
-    return doc;
-    
-  }
-
-
-}
+  
+  /**
+   * Configures this DataObject with the information provided within the given
+   * <code>sl:DataObjectInfo</code>.
+   * 
+   * @param dataObjectInfo
+   *          the <code>sl:DataObjectInfo</code>
+   * 
+   * @throws SLCommandException
+   *           if configuring this DataObject with the information provided in
+   *           the <code>sl:DataObjectInfo</code> fails.
+   * @throws SLRequestException
+   *           if the information provided in the <code>sl:DataObjectInfo</code>
+   *           does not conform to the security layer specification.
+   * @throws NullPointerException
+   *           if <code>dataObjectInfo</code> is <code>null</code>
+   */
+  public void setDataObjectInfo(DataObjectInfoType dataObjectInfo) throws SLCommandException, SLRequestException {
+  
+    Base64XMLLocRefOptRefContentType dataObject = dataObjectInfo.getDataObject();
+    String structure = dataObjectInfo.getStructure();
+    
+    // select and unmarshal an appropriate transformation path if provided
+    // and set the final data meta information
+    XSECTTransforms transforms = createTransformsAndSetFinalDataMetaInfo(dataObjectInfo.getTransformsInfo());
+  
+    if ("enveloping".equals(structure)) {
+      
+      // configure this DataObject as an enveloped DataObject
+      setEnvelopedDataObject(dataObject, transforms);
+      
+    } else if ("detached".equals(structure)) {
+      
+      // configure this DataObject as an detached DataObject
+      setDetachedDataObject(dataObject, transforms);
+      
+    } 
+    // other values are not allowed by the schema and are therefore ignored
+    
+  }
+
+  private byte[] getTransformsBytes(at.gv.egiz.slbinding.impl.TransformsInfoType ti) {
+    return ti.getRedirectedStream().toByteArray();
+//    byte[] transformsBytes = ti.getRedirectedStream().toByteArray();
+//
+//    if (transformsBytes == null || transformsBytes.length == 0) {
+//      return null;
+//    }
+//
+//    String dsigPrefix = ti.getNamespaceContext().getNamespaceURI("http://www.w3.org/2000/09/xmldsig#");
+//    byte[] pre, post;
+//    if (dsigPrefix == null) {
+//      log.trace("XMLDSig not declared in outside dsig:Transforms");
+//      pre = "<AssureDSigNS>".getBytes();
+//      post = "</AssureDSigNS>".getBytes();
+//    } else {
+//      log.trace("XMLDSig bound to prefix " + dsigPrefix);
+//       pre = ("<AssureDSigNS xmlns:" + dsigPrefix + "=\"http://www.w3.org/2000/09/xmldsig#\">").getBytes();
+//       post = "</AssureDSigNS>".getBytes();
+//    }
+//
+//    byte[] workaround = new byte[pre.length + transformsBytes.length + post.length];
+//    System.arraycopy(pre, 0, workaround, 0, pre.length);
+//    System.arraycopy(transformsBytes, 0, workaround, pre.length, transformsBytes.length);
+//    System.arraycopy(post, 0, workaround, pre.length + transformsBytes.length, post.length);
+//    return workaround;
+  }
+
+  /**
+   * Configures this DataObject as an enveloped DataObject with the information
+   * provided within the given <code>sl:DataObject</code>.
+   * 
+   * @param dataObject
+   *          the <code>sl:DataObject</code>
+   * @param transforms
+   *          an optional <code>Transforms</code> element (may be
+   *          <code>null</code>)
+   * 
+   * @throws SLCommandException
+   *           if configuring this DataObject with the information provided in
+   *           the <code>sl:DataObject</code> fails.
+   * @throws SLRequestException
+   *           if the information provided in the <code>sl:DataObject</code>
+   *           does not conform to the security layer specification.
+   * @throws NullPointerException
+   *           if <code>dataObject</code> is <code>null</code>
+   */
+  private void setEnvelopedDataObject(
+      Base64XMLLocRefOptRefContentType dataObject, XSECTTransforms transforms)
+      throws SLCommandException, SLRequestException {
+    
+    String reference = dataObject.getReference();
+    if (reference == null) {
+      //
+      // case A
+      //
+      // The Reference attribute is not used; the content of sl:DataObject represents the data object. 
+      // If the data object is XML-coded (the sl:XMLContent element is used in sl:DataObject), then it 
+      // must be incorporated in the signature structure as parsed XML.
+      //
+
+      if (dataObject.getBase64Content() != null) {
+
+        log.debug("Adding DataObject (Base64Content) without a reference URI.");
+
+        // create XMLObject
+        XMLObject xmlObject = createXMLObject(new ByteArrayInputStream(dataObject.getBase64Content()));
+
+        setXMLObjectAndReferenceBase64(xmlObject, transforms);
+        
+      } else if (dataObject.getXMLContent() != null) {
+        
+        log.debug("Adding DataObject (XMLContent) without a reference URI.");
+
+        // create XMLObject
+        DocumentFragment content = parseDataObject((XMLContentType) dataObject.getXMLContent());
+        XMLObject xmlObject = createXMLObject(content);
+        
+        setXMLObjectAndReferenceXML(xmlObject, transforms);
+        
+      } else if (dataObject.getLocRefContent() != null) {
+        
+        log.debug("Adding DataObject (LocRefContent) without a reference URI.");
+        
+        setEnvelopedDataObject(dataObject.getLocRefContent(), transforms);
+        
+      } else {
+        
+        // not allowed
+        log.info("XML structure of the command request contains an " +
+                "invalid combination of optional elements or attributes. " +
+            "DataObject of structure='enveloped' without a reference must contain content.");
+        throw new SLRequestException(3003);
+        
+      }
+      
+    } else {
+      
+      if (dataObject.getBase64Content() == null &&
+          dataObject.getXMLContent() == null &&
+          dataObject.getLocRefContent() == null) {
+
+        //
+        // case B
+        //
+        // The Reference attribute contains a URI that must be resolved by the 
+        // Citizen Card Environment to obtain the data object. 
+        // The content of sl:DataObject remains empty
+        //
+        
+        log.debug("Adding DataObject from reference URI '" + reference + "'.");
+        
+        setEnvelopedDataObject(reference, transforms);
+        
+      } else {
+        
+        // not allowed
+        log.info("XML structure of the command request contains an " +
+            "invalid combination of optional elements or attributes. " +
+        "DataObject of structure='enveloped' with reference must not contain content.");
+        throw new SLRequestException(3003);
+        
+      }
+      
+      
+    }
+    
+  }
+
+  /**
+   * Configures this DataObject as an enveloped DataObject with the content to
+   * be dereferenced from the given <code>reference</code>.
+   * 
+   * @param reference
+   *          the <code>reference</code> URI
+   * @param transforms
+   *          an optional <code>Transforms</code> element (may be
+   *          <code>null</code>)
+   * 
+   * @throws SLCommandException
+   *           if dereferencing the given <code>reference</code> fails, or if
+   *           configuring this DataObject with the data dereferenced from the
+   *           given <code>reference</code> fails.
+   * @throws NullPointerException
+   *           if <code>reference</code> is <code>null</code>
+   */
+  private void setEnvelopedDataObject(String reference, XSECTTransforms transforms) throws SLCommandException {
+
+    if (reference == null) {
+      throw new NullPointerException("Argument 'reference' must not be null.");
+    }
+    
+    // dereference URL
+    URLDereferencer dereferencer = URLDereferencer.getInstance();
+    
+    StreamData streamData;
+    try {
+      streamData = dereferencer.dereference(reference, ctx.getDereferencerContext());
+    } catch (IOException e) {
+      log.info("Failed to dereference XMLObject from '" + reference + "'.", e);
+      throw new SLCommandException(4110);
+    }
+
+    Node childNode;
+    
+    String contentType = streamData.getContentType();
+    if (contentType.startsWith("text/xml")) {
+  
+      // If content type is text/xml parse content.
+      String charset = HttpUtil.getCharset(contentType, true);
+      
+      Document doc = parseDataObject(streamData.getStream(), charset);
+      
+      childNode = doc.getDocumentElement();
+      
+      if (childNode == null) {
+        log.info("Failed to parse XMLObject from '" + reference + "'.");
+        throw new SLCommandException(4111);
+      }
+      
+      XMLObject xmlObject = createXMLObject(childNode);
+      
+      setXMLObjectAndReferenceXML(xmlObject, transforms);
+      
+    } else {
+  
+      // Include content Base64 encoded.
+      XMLObject xmlObject = createXMLObject(streamData.getStream());
+      
+      setXMLObjectAndReferenceBase64(xmlObject, transforms);
+      
+    }
+    
+  }
+
+  /**
+   * Configures this DataObject as an detached DataObject with the information
+   * provided in the given <code>sl:DataObject</code> and optionally
+   * <code>transforms</code>.
+   * 
+   * @param dataObject
+   *          the <code>sl:DataObject</code>
+   * @param transforms
+   *          an optional Transforms object, may be <code>null</code>
+   * 
+   * @throws SLCommandException
+   *           if configuring this DataObject with the information provided in
+   *           the <code>sl:DataObject</code> fails.
+   * @throws SLRequestException
+   *           if the information provided in the <code>sl:DataObject</code>
+   *           does not conform to the security layer specification.
+   * @throws NullPointerException
+   *           if <code>dataObject</code> is <code>null</code>
+   */
+  private void setDetachedDataObject(
+      Base64XMLLocRefOptRefContentType dataObject, XSECTTransforms transforms)
+      throws SLCommandException, SLRequestException {
+    
+    String referenceURI = dataObject.getReference();
+    
+    if (referenceURI == null) {
+      
+      // not allowed
+      log.info("XML structure of the command request contains an " +
+          "invalid combination of optional elements or attributes. " +
+      "DataObject of structure='detached' must contain a reference.");
+      throw new SLRequestException(3003);
+
+    } else {
+      
+      DigestMethod dm;
+      try {
+        dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
+      } catch (NoSuchAlgorithmException e) {
+        log.error("Failed to get DigestMethod.", e);
+        throw new SLCommandException(4006);
+      } catch (InvalidAlgorithmParameterException e) {
+        log.error("Failed to get DigestMethod.", e);
+        throw new SLCommandException(4006);
+      }
+      
+      String idValue = ctx.getIdValueFactory().createIdValue("Reference");
+      
+      reference = new XSECTReference(referenceURI, dm, transforms, null, idValue);
+      
+      // case D:
+      //
+      // The Reference attribute contains a URI that is used by the Citizen Card
+      // Environment to code the reference to the data object as part of the XML
+      // signature (attribute URI in the dsig:Reference) element. The content of
+      // sl:DataObject represents the data object.
+      
+      if (dataObject.getLocRefContent() != null) {
+        String locRef = dataObject.getLocRefContent();
+        try {
+          this.reference.setDereferencer(new LocRefDereferencer(ctx.getDereferencerContext(), locRef));
+        } catch (URISyntaxException e) {
+          log.info("Invalid URI '" + locRef + "' in DataObject.", e);
+          throw new SLCommandException(4003);
+        } catch (IllegalArgumentException e) {
+          log.info("LocRef URI of '" + locRef + "' not supported in DataObject. ", e);
+          throw new SLCommandException(4003);
+        }
+      } else if (dataObject.getBase64Content() != null) {
+        byte[] base64Content = dataObject.getBase64Content();
+        this.reference.setDereferencer(new ByteArrayDereferencer(base64Content));
+      } else if (dataObject.getXMLContent() != null) {
+        XMLContentType xmlContent = (XMLContentType) dataObject.getXMLContent();
+        byte[] bytes = xmlContent.getRedirectedStream().toByteArray();
+        this.reference.setDereferencer(new ByteArrayDereferencer(bytes));
+      } else {
+        
+        // case C:
+        //
+        // The Reference attribute contains a URI that must be resolved by the
+        // Citizen Card Environment to obtain the data object. The Reference
+        // attribute contains a URI that is used by the Citizen Card Environment
+        // to code the reference to the data object as part of the XML signature
+        // (attribute URI in the dsig:Reference) element. The content of
+        // sl:DataObject remains empty.
+
+      }
+      
+    }     
+  }
+
+  /**
+   * Returns the preferred <code>sl:TransformInfo</code> from the given list of
+   * <code>transformInfos</code>, or <code>null</code> if none of the given
+   * <code>transformInfos</code> is preferred over the others.
+   * 
+   * @param transformsInfos
+   *          a list of <code>sl:TransformInfo</code>s
+   * 
+   * @return the selected <code>sl:TransformInfo</code> or <code>null</code>, if
+   *         none is preferred over the others
+   */
+  private TransformsInfoType selectPreferredTransformsInfo(List<TransformsInfoType> transformsInfos) {
+    
+    Map<String, TransformsInfoType> mimeTypes = new HashMap<String, TransformsInfoType>();
+    
+    StringBuilder debugString = null;
+    if (log.isDebugEnabled()) {
+      debugString = new StringBuilder();
+      debugString.append("Got " + transformsInfos.size() + " TransformsInfo(s):");
+    }
+    
+    for (TransformsInfoType transformsInfoType : transformsInfos) {
+      MetaInfoType finalDataMetaInfo = transformsInfoType.getFinalDataMetaInfo();
+      String mimeType = finalDataMetaInfo.getMimeType();
+      String description = finalDataMetaInfo.getDescription();
+      mimeTypes.put(mimeType, transformsInfoType);
+      if (debugString != null) {
+        debugString.append("\n FinalDataMetaInfo: MIME-Type=");
+        debugString.append(mimeType);
+        if (description != null) {
+          debugString.append(" ");
+          debugString.append(description);
+        }
+      }
+    }
+
+    if (debugString != null) {
+      log.debug(debugString);
+    }
+
+    // look for preferred transform
+    for (String mimeType : DEFAULT_PREFFERED_MIME_TYPES) {
+      if (mimeTypes.containsKey(mimeType)) {
+        return mimeTypes.get(mimeType);
+      }
+    }
+    
+    // no preferred transform
+    return null;
+    
+  }
+
+  /**
+   * Create an instance of <code>ds:Transforms</code> from the given
+   * <code>sl:TransformsInfo</code>.
+   * 
+   * @param transformsInfo
+   *          the <code>sl:TransformsInfo</code>
+   * 
+   * @return a corresponding unmarshalled <code>ds:Transforms</code>, or
+   *         <code>null</code> if the given <code>sl:TransformsInfo</code> does
+   *         not contain a <code>dsig:Transforms</code> element
+   * 
+   * @throws SLRequestException
+   *           if the <code>ds:Transforms</code> in the given
+   *           <code>transformsInfo</code> are not valid or cannot be parsed.
+   * 
+   * @throws MarshalException
+   *           if the <code>ds:Transforms</code> in the given
+   *           <code>transformsInfo</code> cannot be unmarshalled.
+   */
+  private XSECTTransforms createTransforms(TransformsInfoType transformsInfo) throws SLRequestException, MarshalException {
+
+    byte[] transforms = getTransformsBytes((at.gv.egiz.slbinding.impl.TransformsInfoType) transformsInfo);
+
+    if (transforms != null && transforms.length > 0) {
+      // debug
+      if (log.isTraceEnabled()) {
+        StringBuilder sb = new StringBuilder();
+        sb.append("Trying to parse transforms:\n");
+        sb.append(new String(transforms, Charset.forName("UTF-8")));
+        log.trace(sb);
+      }
+
+      DOMImplementationLS domImplLS = DOMUtils.getDOMImplementationLS();
+      LSInput input = domImplLS.createLSInput();
+      input.setByteStream(new ByteArrayInputStream(transforms));
+
+      LSParser parser = domImplLS.createLSParser(
+          DOMImplementationLS.MODE_SYNCHRONOUS, null);
+      DOMConfiguration domConfig = parser.getDomConfig();
+      SimpleDOMErrorHandler errorHandler = new SimpleDOMErrorHandler();
+      domConfig.setParameter("error-handler", errorHandler);
+      domConfig.setParameter("validate", Boolean.FALSE);
+
+      Document document;
+      try {
+        document = parser.parse(input);
+      } catch (DOMException e) {
+        log.info("Failed to parse dsig:Transforms.", e);
+        throw new SLRequestException(3002);
+      } catch (LSException e) {
+        log.info("Failed to parse dsig:Transforms.", e);
+        throw new SLRequestException(3002);
+      }
+
+      // adopt ds:Transforms
+      Element transformsElt = document.getDocumentElement();
+      Node adoptedTransforms = ctx.getDocument().adoptNode(transformsElt);
+
+      DOMCryptoContext context = new DOMCryptoContext();
+
+      // unmarshall ds:Transforms
+      return new XSECTTransforms(context, adoptedTransforms);
+
+    } else {
+      return null;
+    }
+
+
+//    TransformsType transformsType = transformsInfo.getTransforms();
+//    if (transformsType == null) {
+//      return null;
+//    }
+//    List<TransformType> transformList = transformsType.getTransform();
+//
+//    DOMImplementationLS domImplLS = DOMUtils.getDOMImplementationLS();
+////    Document transformsDoc = ((DOMImplementation) domImplLS).createDocument("http://www.w3.org/2000/09/xmldsig#", "Transforms", null);
+////    Element transforms = transformsDoc.getDocumentElement();
+//    Document transformsDoc = DOMUtils.createDocument();
+//    Element transforms = transformsDoc.createElementNS(
+//            "http://www.w3.org/2000/09/xmldsig#",
+//            Signature.XMLDSIG_PREFIX + ":Transforms");
+//    transformsDoc.appendChild(transforms);
+//
+//    for (TransformType transformType : transformList) {
+//      log.trace("found " + transformType.getClass().getName());
+//      Element transform = transformsDoc.createElementNS(
+//              "http://www.w3.org/2000/09/xmldsig#",
+//              Signature.XMLDSIG_PREFIX + ":Transform");
+//      String algorithm = transformType.getAlgorithm();
+//      if (algorithm != null) {
+//        log.trace("found algorithm " + algorithm);
+//        transform.setAttribute("Algorithm", algorithm);
+//      }
+//
+//      at.gv.egiz.slbinding.impl.TransformType t = (at.gv.egiz.slbinding.impl.TransformType) transformType;
+//      byte[] redirectedBytes = t.getRedirectedStream().toByteArray();
+//      if (redirectedBytes != null && redirectedBytes.length > 0) {
+//        if (log.isTraceEnabled()) {
+//          StringBuilder sb = new StringBuilder();
+//          sb.append("Trying to parse dsig:Transform:\n");
+//          sb.append(new String(redirectedBytes, Charset.forName("UTF-8")));
+//          log.trace(sb);
+//        }
+//        LSInput input = domImplLS.createLSInput();
+//        input.setByteStream(new ByteArrayInputStream(redirectedBytes));
+//
+//        LSParser parser = domImplLS.createLSParser(
+//            DOMImplementationLS.MODE_SYNCHRONOUS, null);
+//        DOMConfiguration domConfig = parser.getDomConfig();
+//        SimpleDOMErrorHandler errorHandler = new SimpleDOMErrorHandler();
+//        domConfig.setParameter("error-handler", errorHandler);
+//        domConfig.setParameter("validate", Boolean.FALSE);
+//
+//        try {
+//          Document redirectedDoc = parser.parse(input);
+//          Node redirected = transformsDoc.adoptNode(redirectedDoc.getDocumentElement());
+//          transform.appendChild(redirected);
+//
+//          //not supported by Xerces2.9.1
+////          Node redirected = parser.parseWithContext(input, transform, LSParser.ACTION_APPEND_AS_CHILDREN);
+//
+//        } catch (DOMException e) {
+//          log.info("Failed to parse dsig:Transform.", e);
+//          throw new SLRequestException(3002);
+//        } catch (LSException e) {
+//          log.info("Failed to parse dsig:Transform.", e);
+//          throw new SLRequestException(3002);
+//        }
+//      }
+//      transforms.appendChild(transform);
+//    }
+//
+//    //adopt ds:Transforms
+//    Node adoptedTransforms = ctx.getDocument().adoptNode(transforms);
+//    DOMCryptoContext context = new DOMCryptoContext();
+//
+//    // unmarshall ds:Transforms
+//    return new XSECTTransforms(context, adoptedTransforms);
+
+  }
+  
+  /**
+   * Sets the <code>mimeType</code> and the <code>description</code> value
+   * for this DataObject.
+   * 
+   * @param metaInfoType the <code>sl:FinalMetaDataInfo</code>
+   * 
+   * @throws NullPointerException if <code>metaInfoType</code> is <code>null</code>
+   */
+  private void setFinalDataMetaInfo(MetaInfoType metaInfoType) {
+    
+    this.mimeType = metaInfoType.getMimeType();
+    this.description = metaInfoType.getDescription();
+    
+  }
+  
+  /**
+   * Selects an appropriate transformation path (if present) from the given list
+   * of <code>sl:TransformInfos</code>, sets the corresponding final data meta info and
+   * returns the corresponding unmarshalled <code>ds:Transforms</code>.
+   * 
+   * @param transformsInfos the <code>sl:TransformInfos</code>
+   * 
+   * @return the unmarshalled <code>ds:Transforms</code>, or <code>null</code> if
+   * no transformation path has been selected.
+   * 
+   * @throws SLRequestException if the given list <code>ds:TransformsInfo</code> contains
+   * an invalid <code>ds:Transforms</code> element, or no suitable transformation path
+   * can be found. 
+   */
+  private XSECTTransforms createTransformsAndSetFinalDataMetaInfo(
+      List<TransformsInfoType> transformsInfos) throws SLRequestException {
+
+    TransformsInfoType preferredTransformsInfo = selectPreferredTransformsInfo(transformsInfos);
+    // try preferred transform
+    if (preferredTransformsInfo != null) {
+
+      try {
+        XSECTTransforms transforms = createTransforms(preferredTransformsInfo);
+        setFinalDataMetaInfo(preferredTransformsInfo.getFinalDataMetaInfo());
+        return transforms;
+      } catch (MarshalException e) {
+      
+        String mimeType = preferredTransformsInfo.getFinalDataMetaInfo().getMimeType();
+        log.info("Failed to unmarshal preferred transformation path (MIME-Type="
+            + mimeType + ").", e);
+      
+      }
+
+    }
+
+    // look for another suitable transformation path
+    for (TransformsInfoType transformsInfoType : transformsInfos) {
+      
+      try {
+        XSECTTransforms transforms = createTransforms(transformsInfoType);
+        setFinalDataMetaInfo(transformsInfoType.getFinalDataMetaInfo());
+        return transforms;
+      } catch (MarshalException e) {
+
+        String mimeType = transformsInfoType.getFinalDataMetaInfo().getMimeType();
+        log.info("Failed to unmarshal transformation path (MIME-Type="
+            + mimeType + ").", e);
+      }
+      
+    }
+
+    // no suitable transformation path found
+    throw new SLRequestException(3003);
+    
+  }
+
+  /**
+   * Create an XMLObject with the Base64 encoding of the given
+   * <code>content</code>.
+   * 
+   * @param content
+   *          the to-be Base64 encoded content
+   * @return an XMLObject with the Base64 encoded <code>content</code>
+   */
+  private XMLObject createXMLObject(InputStream content) {
+    
+    Text textNode;
+    try {
+      textNode = at.gv.egiz.dom.DOMUtils.createBase64Text(content, ctx.getDocument());
+    } catch (IOException e) {
+      log.error(e);
+      throw new SLRuntimeException(e);
+    }
+
+    DOMStructure structure = new DOMStructure(textNode);
+    
+    String idValue = ctx.getIdValueFactory().createIdValue("Object");
+
+    return ctx.getSignatureFactory().newXMLObject(Collections.singletonList(structure), idValue, null, null);
+    
+  }
+  
+  /**
+   * Create an XMLObject with the given <code>content</code> node.
+   * 
+   * @param content the content node
+   * 
+   * @return an XMLObject with the given <code>content</code>
+   */
+  private XMLObject createXMLObject(Node content) {
+    
+    String idValue = ctx.getIdValueFactory().createIdValue("Object");
+    
+    List<DOMStructure> structures = Collections.singletonList(new DOMStructure(content));
+    
+    return ctx.getSignatureFactory().newXMLObject(structures, idValue, null, null);
+    
+  }
+
+  /**
+   * Sets the given <code>xmlObject</code> and creates and sets a corresponding
+   * <code>Reference</code>.
+   * <p>
+   * A transform to Base64-decode the xmlObject's content is inserted at the top
+   * of to the optional <code>transforms</code> if given, or to a newly created
+   * <code>Transforms</code> element if <code>transforms</code> is
+   * <code>null</code>.
+   * 
+   * @param xmlObject
+   *          the XMLObject
+   * @param transforms
+   *          an optional <code>Transforms</code> element (may be
+   *          <code>null</code>)
+   * 
+   * @throws SLCommandException
+   *           if creating the Reference fails
+   * @throws NullPointerException
+   *           if <code>xmlObject</code> is <code>null</code>
+   */
+  private void setXMLObjectAndReferenceBase64(XMLObject xmlObject, XSECTTransforms transforms) throws SLCommandException {
+    
+    // create reference URI
+    //
+    // NOTE: the ds:Object can be referenced directly, as the Base64 transform
+    // operates on the text() of the input nodelist.
+    //
+    String referenceURI = "#" + xmlObject.getId();
+  
+    // create Base64 Transform
+    Transform transform;
+    try {
+      transform = ctx.getSignatureFactory().newTransform(Transform.BASE64, (TransformParameterSpec) null);
+    } catch (NoSuchAlgorithmException e) {
+      // algorithm must be present
+      throw new SLRuntimeException(e);
+    } catch (InvalidAlgorithmParameterException e) {
+      // algorithm does not take parameters
+      throw new SLRuntimeException(e);
+    }
+    
+    if (transforms == null) {
+      transforms = new XSECTTransforms(Collections.singletonList(transform)); 
+    } else {
+      transforms.insertTransform(transform);
+    }
+  
+    DigestMethod dm;
+    try {
+      dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get DigestMethod.", e);
+      throw new SLCommandException(4006);
+    } catch (InvalidAlgorithmParameterException e) {
+      log.error("Failed to get DigestMethod.", e);
+      throw new SLCommandException(4006);
+    }
+    String id = ctx.getIdValueFactory().createIdValue("Reference");
+    
+    this.xmlObject = xmlObject;
+    this.reference = new XSECTReference(referenceURI, dm, transforms, null, id);
+    
+  }
+
+  /**
+   * Sets the given <code>xmlObject</code> and creates and sets a corresponding
+   * <code>Reference</code>.
+   * <p>
+   * A transform to select the xmlObject's content is inserted at the top of to
+   * the optional <code>transforms</code> if given, or to a newly created
+   * <code>Transforms</code> element if <code>transforms</code> is
+   * <code>null</code>.
+   * </p>
+   * 
+   * @param xmlObject
+   *          the XMLObject
+   * @param transforms
+   *          an optional <code>Transforms</code> element (may be
+   *          <code>null</code>)
+   * 
+   * @throws SLCommandException
+   *           if creating the Reference fails
+   * @throws NullPointerException
+   *           if <code>xmlObject</code> is <code>null</code>
+   */
+  private void setXMLObjectAndReferenceXML(XMLObject xmlObject, XSECTTransforms transforms) throws SLCommandException {
+    
+    // create reference URI
+    String referenceURI = "#" + xmlObject.getId();
+    
+    // create Transform to select ds:Object's children
+    Transform xpathTransform;
+    Transform c14nTransform;
+    try {
+
+      XPathType xpath = new XPathType("id(\"" + xmlObject.getId() + "\")/node()", XPathType.Filter.INTERSECT);
+      List<XPathType> xpaths = Collections.singletonList(xpath);
+      XPathFilter2ParameterSpec params = new XPathFilter2ParameterSpec(xpaths);
+
+      xpathTransform = ctx.getSignatureFactory().newTransform(Transform.XPATH2, params);
+
+      // add exclusive canonicalization to avoid signing the namespace context of the ds:Object
+      c14nTransform = ctx.getSignatureFactory().newTransform(CanonicalizationMethod.EXCLUSIVE, (TransformParameterSpec) null);
+      
+    } catch (NoSuchAlgorithmException e) {
+      // algorithm must be present
+      throw new SLRuntimeException(e);
+    } catch (InvalidAlgorithmParameterException e) {
+      // params must be appropriate
+      throw new SLRuntimeException(e);
+    }
+  
+    if (transforms == null) {
+      List<Transform> newTransfroms = new ArrayList<Transform>();
+      newTransfroms.add(xpathTransform);
+      newTransfroms.add(c14nTransform);
+      transforms = new XSECTTransforms(newTransfroms);
+    } else {
+      transforms.insertTransform(xpathTransform);
+    }
+    
+    DigestMethod dm;
+    try {
+      dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get DigestMethod.", e);
+      throw new SLCommandException(4006);
+    } catch (InvalidAlgorithmParameterException e) {
+      log.error("Failed to get DigestMethod.", e);
+      throw new SLCommandException(4006);
+    }
+    String id = ctx.getIdValueFactory().createIdValue("Reference");
+
+    this.xmlObject = xmlObject;
+    this.reference = new XSECTReference(referenceURI, dm, transforms, null, id);
+    
+  }
+
+  /**
+   * Parses the given <code>xmlContent</code> and returns a corresponding
+   * document fragment.
+   * 
+   * <p>
+   * The to-be parsed content is surrounded by <dummy> ... </dummy> elements to
+   * allow for mixed (e.g. Text and Element) content in XMLContent.
+   * </p>
+   * 
+   * @param xmlContent
+   *          the XMLContent to-be parsed
+   * 
+   * @return a document fragment containing the parsed nodes
+   * 
+   * @throws SLCommandException
+   *           if parsing the given <code>xmlContent</code> fails
+   * 
+   * @throws NullPointerException
+   *           if <code>xmlContent</code> is <code>null</code>
+   */
+  private DocumentFragment parseDataObject(XMLContentType xmlContent) throws SLCommandException {
+    
+    ByteArrayOutputStream redirectedStream =  xmlContent.getRedirectedStream();
+  
+    // Note: We can assume a fixed character encoding of UTF-8 for the
+    // content of the redirect stream as the content has already been parsed
+    // and serialized again to the redirect stream.
+    
+    List<InputStream> inputStreams = new ArrayList<InputStream>();
+    try {
+      // dummy start element
+      inputStreams.add(new ByteArrayInputStream("<dummy>".getBytes("UTF-8")));
+  
+      // content
+      inputStreams.add(new ByteArrayInputStream(redirectedStream.toByteArray()));
+      
+      // dummy end element
+      inputStreams.add(new ByteArrayInputStream("</dummy>".getBytes("UTF-8")));
+    } catch (UnsupportedEncodingException e) {
+      throw new SLRuntimeException(e);
+    }
+    
+    SequenceInputStream inputStream = new SequenceInputStream(Collections.enumeration(inputStreams));
+  
+    // parse DataObject
+    Document doc = parseDataObject(inputStream, "UTF-8");
+    
+    Element documentElement = doc.getDocumentElement();
+  
+    if (documentElement == null ||
+        !"dummy".equals(documentElement.getLocalName())) {
+      log.info("Failed to parse DataObject XMLContent.");
+      throw new SLCommandException(4111);
+    }
+    
+    DocumentFragment fragment = doc.createDocumentFragment();
+    while (documentElement.getFirstChild() != null) {
+      fragment.appendChild(documentElement.getFirstChild());
+    }
+    
+    // log parsed document
+    if (log.isTraceEnabled()) {
+      
+      StringWriter writer = new StringWriter();
+      
+      writer.write("DataObject:\n");
+      
+      LSOutput output = domImplLS.createLSOutput();
+      output.setCharacterStream(writer);
+      output.setEncoding("UTF-8");
+      LSSerializer serializer = domImplLS.createLSSerializer();
+      serializer.getDomConfig().setParameter("xml-declaration", Boolean.FALSE);
+      serializer.write(fragment, output);
+      
+      log.trace(writer.toString());
+    }
+    
+    return fragment;
+    
+  }
+
+  /**
+   * Parses the given <code>inputStream</code> using the given
+   * <code>encoding</code> and returns the parsed document.
+   * 
+   * @param inputStream
+   *          the to-be parsed input
+   * 
+   * @param encoding
+   *          the encoding to be used for parsing the given
+   *          <code>inputStream</code>
+   * 
+   * @return the parsed document
+   * 
+   * @throws SLCommandException
+   *           if parsing the <code>inputStream</code> fails.
+   * 
+   * @throws NullPointerException
+   *           if <code>inputStram</code> is <code>null</code>
+   */
+  private Document parseDataObject(InputStream inputStream, String encoding) throws SLCommandException {
+
+    LSInput input = domImplLS.createLSInput();
+    input.setByteStream(inputStream);
+
+    if (encoding != null) {
+      input.setEncoding(encoding);
+    }
+    
+    LSParser parser = domImplLS.createLSParser(DOMImplementationLS.MODE_SYNCHRONOUS, null);
+    DOMConfiguration domConfig = parser.getDomConfig();
+    SimpleDOMErrorHandler errorHandler = new SimpleDOMErrorHandler();
+    domConfig.setParameter("error-handler", errorHandler);
+    domConfig.setParameter("validate", Boolean.FALSE);
+
+    Document doc;
+    try {
+      doc = parser.parse(input);
+    } catch (DOMException e) {
+      log.info("Existing XML document cannot be parsed.", e);
+      throw new SLCommandException(4111);
+    } catch (LSException e) {
+      log.info("Existing XML document cannot be parsed. ", e);
+      throw new SLCommandException(4111);
+    }
+    
+    if (errorHandler.hasErrors()) {
+      // log errors
+      if (log.isInfoEnabled()) {
+        List<String> errorMessages = errorHandler.getErrorMessages();
+        StringBuffer sb = new StringBuffer();
+        for (String errorMessage : errorMessages) {
+          sb.append(" ");
+          sb.append(errorMessage);
+        }
+        log.info("Existing XML document cannot be parsed. " + sb.toString());
+      }
+      throw new SLCommandException(4111);
+    }
+
+    return doc;
+    
+  }
+
+
+}
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
index 8baa0137..9182e824 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
@@ -87,6 +87,8 @@ import at.gv.egiz.bku.utils.urldereferencer.StreamData;
 import at.gv.egiz.bku.utils.urldereferencer.URLDereferencer;
 import at.gv.egiz.bku.utils.urldereferencer.URLDereferencerContext;
 import at.gv.egiz.dom.DOMUtils;
+import at.gv.egiz.marshal.NamespacePrefix;
+import at.gv.egiz.marshal.NamespacePrefixMapperImpl;
 import at.gv.egiz.slbinding.impl.XMLContentType;
 import at.gv.egiz.stal.STAL;
 import at.gv.egiz.xades.QualifyingPropertiesException;
@@ -99,6 +101,7 @@ import at.gv.egiz.xades.QualifyingPropertiesFactory;
  * @author mcentner
  */
 public class Signature {
+  public static final String XMLDSIG_PREFIX = "dsig";
   
   /**
    * Logging facility.
@@ -407,7 +410,7 @@ public class Signature {
     
     signContext.setProperty("javax.xml.crypto.dsig.cacheReference", Boolean.TRUE);
     
-    signContext.putNamespacePrefix(XMLSignature.XMLNS, "dsig");
+    signContext.putNamespacePrefix(XMLSignature.XMLNS,XMLDSIG_PREFIX); 
     
     signContext.setURIDereferencer(new URIDereferncerAdapter(ctx.getDereferencerContext()));
     
diff --git a/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java b/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java
index 78172dcb..7ce7b42d 100644
--- a/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java
+++ b/bkucommon/src/test/java/at/gv/egiz/bku/slcommands/impl/xsect/SignatureTest.java
@@ -14,185 +14,186 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package at.gv.egiz.bku.slcommands.impl.xsect;
-
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-
-import iaik.xml.crypto.XSecProvider;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.PrivateKey;
-import java.security.UnrecoverableKeyException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.List;
-
+package at.gv.egiz.bku.slcommands.impl.xsect;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import iaik.xml.crypto.XSecProvider;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLSocketFactory;
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBElement;
-import javax.xml.bind.JAXBException;
-import javax.xml.bind.Unmarshaller;
-import javax.xml.crypto.MarshalException;
-import javax.xml.crypto.dsig.CanonicalizationMethod;
-import javax.xml.crypto.dsig.DigestMethod;
-import javax.xml.crypto.dsig.Reference;
-import javax.xml.crypto.dsig.SignatureMethod;
-import javax.xml.crypto.dsig.Transform;
-import javax.xml.crypto.dsig.XMLObject;
-import javax.xml.crypto.dsig.XMLSignatureException;
-import javax.xml.crypto.dsig.XMLSignatureFactory;
-import javax.xml.crypto.dsig.dom.DOMSignContext;
-import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
-import javax.xml.crypto.dsig.spec.DigestMethodParameterSpec;
-import javax.xml.crypto.dsig.spec.SignatureMethodParameterSpec;
-import javax.xml.stream.XMLEventReader;
-import javax.xml.stream.XMLInputFactory;
-import javax.xml.stream.XMLStreamException;
-
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.w3c.dom.Document;
-import org.w3c.dom.Node;
-import org.w3c.dom.ls.DOMImplementationLS;
-import org.w3c.dom.ls.LSOutput;
-import org.w3c.dom.ls.LSSerializer;
-
-import at.buergerkarte.namespaces.securitylayer._1.CreateXMLSignatureRequestType;
-import at.buergerkarte.namespaces.securitylayer._1.DataObjectInfoType;
-import at.buergerkarte.namespaces.securitylayer._1.ObjectFactory;
-import at.buergerkarte.namespaces.securitylayer._1.SignatureInfoCreationType;
-import at.gv.egiz.bku.slexceptions.SLCommandException;
-import at.gv.egiz.bku.slexceptions.SLRequestException;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBElement;
+import javax.xml.bind.JAXBException;
+import javax.xml.bind.Unmarshaller;
+import javax.xml.crypto.MarshalException;
+import javax.xml.crypto.dsig.CanonicalizationMethod;
+import javax.xml.crypto.dsig.DigestMethod;
+import javax.xml.crypto.dsig.Reference;
+import javax.xml.crypto.dsig.SignatureMethod;
+import javax.xml.crypto.dsig.Transform;
+import javax.xml.crypto.dsig.XMLObject;
+import javax.xml.crypto.dsig.XMLSignatureException;
+import javax.xml.crypto.dsig.XMLSignatureFactory;
+import javax.xml.crypto.dsig.dom.DOMSignContext;
+import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
+import javax.xml.crypto.dsig.spec.DigestMethodParameterSpec;
+import javax.xml.crypto.dsig.spec.SignatureMethodParameterSpec;
+import javax.xml.stream.XMLEventReader;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamException;
+
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.w3c.dom.ls.DOMImplementationLS;
+import org.w3c.dom.ls.LSOutput;
+import org.w3c.dom.ls.LSSerializer;
+
+import at.buergerkarte.namespaces.securitylayer._1.CreateXMLSignatureRequestType;
+import at.buergerkarte.namespaces.securitylayer._1.DataObjectInfoType;
+import at.buergerkarte.namespaces.securitylayer._1.ObjectFactory;
+import at.buergerkarte.namespaces.securitylayer._1.SignatureInfoCreationType;
+import at.gv.egiz.bku.slexceptions.SLCommandException;
+import at.gv.egiz.bku.slexceptions.SLRequestException;
 import at.gv.egiz.bku.slexceptions.SLViewerException;
-import at.gv.egiz.bku.utils.urldereferencer.StreamData;
-import at.gv.egiz.bku.utils.urldereferencer.URLDereferencer;
-import at.gv.egiz.bku.utils.urldereferencer.URLDereferencerContext;
-import at.gv.egiz.bku.utils.urldereferencer.URLProtocolHandler;
-import at.gv.egiz.dom.DOMUtils;
-import at.gv.egiz.slbinding.RedirectEventFilter;
-import at.gv.egiz.slbinding.RedirectUnmarshallerListener;
-
-public class SignatureTest {
-
-  private class AlgorithmMethodFactoryImpl implements AlgorithmMethodFactory {
-  
-    @Override
-    public CanonicalizationMethod createCanonicalizationMethod(
-        SignatureContext signatureContext) {
-      
-      XMLSignatureFactory signatureFactory = signatureContext.getSignatureFactory();
-      
-      try {
-        return signatureFactory.newCanonicalizationMethod(CanonicalizationMethod.EXCLUSIVE, (C14NMethodParameterSpec) null);
-      } catch (Exception e) {
-        throw new RuntimeException(e);
-      } 
-    }
-  
-    @Override
-    public DigestMethod createDigestMethod(SignatureContext signatureContext) {
-  
-      XMLSignatureFactory signatureFactory = signatureContext.getSignatureFactory();
-  
-      try {
-        return signatureFactory.newDigestMethod(DigestMethod.SHA1, (DigestMethodParameterSpec) null);
-      } catch (Exception e) {
-        throw new RuntimeException(e);
-      } 
-    }
-  
-    @Override
-    public SignatureMethod createSignatureMethod(
-        SignatureContext signatureContext) {
-  
-      XMLSignatureFactory signatureFactory = signatureContext.getSignatureFactory();
-  
-      try {
-        return signatureFactory.newSignatureMethod(SignatureMethod.RSA_SHA1, (SignatureMethodParameterSpec) null);
-      } catch (Exception e) {
-        throw new RuntimeException(e);
-      } 
-  
-    }
-    
-  }
-
-  private static final String RESOURCE_PREFIX = "at/gv/egiz/bku/slcommands/impl/";
-  
-  private static Unmarshaller unmarshaller;
-  
-  private static PrivateKey privateKey;
-
-  private static X509Certificate certificate;
-  
-  @BeforeClass
-  public static void setUpClass() throws JAXBException, NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException, UnrecoverableKeyException {
-    
-    XSecProvider.addAsProvider(true);
-    
-    String packageName = ObjectFactory.class.getPackage().getName();
-    packageName += ":"
-        + org.w3._2000._09.xmldsig_.ObjectFactory.class.getPackage().getName();
-    JAXBContext jaxbContext = JAXBContext.newInstance(packageName);
-
-    unmarshaller = jaxbContext.createUnmarshaller();
-    
-    initURLDereferencer();
-    
-    ClassLoader classLoader = SignatureTest.class.getClassLoader();
-    InputStream certStream = classLoader.getResourceAsStream(RESOURCE_PREFIX + "Cert.p12");
-    assertNotNull("Certificate not found.", certStream);
-        
-    char[] passwd = "1622".toCharArray();
-    
-    KeyStore keystore = KeyStore.getInstance("PKCS12");
-    keystore.load(certStream, passwd);
-    String firstAlias = keystore.aliases().nextElement();
-    certificate = (X509Certificate) keystore.getCertificate(firstAlias);
-    privateKey = (PrivateKey) keystore.getKey(firstAlias, passwd);
-    
-  }
-
-  private static void initURLDereferencer() {
-    
-    URLDereferencer.getInstance().registerHandler("testlocal", new URLProtocolHandler() {
-      
-      @Override
-      public StreamData dereference(String url, URLDereferencerContext context)
-          throws IOException {
-
-        ClassLoader classLoader = SignatureTest.class.getClassLoader();
-        
-        String filename = url.split(":", 2)[1];
-
-        InputStream stream = classLoader.getResourceAsStream(RESOURCE_PREFIX + filename);
-        
-        if (stream == null) {
-
-          throw new IOException("Failed to resolve resource '" + url + "'.");
-
-        } else {
-
-          String contentType;
-          if (filename.endsWith(".xml")) {
-            contentType = "text/xml";
-          } else if (filename.endsWith(".txt")) {
-            contentType = "text/plain";
-          } else {
-            contentType = "";
-          }
-          
-          return new StreamData(url, contentType, stream);
-          
-        }
-        
+import at.gv.egiz.bku.utils.urldereferencer.StreamData;
+import at.gv.egiz.bku.utils.urldereferencer.URLDereferencer;
+import at.gv.egiz.bku.utils.urldereferencer.URLDereferencerContext;
+import at.gv.egiz.bku.utils.urldereferencer.URLProtocolHandler;
+import at.gv.egiz.dom.DOMUtils;
+import at.gv.egiz.slbinding.RedirectEventFilter;
+import at.gv.egiz.slbinding.RedirectUnmarshallerListener;
+import org.junit.Ignore;
+
+public class SignatureTest {
+
+  private class AlgorithmMethodFactoryImpl implements AlgorithmMethodFactory {
+  
+    @Override
+    public CanonicalizationMethod createCanonicalizationMethod(
+        SignatureContext signatureContext) {
+      
+      XMLSignatureFactory signatureFactory = signatureContext.getSignatureFactory();
+      
+      try {
+        return signatureFactory.newCanonicalizationMethod(CanonicalizationMethod.EXCLUSIVE, (C14NMethodParameterSpec) null);
+      } catch (Exception e) {
+        throw new RuntimeException(e);
+      } 
+    }
+  
+    @Override
+    public DigestMethod createDigestMethod(SignatureContext signatureContext) {
+  
+      XMLSignatureFactory signatureFactory = signatureContext.getSignatureFactory();
+  
+      try {
+        return signatureFactory.newDigestMethod(DigestMethod.SHA1, (DigestMethodParameterSpec) null);
+      } catch (Exception e) {
+        throw new RuntimeException(e);
+      } 
+    }
+  
+    @Override
+    public SignatureMethod createSignatureMethod(
+        SignatureContext signatureContext) {
+  
+      XMLSignatureFactory signatureFactory = signatureContext.getSignatureFactory();
+  
+      try {
+        return signatureFactory.newSignatureMethod(SignatureMethod.RSA_SHA1, (SignatureMethodParameterSpec) null);
+      } catch (Exception e) {
+        throw new RuntimeException(e);
+      } 
+  
+    }
+    
+  }
+
+  private static final String RESOURCE_PREFIX = "at/gv/egiz/bku/slcommands/impl/";
+  
+  private static Unmarshaller unmarshaller;
+  
+  private static PrivateKey privateKey;
+
+  private static X509Certificate certificate;
+  
+  @BeforeClass
+  public static void setUpClass() throws JAXBException, NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException, UnrecoverableKeyException {
+    
+    XSecProvider.addAsProvider(true);
+    
+    String packageName = ObjectFactory.class.getPackage().getName();
+    packageName += ":"
+        + org.w3._2000._09.xmldsig_.ObjectFactory.class.getPackage().getName();
+    JAXBContext jaxbContext = JAXBContext.newInstance(packageName);
+
+    unmarshaller = jaxbContext.createUnmarshaller();
+    
+    initURLDereferencer();
+    
+    ClassLoader classLoader = SignatureTest.class.getClassLoader();
+    InputStream certStream = classLoader.getResourceAsStream(RESOURCE_PREFIX + "Cert.p12");
+    assertNotNull("Certificate not found.", certStream);
+        
+    char[] passwd = "1622".toCharArray();
+    
+    KeyStore keystore = KeyStore.getInstance("PKCS12");
+    keystore.load(certStream, passwd);
+    String firstAlias = keystore.aliases().nextElement();
+    certificate = (X509Certificate) keystore.getCertificate(firstAlias);
+    privateKey = (PrivateKey) keystore.getKey(firstAlias, passwd);
+    
+  }
+
+  private static void initURLDereferencer() {
+    
+    URLDereferencer.getInstance().registerHandler("testlocal", new URLProtocolHandler() {
+      
+      @Override
+      public StreamData dereference(String url, URLDereferencerContext context)
+          throws IOException {
+
+        ClassLoader classLoader = SignatureTest.class.getClassLoader();
+        
+        String filename = url.split(":", 2)[1];
+
+        InputStream stream = classLoader.getResourceAsStream(RESOURCE_PREFIX + filename);
+        
+        if (stream == null) {
+
+          throw new IOException("Failed to resolve resource '" + url + "'.");
+
+        } else {
+
+          String contentType;
+          if (filename.endsWith(".xml")) {
+            contentType = "text/xml";
+          } else if (filename.endsWith(".txt")) {
+            contentType = "text/plain";
+          } else {
+            contentType = "";
+          }
+          
+          return new StreamData(url, contentType, stream);
+          
+        }
+        
       }
 
       @Override
@@ -205,558 +206,600 @@ public class SignatureTest {
       public void setSSLSocketFactory(SSLSocketFactory socketFactory) {
         // TODO Auto-generated method stub
         
-      }
-      
-    });
-    
-  }
-  
-  private Object unmarshal(String file) throws XMLStreamException, JAXBException {
-
-    ClassLoader classLoader = SignatureTest.class.getClassLoader();
-    InputStream resourceStream = classLoader.getResourceAsStream(RESOURCE_PREFIX + file);
-    assertNotNull(resourceStream);
-
-    XMLInputFactory inputFactory = XMLInputFactory.newInstance();
-    XMLEventReader eventReader = inputFactory.createXMLEventReader(resourceStream);
-    RedirectEventFilter redirectEventFilter = new RedirectEventFilter();
-    XMLEventReader filteredReader = inputFactory.createFilteredReader(eventReader, redirectEventFilter);
-
-    unmarshaller.setListener(new RedirectUnmarshallerListener(redirectEventFilter));
-
-    return unmarshaller.unmarshal(filteredReader);
-    
-  }
-  
-  //
-  //
-  // SignatureInfo
-  //
-  //
-  
-  @SuppressWarnings("unchecked")
-  private SignatureInfoCreationType unmarshalSignatureInfo(String file) throws JAXBException, XMLStreamException {
-
-    Object object = unmarshal(file);
-
-    Object requestType = ((JAXBElement) object).getValue();
-    
-    assertTrue(requestType instanceof CreateXMLSignatureRequestType);
-    
-    SignatureInfoCreationType signatureInfo = ((CreateXMLSignatureRequestType) requestType).getSignatureInfo(); 
-    
-    assertNotNull(signatureInfo);
-    
-    return signatureInfo;
-    
-  }
-
-  @Test
-  public void testSetSignatureInfo_Base64_1() throws JAXBException, SLCommandException, XMLStreamException {
-
-    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
-    
-    signature.setSignatureInfo(signatureInfo);
-    
-    Node parent = signature.getParent();
-    Node nextSibling = signature.getNextSibling();
-
-    assertNotNull(parent);
-    assertTrue("urn:document".equals(parent.getNamespaceURI()));
-    assertTrue("XMLDocument".equals(parent.getLocalName()));
-    
-    assertNotNull(nextSibling);
-    assertTrue("urn:document".equals(nextSibling.getNamespaceURI()));
-    assertTrue("Paragraph".equals(nextSibling.getLocalName()));
-    
-  }
-
-  @Test
-  public void testSetSignature_Base64_2() throws JAXBException, SLCommandException, XMLStreamException {
-
-    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_2.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
-    
-    signature.setSignatureInfo(signatureInfo);
-    
-    Node parent = signature.getParent();
-    Node nextSibling = signature.getNextSibling();
-
-    assertNotNull(parent);
-    assertTrue("XMLDocument".equals(parent.getLocalName()));
-    
-    assertNotNull(nextSibling);
-    assertTrue("Paragraph".equals(nextSibling.getLocalName()));
-    
-  }
-
-  @Test
-  public void testSetSignature_Base64_3() throws JAXBException, SLCommandException, XMLStreamException {
-
-    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_3.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
-    
-    signature.setSignatureInfo(signatureInfo);
-    
-    Node parent = signature.getParent();
-    Node nextSibling = signature.getNextSibling();
-
-    assertNotNull(parent);
-    assertTrue("XMLDocument".equals(parent.getLocalName()));
-    
-    assertNotNull(nextSibling);
-    assertTrue("Paragraph".equals(nextSibling.getLocalName()));
-    
-  }
-
-  @Test
-  public void testSetSignatureInfo_XMLContent_1() throws JAXBException, SLCommandException, XMLStreamException {
-
-    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_XMLContent_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
-    
-    signature.setSignatureInfo(signatureInfo);
-    
-    Node parent = signature.getParent();
-    Node nextSibling = signature.getNextSibling();
-    
-    assertNotNull(parent);
-    assertTrue("urn:document".equals(parent.getNamespaceURI()));
-    assertTrue("Whole".equals(parent.getLocalName()));
-    
-    assertNull(nextSibling);
-    
-  }
-
-  @Test
-  public void testSetSignature_Reference_1() throws JAXBException, SLCommandException, XMLStreamException {
-
-    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Reference_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
-    
-    signature.setSignatureInfo(signatureInfo);
-    
-    Node parent = signature.getParent();
-    Node nextSibling = signature.getNextSibling();
-    
-    assertNotNull(parent);
-    assertTrue("urn:document".equals(parent.getNamespaceURI()));
-    assertTrue("Paragraph".equals(parent.getLocalName()));
-    
-    assertNull(nextSibling);
-    
-  }
-
-  //
-  //
-  // DataObject
-  //
-  //
-
-  @SuppressWarnings("unchecked")
-  private List<DataObjectInfoType> unmarshalDataObjectInfo(String file) throws JAXBException, XMLStreamException {
-
-    Object object = unmarshal(file);
-
-    Object requestType = ((JAXBElement) object).getValue();
-    
-    assertTrue(requestType instanceof CreateXMLSignatureRequestType);
-    
-    List<DataObjectInfoType> dataObjectInfos = ((CreateXMLSignatureRequestType) requestType).getDataObjectInfo();
-    
-    assertNotNull(dataObjectInfos);
-    
-    return dataObjectInfos;
-    
-  }
-
-  private void signAndMarshalSignature(Signature signature) throws MarshalException, XMLSignatureException, SLCommandException, SLViewerException {
-
-    Node parent = signature.getParent();
-    Node nextSibling = signature.getNextSibling();
-    
-    DOMSignContext signContext = (nextSibling == null) 
-      ? new DOMSignContext(privateKey, parent)
-      : new DOMSignContext(privateKey, parent, nextSibling);
-      
-    signature.sign(signContext);
-    
-    Document document = signature.getDocument();
-    
-    DOMImplementationLS domImplLS = DOMUtils.getDOMImplementationLS();
-    LSOutput output = domImplLS.createLSOutput();
-    output.setByteStream(System.out);
-    
-    LSSerializer serializer = domImplLS.createLSSerializer();
-//    serializer.getDomConfig().setParameter("format-pretty-print", Boolean.TRUE);
-    serializer.getDomConfig().setParameter("namespaces", Boolean.FALSE);
-    serializer.write(document, output);
-    
-  }
-
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_Base64Content_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Base64Content_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.setSignerCeritifcate(certificate);
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-    
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 1);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.BASE64.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
-    
-    XMLObject object = objects.get(0);
-    
-    assertTrue(("#" + object.getId()).equals(reference.getURI()));
-    
-  }
-
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_XMLContent_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_XMLContent_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.setSignerCeritifcate(certificate);
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 2);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.XPATH2.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
-    
-    XMLObject object = objects.get(0);
-    
-    assertTrue(("#" + object.getId()).equals(reference.getURI()));
-    
-  }
-
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_XMLContent_2() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_XMLContent_2.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.setSignerCeritifcate(certificate);
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 2);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.XPATH2.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
-    
-    XMLObject object = objects.get(0);
-    
-    assertTrue(("#" + object.getId()).equals(reference.getURI()));
-    
-  }
-
-  
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_LocRefContent_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_LocRefContent_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 2);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.XPATH2.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
-    
-    XMLObject object = objects.get(0);
-    
-    assertTrue(("#" + object.getId()).equals(reference.getURI()));
-    
-  }
-
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_LocRefContent_2() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_LocRefContent_2.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-    
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 1);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.BASE64.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
-    
-    XMLObject object = objects.get(0);
-    
-    assertTrue(("#" + object.getId()).equals(reference.getURI()));
-    
-  }
-
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_Reference_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Reference_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-    
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 1);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.BASE64.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
-    
-    XMLObject object = objects.get(0);
-    
-    assertTrue(("#" + object.getId()).equals(reference.getURI()));
-    
-  }
-
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_Detached_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Detached_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-    
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 0);
-    
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue(objects.size() == 1);
-    
-  }
-  
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testDataObject_Detached_Base64Content() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Detached_Base64Content.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-    
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue(transforms.size() == 0);
-    
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue(objects.size() == 1);
-    
-  }
-  
-  //
-  //
-  // TransformsInfo
-  //
-  //
-  
-  @SuppressWarnings("unchecked")
-  private CreateXMLSignatureRequestType unmarshalCreateXMLSignatureRequest(String file) throws JAXBException, XMLStreamException {
-
-    Object object = unmarshal(file);
-
-    Object requestType = ((JAXBElement) object).getValue();
-    
-    assertTrue(requestType instanceof CreateXMLSignatureRequestType);
-    
-    return (CreateXMLSignatureRequestType) requestType;
-    
-  }
-
-  
-  @SuppressWarnings("unchecked")
-  @Test
-  public void testTransformsInfo_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
-
-    CreateXMLSignatureRequestType requestType = unmarshalCreateXMLSignatureRequest("TransformsInfo_1.xml");
-    
-    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
-
-
-    signature.setSignatureInfo(requestType.getSignatureInfo());
-    
-    List<DataObjectInfoType> dataObjectInfos = requestType.getDataObjectInfo();
-    
-    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
-      signature.addDataObject(dataObjectInfo);
-    }
-    
-    signature.setSignerCeritifcate(certificate);
-    
-    signature.buildXMLSignature();
-    
-    signAndMarshalSignature(signature);
-    
-    List<Reference> references = signature.getReferences();
-    assertTrue(references.size() == 2);
-
-    Reference reference = references.get(0);
-    assertNotNull(reference.getId());
-    
-    List<Transform> transforms = reference.getTransforms();
-    assertTrue("Size " + transforms.size() + "", transforms.size() == 3);
-    
-    Transform transform = transforms.get(0);
-    assertTrue(Transform.ENVELOPED.equals(transform.getAlgorithm()));
-  
-    List<XMLObject> objects = signature.getXMLObjects();
-    assertNotNull(objects);
-    assertTrue("Size " + objects.size() + " but should be 1.", objects.size() == 1);
-    
-  }
-
-  
-}
+      }
+      
+    });
+    
+  }
+  
+  private Object unmarshal(String file) throws XMLStreamException, JAXBException {
+
+    ClassLoader classLoader = SignatureTest.class.getClassLoader();
+    InputStream resourceStream = classLoader.getResourceAsStream(RESOURCE_PREFIX + file);
+    assertNotNull(resourceStream);
+
+    XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+    XMLEventReader eventReader = inputFactory.createXMLEventReader(resourceStream);
+    RedirectEventFilter redirectEventFilter = new RedirectEventFilter();
+    XMLEventReader filteredReader = inputFactory.createFilteredReader(eventReader, redirectEventFilter);
+
+    unmarshaller.setListener(new RedirectUnmarshallerListener(redirectEventFilter));
+
+    return unmarshaller.unmarshal(filteredReader);
+    
+  }
+  
+  //
+  //
+  // SignatureInfo
+  //
+  //
+  
+  @SuppressWarnings("unchecked")
+  private SignatureInfoCreationType unmarshalSignatureInfo(String file) throws JAXBException, XMLStreamException {
+
+    Object object = unmarshal(file);
+
+    Object requestType = ((JAXBElement) object).getValue();
+    
+    assertTrue(requestType instanceof CreateXMLSignatureRequestType);
+    
+    SignatureInfoCreationType signatureInfo = ((CreateXMLSignatureRequestType) requestType).getSignatureInfo(); 
+    
+    assertNotNull(signatureInfo);
+    
+    return signatureInfo;
+    
+  }
+
+  @Test
+  public void testSetSignatureInfo_Base64_1() throws JAXBException, SLCommandException, XMLStreamException {
+
+    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
+    
+    signature.setSignatureInfo(signatureInfo);
+    
+    Node parent = signature.getParent();
+    Node nextSibling = signature.getNextSibling();
+
+    assertNotNull(parent);
+    assertTrue("urn:document".equals(parent.getNamespaceURI()));
+    assertTrue("XMLDocument".equals(parent.getLocalName()));
+    
+    assertNotNull(nextSibling);
+    assertTrue("urn:document".equals(nextSibling.getNamespaceURI()));
+    assertTrue("Paragraph".equals(nextSibling.getLocalName()));
+    
+  }
+
+  @Test
+  public void testSetSignature_Base64_2() throws JAXBException, SLCommandException, XMLStreamException {
+
+    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_2.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
+    
+    signature.setSignatureInfo(signatureInfo);
+    
+    Node parent = signature.getParent();
+    Node nextSibling = signature.getNextSibling();
+
+    assertNotNull(parent);
+    assertTrue("XMLDocument".equals(parent.getLocalName()));
+    
+    assertNotNull(nextSibling);
+    assertTrue("Paragraph".equals(nextSibling.getLocalName()));
+    
+  }
+
+  @Test
+  public void testSetSignature_Base64_3() throws JAXBException, SLCommandException, XMLStreamException {
+
+    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Base64_3.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
+    
+    signature.setSignatureInfo(signatureInfo);
+    
+    Node parent = signature.getParent();
+    Node nextSibling = signature.getNextSibling();
+
+    assertNotNull(parent);
+    assertTrue("XMLDocument".equals(parent.getLocalName()));
+    
+    assertNotNull(nextSibling);
+    assertTrue("Paragraph".equals(nextSibling.getLocalName()));
+    
+  }
+
+  @Test
+  public void testSetSignatureInfo_XMLContent_1() throws JAXBException, SLCommandException, XMLStreamException {
+
+    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_XMLContent_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
+    
+    signature.setSignatureInfo(signatureInfo);
+    
+    Node parent = signature.getParent();
+    Node nextSibling = signature.getNextSibling();
+    
+    assertNotNull(parent);
+    assertTrue("urn:document".equals(parent.getNamespaceURI()));
+    assertTrue("Whole".equals(parent.getLocalName()));
+    
+    assertNull(nextSibling);
+    
+  }
+
+  @Test
+  public void testSetSignature_Reference_1() throws JAXBException, SLCommandException, XMLStreamException {
+
+    SignatureInfoCreationType signatureInfo = unmarshalSignatureInfo("SignatureInfo_Reference_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), null);
+    
+    signature.setSignatureInfo(signatureInfo);
+    
+    Node parent = signature.getParent();
+    Node nextSibling = signature.getNextSibling();
+    
+    assertNotNull(parent);
+    assertTrue("urn:document".equals(parent.getNamespaceURI()));
+    assertTrue("Paragraph".equals(parent.getLocalName()));
+    
+    assertNull(nextSibling);
+    
+  }
+
+  //
+  //
+  // DataObject
+  //
+  //
+
+  @SuppressWarnings("unchecked")
+  private List<DataObjectInfoType> unmarshalDataObjectInfo(String file) throws JAXBException, XMLStreamException {
+
+    Object object = unmarshal(file);
+
+    Object requestType = ((JAXBElement) object).getValue();
+    
+    assertTrue(requestType instanceof CreateXMLSignatureRequestType);
+    
+    List<DataObjectInfoType> dataObjectInfos = ((CreateXMLSignatureRequestType) requestType).getDataObjectInfo();
+    
+    assertNotNull(dataObjectInfos);
+    
+    return dataObjectInfos;
+    
+  }
+
+  private void signAndMarshalSignature(Signature signature) throws MarshalException, XMLSignatureException, SLCommandException, SLViewerException {
+
+    Node parent = signature.getParent();
+    Node nextSibling = signature.getNextSibling();
+    
+    DOMSignContext signContext = (nextSibling == null) 
+      ? new DOMSignContext(privateKey, parent)
+      : new DOMSignContext(privateKey, parent, nextSibling);
+      
+    signature.sign(signContext);
+    
+    Document document = signature.getDocument();
+    
+    DOMImplementationLS domImplLS = DOMUtils.getDOMImplementationLS();
+    LSOutput output = domImplLS.createLSOutput();
+    output.setByteStream(System.out);
+    
+    LSSerializer serializer = domImplLS.createLSSerializer();
+//    serializer.getDomConfig().setParameter("format-pretty-print", Boolean.TRUE);
+    serializer.getDomConfig().setParameter("namespaces", Boolean.FALSE);
+    serializer.write(document, output);
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_Base64Content_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Base64Content_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.setSignerCeritifcate(certificate);
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+    
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 1);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.BASE64.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
+    
+    XMLObject object = objects.get(0);
+    
+    assertTrue(("#" + object.getId()).equals(reference.getURI()));
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_XMLContent_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_XMLContent_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.setSignerCeritifcate(certificate);
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 2);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.XPATH2.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
+    
+    XMLObject object = objects.get(0);
+    
+    assertTrue(("#" + object.getId()).equals(reference.getURI()));
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_XMLContent_2() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_XMLContent_2.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.setSignerCeritifcate(certificate);
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 2);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.XPATH2.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
+    
+    XMLObject object = objects.get(0);
+    
+    assertTrue(("#" + object.getId()).equals(reference.getURI()));
+    
+  }
+
+  
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_LocRefContent_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_LocRefContent_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 2);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.XPATH2.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
+    
+    XMLObject object = objects.get(0);
+    
+    assertTrue(("#" + object.getId()).equals(reference.getURI()));
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_LocRefContent_2() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_LocRefContent_2.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+    
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 1);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.BASE64.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
+    
+    XMLObject object = objects.get(0);
+    
+    assertTrue(("#" + object.getId()).equals(reference.getURI()));
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_Reference_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Reference_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+    
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 1);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.BASE64.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 2.", objects.size() == 2);
+    
+    XMLObject object = objects.get(0);
+    
+    assertTrue(("#" + object.getId()).equals(reference.getURI()));
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_Detached_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Detached_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+    
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 0);
+    
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue(objects.size() == 1);
+    
+  }
+  
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testDataObject_Detached_Base64Content() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    List<DataObjectInfoType> dataObjectInfos = unmarshalDataObjectInfo("DataObjectInfo_Detached_Base64Content.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+    
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue(transforms.size() == 0);
+    
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue(objects.size() == 1);
+    
+  }
+  
+  //
+  //
+  // TransformsInfo
+  //
+  //
+  
+  @SuppressWarnings("unchecked")
+  private CreateXMLSignatureRequestType unmarshalCreateXMLSignatureRequest(String file) throws JAXBException, XMLStreamException {
+
+    Object object = unmarshal(file);
+
+    Object requestType = ((JAXBElement) object).getValue();
+    
+    assertTrue(requestType instanceof CreateXMLSignatureRequestType);
+    
+    return (CreateXMLSignatureRequestType) requestType;
+    
+  }
+
+  
+  @SuppressWarnings("unchecked")
+  @Test
+  public void testTransformsInfo_1() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    CreateXMLSignatureRequestType requestType = unmarshalCreateXMLSignatureRequest("TransformsInfo_1.xml");
+    
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+
+
+    signature.setSignatureInfo(requestType.getSignatureInfo());
+    
+    List<DataObjectInfoType> dataObjectInfos = requestType.getDataObjectInfo();
+    
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+    
+    signature.setSignerCeritifcate(certificate);
+    
+    signature.buildXMLSignature();
+    
+    signAndMarshalSignature(signature);
+    
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+    
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue("Size " + transforms.size() + "", transforms.size() == 3);
+    
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.ENVELOPED.equals(transform.getAlgorithm()));
+  
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 1.", objects.size() == 1);
+    
+  }
+
+  @SuppressWarnings("unchecked")
+  @Test
+  @Ignore
+  public void testTransformsInfo_2() throws JAXBException, SLCommandException, XMLStreamException, SLRequestException, MarshalException, XMLSignatureException, SLViewerException {
+
+    CreateXMLSignatureRequestType requestType = unmarshalCreateXMLSignatureRequest("TransformsInfo_2.xml");
+
+    Signature signature = new Signature(null, new IdValueFactoryImpl(), new AlgorithmMethodFactoryImpl());
+
+
+    signature.setSignatureInfo(requestType.getSignatureInfo());
+
+    List<DataObjectInfoType> dataObjectInfos = requestType.getDataObjectInfo();
+
+    for (DataObjectInfoType dataObjectInfo : dataObjectInfos) {
+      signature.addDataObject(dataObjectInfo);
+    }
+
+    signature.setSignerCeritifcate(certificate);
+
+    signature.buildXMLSignature();
+
+    signAndMarshalSignature(signature);
+
+    List<Reference> references = signature.getReferences();
+    assertTrue(references.size() == 2);
+
+    Reference reference = references.get(0);
+    assertNotNull(reference.getId());
+
+    List<Transform> transforms = reference.getTransforms();
+    assertTrue("Size " + transforms.size() + "", transforms.size() == 2);
+
+    Transform transform = transforms.get(0);
+    assertTrue(Transform.XSLT.equals(transform.getAlgorithm()));
+
+    List<XMLObject> objects = signature.getXMLObjects();
+    assertNotNull(objects);
+    assertTrue("Size " + objects.size() + " but should be 1.", objects.size() == 1);
+
+  }
+
+  
+}
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/TransformsInfo_2.xml b/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/TransformsInfo_2.xml
new file mode 100644
index 00000000..f43dc61a
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/slcommands/impl/TransformsInfo_2.xml
@@ -0,0 +1,397 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<sl:CreateXMLSignatureRequest xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:sl="http://www.buergerkarte.at/namespaces/securitylayer/1.2#">
+	<sl:KeyboxIdentifier>SecureSignatureKeypair</sl:KeyboxIdentifier>
+	<sl:DataObjectInfo Structure="detached">
+		<sl:DataObject Reference=""/>
+		<sl:TransformsInfo>
+			<dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
+				<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+				<dsig:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
+					<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+						xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
+						xmlns:pr="http://reference.e-government.gv.at/namespace/persondata/20020228#">
+						<xsl:template match="/" xmlns="http://www.w3.org/1999/xhtml">
+							<html>
+								<head>
+									<title>Signatur der Anmeldedaten</title>
+									<style type="text/css" media="screen">
+							.boldstyle { font-weight: bold; }
+							.italicstyle { font-style: italic; }
+							.annotationstyle { font-size: 0.8em; }
+							</style>
+								</head>
+								<body>
+									<h1>Signatur der Anmeldedaten</h1>
+									<p/>
+									<h4>Mit meiner elektronischen Signatur beantrage ich, <span
+											class="boldstyle">
+											<xsl:value-of select="//@Issuer"/>
+										</span>, geboren am <xsl:value-of
+											select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,9,2)"
+										/>. <xsl:value-of
+											select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,6,2)"
+										/>. <xsl:value-of
+											select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,1,4)"
+										/>, <xsl:if
+											test="//saml:Attribute[@AttributeName='OIDTextualDescription']"
+											> in der Rolle als <xsl:value-of
+												select="//saml:Attribute[@AttributeName='OIDTextualDescription']/saml:AttributeValue"
+											/> (OID***= <xsl:value-of
+												select="//saml:Attribute[@AttributeName='OID']/saml:AttributeValue"
+											/>), </xsl:if> den Zugang zur gesicherten Anwendung. </h4>
+									<p/>
+									<h4>Datum und Uhrzeit: <xsl:value-of
+											select="substring(//@IssueInstant,9,2)"/>. <xsl:value-of
+											select="substring(//@IssueInstant,6,2)"/>. <xsl:value-of
+											select="substring(//@IssueInstant,1,4)"/>, <xsl:value-of
+											select="substring(//@IssueInstant,12,2)"/>:
+											<xsl:value-of select="substring(//@IssueInstant,15,2)"
+										/>: <xsl:value-of select="substring(//@IssueInstant,18,2)"/>
+									</h4>
+									<xsl:if test="//saml:Attribute[@AttributeName='HPI']">
+										<h4>HPI(**): <xsl:value-of
+												select="//saml:Attribute[@AttributeName='HPI']/saml:AttributeValue"
+											/></h4>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='wbPK']">
+										<h4>wbPK(*): <xsl:value-of
+												select="//saml:Attribute[@AttributeName='wbPK']/saml:AttributeValue/pr:Identification/pr:Value"
+											/></h4>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='MandatorName']">
+										<hr/>
+										<h4>Ich bin weiters ermächtigt als <xsl:value-of
+												select="//saml:Attribute[@AttributeName='RepresentationType']/saml:AttributeValue/text()"
+											/> von <xsl:value-of
+												select="//saml:Attribute[@AttributeName='MandatorName']/saml:AttributeValue/text()"/>
+											<xsl:if
+												test="//saml:Attribute[@AttributeName='MandatorDateOfBirth']"
+												>, geboren am <xsl:value-of
+												select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,9,2)"
+												/>. <xsl:value-of
+												select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,6,2)"
+												/>. <xsl:value-of
+												select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,1,4)"
+												/>
+											</xsl:if>
+											<xsl:if
+												test="//saml:Attribute[@AttributeName='MandatorDomainIdentifier']"
+												>, <xsl:value-of
+												select="//saml:Attribute[@AttributeName='MandatorDomainIdentifier']/saml:AttributeValue/text()"
+												/>
+											</xsl:if>, in deren Auftrag zu handeln. <xsl:if
+												test="//saml:Attribute[@AttributeName='MandatorWbpk']">
+												<h4>wbPK(*) des Vollmachtgebers: <xsl:value-of
+												select="//saml:Attribute[@AttributeName='MandatorWbpk']/saml:AttributeValue/text()"
+												/></h4>
+											</xsl:if>
+										</h4>
+										<p/>
+									</xsl:if>
+									<xsl:choose>
+										<xsl:when test="//saml:Attribute[@AttributeName='OID']">
+											<p/>
+											<hr/>
+										</xsl:when>
+										<xsl:when test="//saml:Attribute[@AttributeName='HPI']">
+											<p/>
+											<hr/>
+										</xsl:when>
+										<xsl:when test="//saml:Attribute[@AttributeName='wbPK']">
+											<p/>
+											<hr/>
+										</xsl:when>
+									</xsl:choose>
+									<xsl:if test="//saml:Attribute[@AttributeName='wbPK']">
+										<div class="annotationstyle">(*) wbPK: Das <span
+												class="italicstyle">wirtschaftsbereichsspezifische
+												Personenkennzeichen</span> wird aus den jeweiligen
+											Stammzahlen des Bürgers und des Wirtschaftsunternehmens
+											berechnet und ermöglicht eine eindeutige Zuordnung des
+											Bürgers zum Wirtschaftsunternehmen.</div>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='HPI']">
+										<div class="annotationstyle">(**) HPI: Der <span
+												class="italicstyle">eHealth Professional
+											Identifier</span> wird aus den jeweiligen Stammzahlen
+											der Gesundheitsdiensteanbieterinnen /
+											Gesundheitsdiensteanbieter berechnet und ermöglicht eine
+											eindeutige Zuordnung der Gesundheitsdiensteanbieterin /
+											des Gesundheitsdiensteanbieters im
+										Gesundheitsbereich.</div>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='OID']">
+										<div class="annotationstyle">(***) OID: <span
+												class="italicstyle">Object Identifier</span> sind
+											standardisierte Objekt-Bezeichner und beschreiben
+											eindeutig die Rollen des GDA-Token Inhabers.</div>
+									</xsl:if>
+								</body>
+							</html>
+						</xsl:template>
+					</xsl:stylesheet>
+				</dsig:Transform>
+				<dsig:Transform
+					Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
+			</dsig:Transforms>
+			<sl:FinalDataMetaInfo>
+				<sl:MimeType>application/xhtml+xml</sl:MimeType>
+			</sl:FinalDataMetaInfo>
+		</sl:TransformsInfo>
+		<sl:TransformsInfo>
+			<dsig:Transforms xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
+				<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+				<dsig:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
+					<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+						xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
+						xmlns:pr="http://reference.e-government.gv.at/namespace/persondata/20020228#">
+						<xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes"/>
+						<xsl:template match="/" xmlns="http://www.w3.org/1999/xhtml">
+							<html>
+								<head>
+									<title>Signatur der Anmeldedaten</title>
+								</head>
+								<body>
+									<h1>Signatur der Anmeldedaten</h1>
+									<p/>
+									<h4>Mit meiner elektronischen Signatur beantrage ich, <b>
+											<xsl:value-of select="//@Issuer"/>
+										</b>, geboren am <xsl:value-of
+											select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,9,2)"
+										/>. <xsl:value-of
+											select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,6,2)"
+										/>. <xsl:value-of
+											select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,1,4)"
+										/>, <xsl:if
+											test="//saml:Attribute[@AttributeName='OIDTextualDescription']"
+											> in der Rolle als <xsl:value-of
+												select="//saml:Attribute[@AttributeName='OIDTextualDescription']/saml:AttributeValue"
+											/> (OID***= <xsl:value-of
+												select="//saml:Attribute[@AttributeName='OID']/saml:AttributeValue"
+											/>), </xsl:if> den Zugang zur gesicherten Anwendung. </h4>
+									<p/>
+									<h4>Datum und Uhrzeit: <xsl:value-of
+											select="substring(//@IssueInstant,9,2)"/>. <xsl:value-of
+											select="substring(//@IssueInstant,6,2)"/>. <xsl:value-of
+											select="substring(//@IssueInstant,1,4)"/>, <xsl:value-of
+											select="substring(//@IssueInstant,12,2)"/>:
+											<xsl:value-of select="substring(//@IssueInstant,15,2)"
+										/>: <xsl:value-of select="substring(//@IssueInstant,18,2)"/>
+									</h4>
+									<xsl:if test="//saml:Attribute[@AttributeName='HPI']">
+										<h4>HPI(**): <xsl:value-of
+												select="//saml:Attribute[@AttributeName='HPI']/saml:AttributeValue"
+											/></h4>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='wbPK']">
+										<h4>wbPK(*): <xsl:value-of
+												select="//saml:Attribute[@AttributeName='wbPK']/saml:AttributeValue/pr:Identification/pr:Value"
+											/></h4>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='MandatorName']">
+										<hr/>
+										<h4>Ich bin weiters ermächtigt als <xsl:value-of
+												select="//saml:Attribute[@AttributeName='RepresentationType']/saml:AttributeValue/text()"
+											/> von <xsl:value-of
+												select="//saml:Attribute[@AttributeName='MandatorName']/saml:AttributeValue/text()"/>
+											<xsl:if
+												test="//saml:Attribute[@AttributeName='MandatorDateOfBirth']"
+												>, geboren am <xsl:value-of
+												select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,9,2)"
+												/>. <xsl:value-of
+												select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,6,2)"
+												/>. <xsl:value-of
+												select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,1,4)"
+												/>
+											</xsl:if>
+											<xsl:if
+												test="//saml:Attribute[@AttributeName='MandatorDomainIdentifier']"
+												>, <xsl:value-of
+												select="//saml:Attribute[@AttributeName='MandatorDomainIdentifier']/saml:AttributeValue/text()"
+												/>
+											</xsl:if>, in deren Auftrag zu handeln. <xsl:if
+												test="//saml:Attribute[@AttributeName='MandatorWbpk']">
+												<h4>wbPK(*) des Vollmachtgebers: <xsl:value-of
+												select="//saml:Attribute[@AttributeName='MandatorWbpk']/saml:AttributeValue/text()"
+												/></h4>
+											</xsl:if>
+										</h4>
+										<p/>
+									</xsl:if>
+									<xsl:choose>
+										<xsl:when test="//saml:Attribute[@AttributeName='OID']">
+											<p/>
+											<hr/>
+										</xsl:when>
+										<xsl:when test="//saml:Attribute[@AttributeName='HPI']">
+											<p/>
+											<hr/>
+										</xsl:when>
+										<xsl:when test="//saml:Attribute[@AttributeName='wbPK']">
+											<p/>
+											<hr/>
+										</xsl:when>
+									</xsl:choose>
+									<xsl:if test="//saml:Attribute[@AttributeName='wbPK']">
+										<h6>(*) wbPK: Das <i>wirtschaftsbereichsspezifische
+												Personenkennzeichen</i> wird aus den jeweiligen
+											Stammzahlen des Bürgers und des Wirtschaftsunternehmens
+											berechnet und ermöglicht eine eindeutige Zuordnung des
+											Bürgers zum Wirtschaftsunternehmen.</h6>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='HPI']">
+										<h6>(**) HPI: Der <i>eHealth Professional Identifier</i>
+											wird aus den jeweiligen Stammzahlen der
+											Gesundheitsdiensteanbieterinnen /
+											Gesundheitsdiensteanbieter berechnet und ermöglicht eine
+											eindeutige Zuordnung der Gesundheitsdiensteanbieterin /
+											des Gesundheitsdiensteanbieters im
+										Gesundheitsbereich.</h6>
+									</xsl:if>
+									<xsl:if test="//saml:Attribute[@AttributeName='OID']">
+										<h6>(***) OID: <i>Object Identifier</i> sind standardisierte
+											Objekt-Bezeichner und beschreiben eindeutig die Rollen
+											des GDA-Token Inhabers.</h6>
+									</xsl:if>
+								</body>
+							</html>
+						</xsl:template>
+					</xsl:stylesheet>
+				</dsig:Transform>
+				<dsig:Transform
+					Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
+			</dsig:Transforms>
+			<sl:FinalDataMetaInfo>
+				<sl:MimeType>text/html</sl:MimeType>
+			</sl:FinalDataMetaInfo>
+		</sl:TransformsInfo>
+        <sl:TransformsInfo>
+            <dsig:Transforms> <!-- xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"-->
+                <dsig:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
+                    <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:pr="http://reference.e-government.gv.at/namespace/persondata/20020228#" exclude-result-prefixes="pr saml">
+                        <xsl:output method="xml" xml:space="default"/>
+                        <xsl:template match="/" xmlns="">
+                            <text>
+                                <xsl:text>Mit meiner elektronischen Signatur beantrage ich, </xsl:text>
+                                <xsl:value-of select="//@Issuer"/>
+                                <xsl:text>, geboren am </xsl:text>
+                                <xsl:value-of select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,9,2)"/>
+                                <xsl:text>.</xsl:text>
+                                <xsl:value-of select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,6,2)"/>
+                                <xsl:text>.</xsl:text>
+                                <xsl:value-of select="substring(//saml:Attribute[@AttributeName='Geburtsdatum']/saml:AttributeValue,1,4)"/>
+                                <xsl:text>, </xsl:text>
+                                <xsl:if test="//saml:Attribute[@AttributeName='OIDTextualDescription']">
+                                    <xsl:text>in der Rolle als </xsl:text>
+                                    <xsl:value-of select="//saml:Attribute[@AttributeName='OIDTextualDescription']/saml:AttributeValue"/>
+                                    <xsl:text>(OID***= </xsl:text>
+                                    <xsl:value-of select="//saml:Attribute[@AttributeName='OID']/saml:AttributeValue"/>)
+                                    <xsl:text>, </xsl:text>
+                                </xsl:if>
+                                <xsl:text>den Zugang zur gesicherten Anwendung.</xsl:text>
+                                <xsl:text>&#xa;&#xa;Datum und Uhrzeit: </xsl:text>
+                                <xsl:value-of select="substring(//@IssueInstant,9,2)"/>
+                                <xsl:text>.</xsl:text>
+                                <xsl:value-of select="substring(//@IssueInstant,6,2)"/>
+                                <xsl:text>.</xsl:text>
+                                <xsl:value-of select="substring(//@IssueInstant,1,4)"/>
+                                <xsl:text>, </xsl:text>
+                                <xsl:value-of select="substring(//@IssueInstant,12,2)"/>
+                                <xsl:text>:</xsl:text>
+                                <xsl:value-of select="substring(//@IssueInstant,15,2)"/>
+                                <xsl:text>:</xsl:text>
+                                <xsl:value-of select="substring(//@IssueInstant,18,2)"/>
+
+                                <xsl:if test="//saml:Attribute[@AttributeName='HPI']">
+                                    <xsl:text>&#xa;&#xa;HPI(**): </xsl:text>
+                                    <xsl:value-of select="//saml:Attribute[@AttributeName='HPI']/saml:AttributeValue"/>
+                                </xsl:if>
+
+                                <xsl:if test="//saml:Attribute[@AttributeName='wbPK']">
+                                    <xsl:text>&#xa;&#xa;wbPK(*): </xsl:text>
+                                    <xsl:value-of select="//saml:Attribute[@AttributeName='wbPK']/saml:AttributeValue/pr:Identification/pr:Value"/>
+                                </xsl:if>
+
+                                <xsl:if test="//saml:Attribute[@AttributeName='MandatorName']">
+                                    <xsl:text>&#xa;&#xa;Ich bin weiters ermächtigt als </xsl:text>
+                                    <xsl:value-of select="//saml:Attribute[@AttributeName='RepresentationType']/saml:AttributeValue/text()"/>
+                                    <xsl:text>von </xsl:text>
+                                    <xsl:value-of select="//saml:Attribute[@AttributeName='MandatorName']/saml:AttributeValue/text()"/>
+                                    <xsl:if test="//saml:Attribute[@AttributeName='MandatorDateOfBirth']">
+                                        <xsl:text>, geboren am </xsl:text>
+                                        <xsl:value-of select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,9,2)"/>
+                                        <xsl:text>.</xsl:text>
+                                        <xsl:value-of select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,6,2)"/>
+                                        <xsl:text>.</xsl:text>
+                                        <xsl:value-of select="substring(//saml:Attribute[@AttributeName='MandatorDateOfBirth']/saml:AttributeValue,1,4)"/>
+                                    </xsl:if>
+                                    <xsl:if test="//saml:Attribute[@AttributeName='MandatorDomainIdentifier']">
+                                        <xsl:text>,</xsl:text>
+                                        <xsl:value-of select="//saml:Attribute[@AttributeName='MandatorDomainIdentifier']/saml:AttributeValue/text()"/>
+                                    </xsl:if>
+                                    <xsl:text>, in deren Auftrag zu handeln.</xsl:text>
+
+                                    <xsl:if test="//saml:Attribute[@AttributeName='MandatorWbpk']">
+                                        <xsl:text>&#xa;&#xa;wbPK(*) des Vollmachtgebers: </xsl:text>
+                                        <xsl:value-of select="//saml:Attribute[@AttributeName='MandatorWbpk']/saml:AttributeValue/text()"/>
+                                    </xsl:if>
+                                </xsl:if>
+
+                                <xsl:if test="//saml:Attribute[@AttributeName='wbPK']">
+                                    <xsl:text>&#xa;&#xa;(*) wbPK: Das wirtschaftsbereichsspezifische Personenkennzeichen wird aus den jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum Wirtschaftsunternehmen.</xsl:text>
+                                </xsl:if>
+                                <xsl:if test="//saml:Attribute[@AttributeName='HPI']">
+                                    <xsl:text>&#xa;&#xa;(**) HPI: Der eHealth Professional Identifier wird aus den jeweiligen Stammzahlen der Gesundheitsdiensteanbieterinnen / Gesundheitsdiensteanbieter berechnet und ermöglicht eine eindeutige Zuordnung der Gesundheitsdiensteanbieterin / des Gesundheitsdiensteanbieters im Gesundheitsbereich.</xsl:text>
+                                </xsl:if>
+                                <xsl:if test="//saml:Attribute[@AttributeName='OID']">
+                                    <xsl:text>&#xa;&#xa;(***) OID: Object Identifier sind standardisierte Objekt-Bezeichner und beschreiben eindeutig die Rollen des GDA-Token Inhabers.</xsl:text>
+                                </xsl:if>
+                            </text>
+                        </xsl:template>
+                    </xsl:stylesheet>
+                </dsig:Transform>
+                <dsig:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
+                    <dsig:XPath>not(text())</dsig:XPath>
+                </dsig:Transform>
+            </dsig:Transforms>
+            <sl:FinalDataMetaInfo>
+                <sl:MimeType>text/plain</sl:MimeType>
+            </sl:FinalDataMetaInfo>
+        </sl:TransformsInfo>
+	</sl:DataObjectInfo>
+	<sl:SignatureInfo>
+		<sl:SignatureEnvironment>
+			<sl:XMLContent>
+				<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
+					xmlns:pr="http://reference.e-government.gv.at/namespace/persondata/20020228#"
+					MajorVersion="1" MinorVersion="0" AssertionID="any" Issuer="Klämens Örthäçké"
+					IssueInstant="2008-06-05T11:26:10+02:00">
+					<saml:AttributeStatement>
+						<saml:Subject>
+							<saml:NameIdentifier>https://demo.egiz.gv.at/exchange-moa-id-auth/</saml:NameIdentifier>
+						</saml:Subject>
+						<saml:Attribute AttributeName="wbPK"
+							AttributeNamespace="http://reference.e-government.gv.at/namespace/moa/20020822#">
+							<saml:AttributeValue>
+								<pr:Identification>
+									<pr:Value>LTpz8VYzns2jrx0J8Gm/R/nAhxA=</pr:Value>
+									<pr:Type>urn:publicid:gv.at:wbpk+FN+TODO</pr:Type>
+								</pr:Identification>
+							</saml:AttributeValue>
+						</saml:Attribute>
+						<saml:Attribute AttributeName="OA"
+							AttributeNamespace="http://reference.e-government.gv.at/namespace/moa/20020822#">
+							<saml:AttributeValue>https://apps.egiz.gv.at/urlaubsschein-frontend/moaid-login</saml:AttributeValue>
+						</saml:Attribute>
+						<saml:Attribute AttributeName="Geburtsdatum"
+							AttributeNamespace="http://reference.e-government.gv.at/namespace/moa/20020822#">
+							<saml:AttributeValue>1971-11-10</saml:AttributeValue>
+						</saml:Attribute>
+					</saml:AttributeStatement>
+				</saml:Assertion>
+			</sl:XMLContent>
+		</sl:SignatureEnvironment>
+		<sl:SignatureLocation Index="2" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">/saml:Assertion</sl:SignatureLocation>
+	</sl:SignatureInfo>
+</sl:CreateXMLSignatureRequest>
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index 13c57686..86223854 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -30,8 +30,6 @@ package at.gv.egiz.smcc;
 
 import java.nio.charset.Charset;
 
-import java.util.logging.Level;
-import java.util.logging.Logger;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CommandAPDU;
@@ -41,7 +39,7 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
-  
+
   private static Log log = LogFactory.getLog(ACOSCard.class);
 
   public static final byte[] AID_DEC = new byte[] { (byte) 0xA0, (byte) 0x00,
@@ -100,8 +98,15 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
       (byte) 0x01 // RSA // TODO: Not verified yet
   };
 
+  private static final int PINSPEC_INF = 0;
+  private static final int PINSPEC_DEC = 1;
+  private static final int PINSPEC_SIG = 2;
+
   public ACOSCard() {
     super("at/gv/egiz/smcc/ACOSCard");
+    pinSpecs.add(PINSPEC_INF, new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("inf.pin.name"), KID_PIN_INF, null));
+    pinSpecs.add(PINSPEC_DEC, new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("dec.pin.name"), KID_PIN_DEC, null));
+    pinSpecs.add(PINSPEC_SIG, new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"), KID_PIN_SIG, null));
   }
 
   /* (non-Javadoc)
@@ -165,7 +170,8 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
     try {
       if ("IdentityLink".equals(infobox)) {
  
-        PINSpec spec = new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("inf.pin.name"));
+        PINSpec spec = pinSpecs.get(PINSPEC_INF);
+        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("inf.pin.name"));
         
         int retries = -1;
         String pin = null;
@@ -219,7 +225,8 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
       
       if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)) {
 
-        PINSpec spec = new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
+        PINSpec spec = pinSpecs.get(PINSPEC_SIG);
+        //new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
         
         int retries = -1;
         String pin = null;
@@ -260,7 +267,8 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
     
       } else if (KeyboxName.CERITIFIED_KEYPAIR.equals(keyboxName)) {
         
-        PINSpec spec = new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("dec.pin.name"));
+        PINSpec spec = pinSpecs.get(PINSPEC_DEC);
+        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("dec.pin.name"));
 
         int retries = -1;
         String pin = null;
@@ -321,11 +329,6 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
         0x00, fid, 256));
   }
 
-  @Override
-  public byte[] getKIDs() {
-    return new byte[] { KID_PIN_DEC, KID_PIN_INF, KID_PIN_SIG };
-  }
-
   @Override
   public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
     
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index 67f090a5..cb068725 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -31,7 +31,11 @@ package at.gv.egiz.smcc;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.ResourceBundle;
 
 import javax.smartcardio.ATR;
@@ -49,6 +53,8 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
   private static Log log = LogFactory.getLog(AbstractSignatureCard.class);
 
+  protected List<PINSpec> pinSpecs = new ArrayList<PINSpec>();
+
   private ResourceBundle i18n;
   private String resourceBundleName;
 
@@ -433,4 +439,8 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     }
   }
 
+  @Override
+  public List<PINSpec> getPINSpecs() {
+    return pinSpecs;
+  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java b/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java
index 0852d664..d180ddf0 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java
@@ -35,23 +35,40 @@ public class PINSpec {
     
     String name_;
 
+    byte kid_;
+
+    byte[] context_aid_;
+
+    /**
+     *
+     * @param minLenght
+     * @param maxLength
+     * @param rexepPattern
+     * @param resourceBundle
+     * @param name
+     * @param kid the keyId for this pin
+     */
     public PINSpec(int minLenght, int maxLength, String rexepPattern, 
-        ResourceBundle resourceBundle, String name) {
+        ResourceBundle resourceBundle, String name, byte kid, byte[] contextAID) {
         
         minLength_ = minLenght;
         maxLength_ = maxLength;
         rexepPattern_ = rexepPattern;
         resourceBundle_ = resourceBundle;
         name_ = name;
+        kid_ = kid;
+        context_aid_ = contextAID;
     }
     
     public PINSpec(int minLenght, int maxLength, String rexepPattern, 
-        String name) {
+        String name, byte kid, byte[] contextAID) {
         
         minLength_ = minLenght;
         maxLength_ = maxLength;
         rexepPattern_ = rexepPattern;
         name_ = name;
+        kid_ = kid;
+        context_aid_ = contextAID;
     }
     
     
@@ -75,7 +92,14 @@ public class PINSpec {
     public String getRexepPattern() {
         return rexepPattern_;
     }
-    
+
+    public byte getKID() {
+      return kid_;
+    }
+
+    public byte[] getContextAID() {
+      return context_aid_;
+    }
     
     
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index e80c6683..ae43629e 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -29,10 +29,8 @@
 package at.gv.egiz.smcc;
 
 import java.math.BigInteger;
-import java.util.ArrayList;
 import java.util.Arrays;
 
-import java.util.List;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CommandAPDU;
@@ -42,7 +40,7 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 public class STARCOSCard extends AbstractSignatureCard implements SignatureCard {
-  
+
   /**
    * Logging facility.
    */
@@ -155,12 +153,17 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
   };
 
   public static final byte KID_PIN_CARD = (byte) 0x01;
-  
+
+  private static final int PINSPEC_CARD = 0;
+  private static final int PINSPEC_SS = 1;
+
   /**
    * Creates an new instance.
    */
   public STARCOSCard() {
     super("at/gv/egiz/smcc/STARCOSCard");
+    pinSpecs.add(PINSPEC_CARD, new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"), KID_PIN_CARD, null));
+    pinSpecs.add(PINSPEC_SS, new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"), KID_PIN_SS, AID_DF_SS));
   }
  
   @Override
@@ -210,7 +213,8 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
     try {
       if ("IdentityLink".equals(infobox)) {
  
-        PINSpec spec = new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
+        PINSpec spec = pinSpecs.get(PINSPEC_CARD);
+        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
         
         int retries = -1;
         String pin = null;
@@ -302,7 +306,8 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
       
       if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)) {
 
-        PINSpec spec = new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
+        PINSpec spec = pinSpecs.get(PINSPEC_SS);
+        //new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
         
         int retries = -1;
         String pin = null;
@@ -334,7 +339,8 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
  
       } else if (KeyboxName.CERITIFIED_KEYPAIR.equals(keyboxName)) {
 
-        PINSpec spec = new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
+        PINSpec spec = pinSpecs.get(PINSPEC_CARD);
+        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
  
         int retries = -1;
         String pin = null;
@@ -455,11 +461,6 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
     }
   }
 
-  @Override
-  public byte[] getKIDs() {
-    return new byte[] { KID_PIN_CARD, KID_PIN_SS };
-  }
-
   /**
    * VERIFY PIN
    * <p>
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index bad7ccf6..8dc4ac2a 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -36,9 +36,13 @@ import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
+import java.util.ArrayList;
 import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.List;
 import java.util.Locale;
 
+import java.util.Map;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardTerminal;
 
@@ -311,7 +315,7 @@ public class SWCard implements SignatureCard {
 
     if (password == null) {
 
-      PINSpec pinSpec = new PINSpec(0, -1, ".", "KeyStore-Password");
+      PINSpec pinSpec = new PINSpec(0, -1, ".", "KeyStore-Password", (byte) 0x01, null);
       
       password = provider.providePIN(pinSpec, -1);
       
@@ -390,13 +394,13 @@ public class SWCard implements SignatureCard {
   }
 
   @Override
-  public byte[] getKIDs() {
-    return null;
+  public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
+    return -1;
   }
 
   @Override
-  public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
-    return -1;
+  public List<PINSpec> getPINSpecs() {
+    return new ArrayList<PINSpec>();
   }
 
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index 1ec35b78..1e5e09c8 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -31,6 +31,7 @@ package at.gv.egiz.smcc;
 import java.util.List;
 import java.util.Locale;
 
+import java.util.Map;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardTerminal;
 
@@ -118,10 +119,10 @@ public interface SignatureCard {
       PINProvider provider) throws SignatureCardException, InterruptedException;
 
   /**
-   * get the KIDs for the availabel PINs
+   * Get the KIDs for all available PINs and the corresponding PINSpecs
    * @return array of KIDs
    */
-  public byte[] getKIDs();
+  public List<PINSpec> getPINSpecs();
 
   /**
    *
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java
index e10ba8f9..b6c5a8ca 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java
@@ -102,6 +102,9 @@ public abstract class AbstractBKUWorker extends AbstractSMCCSTAL implements Acti
 
   @Override
   protected boolean waitForCard() {
+    if (signatureCard != null) {
+      return false;
+    }
     SMCCHelper smccHelper = new SMCCHelper();
     actionCommandList.clear();
     actionCommandList.add("cancel");
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index a5f8a771..a5d6df23 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -86,15 +86,16 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       
     }
 
-      @Override
-      public byte[] getKIDs() {
-        return null;
-      }
 
       @Override
       public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
         return 0;
       }
+
+      @Override
+      public List<PINSpec> getPINSpecs() {
+        return new ArrayList<PINSpec>();
+      }
      
    };
     return false;
diff --git a/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java b/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java
new file mode 100644
index 00000000..c03f17cd
--- /dev/null
+++ b/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.marshal;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface NamespacePrefix {
+  String CARDCHANNEL_PREFIX = "cc";
+  String ECDSA_PREFIX = "ecdsa";
+  String PERSONDATA_PREFIX = "pr";
+  String SAML10_PREFIX = "saml";
+  String SL_PREFIX = "sl";
+  String XADES_PREFIX = "xades";
+  String XMLDSIG_PREFIX = "xmldsig";
+  String XSI_PREFIX = "xsi";
+
+}
diff --git a/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefixMapperImpl.java b/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefixMapperImpl.java
index a08c1188..519f6b1f 100644
--- a/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefixMapperImpl.java
+++ b/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefixMapperImpl.java
@@ -36,35 +36,35 @@ public class NamespacePrefixMapperImpl extends NamespacePrefixMapper {
       log.trace("prefix for namespace " + namespaceUri + " requested");
     }
     if ("http://www.w3.org/2001/XMLSchema-instance".equals(namespaceUri)) {
-      return "xsi";
+      return NamespacePrefix.XSI_PREFIX;
     }
 
     if ("http://www.w3.org/2000/09/xmldsig#".equals(namespaceUri)) {
-      return "dsig";
+      return NamespacePrefix.XMLDSIG_PREFIX;
     }
 
     if ("http://www.buergerkarte.at/namespaces/securitylayer/1.2#".equals(namespaceUri)) {
-      return "sl";
+      return NamespacePrefix.SL_PREFIX;
     }
 
     if ("http://www.buergerkarte.at/cardchannel".equals(namespaceUri)) {
-      return "cc";
+      return NamespacePrefix.CARDCHANNEL_PREFIX;
     }
 
     if ("http://www.w3.org/2001/04/xmldsig-more#".equals(namespaceUri)) {
-      return "ecdsa";
+      return NamespacePrefix.ECDSA_PREFIX;
     }
 
     if ("http://reference.e-government.gv.at/namespace/persondata/20020228#".equals(namespaceUri)) {
-      return "pr";
+      return NamespacePrefix.PERSONDATA_PREFIX;
     }
 
     if ("urn:oasis:names:tc:SAML:1.0:assertion".equals(namespaceUri)) {
-      return "saml";
+      return NamespacePrefix.SAML10_PREFIX;
     }
 
     if ("http://uri.etsi.org/01903/v1.1.1#".equals(namespaceUri)) {
-      return "xades";
+      return NamespacePrefix.XADES_PREFIX;
     }
     
     return suggestion;
diff --git a/utils/src/main/java/at/gv/egiz/slbinding/RedirectEventFilter.java b/utils/src/main/java/at/gv/egiz/slbinding/RedirectEventFilter.java
index d2a7fb30..14c5ba48 100644
--- a/utils/src/main/java/at/gv/egiz/slbinding/RedirectEventFilter.java
+++ b/utils/src/main/java/at/gv/egiz/slbinding/RedirectEventFilter.java
@@ -1,19 +1,19 @@
 /*
-* Copyright 2008 Federal Chancellery Austria and
-* Graz University of Technology
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 /*
  * To change this template, choose Tools | Templates
  * and open the template in the editor.
@@ -33,79 +33,84 @@ import javax.xml.stream.events.XMLEvent;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
+/*
+ * TODO: don't set redirect stream from caller (caller does not know whether redirection will be triggered)
+ * rather create on trigger and pass to caller
+ */
 public class RedirectEventFilter implements EventFilter {
 
-    public static final String DEFAULT_ENCODING = "UTF-8";
-    private static Log log = LogFactory.getLog(RedirectEventFilter.class);
-    protected XMLEventWriter redirectWriter = null;
-    protected Set<QName> redirectTriggers = null;
-    private int depth = -1;
-    protected NamespaceContext currentNamespaceContext = null;
+  public static final String DEFAULT_ENCODING = "UTF-8";
+  private static Log log = LogFactory.getLog(RedirectEventFilter.class);
+  protected XMLEventWriter redirectWriter = null;
+  protected Set<QName> redirectTriggers = null;
+  private int depth = -1;
+  protected NamespaceContext currentNamespaceContext = null;
 
-    /**
-     * Event redirection is disabled, set a redirect stream to enable.
-     */
-    public RedirectEventFilter() {
-        redirectWriter = null;
-    // redirectTriggers = null;
-    }
+  /**
+   * Event redirection is disabled, set a redirect stream to enable.
+   */
+  public RedirectEventFilter() {
+    redirectWriter = null;
+  // redirectTriggers = null;
+  }
 
-    /**
-     * 
-     * @param redirectStream
-     *          if null, no events are redirected
-     * @param redirectTriggers
-     *          if null, all events are redirected
-     */
-    public RedirectEventFilter(OutputStream redirectStream, String encoding)
-      throws XMLStreamException { // , List<QName> redirectTriggers
-        if (redirectStream != null) {
-            XMLOutputFactory outputFactory = XMLOutputFactory.newInstance();
-            if (encoding == null) {
-                encoding = DEFAULT_ENCODING;
-            }
-            this.redirectWriter = outputFactory.createXMLEventWriter(redirectStream,
+  /**
+   *
+   * @param redirectStream
+   *          if null, no events are redirected
+   * @param redirectTriggers
+   *          if null, all events are redirected
+   */
+  public RedirectEventFilter(OutputStream redirectStream, String encoding)
+          throws XMLStreamException { // , List<QName> redirectTriggers
+    if (redirectStream != null) {
+      XMLOutputFactory outputFactory = XMLOutputFactory.newInstance();
+      if (encoding == null) {
+        encoding = DEFAULT_ENCODING;
+      }
+      this.redirectWriter = outputFactory.createXMLEventWriter(redirectStream,
               encoding);
-        }
-    // this.redirectTriggers = redirectTriggers;
     }
+  // this.redirectTriggers = redirectTriggers;
+  }
 
-    /**
-     * All startElement events occuring in the redirectTriggers list will trigger
-     * redirection of the entire (sub-)fragment.
-     * 
-     * @param event
-     * @return false if an event is redirected
-     */
-    @Override
-    public boolean accept(XMLEvent event) {
-        int eventType = event.getEventType();
+  /**
+   * All startElement events occuring in the redirectTriggers list will trigger
+   * redirection of the entire (sub-)fragment.
+   *
+   * @param event
+   * @return false if an event is redirected
+   */
+  @Override
+  public boolean accept(XMLEvent event) {
+    int eventType = event.getEventType();
 
-        if (eventType == XMLStreamConstants.START_ELEMENT) {
-            currentNamespaceContext = event.asStartElement().getNamespaceContext();
-        }
-        if (redirectWriter == null) {
-            return true;
-        }
-        if (eventType == XMLStreamConstants.START_ELEMENT) {
-            if (depth >= 0 || triggersRedirect(event.asStartElement().getName())) {
-                depth++;
-            }
-        } else if (eventType == XMLStreamConstants.END_ELEMENT) {
-            if (depth >= 0 && --depth < 0) {
-                // redirect the end element of the trigger, 
-                // but do not redirect the end element of the calling type
-                if (redirectTriggers != null) {
-                    redirectEvent(event);
-                    return false;
-                }
-            }
-        }
-        if (depth >= 0) { //|| (depth == 0 && redirectTriggers == null)) {
-            redirectEvent(event);
-            return false;
+    if (eventType == XMLStreamConstants.START_ELEMENT) {
+      //hopefully, this is a copy
+      currentNamespaceContext = event.asStartElement().getNamespaceContext();
+    }
+    if (redirectWriter == null) {
+      return true;
+    }
+    if (eventType == XMLStreamConstants.START_ELEMENT) {
+      if (depth >= 0 || triggersRedirect(event.asStartElement().getName())) {
+        depth++;
+      }
+    } else if (eventType == XMLStreamConstants.END_ELEMENT) {
+      if (depth >= 0 && --depth < 0) {
+        // redirect the end element of the trigger,
+        // but do not redirect the end element of the calling type
+        if (redirectTriggers != null) {
+          redirectEvent(event);
+          return false;
         }
-        return true; // depth < 0;
+      }
+    }
+    if (depth >= 0) { //|| (depth == 0 && redirectTriggers == null)) {
+      redirectEvent(event);
+      return false;
+    }
+    return true; // depth < 0;
 
 //    switch (event.getEventType()) {
 //    case XMLStreamConstants.START_ELEMENT:
@@ -132,128 +137,130 @@ public class RedirectEventFilter implements EventFilter {
 //      return false;
 //    }
 //    return true; // depth < 0;
-    }
+  }
 
-    /**
-     * @param startElt
-     * @return true if the set of triggers contains startElement 
-     * (or no triggers are registered, i.e. everything is redirected)
-     */
-    private boolean triggersRedirect(QName startElement) {
-        if (redirectTriggers != null) {
-            return redirectTriggers.contains(startElement);
-        }
-        return true;
+  /**
+   * @param startElt
+   * @return true if the set of triggers contains startElement
+   * (or no triggers are registered, i.e. everything is redirected)
+   */
+  private boolean triggersRedirect(QName startElement) {
+    if (redirectTriggers != null) {
+      return redirectTriggers.contains(startElement);
     }
+    return true;
+  }
 
-    private void redirectEvent(XMLEvent event) {
-        try {
-            if (log.isTraceEnabled()) {
-                log.trace("redirecting StAX event " + event);
-            }
-            redirectWriter.add(event);
-        } catch (XMLStreamException ex) {
-            ex.printStackTrace();
-        }
+  private void redirectEvent(XMLEvent event) {
+    try {
+      if (log.isTraceEnabled()) {
+        log.trace("redirecting StAX event " + event);
+      }
+      redirectWriter.add(event);
+    } catch (XMLStreamException ex) {
+      ex.printStackTrace();
     }
+  }
 
-    /**
-     * Enable/disable redirection of <em>all</em> events from now on. 
-     * The redirected events will be UTF-8 encoded and written to the stream.
-     * 
-     * @param redirectstream
-     *          if null, redirection is disabled
-     */
-    public void setRedirectStream(OutputStream redirectStream) throws XMLStreamException {
-        setRedirectStream(redirectStream, DEFAULT_ENCODING, null);
-    }
+  /**
+   * Enable/disable redirection of <em>all</em> events from now on.
+   * The redirected events will be UTF-8 encoded and written to the stream.
+   *
+   * @param redirectstream
+   *          if null, redirection is disabled
+   */
+  public void setRedirectStream(OutputStream redirectStream) throws XMLStreamException {
+    setRedirectStream(redirectStream, DEFAULT_ENCODING, null);
+  }
 
-    /**
-     * Enable/disable redirection of <em>all</em> events from now on. 
-     * 
-     * @param redirectStream if null, redirection is disabled
-     * @param encoding The encoding for the redirect stream
-     * @throws javax.xml.stream.XMLStreamException
-     */
-    public void setRedirectStream(OutputStream redirectStream, String encoding) throws XMLStreamException {
-        setRedirectStream(redirectStream, encoding, null);
-    }
+  /**
+   * Enable/disable redirection of <em>all</em> events from now on.
+   *
+   * @param redirectStream if null, redirection is disabled
+   * @param encoding The encoding for the redirect stream
+   * @throws javax.xml.stream.XMLStreamException
+   */
+  public void setRedirectStream(OutputStream redirectStream, String encoding) throws XMLStreamException {
+    setRedirectStream(redirectStream, encoding, null);
+  }
 
-    /**
-     * Enable/disable redirection of all (child) elements contained in redirect triggers.
-     * The redirected events will be UTF-8 encoded and written to the stream.
-     * 
-     * @param redirectstream
-     *          if null, redirection is disabled
-     * @param redirectTriggers elements that trigger the redirection
-     */
-    public void setRedirectStream(OutputStream redirectStream, Set<QName> redirectTriggers) throws XMLStreamException {
-        setRedirectStream(redirectStream, DEFAULT_ENCODING, redirectTriggers);
-    }
+  /**
+   * Enable/disable redirection of all (child) elements contained in redirect triggers.
+   * The redirected events will be UTF-8 encoded and written to the stream.
+   *
+   * @param redirectstream
+   *          if null, redirection is disabled
+   * @param redirectTriggers elements that trigger the redirection
+   */
+  public void setRedirectStream(OutputStream redirectStream, Set<QName> redirectTriggers) throws XMLStreamException {
+    setRedirectStream(redirectStream, DEFAULT_ENCODING, redirectTriggers);
+  }
 
-    /**
-     * Enable/disable redirection of all (child) elements contained in redirect triggers.
-     * 
-     * @param redirectstream
-     *          if null, redirection is disabled
-     * @param encoding The encoding for the redirect stream
-     * @param redirectTriggers elements that trigger the redirection
-     */
-    public void setRedirectStream(OutputStream redirectStream, String encoding, Set<QName> redirectTriggers) throws XMLStreamException {
-        if (redirectStream != null) {
-            XMLOutputFactory outputFactory = XMLOutputFactory.newInstance();
-            if (encoding == null) {
-                encoding = DEFAULT_ENCODING;
-            }
-            redirectWriter = outputFactory.createXMLEventWriter(redirectStream,
+  /**
+   * Enable/disable redirection of all (child) elements contained in redirect triggers.
+   *
+   * TODO: don't set redirect stream from caller (caller does not know whether redirection will be triggered)
+   * rather create on trigger and pass to caller
+   * @param redirectstream
+   *          if null, redirection is disabled
+   * @param encoding The encoding for the redirect stream
+   * @param redirectTriggers elements that trigger the redirection
+   */
+  public void setRedirectStream(OutputStream redirectStream, String encoding, Set<QName> redirectTriggers) throws XMLStreamException {
+    if (redirectStream != null) {
+      XMLOutputFactory outputFactory = XMLOutputFactory.newInstance();
+      if (encoding == null) {
+        encoding = DEFAULT_ENCODING;
+      }
+      redirectWriter = outputFactory.createXMLEventWriter(redirectStream,
               encoding);
-            if (redirectTriggers == null) {
-                // start redirecting 
-                depth = 0;
-            }
-            this.redirectTriggers = redirectTriggers;
-        } else {
-            redirectWriter = null;
-            this.redirectTriggers = null;
-        }
+      if (redirectTriggers == null) {
+        // start redirecting
+        depth = 0;
+      }
+      this.redirectTriggers = redirectTriggers;
+    } else {
+      redirectWriter = null;
+      this.redirectTriggers = null;
     }
+  }
 
-    /**
-     * Enable/disable redirection of fragments (defined by elements in
-     * redirectTriggers)
-     * 
-     * @param redirectStream
-     *          if null, redirection is disabled
-     * @param redirectTriggers
-     *          All startElement events occuring in this list will trigger
-     *          redirection of the entire fragment. If null, all events are
-     *          redirected
-     */
-    // public void setRedirectStream(OutputStream redirectStream, List<QName>
-    // redirectTriggers) throws XMLStreamException {
-    // if (redirectStream != null) {
-    // XMLOutputFactory outputFactory = XMLOutputFactory.newInstance();
-    // redirectWriter = outputFactory.createXMLEventWriter(redirectStream);
-    // } else {
-    // redirectWriter = null;
-    // }
-    // this.redirectTriggers = (redirectStream == null) ? null : redirectTriggers;
-    // }
-    /**
-     * flushes the internal EventWriter
-     * 
-     * @throws javax.xml.stream.XMLStreamException
-     */
-    public void flushRedirectStream() throws XMLStreamException {
-        redirectWriter.flush();
-    }
+  /**
+   * Enable/disable redirection of fragments (defined by elements in
+   * redirectTriggers)
+   *
+   * @param redirectStream
+   *          if null, redirection is disabled
+   * @param redirectTriggers
+   *          All startElement events occuring in this list will trigger
+   *          redirection of the entire fragment. If null, all events are
+   *          redirected
+   */
+  // public void setRedirectStream(OutputStream redirectStream, List<QName>
+  // redirectTriggers) throws XMLStreamException {
+  // if (redirectStream != null) {
+  // XMLOutputFactory outputFactory = XMLOutputFactory.newInstance();
+  // redirectWriter = outputFactory.createXMLEventWriter(redirectStream);
+  // } else {
+  // redirectWriter = null;
+  // }
+  // this.redirectTriggers = (redirectStream == null) ? null : redirectTriggers;
+  // }
+  /**
+   * flushes the internal EventWriter
+   *
+   * @throws javax.xml.stream.XMLStreamException
+   */
+  public void flushRedirectStream() throws XMLStreamException {
+    redirectWriter.flush();
+  }
 
-    /**
-     * the namespaceContext of the last startelement event read
-     * 
-     * @return
-     */
-    public NamespaceContext getCurrentNamespaceContext() {
-        return currentNamespaceContext;
-    }
+  /**
+   * the namespaceContext of the last startelement event read
+   *
+   * @return
+   */
+  public NamespaceContext getCurrentNamespaceContext() {
+    return currentNamespaceContext;
+  }
 }
diff --git a/utils/src/main/java/at/gv/egiz/slbinding/impl/TransformsInfoType.java b/utils/src/main/java/at/gv/egiz/slbinding/impl/TransformsInfoType.java
index b4e988f0..1180e9fa 100644
--- a/utils/src/main/java/at/gv/egiz/slbinding/impl/TransformsInfoType.java
+++ b/utils/src/main/java/at/gv/egiz/slbinding/impl/TransformsInfoType.java
@@ -25,6 +25,7 @@ import java.io.ByteArrayOutputStream;
 import java.util.HashSet;
 import java.util.Set;
 import javax.xml.bind.annotation.XmlTransient;
+import javax.xml.namespace.NamespaceContext;
 import javax.xml.namespace.QName;
 import javax.xml.stream.XMLStreamException;
 import org.apache.commons.logging.Log;
diff --git a/utils/src/main/java/at/gv/egiz/slbinding/impl/XMLContentType.java b/utils/src/main/java/at/gv/egiz/slbinding/impl/XMLContentType.java
index c32542aa..eb147f88 100644
--- a/utils/src/main/java/at/gv/egiz/slbinding/impl/XMLContentType.java
+++ b/utils/src/main/java/at/gv/egiz/slbinding/impl/XMLContentType.java
@@ -35,7 +35,7 @@ import org.apache.commons.logging.LogFactory;
 public class XMLContentType extends at.buergerkarte.namespaces.securitylayer._1.XMLContentType implements RedirectCallback {
 
     @XmlTransient
-    private static Log log = LogFactory.getLog(TransformsInfoType.class);
+    private static Log log = LogFactory.getLog(XMLContentType.class);
     @XmlTransient
     protected ByteArrayOutputStream redirectOS = null;
 
diff --git a/utils/src/main/java/org/w3/_2000/_09/xmldsig_/ObjectFactory.java b/utils/src/main/java/org/w3/_2000/_09/xmldsig_/ObjectFactory.java
index 4ab376f1..fae77451 100644
--- a/utils/src/main/java/org/w3/_2000/_09/xmldsig_/ObjectFactory.java
+++ b/utils/src/main/java/org/w3/_2000/_09/xmldsig_/ObjectFactory.java
@@ -167,6 +167,7 @@ public class ObjectFactory {
      * 
      */
     public TransformType createTransformType() {
+//      return new at.gv.egiz.slbinding.impl.TransformType();
         return new TransformType();
     }
 
diff --git a/utils/src/main/java/org/w3/_2000/_09/xmldsig_/TransformsType.java b/utils/src/main/java/org/w3/_2000/_09/xmldsig_/TransformsType.java
index 584baf80..c7044c4c 100644
--- a/utils/src/main/java/org/w3/_2000/_09/xmldsig_/TransformsType.java
+++ b/utils/src/main/java/org/w3/_2000/_09/xmldsig_/TransformsType.java
@@ -57,7 +57,7 @@ import javax.xml.bind.annotation.XmlType;
 })
 public class TransformsType {
 
-    @XmlElement(name = "Transform", required = true)
+    @XmlElement(name = "Transform", required = true) //, type=at.gv.egiz.slbinding.impl.TransformType.class)
     protected List<TransformType> transform;
 
     /**
diff --git a/utils/src/test/java/at/gv/egiz/slbinding/RedirectTest.java b/utils/src/test/java/at/gv/egiz/slbinding/RedirectTest.java
index 99d353ac..7c8c206a 100644
--- a/utils/src/test/java/at/gv/egiz/slbinding/RedirectTest.java
+++ b/utils/src/test/java/at/gv/egiz/slbinding/RedirectTest.java
@@ -52,6 +52,8 @@ import javax.xml.stream.XMLEventReader;
 import javax.xml.stream.XMLInputFactory;
 
 import static org.junit.Assert.*;
+import org.w3._2000._09.xmldsig_.TransformType;
+import org.w3._2000._09.xmldsig_.TransformsType;
 
 /**
  *
@@ -131,11 +133,34 @@ public class RedirectTest {
                 Iterator<TransformsInfoType> tiIt = transformsInfos.iterator();
                 while (tiIt.hasNext()) {
                     at.gv.egiz.slbinding.impl.TransformsInfoType ti = (at.gv.egiz.slbinding.impl.TransformsInfoType) tiIt.next();
+//                    TransformsInfoType ti = tiIt.next();
                     assertNotNull(ti);
-                    System.out.println("found at.gv.egiz.slbinding.impl.TransformsInfoType TransformsInfo");
+                    System.out.println("found sl:TransformsInfo: " + ti.getClass().getName()); //at.gv.egiz.slbinding.impl.TransformsInfoType TransformsInfo");
+//                    TransformsType ts = ti.getTransforms();
+//                    assertNotNull(ts);
+//                    System.out.println("found dsig:Transforms " + ts.getClass().getName()); //org.w3._2000._09.xmldsig_.TransformsType dsig:Transforms");
+//                    List<TransformType> tL = ts.getTransform();
+//                    assertNotNull(tL);
+//                    System.out.println("found " + tL.size() + " org.w3._2000._09.xmldsig_.TransformType dsig:Transform");
+//                    for (TransformType t : tL) {
+//                      if (t instanceof at.gv.egiz.slbinding.impl.TransformType) {
+//                        System.out.println("found at.gv.egiz.slbinding.impl.TransformType");
+//                        byte[] redirectedBytes = ((at.gv.egiz.slbinding.impl.TransformType) t).getRedirectedStream().toByteArray();
+//                        if (redirectedBytes != null && redirectedBytes.length > 0) {
+//                          System.out.println("reading redirected stream...");
+//                          os.write("--- redirected Transform ---".getBytes());
+//                          os.write(redirectedBytes);
+//                          os.write("\n".getBytes());
+//                        } else {
+//                          System.out.println("no redirected stream");
+//                        }
+//                      }
+//                    }
+
                     ByteArrayOutputStream dsigTransforms = ti.getRedirectedStream();
+                    os.write("--- redirected TransformsInfo content ---".getBytes());
                     os.write(dsigTransforms.toByteArray());
-                    os.write("\n".getBytes());
+                    os.write("\n---".getBytes());
 
                     MetaInfoType mi = ti.getFinalDataMetaInfo();
                     assertNotNull(mi);
diff --git a/utils/src/test/requests/CreateXMLSignatureRequest02.xml_redirect.txt b/utils/src/test/requests/CreateXMLSignatureRequest02.xml_redirect.txt
index 31be50b7..fc0e4f14 100644
--- a/utils/src/test/requests/CreateXMLSignatureRequest02.xml_redirect.txt
+++ b/utils/src/test/requests/CreateXMLSignatureRequest02.xml_redirect.txt
@@ -1,4 +1,4 @@
-<dsig:Transforms>
+--- redirected TransformsInfo content ---<dsig:Transforms>
 				<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></dsig:Transform>
 				<dsig:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
 					<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:pr="http://reference.e-government.gv.at/namespace/persondata/20020228#" version="1.0">
@@ -82,7 +82,7 @@
 				</dsig:Transform>
 				<dsig:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"></dsig:Transform>
 			</dsig:Transforms>
-<dsig:Transforms>
+------ redirected TransformsInfo content ---<dsig:Transforms>
 				<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></dsig:Transform>
 				<dsig:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
 					<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:pr="http://reference.e-government.gv.at/namespace/persondata/20020228#" version="1.0">
@@ -162,3 +162,4 @@
 				</dsig:Transform>
 				<dsig:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"></dsig:Transform>
 			</dsig:Transforms>
+---
\ No newline at end of file
-- 
cgit v1.2.3


From e177419331b8849497d25d3eb1866c5dc715bc88 Mon Sep 17 00:00:00 2001
From: clemenso <clemenso@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Fri, 6 Mar 2009 14:53:37 +0000
Subject: 1.1-rc4

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@312 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../java/at/gv/egiz/bku/gui/PINManagementGUI.java  | 229 +++++++++------
 .../at/gv/egiz/bku/gui/PINManagementGUIFacade.java |  13 +-
 .../at/gv/egiz/bku/gui/PINStatusTableModel.java    |   6 +-
 .../bku/smccstal/ext/GetPINStatusException.java    |  41 +++
 .../smccstal/ext/PINManagementRequestHandler.java  | 312 ++++++++++++++++-----
 .../gv/egiz/bku/gui/ActivationMessages.properties  |   7 +
 .../egiz/bku/gui/ActivationMessages_en.properties  |   4 +
 .../at/gv/egiz/bku/local/stal/BKUGuiProxy.java     |   6 +
 .../src/test/resources/commons-logging.properties  |  16 ++
 BKUOnline/src/test/resources/log4j.properties      |  29 ++
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   |  82 +++++-
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     |  57 ++--
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java |  96 ++++++-
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |  13 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |  13 +-
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |  16 +-
 .../java/at/gv/egiz/marshal/NamespacePrefix.java   |   2 +-
 17 files changed, 703 insertions(+), 239 deletions(-)
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/GetPINStatusException.java
 create mode 100644 BKUOnline/src/test/resources/commons-logging.properties
 create mode 100644 BKUOnline/src/test/resources/log4j.properties

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
index 1276f2d0..c904be0c 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
@@ -20,6 +20,7 @@ package at.gv.egiz.bku.gui;
 import at.gv.egiz.smcc.PINSpec;
 import java.awt.Container;
 import java.awt.Cursor;
+import java.awt.Font;
 import java.awt.event.ActionEvent;
 import java.awt.event.ActionListener;
 import java.awt.event.MouseEvent;
@@ -55,6 +56,8 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
   /** remember the pinSpec to return to worker */
   protected PINSpec pinSpec;
 
+  protected enum DIALOG { VERIFY, ACTIVATE, CHANGE, UNBLOCK };
+
   public PINManagementGUI(Container contentPane,
           Locale locale,
           Style guiStyle,
@@ -84,6 +87,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
           final String activateCmd,
           final String changeCmd,
           final String unblockCmd,
+          final String verifyCmd,
           final ActionListener cancelListener,
           final String cancelCmd) {
 
@@ -161,9 +165,10 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                             activateButton.setText(getMessage(BUTTON_CHANGE));
                             activateButton.setEnabled(true);
                             activateButton.setActionCommand(changeCmd);
-                          } else {
-                            activateButton.setText(getMessage(BUTTON_ACTIVATE));
-                            activateButton.setEnabled(false);
+                          } else if (status == STATUS.UNKNOWN) {
+                            activateButton.setText(getMessage(BUTTON_VERIFY));
+                            activateButton.setEnabled(true);
+                            activateButton.setActionCommand(verifyCmd);
                           }
                         }
                       }
@@ -234,11 +239,11 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
           final ActionListener okListener, final String okCommand,
           final ActionListener cancelListener, final String cancelCommand) {
     log.debug("scheduling activate pin dialog");
-    showPINDialog(false, pin, okListener, okCommand, cancelListener, cancelCommand);
+    showPINDialog(DIALOG.ACTIVATE, pin, okListener, okCommand, cancelListener, cancelCommand);
   }
 
 
-  private void showPINDialog(final boolean changePin, final PINSpec pinSpec,
+  private void showPINDialog(final DIALOG type, final PINSpec pinSpec,
           final ActionListener okListener, final String okCommand,
           final ActionListener cancelListener, final String cancelCommand) {
 
@@ -248,17 +253,25 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
             public void run() {
 
               String HELP_TOPIC, TITLE, MESSAGE_MGMT;
-              if (changePin) {
+              HELP_TOPIC = HELP_PINMGMT;
+
+              if (type == DIALOG.CHANGE) {
                 log.debug("show change pin dialog");
-                HELP_TOPIC = HELP_PINMGMT;
                 TITLE = TITLE_CHANGE_PIN;
                 MESSAGE_MGMT = MESSAGE_CHANGE_PIN;
-              } else {
+              } else if (type == DIALOG.ACTIVATE) {
                 log.debug("show activate pin dialog");
-                HELP_TOPIC = HELP_PINMGMT;
                 TITLE = TITLE_ACTIVATE_PIN;
                 MESSAGE_MGMT = MESSAGE_ACTIVATE_PIN;
                 oldPinField = null;
+              } else if (type == DIALOG.VERIFY) {
+                log.debug("show verify pin dialog");
+                TITLE = TITLE_VERIFY_PIN;
+                MESSAGE_MGMT = MESSAGE_VERIFY_PIN;
+              } else {
+                log.debug("show unblock pin dialog");
+                TITLE = TITLE_UNBLOCK_PIN;
+                MESSAGE_MGMT = MESSAGE_UNBLOCK_PIN;
               }
 
                 mainPanel.removeAll();
@@ -267,7 +280,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 helpListener.setHelpTopic(HELP_TOPIC);
 
                 JLabel mgmtLabel = new JLabel();
-                mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~Font.BOLD));
 
                 if (renderHeaderPanel) {
                   titleLabel.setText(getMessage(TITLE));
@@ -282,73 +295,83 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 }
 
                 JButton okButton = new JButton();
-                okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+                okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~Font.BOLD));
                 okButton.setText(getMessage(BUTTON_OK));
-                okButton.setEnabled(false);
+                okButton.setEnabled(type == DIALOG.VERIFY && pinSpec.getMinLength() == 0);
                 okButton.setActionCommand(okCommand);
                 okButton.addActionListener(okListener);
 
+                JLabel oldPinLabel = null;
+                JLabel repeatPinLabel = null;
                 JLabel pinLabel = new JLabel();
-                pinLabel.setFont(pinLabel.getFont().deriveFont(pinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                String pinLabelPattern = (changePin) ? getMessage(LABEL_NEW_PIN) : getMessage(LABEL_PIN);
+                pinLabel.setFont(pinLabel.getFont().deriveFont(pinLabel.getFont().getStyle() & ~Font.BOLD));
+                String pinLabelPattern = (type == DIALOG.CHANGE) ? getMessage(LABEL_NEW_PIN) : getMessage(LABEL_PIN);
                 pinLabel.setText(MessageFormat.format(pinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                 final JPasswordField repeatPinField = new JPasswordField();
                 pinField = new JPasswordField();
                 pinField.setText("");
-                pinField.setDocument(new PINDocument(pinSpec, null));
                 pinField.setActionCommand(okCommand);
                 pinField.addActionListener(new ActionListener() {
 
                     @Override
                     public void actionPerformed(ActionEvent e) {
                         if (pinField.getPassword().length >= pinSpec.getMinLength()) {
-                          repeatPinField.requestFocusInWindow();
-                        }
-                    }
-                });
-                JLabel repeatPinLabel = new JLabel();
-                repeatPinLabel.setFont(pinLabel.getFont());
-                String repeatPinLabelPattern = getMessage(LABEL_REPEAT_PIN);
-                repeatPinLabel.setText(MessageFormat.format(repeatPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
-
-                repeatPinField.setText("");
-                repeatPinField.setDocument(new PINDocument(pinSpec, okButton, pinField.getDocument()));
-                repeatPinField.setActionCommand(okCommand);
-                repeatPinField.addActionListener(new ActionListener() {
-
-                    @Override
-                    public void actionPerformed(ActionEvent e) {
-                        if (pinField.getPassword().length >= pinSpec.getMinLength()) {
+                          if (type == DIALOG.VERIFY) {
                             okListener.actionPerformed(e);
+                          } else {
+                            repeatPinField.requestFocusInWindow();
+                          }
                         }
                     }
                 });
 
-                JLabel oldPinLabel = null;
-                if (changePin) {
-                  oldPinLabel = new JLabel();
-                  oldPinLabel.setFont(oldPinLabel.getFont().deriveFont(oldPinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                  String oldPinLabelPattern = getMessage(LABEL_OLD_PIN);
-                  oldPinLabel.setText(MessageFormat.format(oldPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
-
-                  oldPinField = new JPasswordField();
-                  oldPinField.setText("");
-                  oldPinField.setDocument(new PINDocument(pinSpec, null));
-                  oldPinField.setActionCommand(okCommand);
-                  oldPinField.addActionListener(new ActionListener() {
+                if (type != DIALOG.VERIFY) {
+                  pinField.setDocument(new PINDocument(pinSpec, null));
+                  repeatPinLabel = new JLabel();
+                  repeatPinLabel.setFont(pinLabel.getFont());
+                  String repeatPinLabelPattern = getMessage(LABEL_REPEAT_PIN);
+                  repeatPinLabel.setText(MessageFormat.format(repeatPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
+
+                  repeatPinField.setText("");
+                  repeatPinField.setDocument(new PINDocument(pinSpec, okButton, pinField.getDocument()));
+                  repeatPinField.setActionCommand(okCommand);
+                  repeatPinField.addActionListener(new ActionListener() {
 
                       @Override
                       public void actionPerformed(ActionEvent e) {
-                          if (oldPinField.getPassword().length >= pinSpec.getMinLength()) {
-                            pinField.requestFocusInWindow();
+                          if (pinField.getPassword().length >= pinSpec.getMinLength()) {
+                              okListener.actionPerformed(e);
                           }
                       }
                   });
+
+                  if (type == DIALOG.CHANGE) {
+                    oldPinLabel = new JLabel();
+                    oldPinLabel.setFont(oldPinLabel.getFont().deriveFont(oldPinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                    String oldPinLabelPattern = getMessage(LABEL_OLD_PIN);
+                    oldPinLabel.setText(MessageFormat.format(oldPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
+
+                    oldPinField = new JPasswordField();
+                    oldPinField.setText("");
+                    oldPinField.setDocument(new PINDocument(pinSpec, null));
+                    oldPinField.setActionCommand(okCommand);
+                    oldPinField.addActionListener(new ActionListener() {
+
+                        @Override
+                        public void actionPerformed(ActionEvent e) {
+                            if (oldPinField.getPassword().length >= pinSpec.getMinLength()) {
+                              pinField.requestFocusInWindow();
+                            }
+                        }
+                    });
+                  } // else -> ACTIVATE (not verify, not change)
+                } else {
+                  pinField.setDocument(new PINDocument(pinSpec, okButton));
                 }
-                
+
                 JLabel pinsizeLabel = new JLabel();
-                pinsizeLabel.setFont(pinsizeLabel.getFont().deriveFont(pinsizeLabel.getFont().getStyle() & ~java.awt.Font.BOLD, pinsizeLabel.getFont().getSize()-2));
+                pinsizeLabel.setFont(pinsizeLabel.getFont().deriveFont(pinsizeLabel.getFont().getStyle() & ~Font.BOLD, pinsizeLabel.getFont().getSize()-2));
                 String pinsizePattern = getMessage(LABEL_PINSIZE);
                 String pinSize = String.valueOf(pinSpec.getMinLength());
                 if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
@@ -375,37 +398,39 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 GroupLayout.ParallelGroup pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
                 GroupLayout.SequentialGroup pinVertical = mainPanelLayout.createSequentialGroup();
 
-                if (pinLabelPos == PinLabelPosition.ABOVE) {
-                  if (changePin) {
-                    pinHorizontal
-                            .addComponent(oldPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                            .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE);
-                    pinVertical
-                            .addComponent(oldPinLabel)
-                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                            .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
-                  }
-                  pinHorizontal 
-                          .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                          .addComponent(repeatPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                          .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                          .addGroup(mainPanelLayout.createSequentialGroup()
-                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                            .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
-                  pinVertical
-                          .addComponent(pinLabel)
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                          .addComponent(repeatPinLabel)
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                          .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                          .addComponent(pinsizeLabel);
-                } else {
-                  if (changePin) {
+//                if (pinLabelPos == PinLabelPosition.ABOVE) {
+//                  if (changePin) {
+//                      pinHorizontal
+//                              .addComponent(oldPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+//                              .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE);
+//                      pinVertical
+//                              .addComponent(oldPinLabel)
+//                              .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+//                              .addComponent(oldPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+//                              .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
+//                  }
+//                  pinHorizontal
+//                          .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+//                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+//                          .addComponent(repeatPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+//                          .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+//                          .addGroup(mainPanelLayout.createSequentialGroup()
+//                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+//                            .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
+//                  pinVertical
+//                          .addComponent(pinLabel)
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+//                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+//                          .addComponent(repeatPinLabel)
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+//                          .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+//                          .addComponent(pinsizeLabel);
+//                } else {
+
+
+                  if (type == DIALOG.CHANGE) {
                     pinHorizontal
                           .addGroup(mainPanelLayout.createSequentialGroup()
                             .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
@@ -422,8 +447,16 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                           .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
                             .addComponent(oldPinLabel)
                             .addComponent(oldPinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(pinLabel)
+                            .addComponent(pinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(repeatPinLabel)
+                            .addComponent(repeatPinField))
                           .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
-                  } else {
+                  } else if (type == DIALOG.ACTIVATE) {
                     pinHorizontal
                           .addGroup(mainPanelLayout.createSequentialGroup()
                             .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
@@ -434,12 +467,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                               .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                               .addComponent(repeatPinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)));
 
-                  }
-                  pinHorizontal
-                          .addGroup(mainPanelLayout.createSequentialGroup()
-                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                            .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
-                  pinVertical
+                    pinVertical
                           .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
                             .addComponent(pinLabel)
                             .addComponent(pinField))
@@ -447,9 +475,27 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                           .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
                             .addComponent(repeatPinLabel)
                             .addComponent(repeatPinField))
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
+                  } else { // VERIFY
+                    pinHorizontal
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                            .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE));
+
+                    pinVertical
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(pinLabel)
+                            .addComponent(pinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
+                  }
+                  pinHorizontal
+                          .addGroup(mainPanelLayout.createSequentialGroup()
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                            .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
+                  pinVertical
                           .addComponent(pinsizeLabel);
-                }
+//                }
 
                 mainPanelLayout.setHorizontalGroup(
                   mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
@@ -503,7 +549,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
           final ActionListener cancelListener, final String cancelCommand) {
     
       log.debug("scheduling change pin dialog");
-      showPINDialog(true, pin, okListener, okCommand, cancelListener, cancelCommand);
+      showPINDialog(DIALOG.CHANGE, pin, okListener, okCommand, cancelListener, cancelCommand);
   }
 
   @Override
@@ -612,4 +658,9 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
 
     return bs;
   }
+
+  @Override
+  public void showVerifyPINDialog(PINSpec pin, ActionListener okListener, String okCmd, ActionListener cancelListener, String cancelCmd) {
+    showPINDialog(DIALOG.VERIFY, pin, okListener, okCmd, cancelListener, cancelCmd);
+  }
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
index 6b083e16..9c630431 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
@@ -31,6 +31,7 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String TITLE_PINMGMT = "title.pin.mgmt";
   public static final String TITLE_ACTIVATE_PIN = "title.activate.pin";
   public static final String TITLE_CHANGE_PIN = "title.change.pin";
+  public static final String TITLE_VERIFY_PIN = "title.verify.pin";
   public static final String TITLE_UNBLOCK_PIN = "title.unblock.pin";
   public static final String TITLE_ACTIVATE_SUCCESS = "title.activate.success";
   public static final String TITLE_CHANGE_SUCCESS = "title.change.success";
@@ -39,19 +40,25 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String MESSAGE_PINMGMT = "message.pin.mgmt";
   public static final String MESSAGE_ACTIVATE_PIN = "message.activate.pin";
   public static final String MESSAGE_CHANGE_PIN = "message.change.pin";
+  public static final String MESSAGE_VERIFY_PIN = "message.verify.pin";
   public static final String MESSAGE_UNBLOCK_PIN = "message.unblock.pin";
   public static final String LABEL_OLD_PIN = "label.old.pin";
   public static final String LABEL_NEW_PIN = "label.new.pin";
   public static final String LABEL_REPEAT_PIN = "label.repeat.pin";
 
+  public static final String ERR_STATUS = "err.status";
   public static final String ERR_ACTIVATE = "err.activate";
   public static final String ERR_CHANGE = "err.change";
   public static final String ERR_UNBLOCK = "err.unblock";
+  public static final String ERR_VERIFY = "err.verify";
   public static final String ERR_RETRIES = "err.retries";
+  public static final String ERR_LOCKED = "err.locked";
+  public static final String ERR_NOT_ACTIVE = "err.not.active";
 
   public static final String BUTTON_ACTIVATE = "button.activate";
   public static final String BUTTON_UNBLOCK = "button.unblock";
   public static final String BUTTON_CHANGE = "button.change";
+  public static final String BUTTON_VERIFY = "button.verify";
 
   public static final String STATUS_ACTIVE = "status.active";
   public static final String STATUS_BLOCKED = "status.blocked";
@@ -61,7 +68,7 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public enum STATUS { ACTIV, NOT_ACTIV, BLOCKED, UNKNOWN };
 
   public void showPINManagementDialog(Map<PINSpec, STATUS> pins,
-          ActionListener activateListener, String activateCmd, String changeCmd, String unblockCmd,
+          ActionListener activateListener, String activateCmd, String changeCmd, String unblockCmd, String verifyCmd,
           ActionListener cancelListener, String cancelCmd);
 
   public void showActivatePINDialog(PINSpec pin,
@@ -76,6 +83,10 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
           ActionListener okListener, String okCmd,
           ActionListener cancelListener, String cancelCmd);
 
+  public void showVerifyPINDialog(PINSpec pin,
+          ActionListener okListener, String okCmd,
+          ActionListener cancelListener, String cancelCmd);
+
   public char[] getOldPin();
 
   public PINSpec getSelectedPINSpec();
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java
index feaa5072..052c13b2 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusTableModel.java
@@ -20,8 +20,6 @@ import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
 import at.gv.egiz.smcc.PINSpec;
 import java.util.Map;
 import javax.swing.table.DefaultTableModel;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 
 /**
  *
@@ -29,7 +27,7 @@ import org.apache.commons.logging.LogFactory;
  */
 public class PINStatusTableModel extends DefaultTableModel {
 
-  protected static final Log log = LogFactory.getLog(PINStatusTableModel.class);
+//  protected static final Log log = LogFactory.getLog(PINStatusTableModel.class);
   protected Class[] types;
 
   public PINStatusTableModel(Map<PINSpec, STATUS> pinStatuses) {
@@ -37,7 +35,7 @@ public class PINStatusTableModel extends DefaultTableModel {
     if (pinStatuses == null) {
       throw new RuntimeException("pinStatuses must not be null");
     }
-    log.trace(pinStatuses.size() + " PINs");
+//    log.trace(pinStatuses.size() + " PINs");
     types = new Class[] { PINSpec.class, STATUS.class };
     for (PINSpec pinSpec : pinStatuses.keySet()) {
       addRow(new Object[] { pinSpec, pinStatuses.get(pinSpec) });
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/GetPINStatusException.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/GetPINStatusException.java
new file mode 100644
index 00000000..abbe66a1
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/GetPINStatusException.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.smccstal.ext;
+
+import at.gv.egiz.smcc.SignatureCardException;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class GetPINStatusException extends SignatureCardException {
+
+    /**
+     * Creates a new instance of <code>GetStatusException</code> without detail message.
+     */
+    public GetPINStatusException() {
+    }
+
+
+    /**
+     * Constructs an instance of <code>GetStatusException</code> with the specified detail message.
+     * @param msg the detail message.
+     */
+    public GetPINStatusException(String msg) {
+        super(msg);
+    }
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
index c8472c97..66db0484 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
@@ -20,7 +20,10 @@ import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
 import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
+import at.gv.egiz.smcc.LockedException;
+import at.gv.egiz.smcc.NotActivatedException;
 import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.STARCOSCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.VerificationFailedException;
 import at.gv.egiz.smcc.util.SMCCHelper;
@@ -32,6 +35,8 @@ import at.gv.egiz.stal.ext.PINManagementResponse;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.logging.Level;
+import java.util.logging.Logger;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
@@ -48,13 +53,20 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
   protected static final Log log = LogFactory.getLog(PINManagementRequestHandler.class);
 
+  Map<PINSpec, STATUS> pinStatuses;
+
   @Override
   public STALResponse handleRequest(STALRequest request) throws InterruptedException {
     if (request instanceof PINManagementRequest) {
 
       PINManagementGUIFacade gui = (PINManagementGUIFacade) this.gui;
 
-      showPINManagementDialog(gui);
+      try {
+      pinStatuses = getPINStatuses();
+
+      gui.showPINManagementDialog(pinStatuses,
+              this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+              this, "cancel");
 
       while (true) {
 
@@ -63,7 +75,9 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
         if ("cancel".equals(actionCommand)) {
           return new PINManagementResponse();
         } else if ("back".equals(actionCommand)) {
-          showPINManagementDialog(gui);
+          gui.showPINManagementDialog(pinStatuses,
+              this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+              this, "cancel");
         } else {
           PINSpec selectedPIN = gui.getSelectedPINSpec();
 
@@ -72,63 +86,163 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
           }
 
           if ("activate_enterpin".equals(actionCommand)) {
-            gui.showActivatePINDialog(selectedPIN, this, "activate", this, "back");
+            gui.showActivatePINDialog(selectedPIN,
+                    this, "activate", this, "back");
           } else if ("change_enterpin".equals(actionCommand)) {
-            gui.showChangePINDialog(selectedPIN, this, "change", this, "back");
+            gui.showChangePINDialog(selectedPIN,
+                    this, "change", this, "back");
           } else if ("unblock_enterpuk".equals(actionCommand)) {
-            gui.showUnblockPINDialog(selectedPIN, this, "unblock", this, "back");
+            gui.showUnblockPINDialog(selectedPIN,
+                    this, "unblock", this, "back");
+          } else if ("verify_enterpin".equals(actionCommand)) {
+            gui.showVerifyPINDialog(selectedPIN,
+                    this, "verify", this, "back");
           } else if ("activate".equals(actionCommand)) {
             try {
-              card.activatePIN(selectedPIN.getKID(),
-                      selectedPIN.getContextAID(),
+              log.debug("activate " + selectedPIN.getLocalizedName());
+              card.activatePIN(selectedPIN,
                       String.valueOf(gui.getPin()));
+              updatePINStatus(selectedPIN, STATUS.ACTIV);
               gui.showMessageDialog(PINManagementGUIFacade.TITLE_ACTIVATE_SUCCESS,
                       PINManagementGUIFacade.MESSAGE_ACTIVATE_SUCCESS,
                       new Object[] {selectedPIN.getLocalizedName()},
                       this, "ok");
               waitForAction();
-              showPINManagementDialog(gui);
+              gui.showPINManagementDialog(pinStatuses,
+                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                this, "cancel");
+            } catch (GetPINStatusException ex) {
+              log.error("failed to get " +  selectedPIN.getLocalizedName() +
+                      " status: " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
+                      this, "cancel");
             } catch (SignatureCardException ex) {
-              log.error("failed to activate " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
+              log.error("failed to activate " + selectedPIN.getLocalizedName() +
+                      ": " + ex.getMessage());
               gui.showErrorDialog(PINManagementGUIFacade.ERR_ACTIVATE, 
                       new Object[] {selectedPIN.getLocalizedName()},
                       this, "cancel");
             }
           } else if ("change".equals(actionCommand)) {
+            log.info("change " + selectedPIN.getLocalizedName());
             try {
-              card.changePIN(selectedPIN.getKID(),
-                      selectedPIN.getContextAID(),
+              card.changePIN(selectedPIN,
                       String.valueOf(gui.getOldPin()),
                       String.valueOf(gui.getPin()));
+              updatePINStatus(selectedPIN, STATUS.ACTIV);
               gui.showMessageDialog(PINManagementGUIFacade.TITLE_CHANGE_SUCCESS,
                       PINManagementGUIFacade.MESSAGE_CHANGE_SUCCESS,
                       new Object[] {selectedPIN.getLocalizedName()},
                       this, "ok");
               waitForAction();
-              showPINManagementDialog(gui);
+              gui.showPINManagementDialog(pinStatuses,
+                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                this, "cancel");
+            } catch (GetPINStatusException ex) {
+              log.error("failed to get " +  selectedPIN.getLocalizedName() +
+                      " status: " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
+                      this, "cancel");
+            } catch (LockedException ex) {
+              log.error("failed to change " + selectedPIN.getLocalizedName() +
+                      ": PIN locked");
+              updatePINStatus(selectedPIN, STATUS.BLOCKED);
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_LOCKED,
+                      new Object[] {selectedPIN.getLocalizedName()},
+                      this, "ok");
+              waitForAction();
+              gui.showPINManagementDialog(pinStatuses,
+                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                this, "cancel");
             } catch (VerificationFailedException ex) {
-              log.error("failed to change " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
+              log.error("failed to change " + selectedPIN.getLocalizedName() +
+                      ": " + ex.getMessage());
               gui.showErrorDialog(PINManagementGUIFacade.ERR_RETRIES,
                       new Object[] {selectedPIN.getLocalizedName(), ex.getRetries()},
-                      this, "back");
+                      this, "change_enterpin");
+            } catch (NotActivatedException ex) {
+              log.error("failed to change " + selectedPIN.getLocalizedName() +
+                      ": PIN not active");
+              updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_NOT_ACTIVE,
+                      new Object[] {selectedPIN.getLocalizedName()},
+                      this, "ok");
+              waitForAction();
+              gui.showPINManagementDialog(pinStatuses,
+                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                this, "cancel");
             } catch (SignatureCardException ex) {
-              log.error("failed to change " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
+              log.error("failed to change " + selectedPIN.getLocalizedName() +
+                      ": " + ex.getMessage());
               gui.showErrorDialog(PINManagementGUIFacade.ERR_CHANGE, 
                       new Object[] {selectedPIN.getLocalizedName()},
                       this, "cancel");
             }
           } else if ("unblock".equals(actionCommand)) {
+            log.info("unblock " + selectedPIN.getLocalizedName());
             log.error("unblock PIN not implemented");
             gui.showErrorDialog(PINManagementGUIFacade.ERR_UNBLOCK, null, this, "cancel");
+          } else if ("verify".equals(actionCommand)) {
+            try {
+              log.info("verify " + selectedPIN.getLocalizedName());
+              int retries = card.verifyPIN(selectedPIN, String.valueOf(gui.getPin()));
+              log.trace(retries + " retries");
+              if (retries < 0) {
+                updatePINStatus(selectedPIN, STATUS.ACTIV);
+                gui.showPINManagementDialog(pinStatuses,
+                        this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                        this, "cancel");
+              } else {
+                log.error("failed to verify " + selectedPIN.getLocalizedName() +
+                      ": " + retries + " retries left");
+                gui.showErrorDialog(PINManagementGUIFacade.ERR_RETRIES,
+                      new Object[] {selectedPIN.getLocalizedName(), retries},
+                      this, "verify_enterpin");
+              }
+            } catch (GetPINStatusException ex) {
+              log.error("failed to get " +  selectedPIN.getLocalizedName() +
+                      " status: " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
+                      this, "cancel");
+            } catch (LockedException ex) {
+              log.error("failed to verify " + selectedPIN.getLocalizedName() +
+                      ": PIN locked");
+              updatePINStatus(selectedPIN, STATUS.BLOCKED);
+              gui.showPINManagementDialog(pinStatuses,
+                      this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                      this, "cancel");
+            } catch (NotActivatedException ex) {
+              log.error("failed to verify " + selectedPIN.getLocalizedName() +
+                      ": PIN not active");
+              updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
+              gui.showPINManagementDialog(pinStatuses,
+                      this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                      this, "cancel");
+            } catch (SignatureCardException ex) {
+              log.error("failed to verify " + selectedPIN.getLocalizedName() +
+                      ": " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS,
+                      new Object[] {selectedPIN.getLocalizedName()},
+                      this, "cancel");
+            }
+
           } else {
             throw new RuntimeException("unsupported action " + actionCommand);
           }
         }
       }
+      } catch (GetPINStatusException ex) {
+        log.error("Failed to get PIN statuses: " + ex.getMessage());
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
+                this, "ok");
+        waitForAction();
+        return new ErrorResponse(1000);
+      }
     } else {
       log.error("Got unexpected STAL request: " + request);
       return new ErrorResponse(1000);
     }
+
   }
 
   @Override
@@ -136,75 +250,129 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
     return true;
   }
 
-  public Map<PINSpec, STATUS> getPINStatuses() throws SignatureCardException {
-    Card icc = card.getCard();
-    try {
-      icc.beginExclusive();
-      CardChannel channel = icc.getBasicChannel();
+  private Map<PINSpec, STATUS> getPINStatuses() throws GetPINStatusException {
+    HashMap<PINSpec, STATUS> pinStatuses = new HashMap<PINSpec, STATUS>();
+    List<PINSpec> pins = card.getPINSpecs();
 
-      HashMap<PINSpec, STATUS> pinStatuses = new HashMap<PINSpec, STATUS>();
-      List<PINSpec> pins = card.getPINSpecs();
+    if (card instanceof STARCOSCard) {
+      Card icc = card.getCard();
+      try {
+        icc.beginExclusive();
+        CardChannel channel = icc.getBasicChannel();
 
-      for (PINSpec pinSpec : pins) {
-        byte kid = pinSpec.getKID();
-        byte[] contextAID = pinSpec.getContextAID();
-
-        if (contextAID != null) {
-          CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
-          ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
-          if (responseAPDU.getSW() != 0x9000) {
-            icc.endExclusive();
-            String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) +
-                    ": Failed to select AID " + SMCCHelper.toString(contextAID) +
-                    ": " + SMCCHelper.toString(responseAPDU.getBytes());
-            log.error(msg);
-            throw new SignatureCardException(msg);
+        for (PINSpec pinSpec : pins) {
+          byte kid = pinSpec.getKID();
+          byte[] contextAID = pinSpec.getContextAID();
+
+          if (contextAID != null) {
+            CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
+            ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
+            if (responseAPDU.getSW() != 0x9000) {
+              icc.endExclusive();
+              String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
+                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
+              log.error(msg);
+              throw new GetPINStatusException(msg);
+            }
           }
-        }
 
-        CommandAPDU verifyAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0x20, (byte) 00, kid});
-        ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
+          CommandAPDU verifyAPDU = new CommandAPDU(new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 00, kid });
+          ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
 
-        STATUS status = STATUS.UNKNOWN;
-        if (responseAPDU.getSW() == 0x6984) {
-          status = STATUS.NOT_ACTIV;
-        } else if (responseAPDU.getSW() == 0x63c0) {
-          status = STATUS.BLOCKED;
-        } else if (responseAPDU.getSW1() == 0x63) {
-          status = STATUS.ACTIV;
-        }
-        if (log.isDebugEnabled()) {
-          log.debug("PIN " + pinSpec.getLocalizedName() + " status: " + SMCCHelper.toString(responseAPDU.getBytes()));
+          STATUS status = STATUS.UNKNOWN;
+          if (responseAPDU.getSW() == 0x6984) {
+            status = STATUS.NOT_ACTIV;
+          } else if (responseAPDU.getSW() == 0x63c0) {
+            status = STATUS.BLOCKED;
+          } else if (responseAPDU.getSW1() == 0x63) {
+            status = STATUS.ACTIV;
+          }
+          if (log.isDebugEnabled()) {
+            log.debug("PIN " + pinSpec.getLocalizedName() +
+                    " status: " + SMCCHelper.toString(responseAPDU.getBytes()));
+          }
+          pinStatuses.put(pinSpec, status);
         }
+        return pinStatuses;
 
-        pinStatuses.put(pinSpec, status);
-      }
-//      icc.endExclusive();
-
-      return pinStatuses;
-
-    } catch (CardException ex) {
-      log.error("Failed to get PIN status: " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
-    } finally {
-      try {
-        icc.endExclusive();
       } catch (CardException ex) {
-        log.trace("failed to end exclusive card access");
+        log.error("Failed to get PIN status: " + ex.getMessage(), ex);
+        throw new GetPINStatusException(ex.getMessage());
+      } finally {
+        try {
+          icc.endExclusive();
+        } catch (CardException ex) {
+          log.trace("failed to end exclusive card access: " + ex.getMessage());
+        }
+      }
+    } else {
+      for (PINSpec pinSpec : pins) {
+        pinStatuses.put(pinSpec, STATUS.UNKNOWN);
       }
     }
+    return pinStatuses;
   }
 
-  private void showPINManagementDialog(PINManagementGUIFacade gui) {
-    try {
-      Map<PINSpec, STATUS> pins = getPINStatuses();
-      gui.showPINManagementDialog(pins, 
-              this, "activate_enterpin", "change_enterpin", "unblock_enterpuk",
-              this, "cancel");
-    } catch (SignatureCardException ex) {
-      gui.showErrorDialog(BKUGUIFacade.ERR_UNKNOWN_WITH_PARAM, 
-              new Object[]{ex.getMessage()},
-              this, "cancel");
+  /**
+   * query status for STARCOS card,
+   * assume provided status for ACOS card
+   * @param pinSpec
+   * @param status
+   * @throws at.gv.egiz.smcc.SignatureCardException if query status fails
+   */
+  private void updatePINStatus(PINSpec pinSpec, STATUS status) throws GetPINStatusException {
+    if (card instanceof STARCOSCard) {
+      Card icc = card.getCard();
+      try {
+        icc.beginExclusive();
+        CardChannel channel = icc.getBasicChannel();
+
+          byte kid = pinSpec.getKID();
+          byte[] contextAID = pinSpec.getContextAID();
+
+          if (contextAID != null) {
+            CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
+            ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
+            if (responseAPDU.getSW() != 0x9000) {
+              icc.endExclusive();
+              String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
+                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
+              log.error(msg);
+              throw new GetPINStatusException(msg);
+            }
+          }
+
+          CommandAPDU verifyAPDU = new CommandAPDU(new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 00, kid });
+          ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
+
+          status = STATUS.UNKNOWN;
+          if (responseAPDU.getSW() == 0x6984) {
+            status = STATUS.NOT_ACTIV;
+          } else if (responseAPDU.getSW() == 0x63c0) {
+            status = STATUS.BLOCKED;
+          } else if (responseAPDU.getSW1() == 0x63) {
+            status = STATUS.ACTIV;
+          }
+          if (log.isDebugEnabled()) {
+            log.debug(pinSpec.getLocalizedName() +
+                    " status: " + SMCCHelper.toString(responseAPDU.getBytes()));
+          }
+          pinStatuses.put(pinSpec, status);
+
+      } catch (CardException ex) {
+        log.error("Failed to get PIN status: " + ex.getMessage(), ex);
+        throw new GetPINStatusException(ex.getMessage());
+      } finally {
+        try {
+          icc.endExclusive();
+        } catch (CardException ex) {
+          log.warn("failed to end exclusive card access: " + ex.getMessage());
+        }
+      }
+    } else {
+      pinStatuses.put(pinSpec, status);
     }
   }
 }
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
index 430f85b5..69d231f7 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
@@ -18,6 +18,7 @@ title.pin.mgmt=<html>PIN Verwaltung</html>
 title.activate.pin=<html>PIN Aktivieren</html>
 title.change.pin=<html>PIN \u00C4ndern</html>
 title.unblock.pin=<html>PIN Entsperren</html>
+title.verify.pin=<html>PIN Eingeben</html>
 title.activate.success=<html>Erfolg</html>
 title.change.success=<html>Erfolg</html>
 
@@ -25,6 +26,7 @@ message.pin.mgmt=<html>Die Karte verf\u00FCgt \u00FCber {0} PINs</html>
 message.activate.pin=<html>{0} eingeben und best\u00E4tigen</html>
 message.change.pin=<html>{0} eingeben und best\u00E4tigen</html>
 message.unblock.pin=<html>PUK zu {0} eingeben</html>
+message.verify.pin=<html>{0} eingeben (TODO: Warning not activated)</html>
 message.activate.success=<html>{0} wurde erfolgreich aktiviert.</html>
 message.change.success=<html>{0} wurde erfolgreich ge\u00E4ndert.</html>
 
@@ -38,14 +40,19 @@ label.repeat.pin=<html>Best\u00E4tigung:</html>
 button.activate=Aktivieren
 button.change=\u00C4ndern
 button.unblock=Entsperren
+button.verify=Abfragen
 
 help.activation=help.activation
 help.pin.mgmt=help.pin.mgmt
 
+err.status=<html>Der Status der PINs konnte nicht \u00FCberpr\u00FCft werden.</html>
 err.activate=<html>Beim Aktivieren der {0} trat ein Fehler auf.</html>
 err.change=<html>Beim \u00C4ndern der {0} trat ein Fehler auf.</html>
 err.unblock=<html>Das Entsperren der {0} wird nicht unterst\u00FCtzt.</html>
+err.verify=<html>VERIFY ERROR (TODO)</html>
 err.retries=<html>Falscher {0}, noch {1} Versuche</html>
+err.locked=<html>{0} gesperrt.</html>
+err.not.active=<html>{0} nicht aktiviert.</html>
 
 status.not.active=NICHT AKTIV
 status.active=AKTIV
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
index 98d18633..920f7d5b 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
@@ -38,14 +38,18 @@ label.repeat.pin=<html>Confirmation:</html>
 button.activate=Activate
 button.change=Change
 button.unblock=Unblock
+button.verify=Query
 
 help.activation=help.activation
 help.pin.mgmt=help.pin.mgmt
 
+err.status=<html>PIN statuses could not be read.</html>
 err.activate=<html>An error occured during the activation of {0}.</html>
 err.change=<html>An error occured during the changing of {0}.</html>
 err.unblock=<html>Unblocking of {0} is not supported.</html>
 err.retries=<html>Wrong {0}, {1} tries remaining</html>
+err.locked=<html>{0} locked</html>
+err.not.active=<html>{0} not activated.</html>
 
 status.not.active=NOT ACTIVE
 status.active=ACTIVE
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
index a28ee1eb..1714017e 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
@@ -124,4 +124,10 @@ public class BKUGuiProxy implements BKUGUIFacade {
     showDialog();
     delegate.showHashDataInputDialog(signedReferences, okListener, okCommand);
   }
+
+  @Override
+  public void showMessageDialog(String titleKey, String msgKey, Object[] msgParams, ActionListener okListener, String okCommand) {
+    showDialog();
+    delegate.showMessageDialog(titleKey, msgKey, msgParams, okListener, okCommand);
+  }
 }
diff --git a/BKUOnline/src/test/resources/commons-logging.properties b/BKUOnline/src/test/resources/commons-logging.properties
new file mode 100644
index 00000000..0d497b1b
--- /dev/null
+++ b/BKUOnline/src/test/resources/commons-logging.properties
@@ -0,0 +1,16 @@
+# Copyright 2008 Federal Chancellery Austria and
+# Graz University of Technology
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+org.apache.commons.logging.Log=org.apache.commons.logging.impl.Log4JLogger
diff --git a/BKUOnline/src/test/resources/log4j.properties b/BKUOnline/src/test/resources/log4j.properties
new file mode 100644
index 00000000..b30aa40a
--- /dev/null
+++ b/BKUOnline/src/test/resources/log4j.properties
@@ -0,0 +1,29 @@
+# Copyright 2008 Federal Chancellery Austria and
+# Graz University of Technology
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+#log4j.rootLogger=INFO, STDOUT, file
+log4j.rootLogger=DEBUG, STDOUT
+log4j.logger.at.gv.egiz.bku.slcommands=TRACE, STDOUT
+log4j.logger.at.gv.egiz.bku.binding=TRACE, STDOUT
+#log4j.logger.at.gv = INFO
+
+
+# STDOUT appender
+log4j.appender.STDOUT=org.apache.log4j.ConsoleAppender
+log4j.appender.STDOUT.layout=org.apache.log4j.PatternLayout
+#log4j.appender.STDOUT.layout.ConversionPattern=%5p | %d{dd HH:mm:ss,SSS} | %20c |  %10t | %m%n
+#log4j.appender.STDOUT.layout.ConversionPattern=%-4r [%t] %-5p %c %x - %m%n
+log4j.appender.STDOUT.layout.ConversionPattern=%-5p | %t | %c %x - %m%n
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index 57925240..c2c62fd8 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -31,6 +31,7 @@ package at.gv.egiz.smcc;
 import at.gv.egiz.smcc.util.SMCCHelper;
 import java.nio.charset.Charset;
 
+import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CommandAPDU;
@@ -334,8 +335,8 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
   }
 
   @Override
-  public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
-    
+  protected int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
+
     CardChannel channel = getCardChannel();
 
     ResponseAPDU resp;
@@ -343,13 +344,17 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
       if (pin != null) {
         resp = transmit(channel, new CommandAPDU(0x00, 0x20, 0x00, kid, encodePINBlock(pin)), false);
       } else {
+        //TODO this is not supported
         resp = transmit(channel, new CommandAPDU(0x00, 0x20, 0x00, kid), false);
       }
     } catch (CardException ex) {
       log.error("smart card communication failed: " + ex.getMessage());
       throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
     }
-    
+
+    //6A 00 (falshe P1/P2) nicht in contextAID
+    //69 85 (nutzungsbedingungen nicht erfüllt) in DF_Sig und nicht sigpin
+
     if (resp.getSW() == 0x63c0) {
       throw new LockedException("PIN locked.");
     } else if (resp.getSW1() == 0x63 && resp.getSW2() >> 4 == 0xc) {
@@ -363,7 +368,6 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
       throw new SignatureCardException("Failed to verify pin: SW="
           + Integer.toHexString(resp.getSW()) + ".");
     }
-
   }
   
   private void mseSetDST(int p1, int p2, byte[] dst) throws CardException, SignatureCardException {
@@ -432,8 +436,7 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
    * @param pin
    * @return a 8 byte pin block 
    */
-  @Override
-  public byte[] encodePINBlock(String pin) {
+  private byte[] encodePINBlock(String pin) {
     byte[] asciiPIN = pin.getBytes(Charset.forName("ASCII"));
     byte[] encodedPIN = new byte[8];
     System.arraycopy(asciiPIN, 0, encodedPIN, 0, Math.min(asciiPIN.length,
@@ -443,7 +446,72 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
   }
 
   @Override
-  public void activatePIN(byte kid, byte[] contextAID, String pin) throws SignatureCardException {
+  public void activatePIN(PINSpec pinSpec, String pin) throws SignatureCardException {
     throw new SignatureCardException("PIN activation not supported by this card");
   }
+
+  /**
+   * SCARD_E_NOT_TRANSACTED inf/dec PIN not active (pcsc crash)
+   * @param pinSpec
+   * @param oldPIN
+   * @param newPIN
+   * @throws at.gv.egiz.smcc.LockedException
+   * @throws at.gv.egiz.smcc.VerificationFailedException
+   * @throws at.gv.egiz.smcc.NotActivatedException
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  @Override
+  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN)
+          throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
+    Card icc = getCard();
+    try {
+      icc.beginExclusive();
+      CardChannel channel = icc.getBasicChannel();
+
+      if (pinSpec.getContextAID() != null) {
+        ResponseAPDU responseAPDU = transmit(channel,
+                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
+        if (responseAPDU.getSW() != 0x9000) {
+          icc.endExclusive();
+          String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
+                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
+          log.error(msg);
+          throw new SignatureCardException(msg);
+        }
+      }
+
+      byte[] cmd = new byte[16];
+      System.arraycopy(encodePINBlock(oldPIN), 0, cmd, 0, 8);
+      System.arraycopy(encodePINBlock(newPIN), 0, cmd, 8, 8);
+
+      ResponseAPDU responseAPDU = transmit(channel,
+              new CommandAPDU(0x00, 0x24, 0x00, pinSpec.getKID(), cmd), false);
+
+      icc.endExclusive();
+
+      log.debug("change pin returned SW=" + Integer.toHexString(responseAPDU.getSW()));
+
+      if (responseAPDU.getSW() == 0x63c0) {
+        log.error(pinSpec.getLocalizedName() + " locked");
+        throw new LockedException();
+      } else if (responseAPDU.getSW1() == 0x63 && responseAPDU.getSW2() >> 4 == 0xc) {
+        int retries = responseAPDU.getSW2() & 0x0f;
+        log.error("wrong " + pinSpec.getLocalizedName() + ", " + retries + " retries");
+        throw new VerificationFailedException(retries);
+      } else if (responseAPDU.getSW() == 0x6983) {
+        // sig-pin only (card not transacted for inf/dec pin)
+        log.error(pinSpec.getLocalizedName() + " not activated");
+        throw new NotActivatedException();
+      } else if (responseAPDU.getSW() != 0x9000) {
+        String msg = "Failed to change " + pinSpec.getLocalizedName() +
+                ": SW=" + Integer.toHexString(responseAPDU.getSW());
+        log.error(msg);
+        throw new SignatureCardException(msg);
+      }
+    } catch (CardException ex) {
+      log.error("Failed to change " + pinSpec.getLocalizedName() +
+              ": " + ex.getMessage());
+      throw new SignatureCardException(ex.getMessage(), ex);
+    }
+  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index 63301bd1..39952bb9 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -37,6 +37,8 @@ import java.util.List;
 import java.util.Locale;
 import java.util.ResourceBundle;
 
+import java.util.logging.Level;
+import java.util.logging.Logger;
 import javax.smartcardio.ATR;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
@@ -117,8 +119,8 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   protected abstract ResponseAPDU selectFileFID(byte[] fid) throws CardException,
       SignatureCardException;
 
-  // made public
-//  protected abstract int verifyPIN(String pin, byte kid) throws CardException, SignatureCardException;
+  protected abstract int verifyPIN(String pin, byte kid) 
+          throws LockedException, NotActivatedException, SignatureCardException;
 
   
   protected byte[] readRecord(int recordNumber) throws SignatureCardException, CardException {
@@ -321,7 +323,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
         throw new VerificationFailedException(retries);
       }
     }
-    
+   
     return readBinaryTLV(maxLength, (byte) 0x30);
       
     
@@ -443,53 +445,40 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     return pinSpecs;
   }
 
-  public void changePIN(byte kid, byte[] contextAID, String oldPIN, String newPIN) throws SignatureCardException, VerificationFailedException {
+  @Override
+  public int verifyPIN(PINSpec pinSpec, String pin) throws LockedException, NotActivatedException, SignatureCardException {
+
     Card icc = getCard();
     try {
       icc.beginExclusive();
       CardChannel channel = icc.getBasicChannel();
 
-      if (contextAID != null) {
+      if (pinSpec.getContextAID() != null) {
         ResponseAPDU responseAPDU = transmit(channel,
-                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID));
+                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
         if (responseAPDU.getSW() != 0x9000) {
           icc.endExclusive();
-          String msg = "Failed to change PIN " + SMCCHelper.toString(new byte[]{kid}) +
-                  ": Failed to select AID " + SMCCHelper.toString(contextAID) +
+          String msg = "Failed to verify PIN " +
+                  SMCCHelper.toString(new byte[]{pinSpec.getKID()}) +
+                  ": Failed to verify AID " +
+                  SMCCHelper.toString(pinSpec.getContextAID()) +
                   ": " + SMCCHelper.toString(responseAPDU.getBytes());
           log.error(msg);
           throw new SignatureCardException(msg);
         }
       }
+      return verifyPIN(pin, pinSpec.getKID());
 
-      byte[] cmd = new byte[16];
-      System.arraycopy(encodePINBlock(oldPIN), 0, cmd, 0, 8);
-      System.arraycopy(encodePINBlock(newPIN), 0, cmd, 8, 8);
-
-      ResponseAPDU responseAPDU = transmit(channel,
-              new CommandAPDU(0x00, 0x24, 0x00, kid, cmd), false);
-
-      icc.endExclusive();
-
-      if (responseAPDU.getSW1() == 0x63 && responseAPDU.getSW2() >> 4 == 0xc) {
-        int retries = responseAPDU.getSW2() & 0x0f;
-        log.error("Failed VERIFY PIN, " + retries + " tries left");
-        throw new VerificationFailedException(retries);
-      }
-      if (responseAPDU.getSW() != 0x9000) {
-        String msg = "Failed to change PIN "
-                + SMCCHelper.toString(new byte[]{kid}) + ": "
-                + SMCCHelper.toString(responseAPDU.getBytes());
-        log.error(msg);
-        throw new SignatureCardException(msg);
+    } catch (CardException ex) {
+      log.error("failed to verify pinspec: " + ex.getMessage(), ex);
+      throw new SignatureCardException(ex);
+    } finally {
+      try {
+        icc.endExclusive();
+      } catch (CardException ex) {
+        log.trace("failed to end exclusive card access: " + ex.getMessage());
       }
 
-    } catch (CardException ex) {
-      log.error("Failed to change PIN: " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
     }
   }
-  
-  abstract byte[] encodePINBlock(String pin);
-
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index b1288f74..3c5f38a2 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -512,7 +512,7 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
         throw new LockedException();
       } else if (resp.getSW() == 0x6984) {
         // PIN LCS = "Initialized" (-> not activated)
-        throw new NotActivatedException("PIN not set.");
+        throw new NotActivatedException();
       } else if (resp.getSW() == 0x9000) {
         return -1; // success
       } else {
@@ -552,8 +552,7 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
    * @return a 8 byte pin block consisting of length byte (0x2X),
    * the BCD encoded pin and a 0xFF padding
    */
-  @Override
-  public byte[] encodePINBlock(String pin) {
+  private byte[] encodePINBlock(String pin) {
     char[] pinChars = pin.toCharArray();
     int numDigits = pinChars.length;
     int numBytes = (int) Math.ceil(numDigits/2.0);
@@ -572,37 +571,108 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
     return pinBlock;
   }
 
-  public void activatePIN(byte kid, byte[] contextAID, String pin) throws SignatureCardException {
+  @Override
+  public void activatePIN(PINSpec pinSpec, String pin)
+          throws SignatureCardException {
     Card icc = getCard();
     try {
       icc.beginExclusive();
       CardChannel channel = icc.getBasicChannel();
 
-      if (contextAID != null) {
+      if (pinSpec.getContextAID() != null) {
         ResponseAPDU responseAPDU = transmit(channel,
-                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID));
+                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
         if (responseAPDU.getSW() != 0x9000) {
           icc.endExclusive();
-          String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) +
-                  ": Failed to select AID " + SMCCHelper.toString(contextAID) +
-                  ": " + SMCCHelper.toString(responseAPDU.getBytes());
+          String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
+                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
           log.error(msg);
           throw new SignatureCardException(msg);
         }
       }
 
       ResponseAPDU responseAPDU = transmit(channel,
-              new CommandAPDU(0x00, 0x24, 0x01, kid, encodePINBlock(pin)), false);
+              new CommandAPDU(0x00, 0x24, 0x01, pinSpec.getKID(), encodePINBlock(pin)),
+              false);
 
       icc.endExclusive();
 
-      if (responseAPDU.getSW() != 0x9000) {
-        String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) + ": " + SMCCHelper.toString(responseAPDU.getBytes());
+      log.debug("activate pin returned SW=" + Integer.toHexString(responseAPDU.getSW()));
+
+       if (responseAPDU.getSW() != 0x9000) {
+        String msg = "Failed to activate " + pinSpec.getLocalizedName() +
+                ": SW=" + Integer.toHexString(responseAPDU.getSW());
+        log.error(msg);
+        throw new SignatureCardException(msg);
+      }
+    } catch (CardException ex) {
+      log.error("Failed to activate " + pinSpec.getLocalizedName() +
+              ": " + ex.getMessage());
+      throw new SignatureCardException(ex.getMessage(), ex);
+    }
+  }
+
+  /**
+   * activates pin (newPIN) if not active
+   * @param pinSpec
+   * @param oldPIN
+   * @param newPIN
+   * @throws at.gv.egiz.smcc.LockedException
+   * @throws at.gv.egiz.smcc.VerificationFailedException
+   * @throws at.gv.egiz.smcc.NotActivatedException
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  @Override
+  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN)
+          throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
+    Card icc = getCard();
+    try {
+      icc.beginExclusive();
+      CardChannel channel = icc.getBasicChannel();
+
+      if (pinSpec.getContextAID() != null) {
+        ResponseAPDU responseAPDU = transmit(channel,
+                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
+        if (responseAPDU.getSW() != 0x9000) {
+          icc.endExclusive();
+          String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
+                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
+          log.error(msg);
+          throw new SignatureCardException(msg);
+        }
+      }
+
+      byte[] cmd = new byte[16];
+      System.arraycopy(encodePINBlock(oldPIN), 0, cmd, 0, 8);
+      System.arraycopy(encodePINBlock(newPIN), 0, cmd, 8, 8);
+
+      ResponseAPDU responseAPDU = transmit(channel,
+              new CommandAPDU(0x00, 0x24, 0x00, pinSpec.getKID(), cmd), false);
+
+      icc.endExclusive();
+
+      log.debug("change pin returned SW=" + Integer.toHexString(responseAPDU.getSW()));
+
+      // activates pin (newPIN) if not active
+      if (responseAPDU.getSW() == 0x63c0) {
+        log.error(pinSpec.getLocalizedName() + " locked");
+        throw new LockedException();
+      } else if (responseAPDU.getSW1() == 0x63 && responseAPDU.getSW2() >> 4 == 0xc) {
+        int retries = responseAPDU.getSW2() & 0x0f;
+        log.error("wrong " + pinSpec.getLocalizedName() + ", " + retries + " retries");
+        throw new VerificationFailedException(retries);
+      } else if (responseAPDU.getSW() == 0x6983) {
+        log.error(pinSpec.getLocalizedName() + " locked");
+        throw new LockedException();
+      } else if (responseAPDU.getSW() != 0x9000) {
+        String msg = "Failed to change " + pinSpec.getLocalizedName() +
+                ": SW=" + Integer.toHexString(responseAPDU.getSW());
         log.error(msg);
         throw new SignatureCardException(msg);
       }
     } catch (CardException ex) {
-      log.error("Failed to activate PIN: " + ex.getMessage());
+      log.error("Failed to change " + pinSpec.getLocalizedName() +
+              ": " + ex.getMessage());
       throw new SignatureCardException(ex.getMessage(), ex);
     }
   }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index 57aeb994..d7763be0 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -393,22 +393,21 @@ public class SWCard implements SignatureCard {
   public void reset() throws SignatureCardException {
   }
 
-  @Override
-  public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
-    return -1;
-  }
-
   @Override
   public List<PINSpec> getPINSpecs() {
     return new ArrayList<PINSpec>();
   }
 
   @Override
-  public void changePIN(byte kid, byte[] contextAID, String oldPIN, String newPIN) throws SignatureCardException, VerificationFailedException {
+  public int verifyPIN(PINSpec pinSpec, String pin) throws LockedException, NotActivatedException, SignatureCardException {
+    return -1;
   }
 
   @Override
-  public void activatePIN(byte kid, byte[] contextAID, String pin) throws SignatureCardException {
+  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN) throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
   }
 
+  @Override
+  public void activatePIN(PINSpec pinSpec, String pin) throws SignatureCardException {
+  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index a88593bc..3c2273b9 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -125,21 +125,20 @@ public interface SignatureCard {
 
   /**
    *
+   * @param pinSpec descriptor which pin to verify
    * @param pin may be null to test the PIN status
-   * @param kid
    * @return the number of remaining retries or -1
    * @throws at.gv.egiz.smcc.LockedException
    * @throws at.gv.egiz.smcc.NotActivatedException
    * @throws at.gv.egiz.smcc.SignatureCardException
    */
-  public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException;
+  public int verifyPIN(PINSpec pinSpec, String pin)
+          throws LockedException, NotActivatedException, SignatureCardException;
 
-  public void changePIN(byte kid, byte[] contextAID,
-          String oldPIN, String newPIN)
-          throws SignatureCardException, VerificationFailedException;
+  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN)
+          throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException;
 
-  public void activatePIN(byte kid, byte[] contextAID,
-          String pin)
+  public void activatePIN(PINSpec pinSpec, String pin)
           throws SignatureCardException;
 
   /**
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index a5d6df23..b2a91784 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -88,13 +88,21 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
 
 
       @Override
-      public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
-        return 0;
+      public List<PINSpec> getPINSpecs() {
+        return new ArrayList<PINSpec>();
       }
 
       @Override
-      public List<PINSpec> getPINSpecs() {
-        return new ArrayList<PINSpec>();
+      public int verifyPIN(PINSpec pinSpec, String pin) throws LockedException, NotActivatedException, SignatureCardException {
+        return -1;
+      }
+
+      @Override
+      public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN) throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
+      }
+
+      @Override
+      public void activatePIN(PINSpec pinSpec, String pin) throws SignatureCardException {
       }
      
    };
diff --git a/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java b/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java
index c03f17cd..3ae1d0ff 100644
--- a/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java
+++ b/utils/src/main/java/at/gv/egiz/marshal/NamespacePrefix.java
@@ -28,7 +28,7 @@ public interface NamespacePrefix {
   String SAML10_PREFIX = "saml";
   String SL_PREFIX = "sl";
   String XADES_PREFIX = "xades";
-  String XMLDSIG_PREFIX = "xmldsig";
+  String XMLDSIG_PREFIX = "dsig";
   String XSI_PREFIX = "xsi";
 
 }
-- 
cgit v1.2.3


From 2a1df5e58e44f8d77f34eb80df74e8c0d27caceb Mon Sep 17 00:00:00 2001
From: clemenso <clemenso@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Wed, 18 Mar 2009 22:27:28 +0000
Subject: 1.1-rc5 (pinProviderFactories, gui refactoring, signatureCard,
 secureViewer)

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@322 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../gv/egiz/bku/online/applet/AppletBKUWorker.java |   5 +-
 .../bku/online/applet/AppletHashDataDisplay.java   | 217 --------
 .../egiz/bku/online/applet/AppletSecureViewer.java | 221 ++++++++
 .../java/at/gv/egiz/bku/gui/PINManagementGUI.java  | 365 +++++++-------
 .../at/gv/egiz/bku/gui/PINManagementGUIFacade.java |  46 +-
 .../bku/online/applet/PINManagementBKUWorker.java  |  10 +-
 .../smccstal/ext/ManagementPINProviderFactory.java |  53 ++
 .../smccstal/ext/PINManagementRequestHandler.java  | 319 ++++++------
 .../bku/smccstal/ext/PinpadPINProviderFactory.java | 126 +++++
 .../smccstal/ext/SoftwarePINProviderFactory.java   | 148 ++++++
 .../gv/egiz/bku/gui/ActivationMessages.properties  |  17 +-
 .../egiz/bku/gui/ActivationMessages_en.properties  |  15 +-
 .../test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java |   4 +-
 .../gv/egiz/bku/smccstal/ext/FileSystemTest.java   | 435 ----------------
 .../main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java |  66 ++-
 .../main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java   | 560 +++++++++++----------
 .../main/java/at/gv/egiz/bku/gui/PinDocument.java  |  30 +-
 .../at/gv/egiz/bku/gui/Messages.properties         |  28 +-
 .../at/gv/egiz/bku/gui/Messages_en.properties      |  28 +-
 .../test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java |   6 +-
 .../at/gv/egiz/bku/local/stal/BKUGuiProxy.java     | 106 ++--
 .../bku/local/stal/LocalSignRequestHandler.java    |   4 +-
 .../java/at/gv/egiz/bku/local/app/Container.java   |   5 -
 .../main/webapp/helpfiles/de/cardnotsupported.html |  47 ++
 .../main/webapp/helpfiles/de/cardnotsupported.png  | Bin 0 -> 2120 bytes
 .../webapp/helpfiles/de/help.cardnotsupported.html |  47 --
 .../webapp/helpfiles/de/help.cardnotsupported.png  | Bin 2120 -> 0 bytes
 .../main/webapp/helpfiles/de/help.insertcard.html  |  42 --
 .../main/webapp/helpfiles/de/help.insertcard.png   | Bin 2270 -> 0 bytes
 .../src/main/webapp/helpfiles/de/help.wait.html    |  39 --
 .../src/main/webapp/helpfiles/de/help.wait.png     | Bin 1542 -> 0 bytes
 .../src/main/webapp/helpfiles/de/help.welcome.html |  40 --
 .../src/main/webapp/helpfiles/de/help.welcome.png  | Bin 1537 -> 0 bytes
 .../src/main/webapp/helpfiles/de/insertcard.html   |  42 ++
 .../src/main/webapp/helpfiles/de/insertcard.png    | Bin 0 -> 2270 bytes
 BKUOnline/src/main/webapp/helpfiles/de/wait.html   |  39 ++
 BKUOnline/src/main/webapp/helpfiles/de/wait.png    | Bin 0 -> 1542 bytes
 .../src/main/webapp/helpfiles/de/welcome.html      |  40 ++
 BKUOnline/src/main/webapp/helpfiles/de/welcome.png | Bin 0 -> 1537 bytes
 smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java |  30 ++
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   | 410 ++++++++++-----
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     | 352 +++++++++++--
 .../java/at/gv/egiz/smcc/ChangePINProvider.java    |  39 ++
 .../src/main/java/at/gv/egiz/smcc/PINProvider.java |  26 +-
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java | 479 +++++++++++-------
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |  36 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |  42 +-
 .../java/at/gv/egiz/smcc/SignatureCardFactory.java |   2 +-
 .../java/at/gv/egiz/smcc/TimeoutException.java     |  39 ++
 smcc/src/test/resources/log4j.properties           |   2 +-
 .../at/gv/egiz/bku/smccstal/AbstractBKUWorker.java |   8 +-
 .../gv/egiz/bku/smccstal/AbstractPINProvider.java  |  67 +++
 .../at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java  |   6 +
 .../bku/smccstal/InfoBoxReadRequestHandler.java    |  40 +-
 .../gv/egiz/bku/smccstal/PINProviderFactory.java   |  47 ++
 .../bku/smccstal/PinpadPINProviderFactory.java     | 155 ++++++
 .../java/at/gv/egiz/bku/smccstal/SecureViewer.java |  44 ++
 .../gv/egiz/bku/smccstal/SignRequestHandler.java   | 149 +++---
 .../bku/smccstal/SoftwarePINProviderFactory.java   | 140 ++++++
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |  16 +-
 60 files changed, 3278 insertions(+), 2001 deletions(-)
 delete mode 100644 BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java
 create mode 100644 BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java
 create mode 100644 BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/SoftwarePINProviderFactory.java
 delete mode 100644 BKUAppletExt/src/test/java/at/gv/egiz/bku/smccstal/ext/FileSystemTest.java
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.html
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.png
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.html
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.png
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.html
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.png
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.wait.html
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.wait.png
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.welcome.html
 delete mode 100644 BKUOnline/src/main/webapp/helpfiles/de/help.welcome.png
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/insertcard.html
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/insertcard.png
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/wait.html
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/wait.png
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/welcome.html
 create mode 100644 BKUOnline/src/main/webapp/helpfiles/de/welcome.png
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/TimeoutException.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
index eb6cf30b..9b9735f6 100644
--- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
+++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
@@ -60,14 +60,15 @@ public class AppletBKUWorker extends AbstractBKUWorker implements Runnable {
 
   @Override
   public void run() {
-    gui.showWelcomeDialog();
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WELCOME,
+            BKUGUIFacade.MESSAGE_WELCOME);
 
     try {
       STALPortType stalPort = applet.getSTALPort();
       STALTranslator stalTranslator = applet.getSTALTranslator();
 
       addRequestHandler(SignRequest.class,
-              new AppletHashDataDisplay(stalPort, sessionId));
+              new AppletSecureViewer(stalPort, sessionId));
 
       GetNextRequestResponseType nextRequestResp = stalPort.connect(sessionId);
 
diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java
deleted file mode 100644
index 2ed9aa5b..00000000
--- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package at.gv.egiz.bku.online.applet;
-
-import java.security.DigestException;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import at.gv.egiz.bku.smccstal.SignRequestHandler;
-import at.gv.egiz.stal.HashDataInput;
-import at.gv.egiz.stal.impl.ByteArrayHashDataInput;
-import at.gv.egiz.stal.service.GetHashDataInputFault;
-import at.gv.egiz.stal.service.STALPortType;
-import at.gv.egiz.stal.service.types.GetHashDataInputResponseType;
-import at.gv.egiz.stal.service.types.GetHashDataInputType;
-import at.gv.egiz.stal.signedinfo.ReferenceType;
-import java.security.NoSuchAlgorithmException;
-
-/**
- * A SignRequesthandler that obtains hashdata inputs from a STAL webservice and
- * displays these either within the applet or in a separate frame.
- * The internal viewer displays plaintext data only, other mimetypes can be saved to disk.
- * The standalone (frame) viewer displays all mimetypes.
- * 
- * (This class depends on STALService and therefore is not part of BKUCommonGUI.)
- * 
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class AppletHashDataDisplay extends SignRequestHandler {
-
-  private static final Log log = LogFactory.getLog(AppletHashDataDisplay.class);
-  protected STALPortType stalPort;
-  protected String sessId;
-
-  public AppletHashDataDisplay(STALPortType stalPort, String sessId) {
-    if (stalPort == null || sessId == null) {
-      throw new NullPointerException("STAL port must not be null");
-    }
-    this.sessId = sessId;
-    this.stalPort = stalPort;
-  }
-
-  /**
-   * TODO don't throw exceptions
-   * @param signedReferences
-   * @throws java.security.DigestException
-   * @throws java.lang.Exception
-   */
-  @Override
-  public void displayHashDataInputs(List<ReferenceType> signedReferences) throws DigestException, Exception {
-
-    List<GetHashDataInputResponseType.Reference> hdi = getHashDataInput(signedReferences);
-    List<HashDataInput> verifiedHashDataInputs = verifyHashDataInput(signedReferences, hdi);
-
-    if (verifiedHashDataInputs.size() > 0) {
-      gui.showHashDataInputDialog(verifiedHashDataInputs, this, "hashDataDone");
-    } else {
-      throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)");
-    }
-  }
-
-  /**
-   * Get all hashdata inputs that contain an ID attribute but no Type attribute.
-   * @param signedReferences
-   * @return
-   * @throws at.gv.egiz.stal.service.GetHashDataInputFault
-   */
-  private List<GetHashDataInputResponseType.Reference> getHashDataInput(List<ReferenceType> signedReferences) throws GetHashDataInputFault, Exception {
-    GetHashDataInputType request = new GetHashDataInputType();
-    request.setSessionId(sessId);
-
-//    HashMap<String, ReferenceType> idSignedRefMap = new HashMap<String, ReferenceType>();
-    for (ReferenceType signedRef : signedReferences) {
-      //don't get Manifest, QualifyingProperties, ...
-      if (signedRef.getType() == null) {
-        String signedRefId = signedRef.getId();
-        if (signedRefId != null) {
-          if (log.isTraceEnabled()) {
-            log.trace("requesting hashdata input for reference " + signedRefId);
-          }
-//          idSignedRefMap.put(signedRefId, signedRef);
-          GetHashDataInputType.Reference ref = new GetHashDataInputType.Reference();
-          ref.setID(signedRefId);
-          request.getReference().add(ref);
-
-        } else {
-          throw new Exception("Cannot resolve signature data for dsig:Reference without Id attribute");
-        }
-      }
-    }
-    
-    if (request.getReference().size() < 1) {
-      log.error("No signature data (apart from any QualifyingProperties or a Manifest) for session " + sessId);
-      throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)");
-    }
-
-    if (log.isDebugEnabled()) {
-      log.debug("WebService call GetHashDataInput for " + request.getReference().size() + " references in session " + sessId);
-    }
-    GetHashDataInputResponseType response = stalPort.getHashDataInput(request);
-    return response.getReference();
-  }
-
-  /**
-   * Verifies all signed references and returns STAL HashDataInputs
-   * @param signedReferences
-   * @param hashDataInputs
-   * @return
-   * @throws java.security.DigestException
-   * @throws java.security.NoSuchAlgorithmException
-   * @throws Exception if no hashdata input is provided for a signed reference
-   */
-  private List<HashDataInput> verifyHashDataInput(List<ReferenceType> signedReferences, List<GetHashDataInputResponseType.Reference> hashDataInputs) throws DigestException, NoSuchAlgorithmException, Exception {
-
-    ArrayList<HashDataInput> verifiedHashDataInputs = new ArrayList<HashDataInput>();
-
-    for (ReferenceType signedRef : signedReferences) {
-      if (signedRef.getType() == null) {
-        log.info("Verifying digest for signed reference " + signedRef.getId());
-
-        String signedRefId = signedRef.getId();
-        byte[] signedDigest = signedRef.getDigestValue();
-        String signedDigestAlg = null;
-        if (signedRef.getDigestMethod() != null) {
-          signedDigestAlg = signedRef.getDigestMethod().getAlgorithm();
-        } else {
-          throw new NoSuchAlgorithmException("Failed to verify digest value for reference " + signedRefId + ": no digest algorithm");
-        }
-
-        // usually, there is just one item here
-        GetHashDataInputResponseType.Reference hashDataInput = null;
-        for (GetHashDataInputResponseType.Reference hdi : hashDataInputs) {
-          if (signedRefId.equals(hdi.getID())) {
-            hashDataInput = hdi;
-            break;
-          }
-        }
-        if (hashDataInput == null) {
-          throw new Exception("No hashdata input for reference " + signedRefId + " returned by service");
-        }
-
-        byte[] hdi = hashDataInput.getValue();
-        String mimeType = hashDataInput.getMimeType();
-        String encoding = hashDataInput.getEncoding();
-
-        if (hdi == null) {
-          throw new Exception("No hashdata input for reference " + signedRefId + " provided by service");
-        }
-        if (log.isDebugEnabled()) {
-          log.debug("Got HashDataInput " + signedRefId + " (" + mimeType + ";" + encoding + ")");
-        }
-
-        byte[] hashDataInputDigest = digest(hdi, signedDigestAlg);
-
-        if (log.isDebugEnabled()) {
-          log.debug("Comparing digest values... ");
-        }
-//        log.warn("***************** DISABLED HASHDATA VERIFICATION");
-        if (!Arrays.equals(hashDataInputDigest, signedDigest)) {
-          log.error("Bad digest value for reference " + signedRefId);
-          throw new DigestException("Bad digest value for reference " + signedRefId);
-        }
-
-        verifiedHashDataInputs.add(new ByteArrayHashDataInput(hdi, signedRefId, mimeType, encoding));
-      }
-    }
-    
-    return verifiedHashDataInputs;
-  }
-
-  //TODO
-  private byte[] digest(byte[] hashDataInput, String mdAlg) throws NoSuchAlgorithmException {
-    if ("http://www.w3.org/2000/09/xmldsig#sha1".equals(mdAlg)) {
-      mdAlg = "SHA-1";
-    } else if ("http://www.w3.org/2001/04/xmlenc#sha256".equals(mdAlg)) {
-      mdAlg = "SHA-256";
-    } else if ("http://www.w3.org/2001/04/xmlenc#sha224".equals(mdAlg)) {
-      mdAlg = "SHA-224";
-    } else if ("http://www.w3.org/2001/04/xmldsig-more#sha224".equals(mdAlg)) {
-      mdAlg = "SHA-224";
-    } else if ("http://www.w3.org/2001/04/xmldsig-more#sha384".equals(mdAlg)) {
-      mdAlg = "SHA-384";
-    } else if ("http://www.w3.org/2001/04/xmlenc#sha512".equals(mdAlg)) {
-      mdAlg = "SHA-512";
-    } else if ("http://www.w3.org/2001/04/xmldsig-more#md2".equals(mdAlg)) {
-      mdAlg = "MD2";
-    } else if ("http://www.w3.org/2001/04/xmldsig-more#md5".equals(mdAlg)) {
-      mdAlg = "MD5";
-    } else if ("http://www.w3.org/2001/04/xmlenc#ripemd160".equals(mdAlg)) {
-      mdAlg = "RipeMD-160";
-    } else {
-      throw new NoSuchAlgorithmException("Failed to verify digest value: unsupported digest algorithm " + mdAlg);
-    }
-
-    MessageDigest md = MessageDigest.getInstance(mdAlg);
-    return md.digest(hashDataInput);
-  }
-}
diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java
new file mode 100644
index 00000000..e2551e2d
--- /dev/null
+++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java
@@ -0,0 +1,221 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.online.applet;
+
+import at.gv.egiz.bku.smccstal.SecureViewer;
+import java.security.DigestException;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.gv.egiz.bku.smccstal.SignRequestHandler;
+import at.gv.egiz.stal.HashDataInput;
+import at.gv.egiz.stal.impl.ByteArrayHashDataInput;
+import at.gv.egiz.stal.service.GetHashDataInputFault;
+import at.gv.egiz.stal.service.STALPortType;
+import at.gv.egiz.stal.service.types.GetHashDataInputResponseType;
+import at.gv.egiz.stal.service.types.GetHashDataInputType;
+import at.gv.egiz.stal.signedinfo.ReferenceType;
+import java.security.NoSuchAlgorithmException;
+
+/**
+ * A SignRequesthandler that obtains hashdata inputs from a STAL webservice and
+ * displays these either within the applet or in a separate frame.
+ * The internal viewer displays plaintext data only, other mimetypes can be saved to disk.
+ * The standalone (frame) viewer displays all mimetypes.
+ * 
+ * (This class depends on STALService and therefore is not part of BKUCommonGUI.)
+ * 
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class AppletSecureViewer extends SignRequestHandler {
+
+  private static final Log log = LogFactory.getLog(AppletSecureViewer.class);
+  protected STALPortType stalPort;
+  protected String sessId;
+
+  public AppletSecureViewer(STALPortType stalPort, String sessId) {
+    if (stalPort == null || sessId == null) {
+      throw new NullPointerException("STAL port must not be null");
+    }
+    this.sessId = sessId;
+    this.stalPort = stalPort;
+  }
+
+  /**
+   * TODO don't throw exceptions
+   * @param signedReferences
+   * @throws java.security.DigestException
+   * @throws java.lang.Exception
+   */
+  @Override
+  public void displayDataToBeSigned(List<ReferenceType> signedReferences) 
+          throws DigestException, Exception {
+
+  List<GetHashDataInputResponseType.Reference> hdi = getHashDataInput(signedReferences);
+    List<HashDataInput> verifiedHashDataInputs = verifyHashDataInput(signedReferences, hdi);
+
+    if (verifiedHashDataInputs.size() > 0) {
+      gui.showSecureViewer(verifiedHashDataInputs, this, "hashDataDone");
+    } else {
+      throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)");
+    }
+  }
+
+  /**
+   * Get all hashdata inputs that contain an ID attribute but no Type attribute.
+   * @param signedReferences
+   * @return
+   * @throws at.gv.egiz.stal.service.GetHashDataInputFault
+   */
+  private List<GetHashDataInputResponseType.Reference> getHashDataInput(List<ReferenceType> signedReferences)
+          throws GetHashDataInputFault, Exception {
+    GetHashDataInputType request = new GetHashDataInputType();
+    request.setSessionId(sessId);
+
+//    HashMap<String, ReferenceType> idSignedRefMap = new HashMap<String, ReferenceType>();
+    for (ReferenceType signedRef : signedReferences) {
+      //don't get Manifest, QualifyingProperties, ...
+      if (signedRef.getType() == null) {
+        String signedRefId = signedRef.getId();
+        if (signedRefId != null) {
+          if (log.isTraceEnabled()) {
+            log.trace("requesting hashdata input for reference " + signedRefId);
+          }
+//          idSignedRefMap.put(signedRefId, signedRef);
+          GetHashDataInputType.Reference ref = new GetHashDataInputType.Reference();
+          ref.setID(signedRefId);
+          request.getReference().add(ref);
+
+        } else {
+          throw new Exception("Cannot resolve signature data for dsig:Reference without Id attribute");
+        }
+      }
+    }
+    
+    if (request.getReference().size() < 1) {
+      log.error("No signature data (apart from any QualifyingProperties or a Manifest) for session " + sessId);
+      throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)");
+    }
+
+    if (log.isDebugEnabled()) {
+      log.debug("WebService call GetHashDataInput for " + request.getReference().size() + " references in session " + sessId);
+    }
+    GetHashDataInputResponseType response = stalPort.getHashDataInput(request);
+    return response.getReference();
+  }
+
+  /**
+   * Verifies all signed references and returns STAL HashDataInputs
+   * @param signedReferences
+   * @param hashDataInputs
+   * @return
+   * @throws java.security.DigestException
+   * @throws java.security.NoSuchAlgorithmException
+   * @throws Exception if no hashdata input is provided for a signed reference
+   */
+  private List<HashDataInput> verifyHashDataInput(List<ReferenceType> signedReferences, List<GetHashDataInputResponseType.Reference> hashDataInputs)
+          throws DigestException, NoSuchAlgorithmException, Exception {
+
+    ArrayList<HashDataInput> verifiedHashDataInputs = new ArrayList<HashDataInput>();
+
+    for (ReferenceType signedRef : signedReferences) {
+      if (signedRef.getType() == null) {
+        log.info("Verifying digest for signed reference " + signedRef.getId());
+
+        String signedRefId = signedRef.getId();
+        byte[] signedDigest = signedRef.getDigestValue();
+        String signedDigestAlg = null;
+        if (signedRef.getDigestMethod() != null) {
+          signedDigestAlg = signedRef.getDigestMethod().getAlgorithm();
+        } else {
+          throw new NoSuchAlgorithmException("Failed to verify digest value for reference " + signedRefId + ": no digest algorithm");
+        }
+
+        // usually, there is just one item here
+        GetHashDataInputResponseType.Reference hashDataInput = null;
+        for (GetHashDataInputResponseType.Reference hdi : hashDataInputs) {
+          if (signedRefId.equals(hdi.getID())) {
+            hashDataInput = hdi;
+            break;
+          }
+        }
+        if (hashDataInput == null) {
+          throw new Exception("No hashdata input for reference " + signedRefId + " returned by service");
+        }
+
+        byte[] hdi = hashDataInput.getValue();
+        String mimeType = hashDataInput.getMimeType();
+        String encoding = hashDataInput.getEncoding();
+
+        if (hdi == null) {
+          throw new Exception("No hashdata input for reference " + signedRefId + " provided by service");
+        }
+        if (log.isDebugEnabled()) {
+          log.debug("Got HashDataInput " + signedRefId + " (" + mimeType + ";" + encoding + ")");
+        }
+
+        byte[] hashDataInputDigest = digest(hdi, signedDigestAlg);
+
+        if (log.isDebugEnabled()) {
+          log.debug("Comparing digest values... ");
+        }
+//        log.warn("***************** DISABLED HASHDATA VERIFICATION");
+        if (!Arrays.equals(hashDataInputDigest, signedDigest)) {
+          log.error("Bad digest value for reference " + signedRefId);
+          throw new DigestException("Bad digest value for reference " + signedRefId);
+        }
+
+        verifiedHashDataInputs.add(new ByteArrayHashDataInput(hdi, signedRefId, mimeType, encoding));
+      }
+    }
+    
+    return verifiedHashDataInputs;
+  }
+
+  //TODO
+  private byte[] digest(byte[] hashDataInput, String mdAlg) throws NoSuchAlgorithmException {
+    if ("http://www.w3.org/2000/09/xmldsig#sha1".equals(mdAlg)) {
+      mdAlg = "SHA-1";
+    } else if ("http://www.w3.org/2001/04/xmlenc#sha256".equals(mdAlg)) {
+      mdAlg = "SHA-256";
+    } else if ("http://www.w3.org/2001/04/xmlenc#sha224".equals(mdAlg)) {
+      mdAlg = "SHA-224";
+    } else if ("http://www.w3.org/2001/04/xmldsig-more#sha224".equals(mdAlg)) {
+      mdAlg = "SHA-224";
+    } else if ("http://www.w3.org/2001/04/xmldsig-more#sha384".equals(mdAlg)) {
+      mdAlg = "SHA-384";
+    } else if ("http://www.w3.org/2001/04/xmlenc#sha512".equals(mdAlg)) {
+      mdAlg = "SHA-512";
+    } else if ("http://www.w3.org/2001/04/xmldsig-more#md2".equals(mdAlg)) {
+      mdAlg = "MD2";
+    } else if ("http://www.w3.org/2001/04/xmldsig-more#md5".equals(mdAlg)) {
+      mdAlg = "MD5";
+    } else if ("http://www.w3.org/2001/04/xmlenc#ripemd160".equals(mdAlg)) {
+      mdAlg = "RipeMD-160";
+    } else {
+      throw new NoSuchAlgorithmException("Failed to verify digest value: unsupported digest algorithm " + mdAlg);
+    }
+
+    MessageDigest md = MessageDigest.getInstance(mdAlg);
+    return md.digest(hashDataInput);
+  }
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
index c904be0c..159dd29d 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
@@ -56,8 +56,6 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
   /** remember the pinSpec to return to worker */
   protected PINSpec pinSpec;
 
-  protected enum DIALOG { VERIFY, ACTIVATE, CHANGE, UNBLOCK };
-
   public PINManagementGUI(Container contentPane,
           Locale locale,
           Style guiStyle,
@@ -235,43 +233,110 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
   }
 
   @Override
-  public void showActivatePINDialog(final PINSpec pin,
-          final ActionListener okListener, final String okCommand,
-          final ActionListener cancelListener, final String cancelCommand) {
-    log.debug("scheduling activate pin dialog");
-    showPINDialog(DIALOG.ACTIVATE, pin, okListener, okCommand, cancelListener, cancelCommand);
+  public void showPINDialog(DIALOG type, PINSpec pinSpec,
+          ActionListener okListener, String okCommand,
+          ActionListener cancelListener, String cancelCommand) {
+    showPINDialog(type, pinSpec, -1, false,
+            okListener, okCommand, cancelListener, cancelCommand);
+  }
+
+  @Override
+  public void showPINDialog(DIALOG type, PINSpec pinSpec, int retries,
+          ActionListener okListener, String okCommand,
+          ActionListener cancelListener, String cancelCommand) {
+    showPINDialog(type, pinSpec, retries, false,
+            okListener, okCommand, cancelListener, cancelCommand);
   }
 
+  @Override
+  public void showPinpadPINDialog(DIALOG type, PINSpec pinSpec, int retries) {
+    String title, msg;
+    Object[] params;
+    if (retries < 0) {
+      params = new Object[2];
+      if (shortText) {
+        params[0] = "PIN";
+      } else {
+        params[0] = pinSpec.getLocalizedName();
+      }
+      String pinSize = String.valueOf(pinSpec.getMinLength());
+      if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+      }
+      params[1] = pinSize;
+      if (type == DIALOG.CHANGE) {
+        log.debug("show change pin dialog");
+        title = TITLE_CHANGE_PIN;
+        msg = MESSAGE_CHANGEPIN_PINPAD;
+      } else if (type == DIALOG.ACTIVATE) {
+        log.debug("show activate pin dialog");
+        title = TITLE_ACTIVATE_PIN;
+        msg = MESSAGE_ENTERPIN_PINPAD;
+      } else if (type == DIALOG.VERIFY) {
+        log.debug("show verify pin dialog");
+        title = TITLE_VERIFY_PIN;
+        msg = MESSAGE_ENTERPIN_PINPAD;
+      } else {
+        log.debug("show unblock pin dialog");
+        title = TITLE_UNBLOCK_PIN;
+        msg = MESSAGE_ENTERPIN_PINPAD;
+      }
+
+    } else {
+      log.debug("show retry pin dialog");
+      title = TITLE_RETRY;
+      msg = (retries < 2) ?
+        MESSAGE_LAST_RETRY : MESSAGE_RETRIES;
+      params = new Object[] {String.valueOf(retries)};
+    }
+    showMessageDialog(title, msg, params);
+  }
 
   private void showPINDialog(final DIALOG type, final PINSpec pinSpec,
+          final int retries, final boolean pinpad,
           final ActionListener okListener, final String okCommand,
           final ActionListener cancelListener, final String cancelCommand) {
 
+    log.debug("scheduling pin dialog");
+
       SwingUtilities.invokeLater(new Runnable() {
 
             @Override
             public void run() {
 
-              String HELP_TOPIC, TITLE, MESSAGE_MGMT;
+              String HELP_TOPIC, TITLE, MESSAGE_MGMT, MESSAGE_MGMT_PARAM;
               HELP_TOPIC = HELP_PINMGMT;
 
-              if (type == DIALOG.CHANGE) {
-                log.debug("show change pin dialog");
-                TITLE = TITLE_CHANGE_PIN;
-                MESSAGE_MGMT = MESSAGE_CHANGE_PIN;
-              } else if (type == DIALOG.ACTIVATE) {
-                log.debug("show activate pin dialog");
-                TITLE = TITLE_ACTIVATE_PIN;
-                MESSAGE_MGMT = MESSAGE_ACTIVATE_PIN;
-                oldPinField = null;
-              } else if (type == DIALOG.VERIFY) {
-                log.debug("show verify pin dialog");
-                TITLE = TITLE_VERIFY_PIN;
-                MESSAGE_MGMT = MESSAGE_VERIFY_PIN;
+              if (retries < 0) {
+                if (type == DIALOG.CHANGE) {
+                  log.debug("show change pin dialog");
+                  TITLE = TITLE_CHANGE_PIN;
+                  MESSAGE_MGMT = MESSAGE_CHANGE_PIN;
+                } else if (type == DIALOG.ACTIVATE) {
+                  log.debug("show activate pin dialog");
+                  TITLE = TITLE_ACTIVATE_PIN;
+                  MESSAGE_MGMT = MESSAGE_ACTIVATE_PIN;
+                  oldPinField = null;
+                } else if (type == DIALOG.VERIFY) {
+                  log.debug("show verify pin dialog");
+                  TITLE = TITLE_VERIFY_PIN;
+                  MESSAGE_MGMT = MESSAGE_VERIFY_PIN;
+                } else {
+                  log.debug("show unblock pin dialog");
+                  TITLE = TITLE_UNBLOCK_PIN;
+                  MESSAGE_MGMT = MESSAGE_UNBLOCK_PIN;
+                }
+                if (shortText) {
+                  MESSAGE_MGMT_PARAM = "PIN";
+                } else {
+                  MESSAGE_MGMT_PARAM = pinSpec.getLocalizedName();
+                }
               } else {
-                log.debug("show unblock pin dialog");
-                TITLE = TITLE_UNBLOCK_PIN;
-                MESSAGE_MGMT = MESSAGE_UNBLOCK_PIN;
+                log.debug("show retry pin dialog");
+                TITLE = TITLE_RETRY;
+                MESSAGE_MGMT = (retries < 2) ?
+                  MESSAGE_LAST_RETRY : MESSAGE_RETRIES;
+                MESSAGE_MGMT_PARAM = String.valueOf(retries);
               }
 
                 mainPanel.removeAll();
@@ -280,24 +345,67 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 helpListener.setHelpTopic(HELP_TOPIC);
 
                 JLabel mgmtLabel = new JLabel();
-                mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~Font.BOLD));
+                if (retries < 0) {
+                  mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~Font.BOLD));
+                } else {
+                  mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() | Font.BOLD));
+                  mgmtLabel.setForeground(ERROR_COLOR);
+                  helpListener.setHelpTopic(HELP_RETRY);
+                }
 
                 if (renderHeaderPanel) {
                   titleLabel.setText(getMessage(TITLE));
                   String mgmtPattern = getMessage(MESSAGE_MGMT);
-                  if (shortText) {
-                    mgmtLabel.setText(MessageFormat.format(mgmtPattern, "PIN"));
-                  } else {
-                    mgmtLabel.setText(MessageFormat.format(mgmtPattern, pinSpec.getLocalizedName()));
-                  }
+                  mgmtLabel.setText(MessageFormat.format(mgmtPattern, MESSAGE_MGMT_PARAM));
                 } else {
                   mgmtLabel.setText(getMessage(TITLE));
                 }
 
+                String pinSize = String.valueOf(pinSpec.getMinLength());
+                if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+                    pinSize += "-" + pinSpec.getMaxLength();
+                }
+
+                ////////////////////////////////////////////////////////////////
+                // COMMON LAYOUT SECTION
+                ////////////////////////////////////////////////////////////////
+
+                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+                mainPanel.setLayout(mainPanelLayout);
+
+                GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
+                          .addComponent(mgmtLabel);
+                GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                          .addComponent(mgmtLabel);
+
+                if (!renderHeaderPanel) {
+                  infoHorizontal
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                          .addComponent(helpLabel);
+                  infoVertical
+                          .addComponent(helpLabel);
+                }
+
+                GroupLayout.ParallelGroup pinHorizontal;
+                GroupLayout.SequentialGroup pinVertical;
+
+                if (pinpad) {
+                  JLabel pinpadLabel = new JLabel();
+                  pinpadLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~Font.BOLD));
+                  String pinpadPattern = getMessage(MESSAGE_PINPAD);
+                  pinpadLabel.setText(MessageFormat.format(pinpadPattern,
+                          new Object[] { pinSpec.getLocalizedName(), pinSize }));
+                  
+                  pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                          .addComponent(pinpadLabel);
+                  pinVertical = mainPanelLayout.createSequentialGroup()
+                          .addComponent(pinpadLabel);
+                } else {
+
                 JButton okButton = new JButton();
                 okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~Font.BOLD));
                 okButton.setText(getMessage(BUTTON_OK));
-                okButton.setEnabled(type == DIALOG.VERIFY && pinSpec.getMinLength() == 0);
+                okButton.setEnabled(pinSpec.getMinLength() <= 0);
                 okButton.setActionCommand(okCommand);
                 okButton.addActionListener(okListener);
 
@@ -334,7 +442,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                   repeatPinLabel.setText(MessageFormat.format(repeatPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                   repeatPinField.setText("");
-                  repeatPinField.setDocument(new PINDocument(pinSpec, okButton, pinField.getDocument()));
+//                  repeatPinField.setDocument(new PINDocument(pinSpec, okButton, pinField.getDocument()));
                   repeatPinField.setActionCommand(okCommand);
                   repeatPinField.addActionListener(new ActionListener() {
 
@@ -365,7 +473,15 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                             }
                         }
                     });
-                  } // else -> ACTIVATE (not verify, not change)
+
+                    repeatPinField.setDocument(new PINDocument(
+                            pinSpec, okButton,
+                            pinField.getDocument(), oldPinField.getDocument()));
+                  } else {
+                    // else -> ACTIVATE (not verify, not change)
+                    repeatPinField.setDocument(new PINDocument(
+                            pinSpec, okButton, pinField.getDocument()));
+                  }
                 } else {
                   pinField.setDocument(new PINDocument(pinSpec, okButton));
                 }
@@ -373,30 +489,14 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 JLabel pinsizeLabel = new JLabel();
                 pinsizeLabel.setFont(pinsizeLabel.getFont().deriveFont(pinsizeLabel.getFont().getStyle() & ~Font.BOLD, pinsizeLabel.getFont().getSize()-2));
                 String pinsizePattern = getMessage(LABEL_PINSIZE);
-                String pinSize = String.valueOf(pinSpec.getMinLength());
-                if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
-                    pinSize += "-" + pinSpec.getMaxLength();
-                }
                 pinsizeLabel.setText(MessageFormat.format(pinsizePattern, new Object[]{pinSize}));
 
-                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-                mainPanel.setLayout(mainPanelLayout);
-
-                GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
-                          .addComponent(mgmtLabel);
-                GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                          .addComponent(mgmtLabel);
-
-                if (!renderHeaderPanel) {
-                  infoHorizontal
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                          .addComponent(helpLabel);
-                  infoVertical
-                          .addComponent(helpLabel);
-                }
+                ////////////////////////////////////////////////////////////////
+                // NON-PINPAD SPECIFIC LAYOUT SECTION
+                ////////////////////////////////////////////////////////////////
 
-                GroupLayout.ParallelGroup pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
-                GroupLayout.SequentialGroup pinVertical = mainPanelLayout.createSequentialGroup();
+                pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
+                pinVertical = mainPanelLayout.createSequentialGroup();
 
 //                if (pinLabelPos == PinLabelPosition.ABOVE) {
 //                  if (changePin) {
@@ -495,7 +595,38 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                             .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
                   pinVertical
                           .addComponent(pinsizeLabel);
-//                }
+
+                  GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+                  buttonPanel.setLayout(buttonPanelLayout);
+
+                  GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
+                          .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                          .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
+                  GroupLayout.Group buttonVertical;
+
+                  JButton cancelButton = new JButton();
+                  cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+                  cancelButton.setText(getMessage(BUTTON_CANCEL));
+                  cancelButton.setActionCommand(cancelCommand);
+                  cancelButton.addActionListener(cancelListener);
+
+                  buttonHorizontal
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
+                  buttonVertical = buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                          .addComponent(okButton)
+                          .addComponent(cancelButton);
+
+                  buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
+                  buttonPanelLayout.setVerticalGroup(buttonVertical);
+
+                  if (oldPinField != null) {
+                    oldPinField.requestFocusInWindow();
+                  } else {
+                    pinField.requestFocusInWindow();
+                  }
+
+                } // END NON-PINPAD SECTION
 
                 mainPanelLayout.setHorizontalGroup(
                   mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
@@ -508,132 +639,12 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                     .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
                     .addGroup(pinVertical));
 
-                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-                buttonPanel.setLayout(buttonPanelLayout);
-
-                GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
-                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                        .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
-                GroupLayout.Group buttonVertical;
-
-                JButton cancelButton = new JButton();
-                cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                cancelButton.setText(getMessage(BUTTON_CANCEL));
-                cancelButton.setActionCommand(cancelCommand);
-                cancelButton.addActionListener(cancelListener);
-
-                buttonHorizontal
-                        .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                        .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
-                buttonVertical = buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
-                        .addComponent(okButton)
-                        .addComponent(cancelButton);
-
-                buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
-                buttonPanelLayout.setVerticalGroup(buttonVertical);
-
-                if (oldPinField != null) {
-                  oldPinField.requestFocusInWindow();
-                } else {
-                  pinField.requestFocusInWindow();
-                }
                 contentPanel.validate();
 
             }
         });
   }
 
-  @Override
-  public void showChangePINDialog(final PINSpec pin,
-          final ActionListener okListener, final String okCommand,
-          final ActionListener cancelListener, final String cancelCommand) {
-    
-      log.debug("scheduling change pin dialog");
-      showPINDialog(DIALOG.CHANGE, pin, okListener, okCommand, cancelListener, cancelCommand);
-  }
-
-  @Override
-  public void showUnblockPINDialog(final PINSpec pin,
-          final ActionListener okListener, final String okCommand,
-          final ActionListener cancelListener, final String cancelCommand) {
-
-      log.debug("scheduling unblock PIN dialog");
-
-      SwingUtilities.invokeLater(new Runnable() {
-
-          @Override
-            public void run() {
-
-                log.debug("show unblock PIN dialog");
-
-                log.error("unblock pin not supported");
-
-                mainPanel.removeAll();
-                buttonPanel.removeAll();
-
-                if (renderHeaderPanel) {
-                  titleLabel.setText(getMessage(TITLE_ERROR));
-                }
-
-                helpListener.setHelpTopic(HELP_PINMGMT);
-
-                String errorMsgPattern = getMessage(ERR_UNBLOCK);
-                String errorMsg = MessageFormat.format(errorMsgPattern, pin.getLocalizedName());
-
-                JLabel errorMsgLabel = new JLabel();
-                errorMsgLabel.setFont(errorMsgLabel.getFont().deriveFont(errorMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                errorMsgLabel.setText(errorMsg);
-
-                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-                mainPanel.setLayout(mainPanelLayout);
-
-                GroupLayout.ParallelGroup mainHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
-                GroupLayout.SequentialGroup mainVertical = mainPanelLayout.createSequentialGroup();
-
-                if (!renderHeaderPanel) {
-                  JLabel errorTitleLabel = new JLabel();
-                  errorTitleLabel.setFont(errorTitleLabel.getFont().deriveFont(errorTitleLabel.getFont().getStyle() | java.awt.Font.BOLD));
-                  errorTitleLabel.setText(getMessage(TITLE_ERROR));
-                  errorTitleLabel.setForeground(ERROR_COLOR);
-
-                  mainHorizontal
-                          .addGroup(mainPanelLayout.createSequentialGroup()
-                            .addComponent(errorTitleLabel)
-                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                            .addComponent(helpLabel));
-                  mainVertical
-                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                            .addComponent(errorTitleLabel)
-                            .addComponent(helpLabel));
-                }
-
-                mainPanelLayout.setHorizontalGroup(mainHorizontal
-                        .addComponent(errorMsgLabel));
-                mainPanelLayout.setVerticalGroup(mainVertical
-                        .addComponent(errorMsgLabel));
-
-                JButton okButton = new JButton();
-                okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                okButton.setText(getMessage(BUTTON_OK));
-                okButton.setActionCommand(cancelCommand);
-                okButton.addActionListener(cancelListener);
-
-                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-                buttonPanel.setLayout(buttonPanelLayout);
-
-                buttonPanelLayout.setHorizontalGroup(
-                  buttonPanelLayout.createSequentialGroup()
-                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                        .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-                buttonPanelLayout.setVerticalGroup(
-                  buttonPanelLayout.createSequentialGroup()
-                    .addComponent(okButton));
-
-                contentPanel.validate();
-            }
-        });
-  }
-
   @Override
   protected int initButtonSize() {
     int bs = super.initButtonSize();
@@ -659,8 +670,4 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
     return bs;
   }
 
-  @Override
-  public void showVerifyPINDialog(PINSpec pin, ActionListener okListener, String okCmd, ActionListener cancelListener, String cancelCmd) {
-    showPINDialog(DIALOG.VERIFY, pin, okListener, okCmd, cancelListener, cancelCmd);
-  }
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
index 9c630431..45313f42 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
@@ -35,13 +35,18 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String TITLE_UNBLOCK_PIN = "title.unblock.pin";
   public static final String TITLE_ACTIVATE_SUCCESS = "title.activate.success";
   public static final String TITLE_CHANGE_SUCCESS = "title.change.success";
-  public static final String MESSAGE_ACTIVATE_SUCCESS = "message.activate.success";
-  public static final String MESSAGE_CHANGE_SUCCESS = "message.change.success";
-  public static final String MESSAGE_PINMGMT = "message.pin.mgmt";
-  public static final String MESSAGE_ACTIVATE_PIN = "message.activate.pin";
-  public static final String MESSAGE_CHANGE_PIN = "message.change.pin";
-  public static final String MESSAGE_VERIFY_PIN = "message.verify.pin";
-  public static final String MESSAGE_UNBLOCK_PIN = "message.unblock.pin";
+
+  // removed message.* prefix to reuse keys as help keys
+  public static final String MESSAGE_ACTIVATE_SUCCESS = "activate.success";
+  public static final String MESSAGE_CHANGE_SUCCESS = "change.success";
+  public static final String MESSAGE_PINMGMT = "pin.mgmt";
+  public static final String MESSAGE_PINPAD = "pinpad";
+  public static final String MESSAGE_CHANGEPIN_PINPAD = "pinpad.change";
+  public static final String MESSAGE_ACTIVATE_PIN = "activate.pin";
+  public static final String MESSAGE_CHANGE_PIN = "change.pin";
+  public static final String MESSAGE_VERIFY_PIN = "verify.pin";
+  public static final String MESSAGE_UNBLOCK_PIN = "unblock.pin";
+  
   public static final String LABEL_OLD_PIN = "label.old.pin";
   public static final String LABEL_NEW_PIN = "label.new.pin";
   public static final String LABEL_REPEAT_PIN = "label.repeat.pin";
@@ -66,26 +71,37 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String STATUS_UNKNOWN = "status.unknown";
 
   public enum STATUS { ACTIV, NOT_ACTIV, BLOCKED, UNKNOWN };
+  public enum DIALOG { VERIFY, ACTIVATE, CHANGE, UNBLOCK };
 
   public void showPINManagementDialog(Map<PINSpec, STATUS> pins,
           ActionListener activateListener, String activateCmd, String changeCmd, String unblockCmd, String verifyCmd,
           ActionListener cancelListener, String cancelCmd);
 
-  public void showActivatePINDialog(PINSpec pin,
+  public void showPINDialog(DIALOG type, PINSpec pin,
           ActionListener okListener, String okCmd,
           ActionListener cancelListener, String cancelCmd);
 
-  public void showChangePINDialog(PINSpec pin,
+  public void showPINDialog(DIALOG type, PINSpec pin, int retries,
           ActionListener okListener, String okCmd,
           ActionListener cancelListener, String cancelCmd);
 
-  public void showUnblockPINDialog(PINSpec pin,
-          ActionListener okListener, String okCmd,
-          ActionListener cancelListener, String cancelCmd);
+  public void showPinpadPINDialog(DIALOG type, PINSpec pin, int retries);
 
-  public void showVerifyPINDialog(PINSpec pin,
-          ActionListener okListener, String okCmd,
-          ActionListener cancelListener, String cancelCmd);
+//  public void showActivatePINDialog(PINSpec pin,
+//          ActionListener okListener, String okCmd,
+//          ActionListener cancelListener, String cancelCmd);
+//
+//  public void showChangePINDialog(PINSpec pin,
+//          ActionListener okListener, String okCmd,
+//          ActionListener cancelListener, String cancelCmd);
+//
+//  public void showUnblockPINDialog(PINSpec pin,
+//          ActionListener okListener, String okCmd,
+//          ActionListener cancelListener, String cancelCmd);
+//
+//  public void showVerifyPINDialog(PINSpec pin,
+//          ActionListener okListener, String okCmd,
+//          ActionListener cancelListener, String cancelCmd);
 
   public char[] getOldPin();
 
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
index 85892026..81b635f8 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
@@ -42,7 +42,8 @@ public class PINManagementBKUWorker extends AppletBKUWorker {
 
   @Override
   public void run() {
-    gui.showWelcomeDialog();
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WELCOME,
+            BKUGUIFacade.MESSAGE_WELCOME);
 
     try {
       List<STALResponse> responses = handleRequest(Collections.singletonList(new PINManagementRequest()));
@@ -53,7 +54,6 @@ public class PINManagementBKUWorker extends AppletBKUWorker {
           log.debug("PIN management dialog terminated");
         } else if (response instanceof ErrorResponse) {
           log.debug("PIN management dialog terminated with error");
-          showErrorDialog(BKUGUIFacade.ERR_UNKNOWN, null);
         } else {
           throw new RuntimeException("Invalid STAL response: " + response.getClass().getName());
         }
@@ -62,7 +62,11 @@ public class PINManagementBKUWorker extends AppletBKUWorker {
       }
 
     } catch (RuntimeException ex) {
-      log.error("unexpected error: " + ex.getMessage(), ex);
+      log.error(ex.getMessage());
+      Throwable cause = ex.getCause();
+      if (cause != null) { // && cause instanceof InterruptedException) {
+        log.info(cause.getMessage());
+      }
       showErrorDialog(BKUGUIFacade.ERR_UNKNOWN, null);
     } catch (Exception ex) {
       log.error(ex.getMessage(), ex);
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java
new file mode 100644
index 00000000..b0dd8766
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.smccstal.ext;
+
+import at.gv.egiz.smcc.ChangePINProvider;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.SignatureCard;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public abstract class ManagementPINProviderFactory {
+//        extends at.gv.egiz.bku.smccstal.PINProviderFactory {
+
+  PINManagementGUIFacade gui;
+  
+  public static ManagementPINProviderFactory getInstance(SignatureCard forCard,
+          PINManagementGUIFacade gui) {
+//    if (forCard.ifdSupportsFeature(SignatureCard.FEATURE_VERIFY_PIN_DIRECT)) {
+////      forCard.ifdSupportsFeature(SignatureCard.FEATURE_MODIFY_PIN_DIRECT)
+//      return new PinpadPINProviderFactory(gui);
+//
+//    } else {
+      return new SoftwarePINProviderFactory(gui);
+//    }
+  }
+
+  public abstract PINProvider getVerifyPINProvider();
+
+  public abstract PINProvider getActivatePINProvider();
+
+  public abstract ChangePINProvider getChangePINProvider();
+
+  public abstract PINProvider getUnblockPINProvider();
+
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
index 66db0484..6b565b26 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
@@ -18,13 +18,19 @@ package at.gv.egiz.bku.smccstal.ext;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.DIALOG;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
 import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
+import at.gv.egiz.bku.smccstal.PINProviderFactory;
+import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.PINProvider;
 import at.gv.egiz.smcc.PINSpec;
 import at.gv.egiz.smcc.STARCOSCard;
+import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.TimeoutException;
 import at.gv.egiz.smcc.VerificationFailedException;
 import at.gv.egiz.smcc.util.SMCCHelper;
 import at.gv.egiz.stal.ErrorResponse;
@@ -35,8 +41,6 @@ import at.gv.egiz.stal.ext.PINManagementResponse;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.logging.Level;
-import java.util.logging.Logger;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
@@ -53,7 +57,8 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
   protected static final Log log = LogFactory.getLog(PINManagementRequestHandler.class);
 
-  Map<PINSpec, STATUS> pinStatuses;
+  protected Map<PINSpec, STATUS> pinStatuses;
+  private ManagementPINProviderFactory pinProviderFactory;
 
   @Override
   public STALResponse handleRequest(STALRequest request) throws InterruptedException {
@@ -61,9 +66,12 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
       PINManagementGUIFacade gui = (PINManagementGUIFacade) this.gui;
 
+      PINSpec selectedPIN = null;
+
       try {
-      pinStatuses = getPINStatuses();
 
+      pinStatuses = getPINStatuses();
+      
       gui.showPINManagementDialog(pinStatuses,
               this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
               this, "cancel");
@@ -74,175 +82,100 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
         if ("cancel".equals(actionCommand)) {
           return new PINManagementResponse();
-        } else if ("back".equals(actionCommand)) {
-          gui.showPINManagementDialog(pinStatuses,
-              this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-              this, "cancel");
         } else {
-          PINSpec selectedPIN = gui.getSelectedPINSpec();
+          selectedPIN = gui.getSelectedPINSpec();
 
           if (selectedPIN == null) {
-            throw new RuntimeException("no PIN selected for activation/change");
+            throw new NullPointerException("no PIN selected for activation/change");
           }
 
-          if ("activate_enterpin".equals(actionCommand)) {
-            gui.showActivatePINDialog(selectedPIN,
-                    this, "activate", this, "back");
-          } else if ("change_enterpin".equals(actionCommand)) {
-            gui.showChangePINDialog(selectedPIN,
-                    this, "change", this, "back");
-          } else if ("unblock_enterpuk".equals(actionCommand)) {
-            gui.showUnblockPINDialog(selectedPIN,
-                    this, "unblock", this, "back");
-          } else if ("verify_enterpin".equals(actionCommand)) {
-            gui.showVerifyPINDialog(selectedPIN,
-                    this, "verify", this, "back");
-          } else if ("activate".equals(actionCommand)) {
-            try {
-              log.debug("activate " + selectedPIN.getLocalizedName());
-              card.activatePIN(selectedPIN,
-                      String.valueOf(gui.getPin()));
+          if (pinProviderFactory == null) {
+            pinProviderFactory =
+                    ManagementPINProviderFactory.getInstance(card, gui);
+          }
+
+          try {
+            if ("activate_enterpin".equals(actionCommand)) {
+              log.info("activate " + selectedPIN.getLocalizedName());
+              card.activatePIN(selectedPIN, 
+                      pinProviderFactory.getActivatePINProvider());
               updatePINStatus(selectedPIN, STATUS.ACTIV);
               gui.showMessageDialog(PINManagementGUIFacade.TITLE_ACTIVATE_SUCCESS,
                       PINManagementGUIFacade.MESSAGE_ACTIVATE_SUCCESS,
                       new Object[] {selectedPIN.getLocalizedName()},
-                      this, "ok");
+                      BKUGUIFacade.BUTTON_OK, this, "ok");
               waitForAction();
-              gui.showPINManagementDialog(pinStatuses,
-                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                this, "cancel");
-            } catch (GetPINStatusException ex) {
-              log.error("failed to get " +  selectedPIN.getLocalizedName() +
-                      " status: " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
-                      this, "cancel");
-            } catch (SignatureCardException ex) {
-              log.error("failed to activate " + selectedPIN.getLocalizedName() +
-                      ": " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_ACTIVATE, 
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      this, "cancel");
-            }
-          } else if ("change".equals(actionCommand)) {
-            log.info("change " + selectedPIN.getLocalizedName());
-            try {
-              card.changePIN(selectedPIN,
-                      String.valueOf(gui.getOldPin()),
-                      String.valueOf(gui.getPin()));
+            } else if ("change_enterpin".equals(actionCommand)) {
+              log.info("change " + selectedPIN.getLocalizedName());
+              card.changePIN(selectedPIN, 
+                      pinProviderFactory.getChangePINProvider());
               updatePINStatus(selectedPIN, STATUS.ACTIV);
               gui.showMessageDialog(PINManagementGUIFacade.TITLE_CHANGE_SUCCESS,
                       PINManagementGUIFacade.MESSAGE_CHANGE_SUCCESS,
                       new Object[] {selectedPIN.getLocalizedName()},
-                      this, "ok");
-              waitForAction();
-              gui.showPINManagementDialog(pinStatuses,
-                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                this, "cancel");
-            } catch (GetPINStatusException ex) {
-              log.error("failed to get " +  selectedPIN.getLocalizedName() +
-                      " status: " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
-                      this, "cancel");
-            } catch (LockedException ex) {
-              log.error("failed to change " + selectedPIN.getLocalizedName() +
-                      ": PIN locked");
-              updatePINStatus(selectedPIN, STATUS.BLOCKED);
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_LOCKED,
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      this, "ok");
-              waitForAction();
-              gui.showPINManagementDialog(pinStatuses,
-                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                this, "cancel");
-            } catch (VerificationFailedException ex) {
-              log.error("failed to change " + selectedPIN.getLocalizedName() +
-                      ": " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_RETRIES,
-                      new Object[] {selectedPIN.getLocalizedName(), ex.getRetries()},
-                      this, "change_enterpin");
-            } catch (NotActivatedException ex) {
-              log.error("failed to change " + selectedPIN.getLocalizedName() +
-                      ": PIN not active");
-              updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_NOT_ACTIVE,
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      this, "ok");
+                      BKUGUIFacade.BUTTON_OK, this, "ok");
               waitForAction();
-              gui.showPINManagementDialog(pinStatuses,
-                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                this, "cancel");
-            } catch (SignatureCardException ex) {
-              log.error("failed to change " + selectedPIN.getLocalizedName() +
-                      ": " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_CHANGE, 
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      this, "cancel");
-            }
-          } else if ("unblock".equals(actionCommand)) {
-            log.info("unblock " + selectedPIN.getLocalizedName());
-            log.error("unblock PIN not implemented");
-            gui.showErrorDialog(PINManagementGUIFacade.ERR_UNBLOCK, null, this, "cancel");
-          } else if ("verify".equals(actionCommand)) {
-            try {
+
+            } else if ("unblock_enterpuk".equals(actionCommand)) {
+              log.info("unblock " + selectedPIN.getLocalizedName());
+              card.unblockPIN(selectedPIN,
+                      pinProviderFactory.getUnblockPINProvider());
+            } else if ("verify_enterpin".equals(actionCommand)) {
               log.info("verify " + selectedPIN.getLocalizedName());
-              int retries = card.verifyPIN(selectedPIN, String.valueOf(gui.getPin()));
-              log.trace(retries + " retries");
-              if (retries < 0) {
-                updatePINStatus(selectedPIN, STATUS.ACTIV);
-                gui.showPINManagementDialog(pinStatuses,
-                        this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                        this, "cancel");
-              } else {
-                log.error("failed to verify " + selectedPIN.getLocalizedName() +
-                      ": " + retries + " retries left");
-                gui.showErrorDialog(PINManagementGUIFacade.ERR_RETRIES,
-                      new Object[] {selectedPIN.getLocalizedName(), retries},
-                      this, "verify_enterpin");
-              }
-            } catch (GetPINStatusException ex) {
-              log.error("failed to get " +  selectedPIN.getLocalizedName() +
-                      " status: " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
-                      this, "cancel");
-            } catch (LockedException ex) {
-              log.error("failed to verify " + selectedPIN.getLocalizedName() +
-                      ": PIN locked");
-              updatePINStatus(selectedPIN, STATUS.BLOCKED);
-              gui.showPINManagementDialog(pinStatuses,
-                      this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                      this, "cancel");
-            } catch (NotActivatedException ex) {
-              log.error("failed to verify " + selectedPIN.getLocalizedName() +
-                      ": PIN not active");
-              updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
-              gui.showPINManagementDialog(pinStatuses,
-                      this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-                      this, "cancel");
-            } catch (SignatureCardException ex) {
-              log.error("failed to verify " + selectedPIN.getLocalizedName() +
-                      ": " + ex.getMessage());
-              gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS,
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      this, "cancel");
+              card.verifyPIN(selectedPIN,
+                      pinProviderFactory.getVerifyPINProvider());
+              updatePINStatus(selectedPIN, STATUS.ACTIV);
             }
-
-          } else {
-            throw new RuntimeException("unsupported action " + actionCommand);
+          } catch (CancelledException ex) {
+            log.trace("cancelled");
+          } catch (TimeoutException ex) {
+            log.error("Timeout during pin entry");
+            gui.showMessageDialog(BKUGUIFacade.TITLE_ENTRY_TIMEOUT,
+                    BKUGUIFacade.ERR_PIN_TIMEOUT, 
+                    new Object[] {selectedPIN.getLocalizedName()},
+                    BKUGUIFacade.BUTTON_OK, this, null);
+            waitForAction();
+          } catch (LockedException ex) {
+            log.error(selectedPIN.getLocalizedName() + " locked");
+            updatePINStatus(selectedPIN, STATUS.BLOCKED);
+            gui.showErrorDialog(PINManagementGUIFacade.ERR_LOCKED,
+                    new Object[] {selectedPIN.getLocalizedName()},
+                    this, null);
+            waitForAction();
+          } catch (NotActivatedException ex) {
+            log.error(selectedPIN.getLocalizedName() + " not active");
+            updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
+            gui.showErrorDialog(PINManagementGUIFacade.ERR_NOT_ACTIVE,
+                    new Object[] {selectedPIN.getLocalizedName()},
+                    this, null);
+            waitForAction();
           }
-        }
-      }
+        } // end if
+
+        selectedPIN = null;
+        gui.showPINManagementDialog(pinStatuses,
+                this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
+                this, "cancel");
+      } // end while
+
       } catch (GetPINStatusException ex) {
-        log.error("Failed to get PIN statuses: " + ex.getMessage());
+        String pin = (selectedPIN != null) ? selectedPIN.getLocalizedName() : "pin";
+        log.error("failed to get " +  pin + " status: " + ex.getMessage());
         gui.showErrorDialog(PINManagementGUIFacade.ERR_STATUS, null,
                 this, "ok");
         waitForAction();
         return new ErrorResponse(1000);
+      } catch (SignatureCardException ex) {
+        log.error(ex.getMessage(), ex);
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_UNKNOWN, null,
+                this, "ok");
+        waitForAction();
+        return new ErrorResponse(1000);
       }
     } else {
       log.error("Got unexpected STAL request: " + request);
       return new ErrorResponse(1000);
     }
-
   }
 
   @Override
@@ -375,4 +308,100 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
       pinStatuses.put(pinSpec, status);
     }
   }
+
+//  /**
+//   * provides oldPin and newPin from one dialog,
+//   * and don't know whether providePIN() or provideOldPIN() is called first.
+//   */
+//  class SoftwarePinProvider implements PINProvider {
+//
+//    private PINManagementGUIFacade.DIALOG type;
+//    private boolean retry = false;
+//
+//    private char[] newPin;
+//    private char[] oldPin;
+//
+//    public SoftwarePinProvider(DIALOG type) {
+//      this.type = type;
+//    }
+//
+//    @Override
+//    public char[] providePIN(PINSpec spec, int retries)
+//            throws CancelledException, InterruptedException {
+//      if (newPin == null) {
+//        getPINs(spec, retries);
+//      }
+//      char[] pin = newPin;
+//      newPin = null;
+//      return pin;
+//    }
+//
+//    @Override
+//    public char[] provideOldPIN(PINSpec spec, int retries)
+//            throws CancelledException, InterruptedException {
+//      if (oldPin == null) {
+//        getPINs(spec, retries);
+//      }
+//      char[] pin = oldPin;
+//      oldPin = null;
+//      return pin;
+//    }
+//
+//    private void getPINs(PINSpec spec, int retries)
+//            throws InterruptedException, CancelledException {
+//      PINManagementGUIFacade gui =
+//              (PINManagementGUIFacade) PINManagementRequestHandler.this.gui;
+//
+//      if (retry) {
+//        gui.showPINDialog(type, spec, retries,
+//              PINManagementRequestHandler.this, "exec",
+//              PINManagementRequestHandler.this, "back");
+//      } else {
+//        gui.showPINDialog(type, spec,
+//              PINManagementRequestHandler.this, "exec",
+//              PINManagementRequestHandler.this, "back");
+//      }
+//      waitForAction();
+//
+//      if (actionCommand.equals("exec")) {
+//        gui.showWaitDialog(null);
+//        retry = true;
+//        oldPin = gui.getOldPin();
+//        newPin = gui.getPin();
+//      } else if (actionCommand.equals("back")) {
+//        throw new CancelledException();
+//      } else {
+//        log.error("unsupported command " + actionCommand);
+//        throw new CancelledException();
+//      }
+//    }
+//  }
+//
+//
+//  class PinpadPinProvider implements PINProvider {
+//
+//    private PINManagementGUIFacade.DIALOG type;
+//    private boolean retry = false;
+//
+//    public PinpadPinProvider(DIALOG type) {
+//      this.type = type;
+//    }
+//
+//    @Override
+//    public char[] providePIN(PINSpec spec, int retries) {
+//      log.debug("provide pin for " + type);
+//      if (retry) {
+//        ((PINManagementGUIFacade) gui).showPinpadPINDialog(type, spec, retries);
+//      } else {
+//        ((PINManagementGUIFacade) gui).showPinpadPINDialog(type, spec, -1);
+//        retry = true;
+//      }
+//      return null;
+//    }
+//
+//    @Override
+//    public char[] provideOldPIN(PINSpec spec, int retries) {
+//      return null;
+//    }
+//  }
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java
new file mode 100644
index 00000000..4176e0a9
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.smccstal.ext;
+
+import at.gv.egiz.smcc.ChangePINProvider;
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.DIALOG;
+import at.gv.egiz.bku.smccstal.AbstractPINProvider;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.PINSpec;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PinpadPINProviderFactory extends ManagementPINProviderFactory {
+
+  protected PinpadPINProviderFactory(PINManagementGUIFacade gui) {
+    this.gui = gui;
+  }
+
+  @Override
+  public PINProvider getVerifyPINProvider() {
+    return new SimplePinProvider(DIALOG.VERIFY);
+  }
+
+  @Override
+  public PINProvider getActivatePINProvider() {
+    return new SimplePinProvider(DIALOG.ACTIVATE);
+  }
+
+  @Override
+  public ChangePINProvider getChangePINProvider() {
+    return new SimplePinProvider(DIALOG.CHANGE);
+  }
+
+  @Override
+  public PINProvider getUnblockPINProvider() {
+    return new SimplePinProvider(DIALOG.UNBLOCK);
+  }
+
+
+  class SimplePinProvider extends AbstractPINProvider
+          implements ChangePINProvider {
+
+//    protected PINManagementGUIFacade gui;
+    protected PINManagementGUIFacade.DIALOG type;
+
+    private SimplePinProvider(PINManagementGUIFacade.DIALOG type) {
+      this.type = type;
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+
+      showPinpadPINDialog(retries, spec);
+      retry = true;
+      return null;
+
+//      gui.showPINDialog(type, spec, (retry) ? retries : -1,
+//              this, "exec",
+//              this, "back");
+//
+//      waitForAction();
+//
+//      if ("exec".equals(action)) {
+//        gui.showWaitDialog(null);
+//        retry = true;
+//        return gui.getPin();
+//      } else if ("back".equals(action)) {
+//        throw new CancelledException();
+//      } else {
+//        log.error("unsupported command " + action);
+//        throw new CancelledException();
+//      }
+    }
+
+    /**
+     * do not call this method without calling providePIN()
+     * (no message is displayed)
+     * @param spec
+     * @param retries
+     * @return
+     */
+    @Override
+    public char[] provideOldPIN(PINSpec spec, int retries) {
+      return null;
+    }
+
+    private void showPinpadPINDialog(int retries, PINSpec pinSpec) {
+      String title, message;
+      Object[] params;
+      if (retry) {
+        title = BKUGUIFacade.TITLE_RETRY;
+        message = BKUGUIFacade.MESSAGE_RETRIES;
+        params = new Object[]{String.valueOf(retries)};
+      } else {
+        title = BKUGUIFacade.TITLE_SIGN;
+        message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
+        String pinSize = String.valueOf(pinSpec.getMinLength());
+        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+        }
+        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
+      }
+      gui.showMessageDialog(title, message, params);
+    }
+  }
+}
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/SoftwarePINProviderFactory.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/SoftwarePINProviderFactory.java
new file mode 100644
index 00000000..e87512d0
--- /dev/null
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/SoftwarePINProviderFactory.java
@@ -0,0 +1,148 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.smccstal.ext;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.ChangePINProvider;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.DIALOG;
+import at.gv.egiz.bku.smccstal.AbstractPINProvider;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.PINSpec;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class SoftwarePINProviderFactory extends ManagementPINProviderFactory {
+
+  protected SoftwarePINProviderFactory(PINManagementGUIFacade gui) {
+    this.gui = gui;
+  }
+
+  @Override
+  public PINProvider getVerifyPINProvider() {
+    return new SimplePinProvider(DIALOG.VERIFY);
+  }
+
+  @Override
+  public PINProvider getActivatePINProvider() {
+    return new SimplePinProvider(DIALOG.ACTIVATE);
+  }
+
+  @Override
+  public ChangePINProvider getChangePINProvider() {
+    return new ChangePinProvider();
+  }
+
+  @Override
+  public PINProvider getUnblockPINProvider() {
+    return new SimplePinProvider(DIALOG.UNBLOCK);
+  }
+
+  class SimplePinProvider extends AbstractPINProvider {
+
+//    protected PINManagementGUIFacade gui;
+    protected PINManagementGUIFacade.DIALOG type;
+
+    private SimplePinProvider(DIALOG type) {
+      this.type = type;
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+
+      gui.showPINDialog(type, spec, (retry) ? retries : -1,
+              this, "exec",
+              this, "back");
+
+      waitForAction();
+
+      if ("exec".equals(action)) {
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
+        retry = true;
+        return gui.getPin();
+      } else if ("back".equals(action)) {
+        throw new CancelledException();
+      } else {
+        log.error("unsupported command " + action);
+        throw new CancelledException();
+      }
+    }
+  }
+
+  class ChangePinProvider extends AbstractPINProvider
+          implements ChangePINProvider {
+
+//    protected PINManagementGUIFacade gui;
+
+    private char[] oldPin;
+    private char[] newPin;
+
+    private ChangePinProvider() {
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+      if (newPin == null) {
+        getPINs(spec, retries);
+      }
+      char[] pin = newPin;
+      newPin = null;
+      return pin;
+    }
+
+    @Override
+    public char[] provideOldPIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+      if (oldPin == null) {
+        getPINs(spec, retries);
+      }
+      char[] pin = oldPin;
+      oldPin = null;
+      return pin;
+    }
+
+    private void getPINs(PINSpec spec, int retries)
+            throws InterruptedException, CancelledException {
+
+      gui.showPINDialog(PINManagementGUIFacade.DIALOG.CHANGE, spec,
+              (retry) ? retries : -1,
+              this, "exec",
+              this, "back");
+
+      waitForAction();
+
+      if ("exec".equals(action)) {
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
+        retry = true;
+        oldPin = gui.getOldPin();
+        newPin = gui.getPin();
+      } else if ("back".equals(action)) {
+        throw new CancelledException();
+      } else {
+        log.error("unsupported command " + action);
+        throw new CancelledException();
+      }
+    }
+  }
+}
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
index 69d231f7..4ceacb21 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
@@ -22,13 +22,16 @@ title.verify.pin=<html>PIN Eingeben</html>
 title.activate.success=<html>Erfolg</html>
 title.change.success=<html>Erfolg</html>
 
-message.pin.mgmt=<html>Die Karte verf\u00FCgt \u00FCber {0} PINs</html>
-message.activate.pin=<html>{0} eingeben und best\u00E4tigen</html>
-message.change.pin=<html>{0} eingeben und best\u00E4tigen</html>
-message.unblock.pin=<html>PUK zu {0} eingeben</html>
-message.verify.pin=<html>{0} eingeben (TODO: Warning not activated)</html>
-message.activate.success=<html>{0} wurde erfolgreich aktiviert.</html>
-message.change.success=<html>{0} wurde erfolgreich ge\u00E4ndert.</html>
+# removed message.* prefix to reuse keys as help keys
+pin.mgmt=<html>Die Karte verf\u00FCgt \u00FCber {0} PINs</html>
+pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben und best\u00E4tigen.</html>
+pinpad.change=<html>{0} ({1} stellig) am Kartenleser eingeben und best\u00E4tigen.</html>
+activate.pin=<html>{0} eingeben und best\u00E4tigen</html>
+change.pin=<html>{0} eingeben und best\u00E4tigen</html>
+unblock.pin=<html>PUK zu {0} eingeben</html>
+verify.pin=<html>{0} eingeben (TODO: Warning not activated)</html>
+activate.success=<html>{0} wurde erfolgreich aktiviert.</html>
+change.success=<html>{0} wurde erfolgreich ge\u00E4ndert.</html>
 
 label.activation=<html>e-card Aktivierungsprozess</html>
 label.activation.step=<html>Schritt {0}</html>
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
index 920f7d5b..9178d65c 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
@@ -21,12 +21,15 @@ title.unblock.pin=<html>Unblock PIN</html>
 title.activate.success=<html>Success</html>
 title.change.success=<html>Success</html>
 
-message.pin.mgmt=<html>The smartcard has {0} PINs</html>
-message.activate.pin=<html>Enter and confirm {0}</html>
-message.change.pin=<html>Enter and confirm {0}</html>
-message.unblock.pin=<html>Enter PUK for {0}</html>
-message.activate.success=<html>{0} successfully activated</html>
-message.change.success=<html>{0} successfully changed</html>
+# removed message.* prefix to reuse keys as help keys
+pin.mgmt=<html>The smartcard has {0} PINs</html>
+pinpad=<html>Enter {0} ({1} digits) on pinpad and confirm.</html>
+pinpad.change=<html>Enter {0} ({1} digits) on pinpad and confirm.</html>
+activate.pin=<html>Enter and confirm {0}</html>
+change.pin=<html>Enter and confirm {0}</html>
+unblock.pin=<html>Enter PUK for {0}</html>
+activate.success=<html>{0} successfully activated</html>
+change.success=<html>{0} successfully changed</html>
 
 label.activation=<html>e-card activation process</html>
 label.activation.step=<html>Step {0}</html>
diff --git a/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java b/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
index ef8c87e4..b01abe72 100644
--- a/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
+++ b/BKUAppletExt/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
@@ -74,7 +74,7 @@ public class BKUGUIWorker implements Runnable {
 
           @Override
           public void actionPerformed(ActionEvent e) {
-            gui.showSignaturePINDialog(signPinSpec, signListener, "sign", cancelListener, "cancel", null, "hashdata");
+            gui.showSignaturePINDialog(signPinSpec, -1, signListener, "sign", cancelListener, "cancel", null, "hashdata");
           }
         };
         HashDataInput signedRef1 = new ByteArrayHashDataInput(
@@ -112,7 +112,7 @@ public class BKUGUIWorker implements Runnable {
 //                    signedRefs.add(signedRef4);
 //                    signedRefs.add(signedRef4);
 //                    signedRefs = Collections.singletonList(signedRef1);
-        gui.showHashDataInputDialog(signedRefs, returnListener, "return");
+        gui.showSecureViewer(signedRefs, returnListener, "return");
       }
     };
 
diff --git a/BKUAppletExt/src/test/java/at/gv/egiz/bku/smccstal/ext/FileSystemTest.java b/BKUAppletExt/src/test/java/at/gv/egiz/bku/smccstal/ext/FileSystemTest.java
deleted file mode 100644
index 5fa3cbd7..00000000
--- a/BKUAppletExt/src/test/java/at/gv/egiz/bku/smccstal/ext/FileSystemTest.java
+++ /dev/null
@@ -1,435 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package at.gv.egiz.bku.smccstal.ext;
-
-import at.gv.egiz.smcc.FileNotFoundException;
-import at.gv.egiz.smcc.LockedException;
-import at.gv.egiz.smcc.NotActivatedException;
-import at.gv.egiz.smcc.PINProvider;
-import at.gv.egiz.smcc.PINSpec;
-import at.gv.egiz.smcc.SignatureCard;
-import at.gv.egiz.smcc.SignatureCardException;
-import at.gv.egiz.smcc.util.SMCCHelper;
-import at.gv.egiz.smcc.util.SmartCardIO;
-import java.math.BigInteger;
-import java.nio.ByteBuffer;
-import java.util.Arrays;
-import java.util.Locale;
-import java.util.Map;
-import javax.smartcardio.Card;
-import javax.smartcardio.CardChannel;
-import javax.smartcardio.CardException;
-import javax.smartcardio.CardTerminal;
-import javax.smartcardio.CommandAPDU;
-import javax.smartcardio.ResponseAPDU;
-import org.junit.Ignore;
-import org.junit.Test;
-import static org.junit.Assert.*;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-@Ignore
-public class FileSystemTest {
-
-  /** asign premium */
-  public static final byte[] AID_DEC = new byte[] { (byte) 0xA0, (byte) 0x00,
-      (byte) 0x00, (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x4E };
-  
-  @Test
-//  @Ignore
-  public void testCard() throws CardException, SignatureCardException, InterruptedException {
-
-    SMCCHelper smccHelper = new SMCCHelper();
-    switch (smccHelper.getResultCode()) {
-      case SMCCHelper.CARD_FOUND:
-        System.out.println("card found ");
-    }
-    SignatureCard signatureCard = smccHelper.getSignatureCard(new Locale("de"));
-    Card card = signatureCard.getCard();
-
-//    SmartCardIO scIO = new SmartCardIO();
-//    Map<CardTerminal, Card> terminalCardMap = scIO.getCards();
-//
-//    for (CardTerminal ct : terminalCardMap.keySet()) {
-//      Card card = terminalCardMap.get(ct);
-//      System.out.println("found card (" + ct.getName() + "): " + Formatter.byteArrayToHexString(card.getATR().getBytes()));
-
-    System.out.println("found card " + Formatter.byteArrayToHexString(card.getATR().getBytes()));
-
-    CardChannel cardchannel;
-
-    //RESET
-    System.out.println("RESET");
-    signatureCard.reset();
-    card = signatureCard.getCard();
-//      card.disconnect(true);
-//      card = ct.connect("*");
-
-    System.out.println("begin exclusive");
-    card.beginExclusive();
-    System.out.println("get cardchannel");
-    cardchannel = card.getBasicChannel();
-
-    testECard(cardchannel, signatureCard, card);
-//    testASignPremium(cardchannel, signatureCard, card);
-
-//    }
-
-  }
-
-  public static class TestCard {
-
-    protected CardChannel channel;
-    protected int ifs_ = 254;
-
-    public TestCard(CardChannel channel) {
-      this.channel = channel;
-    }
-
-    protected byte[] readTLVFile(byte[] aid, byte[] ef, String pin, byte kid, int maxLength)
-            throws SignatureCardException, InterruptedException, CardException {
-
-
-      // SELECT FILE (AID)
-      selectFileAID(aid);
-
-      // SELECT FILE (EF)
-      ResponseAPDU resp = selectFileFID(ef);
-      if (resp.getSW() == 0x6a82) {
-        // EF not found
-        throw new FileNotFoundException("EF " + toString(ef) + " not found.");
-      } else if (resp.getSW() != 0x9000) {
-        throw new SignatureCardException("SELECT FILE with " + "FID=" + toString(ef) + " failed (" + "SW=" + Integer.toHexString(resp.getSW()) + ").");
-      }
-
-      // VERIFY
-      if (pin != null) {
-        int retries = verifyPIN(pin, kid);
-        if (retries != -1) {
-          throw new at.gv.egiz.smcc.VerificationFailedException(retries);
-        }
-      }
-
-      return readBinaryTLV(maxLength, (byte) 0x30);
-    }
-
-    protected byte[] readBinary(CardChannel channel, int offset, int len)
-            throws CardException, SignatureCardException {
-
-      //transmit(channel,apdu)
-      ResponseAPDU resp = channel.transmit(new CommandAPDU(0x00, 0xB0,
-              0x7F & (offset >> 8), offset & 0xFF, len));
-      if (resp.getSW() == 0x9000) {
-        return resp.getData();
-      } else if (resp.getSW() == 0x6982) {
-        throw new at.gv.egiz.smcc.SecurityStatusNotSatisfiedException();
-      } else {
-        throw new SignatureCardException("Failed to read bytes (" + offset + "+" + len + "): SW=" + Integer.toHexString(resp.getSW()));
-      }
-
-    }
-
-    protected byte[] readBinaryTLV(int maxSize, byte expectedType) throws CardException,
-            SignatureCardException {
-
-//      CardChannel channel = getCardChannel();
-
-      // read first chunk
-      int len = Math.min(maxSize, ifs_);
-      byte[] chunk = readBinary(channel, 0, len);
-      if (chunk.length > 0 && chunk[0] != expectedType) {
-        return null;
-      }
-      int offset = chunk.length;
-      int actualSize = maxSize;
-      if (chunk.length > 3) {
-        if ((chunk[1] & 0x80) > 0) {
-          int octets = (0x0F & chunk[1]);
-          actualSize = 2 + octets;
-          for (int i = 1; i <= octets; i++) {
-            actualSize += (0xFF & chunk[i + 1]) << ((octets - i) * 8);
-          }
-        } else {
-          actualSize = 2 + chunk[1];
-        }
-      }
-      ByteBuffer buffer = ByteBuffer.allocate(actualSize);
-      buffer.put(chunk, 0, Math.min(actualSize, chunk.length));
-      while (offset < actualSize) {
-        len = Math.min(ifs_, actualSize - offset);
-        chunk = readBinary(channel, offset, len);
-        buffer.put(chunk);
-        offset += chunk.length;
-      }
-      return buffer.array();
-
-    }
-
-    protected byte[] selectFileAID(byte[] dfName) throws CardException, SignatureCardException {
-//      CardChannel channel = getCardChannel();
-      ResponseAPDU resp = channel.transmit(new CommandAPDU(0x00, 0xA4, 0x04,
-              0x00, dfName, 256));
-      if (resp.getSW() != 0x9000) {
-        throw new SignatureCardException("Failed to select application AID=" + toString(dfName) + ": SW=" + Integer.toHexString(resp.getSW()) + ".");
-      } else {
-        return resp.getBytes();
-      }
-    }
-
-    protected ResponseAPDU selectFileFID(byte[] fid) throws CardException, SignatureCardException {
-//      CardChannel channel = getCardChannel();
-      return channel.transmit(new CommandAPDU(0x00, 0xA4, 0x02,
-              0x04, fid, 256));
-    }
-
-    protected String toString(byte[] b) {
-      StringBuffer sb = new StringBuffer();
-      if (b != null && b.length > 0) {
-        sb.append(Integer.toHexString((b[0] & 240) >> 4));
-        sb.append(Integer.toHexString(b[0] & 15));
-      }
-      for (int i = 1; i < b.length; i++) {
-        sb.append(':');
-        sb.append(Integer.toHexString((b[i] & 240) >> 4));
-        sb.append(Integer.toHexString(b[i] & 15));
-      }
-      return sb.toString();
-    }
-
-    protected int verifyPIN(String pin, byte kid) throws CardException, SignatureCardException {
-
-//      CardChannel channel = getCardChannel();
-
-      ResponseAPDU resp;
-      if (pin == null) {
-        //
-        resp = channel.transmit(new CommandAPDU(0x00, 0x20, 0x00, kid));
-      } else {
-        // PIN length in bytes
-        int len = (int) Math.ceil(pin.length() / 2);
-
-        // BCD encode PIN and marshal PIN block
-        byte[] pinBytes = new BigInteger(pin, 16).toByteArray();
-        byte[] pinBlock = new byte[8];
-        if (len < pinBytes.length) {
-          System.arraycopy(pinBytes, pinBytes.length - len, pinBlock, 1, len);
-        } else {
-          System.arraycopy(pinBytes, 0, pinBlock, len - pinBytes.length + 1,
-                  pinBytes.length);
-        }
-        pinBlock[0] = (byte) (0x20 + len * 2);
-        Arrays.fill(pinBlock, len + 1, 8, (byte) 0xff);
-
-        resp = channel.transmit(new CommandAPDU(0x00, 0x20, 0x00, kid, pinBlock));//, false);
-
-      }
-
-      if (resp.getSW() == 0x63c0) {
-        throw new LockedException("PIN locked.");
-      } else if (resp.getSW1() == 0x63 && resp.getSW2() >> 4 == 0xc) {
-        // return number of possible retries
-        return resp.getSW2() & 0x0f;
-      } else if (resp.getSW() == 0x6983) {
-        throw new LockedException();
-      } else if (resp.getSW() == 0x6984) {
-        // PIN LCS = "Initialized" (-> not activated)
-        throw new NotActivatedException("PIN not set.");
-      } else if (resp.getSW() == 0x9000) {
-        return -1; // success
-      } else {
-        throw new SignatureCardException("Failed to verify pin: SW=" + Integer.toHexString(resp.getSW()));
-      }
-    }
-  }
-
-  public static class Formatter {
-
-    private static String[] alphabet = {"0", "1", "2",
-      "3", "4", "5", "6", "7", "8",
-      "9", "A", "B", "C", "D", "E",
-      "F"};
-
-    public static String byteArrayToHexString(byte[] bytes) {
-
-      if (bytes == null || bytes.length <= 0) {
-        return null;
-      }
-
-      StringBuffer buf = new StringBuffer(2 * bytes.length);
-
-      byte c = 0x00;
-
-      for (int i = 0; i < bytes.length; i++) {
-
-        // high nibble
-        c = (byte) (bytes[i] & 0xf0);
-
-        // shift down
-        c = (byte) (c >>> 4);
-
-        // cut high order bits
-        c = (byte) (c & 0x0f);
-
-        buf.append(alphabet[(int) c]);
-
-        // low nibble
-        c = (byte) (bytes[i] & 0x0f);
-
-        buf.append(alphabet[(int) c]);
-        if (i < bytes.length - 1) {
-          buf.append(':');
-        }
-      }
-
-      return buf.toString();
-
-    }
-  }
-
-  protected void testASignPremium(CardChannel cardchannel, SignatureCard signatureCard, Card card) throws CardException {
-    byte[] selectMF = new byte[]{(byte) 0x00, (byte) 0xA4, (byte) 0x00, (byte) 0x0C, (byte) 0x02, (byte) 0x3F, (byte) 0x00};
-    byte[] selectDF_DEC = new byte[] { (byte) 0x00, (byte) 0xA4, (byte) 0x00, (byte) 0x0C, (byte) 0x02, (byte) 0xdf, (byte) 0x71 };
-    byte[] selectAID_DEC = new byte[] { (byte) 0x00, (byte) 0xA4, (byte) 0x04, (byte) 0x00, (byte) 0x07, (byte) 0xA0, (byte) 0x00,
-      (byte) 0x00, (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x4E  };
-
-    CommandAPDU cAPDU;
-    ResponseAPDU rAPDU;
-    byte[] sw;
-
-    cAPDU = new CommandAPDU(selectMF);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-
-    cAPDU = new CommandAPDU(selectAID_DEC);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-
-    cAPDU = new CommandAPDU(selectDF_DEC);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-
-
-  }
-
-  protected void testECard(CardChannel cardchannel, SignatureCard signatureCard, Card card) throws CardException, InterruptedException, SignatureCardException {
-//      if (cardTerminal != null) {
-//        card_ = cardTerminal.connect("*");
-//      }
-    byte[] selectMF = new byte[]{(byte) 0x00, (byte) 0xA4, (byte) 0x00, (byte) 0x0C, (byte) 0x02, (byte) 0x3F, (byte) 0x00};
-    byte[] readEF_GDO = new byte[]{(byte) 0x00, (byte) 0xB0, (byte) 0x82, (byte) 0x00, (byte) 0x00};
-    CommandAPDU cAPDU;
-    ResponseAPDU rAPDU;
-    byte[] sw;
-    cAPDU = new CommandAPDU(selectMF);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    cAPDU = new CommandAPDU(readEF_GDO);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    byte[] EF_GDO = rAPDU.getData();
-    //RESET
-    System.out.println("RESET");
-    signatureCard.reset();
-    card = signatureCard.getCard();
-//      card.disconnect(true);
-//      card = ct.connect("*");
-    System.out.println("begin exclusive");
-    card.beginExclusive();
-    System.out.println("get cardchannel");
-    cardchannel = card.getBasicChannel();
-    byte[] getCLC = new byte[]{(byte) 0x00, (byte) 0xCA, (byte) 0xDF, (byte) 0x20, (byte) 0x00};
-    byte[] verifyKartenPIN = new byte[]{(byte) 0x00, (byte) 0x20, (byte) 0x00, (byte) 0x01};
-    byte[] selectDF_SichereSignatur = new byte[]{(byte) 0x00, (byte) 0xA4, (byte) 0x04, (byte) 0x00, (byte) 0x08, (byte) 0xD0, (byte) 0x40, (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01, (byte) 0x00};
-    byte[] verifySignaturPIN = new byte[]{(byte) 0x00, (byte) 0x20, (byte) 0x00, (byte) 0x81};
-    cAPDU = new CommandAPDU(getCLC);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    byte[] clc = rAPDU.getData();
-    cAPDU = new CommandAPDU(verifyKartenPIN);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    cAPDU = new CommandAPDU(selectDF_SichereSignatur);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    cAPDU = new CommandAPDU(verifySignaturPIN);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    //RESET
-    System.out.println("RESET");
-    signatureCard.reset();
-    card = signatureCard.getCard();
-    System.out.println("InfoboxReadRequests...");
-    PINProvider pinProvider = new PINProvider() {
-
-      @Override
-      public String providePIN(PINSpec spec, int retries) throws InterruptedException {
-        if (retries >= 3) {
-          return "2540";
-        } else {
-          throw new InterruptedException("TOO FEW PIN RETRIES LEFT, ABORTING");
-        }
-      }
-    };
-    byte[] ehic = signatureCard.getInfobox("EHIC", pinProvider, null);
-    System.out.println("EHIC: " + Formatter.byteArrayToHexString(ehic));
-    byte[] grunddaten = signatureCard.getInfobox("Grunddaten", pinProvider, null);
-    System.out.println("Grunddaten: " + Formatter.byteArrayToHexString(grunddaten));
-    //RESET
-    System.out.println("RESET");
-    signatureCard.reset();
-    card = signatureCard.getCard();
-//      card.disconnect(true);
-//      card = ct.connect("*");
-    System.out.println("begin exclusive");
-    card.beginExclusive();
-    System.out.println("get cardchannel");
-    cardchannel = card.getBasicChannel();
-    cAPDU = new CommandAPDU(getCLC);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    assertTrue(Arrays.equals(clc, rAPDU.getData()));
-    cAPDU = new CommandAPDU(readEF_GDO);
-    rAPDU = cardchannel.transmit(cAPDU);
-    sw = new byte[]{(byte) (0xFF & rAPDU.getSW1()), (byte) (0xFF & rAPDU.getSW2())};
-    System.out.println("cAPDU: " + Formatter.byteArrayToHexString(cAPDU.getBytes()));
-    System.out.println("rAPDU (sw=" + Formatter.byteArrayToHexString(sw) + "): " + Formatter.byteArrayToHexString(rAPDU.getData()));
-    assertTrue(Arrays.equals(EF_GDO, rAPDU.getData()));
-//    }
-  }
-}
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
index be5e3fc8..1043b6a1 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
@@ -36,6 +36,7 @@ public interface BKUGUIFacade {
   public static final String ERR_INVALID_HASH = "error.invalid.hash";
   public static final String ERR_CARD_LOCKED = "error.card.locked";
   public static final String ERR_CARD_NOTACTIVATED = "error.card.notactivated";
+  public static final String ERR_PIN_TIMEOUT = "error.pin.timeout";
   public static final String ERR_VIEWER = "error.viewer";
   public static final String ERR_EXTERNAL_LINK = "error.external.link";
   public static final String ERR_CONFIG = "error.config";
@@ -52,6 +53,7 @@ public interface BKUGUIFacade {
   public static final String TITLE_CARDPIN = "title.cardpin";
   public static final String TITLE_SIGN = "title.sign";
   public static final String TITLE_ERROR = "title.error";
+  public static final String TITLE_ENTRY_TIMEOUT = "title.entry.timeout";
   public static final String TITLE_RETRY = "title.retry";
   public static final String TITLE_WAIT = "title.wait";
   public static final String TITLE_HASHDATA = "title.hashdata";
@@ -60,17 +62,22 @@ public interface BKUGUIFacade {
   public static final String WINDOWTITLE_OVERWRITE = "windowtitle.overwrite";
   public static final String WINDOWTITLE_VIEWER = "windowtitle.viewer";
   public static final String WINDOWTITLE_HELP = "windowtitle.help";
-  public static final String MESSAGE_WAIT = "message.wait";
-  public static final String MESSAGE_INSERTCARD = "message.insertcard";
-  public static final String MESSAGE_ENTERPIN = "message.enterpin";
-  public static final String MESSAGE_HASHDATALINK = "message.hashdatalink";
-  public static final String MESSAGE_HASHDATALINK_TINY = "message.hashdatalink.tiny";
-//  public static final String MESSAGE_HASHDATA = "message.hashdata";
-  public static final String MESSAGE_HASHDATALIST = "message.hashdatalist";
-  public static final String MESSAGE_RETRIES = "message.retries";
-  public static final String MESSAGE_LAST_RETRY = "message.retries.last";
-  public static final String MESSAGE_OVERWRITE = "message.overwrite";
-  public static final String MESSAGE_HELP = "message.help";
+
+  // removed message.* prefix to reuse keys as help keys
+  public static final String MESSAGE_WELCOME = "welcome";
+  public static final String MESSAGE_WAIT = "wait";
+  public static final String MESSAGE_INSERTCARD = "insertcard";
+  public static final String MESSAGE_CARD_NOT_SUPPORTED = "cardnotsupported";
+  public static final String MESSAGE_ENTERPIN = "enterpin";
+  public static final String MESSAGE_ENTERPIN_PINPAD = "enterpin.pinpad";
+  public static final String MESSAGE_HASHDATALINK = "hashdatalink";
+  public static final String MESSAGE_HASHDATALINK_TINY = "hashdatalink.tiny";
+  public static final String MESSAGE_HASHDATALIST = "hashdatalist";
+  public static final String MESSAGE_RETRIES = "retries";
+  public static final String MESSAGE_LAST_RETRY = "retries.last";
+  public static final String MESSAGE_OVERWRITE = "overwrite";
+  public static final String MESSAGE_HELP = "help";
+
   public static final String WARNING_XHTML = "warning.xhtml";
   public static final String LABEL_PIN = "label.pin";
   public static final String LABEL_PINSIZE = "label.pinsize";
@@ -103,33 +110,48 @@ public interface BKUGUIFacade {
    */
   public Locale getLocale();
 
-  public void showWelcomeDialog();
+//  public void showWelcomeDialog();
 
   /**
    * 
    * @param waitMessage if null, a simple 'please wait' text is displayed
    */
-  public void showWaitDialog(String waitMessage);
+//  public void showWaitDialog(String waitMessage);
+
+//  public void showInsertCardDialog(ActionListener cancelListener, String actionCommand);
 
-  public void showInsertCardDialog(ActionListener cancelListener, String actionCommand);
+//  public void showCardNotSupportedDialog(ActionListener cancelListener, String actionCommand);
 
-  public void showCardNotSupportedDialog(ActionListener cancelListener, String actionCommand);
+  public void showCardPINDialog(PINSpec pinSpec, int numRetries,
+          ActionListener okListener, String okCommand,
+          ActionListener cancelListener, String cancelCommand);
 
-  public void showCardPINDialog(PINSpec pinSpec, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand);
+//  public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand);
 
-  public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand);
+  public void showSignaturePINDialog(PINSpec pinSpec, int numRetries, ActionListener signListener, String signCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand);
 
-  public void showSignaturePINDialog(PINSpec pinSpec, ActionListener signListener, String signCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand);
+//  public void showSignaturePINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand);
 
-  public void showSignaturePINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand);
+//  public void showPinpadSignaturePINDialog(PINSpec pinSpec, int retries);
 
   public char[] getPin();
 
-  public void showHashDataInputDialog(List<HashDataInput> signedReferences, ActionListener okListener, String okCommand);
+  public void showSecureViewer(List<HashDataInput> signedReferences,
+          ActionListener okListener, String okCommand);
 
-  public void showErrorDialog(String errorMsgKey, Object[] errorMsgParams, ActionListener okListener, String okCommand);
+  public void showErrorDialog(String errorMsgKey, Object[] errorMsgParams,
+          ActionListener okListener, String okCommand);
 
   public void showErrorDialog(String errorMsgKey, Object[] errorMsgParams);
 
-  public void showMessageDialog(String titleKey, String msgKey, Object[] msgParams, ActionListener okListener, String okCommand);
+  public void showMessageDialog(String titleKey, 
+          String msgKey, Object[] msgParams,
+          String buttonKey,
+          ActionListener okListener, String okCommand);
+
+  public void showMessageDialog(String titleKey,
+          String msgKey, Object[] msgParams);
+
+  public void showMessageDialog(String titleKey,
+          String msgKey);
 }
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
index 76b1d795..928be249 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
@@ -315,200 +315,204 @@ public class BKUGUIImpl implements BKUGUIFacade {
       return messages.containsKey(key);
     }
 
-    @Override
-    public void showWelcomeDialog() {
-      
-      log.debug("scheduling welcome dialog");
-      
-        SwingUtilities.invokeLater(new Runnable() {
-
-            @Override
-            public void run() {
-              
-              log.debug("show welcome dialog");
-              
-                mainPanel.removeAll();
-                buttonPanel.removeAll();
-
-                helpListener.setHelpTopic(HELP_WELCOME);
-                
-                JLabel welcomeMsgLabel = new JLabel();
-                welcomeMsgLabel.setFont(welcomeMsgLabel.getFont().deriveFont(welcomeMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                
-                if (renderHeaderPanel) {
-                  titleLabel.setText(getMessage(TITLE_WELCOME));
-                  welcomeMsgLabel.setText(getMessage(MESSAGE_WAIT));
-                } else {
-                  welcomeMsgLabel.setText(getMessage(TITLE_WELCOME));
-                }
-                
-                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-                mainPanel.setLayout(mainPanelLayout);
-
-                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-                        .addComponent(welcomeMsgLabel);
-                GroupLayout.Group messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                        .addComponent(welcomeMsgLabel);
-                if (!renderHeaderPanel) {
-                  messageHorizontal
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                          .addComponent(helpLabel); 
-                  messageVertical
-                          .addComponent(helpLabel);
-                }
-
-                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-                mainPanelLayout.setVerticalGroup(messageVertical);
-                
-                contentPanel.validate();
-
-            }
-        });
-    }
-
-    @Override
-    public void showInsertCardDialog(final ActionListener cancelListener, final String cancelCommand) {
-      
-      log.debug("scheduling insert card dialog");
-      
-      SwingUtilities.invokeLater(new Runnable() {
-
-            @Override
-            public void run() {
-              
-              log.debug("show insert card dialog");
-      
-                mainPanel.removeAll();
-                buttonPanel.removeAll();
-
-                if (renderHeaderPanel) {
-                  titleLabel.setText(getMessage(TITLE_INSERTCARD));
-                }
-                
-                helpListener.setHelpTopic(HELP_INSERTCARD);
-
-                JLabel insertCardMsgLabel = new JLabel();
-                insertCardMsgLabel.setFont(insertCardMsgLabel.getFont().deriveFont(insertCardMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                insertCardMsgLabel.setText(getMessage(MESSAGE_INSERTCARD));
-
-                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-                mainPanel.setLayout(mainPanelLayout);
-
-                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-                        .addComponent(insertCardMsgLabel);
-                GroupLayout.ParallelGroup messageVertical = mainPanelLayout.createParallelGroup()
-                        .addComponent(insertCardMsgLabel);
-                
-                if (!renderHeaderPanel) {
-                  messageHorizontal
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                          .addComponent(helpLabel);    
-                  messageVertical
-                          .addComponent(helpLabel);
-                }
-                
-                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-                mainPanelLayout.setVerticalGroup(messageVertical);
-                
-                if (renderCancelButton) {
-                  JButton cancelButton = new JButton();
-                  cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                  cancelButton.setText(getMessage(BUTTON_CANCEL));
-                  cancelButton.addActionListener(cancelListener);
-                  cancelButton.setActionCommand(cancelCommand);
-
-                  GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-                  buttonPanel.setLayout(buttonPanelLayout);
-
-                  buttonPanelLayout.setHorizontalGroup(
-                    buttonPanelLayout.createSequentialGroup()
-                          .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                          .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-                  buttonPanelLayout.setVerticalGroup(
-                    buttonPanelLayout.createSequentialGroup()
-                      .addComponent(cancelButton));
-                }
-
-                contentPanel.validate();
-            }
-        });
-    }
+//    @Override
+//    public void showWelcomeDialog() {
+//
+//      log.debug("scheduling welcome dialog");
+//
+//        SwingUtilities.invokeLater(new Runnable() {
+//
+//            @Override
+//            public void run() {
+//
+//              log.debug("show welcome dialog");
+//
+//                mainPanel.removeAll();
+//                buttonPanel.removeAll();
+//
+//                helpListener.setHelpTopic(HELP_WELCOME);
+//
+//                JLabel welcomeMsgLabel = new JLabel();
+//                welcomeMsgLabel.setFont(welcomeMsgLabel.getFont().deriveFont(welcomeMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+//
+//                if (renderHeaderPanel) {
+//                  titleLabel.setText(getMessage(TITLE_WELCOME));
+//                  welcomeMsgLabel.setText(getMessage(MESSAGE_WAIT));
+//                } else {
+//                  welcomeMsgLabel.setText(getMessage(TITLE_WELCOME));
+//                }
+//
+//                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+//                mainPanel.setLayout(mainPanelLayout);
+//
+//                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
+//                        .addComponent(welcomeMsgLabel);
+//                GroupLayout.Group messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+//                        .addComponent(welcomeMsgLabel);
+//                if (!renderHeaderPanel) {
+//                  messageHorizontal
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+//                          .addComponent(helpLabel);
+//                  messageVertical
+//                          .addComponent(helpLabel);
+//                }
+//
+//                mainPanelLayout.setHorizontalGroup(messageHorizontal);
+//                mainPanelLayout.setVerticalGroup(messageVertical);
+//
+//                contentPanel.validate();
+//
+//            }
+//        });
+//    }
+
+//    @Override
+//    public void showInsertCardDialog(
+//            final ActionListener cancelListener, final String cancelCommand) {
+//
+//      log.debug("scheduling insert card dialog");
+//
+//      SwingUtilities.invokeLater(new Runnable() {
+//
+//            @Override
+//            public void run() {
+//
+//              log.debug("show insert card dialog");
+//
+//                mainPanel.removeAll();
+//                buttonPanel.removeAll();
+//
+//                if (renderHeaderPanel) {
+//                  titleLabel.setText(getMessage(TITLE_INSERTCARD));
+//                }
+//
+//                helpListener.setHelpTopic(HELP_INSERTCARD);
+//
+//                JLabel insertCardMsgLabel = new JLabel();
+//                insertCardMsgLabel.setFont(insertCardMsgLabel.getFont().deriveFont(insertCardMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+//                insertCardMsgLabel.setText(getMessage(MESSAGE_INSERTCARD));
+//
+//                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+//                mainPanel.setLayout(mainPanelLayout);
+//
+//                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
+//                        .addComponent(insertCardMsgLabel);
+//                GroupLayout.ParallelGroup messageVertical = mainPanelLayout.createParallelGroup()
+//                        .addComponent(insertCardMsgLabel);
+//
+//                if (!renderHeaderPanel) {
+//                  messageHorizontal
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+//                          .addComponent(helpLabel);
+//                  messageVertical
+//                          .addComponent(helpLabel);
+//                }
+//
+//                mainPanelLayout.setHorizontalGroup(messageHorizontal);
+//                mainPanelLayout.setVerticalGroup(messageVertical);
+//
+//                if (renderCancelButton) {
+//                  JButton cancelButton = new JButton();
+//                  cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+//                  cancelButton.setText(getMessage(BUTTON_CANCEL));
+//                  cancelButton.addActionListener(cancelListener);
+//                  cancelButton.setActionCommand(cancelCommand);
+//
+//                  GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+//                  buttonPanel.setLayout(buttonPanelLayout);
+//
+//                  buttonPanelLayout.setHorizontalGroup(
+//                    buttonPanelLayout.createSequentialGroup()
+//                          .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+//                          .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
+//                  buttonPanelLayout.setVerticalGroup(
+//                    buttonPanelLayout.createSequentialGroup()
+//                      .addComponent(cancelButton));
+//                }
+//
+//                contentPanel.validate();
+//            }
+//        });
+//    }
 
     /**
      * only difference to showInsertCard: title text: card not supported
      * @param cancelListener
      * @param cancelCommand
      */
-    @Override
-    public void showCardNotSupportedDialog(final ActionListener cancelListener, final String cancelCommand) {
-        
-      log.debug("scheduling card not supported dialog");
-      
-      SwingUtilities.invokeLater(new Runnable() {
-
-            @Override
-            public void run() {
-                
-              log.debug("show card not supported dialog");
-                
-              mainPanel.removeAll();
-              buttonPanel.removeAll();
-
-              JLabel insertCardMsgLabel = new JLabel();
-              insertCardMsgLabel.setFont(insertCardMsgLabel.getFont().deriveFont(insertCardMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-
-              if (renderHeaderPanel) {
-                titleLabel.setText(getMessage(TITLE_CARD_NOT_SUPPORTED));
-                insertCardMsgLabel.setText(getMessage(MESSAGE_INSERTCARD));
-              } else {
-                insertCardMsgLabel.setText(getMessage(TITLE_CARD_NOT_SUPPORTED));
-              }
-
-              helpListener.setHelpTopic(HELP_CARDNOTSUPPORTED);
-              
-              GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-              mainPanel.setLayout(mainPanelLayout);
-
-              GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-                      .addComponent(insertCardMsgLabel);
-              GroupLayout.Group messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                      .addComponent(insertCardMsgLabel);
-              if (!renderHeaderPanel) {
-                messageHorizontal
-                        .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                        .addComponent(helpLabel);
-                messageVertical
-                        .addComponent(helpLabel);
-              } 
-              
-              mainPanelLayout.setHorizontalGroup(messageHorizontal);
-              mainPanelLayout.setVerticalGroup(messageVertical);
-                
-              if (renderCancelButton) {
-                JButton cancelButton = new JButton();
-                cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                cancelButton.setText(getMessage(BUTTON_CANCEL));
-                cancelButton.addActionListener(cancelListener);
-                cancelButton.setActionCommand(cancelCommand);
-
-                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-                buttonPanel.setLayout(buttonPanelLayout);
-
-                buttonPanelLayout.setHorizontalGroup(
-                  buttonPanelLayout.createSequentialGroup()
-                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                        .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-                buttonPanelLayout.setVerticalGroup(
-                  buttonPanelLayout.createSequentialGroup()
-                    .addComponent(cancelButton));
-              }
-              
-              contentPanel.validate();
-            }
-        });
-    }
-
-    private void showCardPINDialog(final PINSpec pinSpec, final int numRetries, final ActionListener okListener, final String okCommand, final ActionListener cancelListener, final String cancelCommand) {
+//    @Override
+//    public void showCardNotSupportedDialog(final ActionListener cancelListener, final String cancelCommand) {
+//
+//      log.debug("scheduling card not supported dialog");
+//
+//      SwingUtilities.invokeLater(new Runnable() {
+//
+//            @Override
+//            public void run() {
+//
+//              log.debug("show card not supported dialog");
+//
+//              mainPanel.removeAll();
+//              buttonPanel.removeAll();
+//
+//              JLabel insertCardMsgLabel = new JLabel();
+//              insertCardMsgLabel.setFont(insertCardMsgLabel.getFont().deriveFont(insertCardMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+//
+//              if (renderHeaderPanel) {
+//                titleLabel.setText(getMessage(TITLE_CARD_NOT_SUPPORTED));
+//                insertCardMsgLabel.setText(getMessage(MESSAGE_INSERTCARD));
+//              } else {
+//                insertCardMsgLabel.setText(getMessage(TITLE_CARD_NOT_SUPPORTED));
+//              }
+//
+//              helpListener.setHelpTopic(HELP_CARDNOTSUPPORTED);
+//
+//              GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+//              mainPanel.setLayout(mainPanelLayout);
+//
+//              GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
+//                      .addComponent(insertCardMsgLabel);
+//              GroupLayout.Group messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+//                      .addComponent(insertCardMsgLabel);
+//              if (!renderHeaderPanel) {
+//                messageHorizontal
+//                        .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+//                        .addComponent(helpLabel);
+//                messageVertical
+//                        .addComponent(helpLabel);
+//              }
+//
+//              mainPanelLayout.setHorizontalGroup(messageHorizontal);
+//              mainPanelLayout.setVerticalGroup(messageVertical);
+//
+//              if (renderCancelButton) {
+//                JButton cancelButton = new JButton();
+//                cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+//                cancelButton.setText(getMessage(BUTTON_CANCEL));
+//                cancelButton.addActionListener(cancelListener);
+//                cancelButton.setActionCommand(cancelCommand);
+//
+//                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+//                buttonPanel.setLayout(buttonPanelLayout);
+//
+//                buttonPanelLayout.setHorizontalGroup(
+//                  buttonPanelLayout.createSequentialGroup()
+//                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+//                        .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
+//                buttonPanelLayout.setVerticalGroup(
+//                  buttonPanelLayout.createSequentialGroup()
+//                    .addComponent(cancelButton));
+//              }
+//
+//              contentPanel.validate();
+//            }
+//        });
+//    }
+
+  @Override
+  public void showCardPINDialog(final PINSpec pinSpec, final int numRetries,
+          final ActionListener okListener, final String okCommand,
+          final ActionListener cancelListener, final String cancelCommand) {
         
       log.debug("scheduling card-pin dialog");
       
@@ -534,7 +538,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 JButton okButton = new JButton();
                 okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
                 okButton.setText(getMessage(BUTTON_OK));
-                okButton.setEnabled(false);
+                okButton.setEnabled(pinSpec.getMinLength() <= 0);
                 okButton.setActionCommand(okCommand);
                 okButton.addActionListener(okListener);
 
@@ -681,27 +685,30 @@ public class BKUGUIImpl implements BKUGUIFacade {
         });
     }
 
-    @Override
-    public void showCardPINDialog(PINSpec pinSpec, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand) {
-        showCardPINDialog(pinSpec, -1, okListener, okCommand, cancelListener, cancelCommand);
-    }
-
-    @Override
-    public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand) {
-        showCardPINDialog(pinSpec, numRetries, okListener, okCommand, cancelListener, cancelCommand);
-    }
-
-    @Override
-    public void showSignaturePINDialog(PINSpec pinSpec, ActionListener signListener, String signCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand) {
-        showSignaturePINDialog(pinSpec, -1, signListener, signCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
-    }
+//    @Override
+//    public void showCardPINDialog(PINSpec pinSpec, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand) {
+//        showCardPINDialog(pinSpec, -1, okListener, okCommand, cancelListener, cancelCommand);
+//    }
+//
+//    @Override
+//    public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand) {
+//        showCardPINDialog(pinSpec, numRetries, okListener, okCommand, cancelListener, cancelCommand);
+//    }
+
+//    @Override
+//    public void showSignaturePINDialog(PINSpec pinSpec, ActionListener signListener, String signCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand) {
+//        showSignaturePINDialog(pinSpec, -1, signListener, signCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
+//    }
 
     @Override
-    public void showSignaturePINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand) {
-        showSignaturePINDialog(pinSpec, numRetries, okListener, okCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
-    }
-
-    private void showSignaturePINDialog(final PINSpec pinSpec, final int numRetries, final ActionListener signListener, final String signCommand, final ActionListener cancelListener, final String cancelCommand, final ActionListener hashdataListener, final String hashdataCommand) {
+    public void showSignaturePINDialog(final PINSpec pinSpec, final int numRetries,
+            final ActionListener signListener, final String signCommand,
+            final ActionListener cancelListener, final String cancelCommand,
+            final ActionListener hashdataListener, final String hashdataCommand) {
+//        showSignaturePINDialog(pinSpec, numRetries, okListener, okCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
+//    }
+//
+//    private void showSignaturePINDialog(final PINSpec pinSpec, final int numRetries, final ActionListener signListener, final String signCommand, final ActionListener cancelListener, final String cancelCommand, final ActionListener hashdataListener, final String hashdataCommand) {
 
       log.debug("scheduling signature-pin dialog");
       
@@ -726,7 +733,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 JButton signButton = new JButton();
                 signButton.setFont(signButton.getFont().deriveFont(signButton.getFont().getStyle() & ~java.awt.Font.BOLD));
                 signButton.setText(getMessage(BUTTON_SIGN));
-                signButton.setEnabled(false);
+                signButton.setEnabled(pinSpec.getMinLength() <= 0);
                 signButton.setActionCommand(signCommand);
                 signButton.addActionListener(signListener);
 
@@ -888,7 +895,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
             final ActionListener okListener, final String okCommand) {
         
       showMessageDialog(TITLE_ERROR, ERROR_COLOR,
-              errorMsgKey, errorMsgParams, okListener, okCommand);
+              errorMsgKey, errorMsgParams, BUTTON_OK, okListener, okCommand);
     }
 
     @Override
@@ -896,22 +903,45 @@ public class BKUGUIImpl implements BKUGUIFacade {
             final String errorMsgKey, final Object[] errorMsgParams) {
 
       showMessageDialog(TITLE_ERROR, ERROR_COLOR,
-              errorMsgKey, errorMsgParams, null, null);
+              errorMsgKey, errorMsgParams, null, null, null);
     }
 
     @Override
     public void showMessageDialog(
             final String titleKey,
             final String msgKey, final Object[] msgParams,
+            final String buttonKey,
             final ActionListener okListener, final String okCommand) {
 
       showMessageDialog(titleKey, null, 
-              msgKey, msgParams, okListener, okCommand);
+              msgKey, msgParams, buttonKey, okListener, okCommand);
+    }
+
+    @Override
+    public void showMessageDialog(
+            final String titleKey,
+            final String msgKey, final Object[] msgParams) {
+
+      showMessageDialog(titleKey, null,
+              msgKey, msgParams, null, null, null);
+    }
+
+    @Override
+    public void showMessageDialog(
+            final String titleKey, final String msgKey) {
+
+      showMessageDialog(titleKey, null,
+              msgKey, null, null, null, null);
     }
 
+    /**
+     *
+     * @param buttonKey if null defaults to BUTTON_OK
+     */
     private void showMessageDialog(
             final String titleKey, final Color titleColor,
             final String msgKey, final Object[] msgParams,
+            final String buttonKey,
             final ActionListener okListener, final String okCommand) {
 
       log.debug("scheduling message dialog");
@@ -972,7 +1002,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 if (okListener != null) {
                   JButton okButton = new JButton();
                   okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                  okButton.setText(getMessage(BUTTON_OK));
+                  okButton.setText(getMessage((buttonKey != null) ? buttonKey : BUTTON_OK));
                   okButton.setActionCommand(okCommand);
                   okButton.addActionListener(okListener);
 
@@ -993,57 +1023,57 @@ public class BKUGUIImpl implements BKUGUIFacade {
         });
     }
 
-    @Override
-    public void showWaitDialog(final String waitMessage) {
-        
-      log.debug("scheduling wait dialog");
-      
-      SwingUtilities.invokeLater(new Runnable() {
-
-            @Override
-            public void run() {
-        
-              log.debug("show wait dialog");
-              
-                mainPanel.removeAll();
-                buttonPanel.removeAll();
-
-                if (renderHeaderPanel) {
-                  titleLabel.setText(getMessage(TITLE_WAIT));
-                }
-                
-                helpListener.setHelpTopic(HELP_WAIT);
-                
-                JLabel waitMsgLabel = new JLabel();
-                waitMsgLabel.setFont(waitMsgLabel.getFont().deriveFont(waitMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                if (waitMessage != null) {
-                    waitMsgLabel.setText("<html>" + waitMessage + "</html>");
-                } else {
-                    waitMsgLabel.setText(getMessage(MESSAGE_WAIT));
-                }
-
-                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-                mainPanel.setLayout(mainPanelLayout);
-
-                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-                        .addComponent(waitMsgLabel);
-                GroupLayout.ParallelGroup messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                        .addComponent(waitMsgLabel);
-                
-                if (!renderHeaderPanel) {
-                  messageHorizontal
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                          .addComponent(helpLabel);
-                  messageVertical
-                          .addComponent(helpLabel);
-                }
-                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-                mainPanelLayout.setVerticalGroup(messageVertical);
-                
-                contentPanel.validate();
-            }
-        });
-    }
+//    @Override
+//    public void showWaitDialog(final String waitMessage) {
+//
+//      log.debug("scheduling wait dialog");
+//
+//      SwingUtilities.invokeLater(new Runnable() {
+//
+//            @Override
+//            public void run() {
+//
+//              log.debug("show wait dialog");
+//
+//                mainPanel.removeAll();
+//                buttonPanel.removeAll();
+//
+//                if (renderHeaderPanel) {
+//                  titleLabel.setText(getMessage(TITLE_WAIT));
+//                }
+//
+//                helpListener.setHelpTopic(HELP_WAIT);
+//
+//                JLabel waitMsgLabel = new JLabel();
+//                waitMsgLabel.setFont(waitMsgLabel.getFont().deriveFont(waitMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+//                if (waitMessage != null) {
+//                    waitMsgLabel.setText("<html>" + waitMessage + "</html>");
+//                } else {
+//                    waitMsgLabel.setText(getMessage(MESSAGE_WAIT));
+//                }
+//
+//                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+//                mainPanel.setLayout(mainPanelLayout);
+//
+//                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
+//                        .addComponent(waitMsgLabel);
+//                GroupLayout.ParallelGroup messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+//                        .addComponent(waitMsgLabel);
+//
+//                if (!renderHeaderPanel) {
+//                  messageHorizontal
+//                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+//                          .addComponent(helpLabel);
+//                  messageVertical
+//                          .addComponent(helpLabel);
+//                }
+//                mainPanelLayout.setHorizontalGroup(messageHorizontal);
+//                mainPanelLayout.setVerticalGroup(messageVertical);
+//
+//                contentPanel.validate();
+//            }
+//        });
+//    }
 
     @Override
     public char[] getPin() {
@@ -1062,7 +1092,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
      * @param okCommand
      */
     @Override
-    public void showHashDataInputDialog(final List<HashDataInput> signedReferences, 
+    public void showSecureViewer(final List<HashDataInput> signedReferences,
             final ActionListener okListener, 
             final String okCommand) {
       
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
index 87b636f0..13aaf870 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
@@ -35,6 +35,7 @@ class PINDocument extends PlainDocument {
         protected Pattern pinPattern;
         protected JButton enterButton;
         protected Document compareTo;
+        protected Document oldPin;
 
         public PINDocument(PINSpec pinSpec, JButton enterButton) {
             this.pinSpec = pinSpec;
@@ -46,11 +47,30 @@ class PINDocument extends PlainDocument {
             this.enterButton = enterButton;
         }
 
+        /**
+         *
+         * @param pinSpec
+         * @param enterButton 
+         * @param compareTo enable enterButton iff this pinDocument's pin equals to compareTo's pin. may be null
+         */
         public PINDocument(PINSpec pinSpec, JButton enterButton, Document compareTo) {
           this(pinSpec, enterButton);
           this.compareTo = compareTo;
         }
 
+        /**
+         *
+         * @param pinSpec
+         * @param enterButton may be null
+         * @param compareTo enable enterButton iff this pinDocument's pin equals to compareTo's pin. may be null
+         * @param oldPin enable enterButton iff oldPin meets the pinSpec pin length requirements, may be null
+         */
+        public PINDocument(PINSpec pinSpec, JButton enterButton, Document compareTo, Document oldPin) {
+          this(pinSpec, enterButton);
+          this.compareTo = compareTo;
+          this.oldPin = oldPin;
+        }
+
         @Override
         public void insertString(int offs, String str, AttributeSet a) throws BadLocationException {
             if (pinSpec.getMaxLength() < 0 || pinSpec.getMaxLength() >= (getLength() + str.length())) {
@@ -66,7 +86,10 @@ class PINDocument extends PlainDocument {
                 }
             }
             if (enterButton != null) {
-              enterButton.setEnabled(getLength() >= pinSpec.getMinLength() && compare());
+              enterButton.setEnabled(
+                      (oldPin == null || oldPin.getLength() >= pinSpec.getMinLength()) &&
+                      getLength() >= pinSpec.getMinLength() &&
+                      compare());
             }
         }
 
@@ -74,7 +97,10 @@ class PINDocument extends PlainDocument {
         public void remove(int offs, int len) throws BadLocationException {
             super.remove(offs, len);
             if (enterButton != null) {
-              enterButton.setEnabled(getLength() >= pinSpec.getMinLength() && compare());
+              enterButton.setEnabled(
+                      (oldPin == null || oldPin.getLength() >= pinSpec.getMinLength()) &&
+                      getLength() >= pinSpec.getMinLength() &&
+                      compare());
             }
         }
 
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
index 1e0bc9f5..6d651b2d 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
@@ -20,6 +20,7 @@ title.cardnotsupported=<html>Die Karte wird nicht unterst\u00FCtzt</html>
 title.cardpin=<html>Karte wird gelesen</html>
 title.sign=<html>Signatur erstellen</html>
 title.error=<html>Fehler</html>
+title.entry.timeout=<html>Zeit\u00FCberschreitung</html>
 title.retry=<html>Falsche PIN</html>
 title.wait=<html>Bitte warten</html>
 title.hashdata=<html>Signaturdaten</html>
@@ -28,19 +29,25 @@ windowtitle.savedir=Signaturdaten in Verzeichnis speichern
 windowtitle.overwrite=Datei \u00FCberschreiben?
 windowtitle.viewer=Signaturdaten
 windowtitle.help=Hilfe zur B\u00FCrgerkarte
-message.wait=<html>Bitte warten...</html>
-message.insertcard=<html>Bitte die B\u00FCrgerkarte in den Kartenleser stecken</html>
-message.enterpin=<html>{0} eingeben</html>
-message.hashdatalink=<html><a href=\"anzeige\">Signaturdaten anzeigen</a></html>
-message.hashdatalink.tiny=<html><a href=\"anzeige\">Signaturdaten</a></html>
+
+# removed message.* prefix to reuse keys as help keys
+welcome=<html>Bitte warten...</html>
+wait=<html>Bitte warten...</html>
+cardnotsupported=<html>Bitte die B\u00FCrgerkarte in den Kartenleser stecken</html>
+insertcard=<html>Bitte die B\u00FCrgerkarte in den Kartenleser stecken</html>
+enterpin=<html>{0} eingeben</html>
+enterpin.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben</html>
+hashdatalink=<html><a href=\"anzeige\">Signaturdaten anzeigen</a></html>
+hashdatalink.tiny=<html><a href=\"anzeige\">Signaturdaten</a></html>
 #message.hashdata=<html>Hinweis: Dies ist eine Voransicht des zu signierenden Inhalts. F\u00FCr eine standardkonforme Darstellung siehe Hilfe (i).</html>
 #message.hashdata=<html>Dies ist eine Voransicht des zu signierenden Inhaltes. F\u00FCr Details siehe Hilfe (i).</html> 
 #verwenden sie bitte die von ihrem System zur Verf\u00FCgung gestellte {0} Anwendung. 
-message.hashdatalist=<html>{0} Signaturdaten:</html>
-message.retries.last=<html>Letzter Versuch!</html>
-message.retries=<html>Noch {0} Versuche</html>
-message.overwrite=<html>M\u00F6chten Sie das existierende Dokument {0} \u00FCberschreiben?</html>
-message.help=<html>Hilfe zu {0}</html>
+hashdatalist=<html>{0} Signaturdaten:</html>
+retries.last=<html>Letzter Versuch!</html>
+retries=<html>Noch {0} Versuche</html>
+overwrite=<html>M\u00F6chten Sie das existierende Dokument {0} \u00FCberschreiben?</html>
+help=<html>Hilfe zu {0}</html>
+
 warning.xhtml=<html>Hinweis: Dies ist eine Voransicht des zu signierenden Inhalts. F\u00FCr eine standardkonforme Darstellung siehe Hilfe (i).</html>
 label.pin=<html>{0}:</html>
 label.pinsize=<html>({0} stellig)</html>
@@ -73,6 +80,7 @@ error.unknown=<html>Ein Fehler trat auf</html>
 error.test=<html>Fehler1 {0} - Fehler2 {1}</html>
 error.card.locked=<html>B\u00FCrgerkarte ist gesperrt</html>
 error.card.notactivated=<html>B\u00FCrgerkartenfunktion ist nicht aktiviert</html>
+error.pin.timeout=<html>Zeit\u00FCberschreitung bei Eingabe der PIN</html>
 error.viewer=Der Inhalt kann nicht dargestellt werden: {0}
 error.external.link=<html>Externer Link {0} wird nicht ge\u00F6ffnet</html>
 error.config=<html>Fehlerhafte Konfiguration des Systems: {0}</html>
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
index 4fbccd5b..2fb66969 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
@@ -20,6 +20,7 @@ title.cardnotsupported=<html>This card is not supported</html>
 title.cardpin=<html>Reading card</html>
 title.sign=<html>Create signature</html>
 title.error=<html>Error</html>
+title.entry.timeout=<html>Timeout</html>
 title.retry=<html>Wrong PIN</html>
 title.wait=<html>Please wait</html>
 title.hashdata=<html>Signature data</html>
@@ -28,17 +29,23 @@ windowtitle.savedir=Save signature data to directory
 windowtitle.overwrite=Overwrite file?
 windowtitle.viewer=Signature data
 windowtitle.help=Citizen card help
-message.wait=<html>Please wait...</html>
-message.insertcard=<html>Please insert your citizen card into the reader</html>
-message.enterpin=<html>Enter {0}</html>
-message.hashdatalink=<html><a href=\"anzeige\">Display signature data</a></html>
-message.hashdatalink.tiny=<html><a href=\"anzeige\">signature data</a></html>
+
+# removed message.* prefix to reuse keys as help keys
+welcome=<html>Please wait...</html>
+wait=<html>Please wait...</html>
+insertcard=<html>Please insert your citizen card into the reader</html>
+cardnotsupported=<html>Please insert your citizen card into the reader</html>
+enterpin=<html>Enter {0}</html>
+enterpin.pinpad=<html>Enter {0} ({1} digits) on card reader pinpad</html>
+hashdatalink=<html><a href=\"anzeige\">Display signature data</a></html>
+hashdatalink.tiny=<html><a href=\"anzeige\">signature data</a></html>
 #message.hashdata=<html>Remark: This is a preview of the data to-be signed. For standards compliant display see help.</html>
-message.hashdatalist=<html>{0} signature data objects:</html>
-message.retries.last=<html>Last try!</html>
-message.retries=<html>{0} tries left</html>
-message.overwrite=<html>Overwrite {0}?</html>
-message.help=<html>Help topic {0}</html>
+hashdatalist=<html>{0} signature data objects:</html>
+retries.last=<html>Last try!</html>
+retries=<html>{0} tries left</html>
+overwrite=<html>Overwrite {0}?</html>
+help=<html>Help topic {0}</html>
+
 warning.xhtml=<html>Remark: This is a preview of the data to-be signed. For standards compliant display see help.</html>
 label.pin=<html>{0}:</html>
 label.pinsize=<html>({0} digits)</html>
@@ -71,6 +78,7 @@ error.unknown=<html>An error occured</html>
 error.test=<html>Error1 {0} - Error2 {1}</html>
 error.card.locked=<html>Citizen card is locked</html>
 error.card.notactivated=<html>Citizen card not activated</html>
+error.pin.timeout=<html>Timeout during PIN entry</html>
 error.viewer=Failed to display contents: {0}
 error.external.link=<html>Cannot open external link {0}</html>
 error.config=<html>Incorrect system configuration: {0}</html>
diff --git a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
index ef64ac59..194e18b0 100644
--- a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
+++ b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
@@ -78,7 +78,7 @@ public class BKUGUIWorker implements Runnable {
 
           @Override
           public void actionPerformed(ActionEvent e) {
-            gui.showSignaturePINDialog(signPinSpec, signListener, "sign", cancelListener, "cancel", null, "hashdata");
+            gui.showSignaturePINDialog(signPinSpec, -1, signListener, "sign", cancelListener, "cancel", null, "hashdata");
           }
         };
         HashDataInput signedRef1 = new ByteArrayHashDataInput(
@@ -116,7 +116,7 @@ public class BKUGUIWorker implements Runnable {
 //                    signedRefs.add(signedRef4);
 //                    signedRefs.add(signedRef4);
 //                    signedRefs = Collections.singletonList(signedRef1);
-        gui.showHashDataInputDialog(signedRefs, returnListener, "return");
+        gui.showSecureViewer(signedRefs, returnListener, "return");
       }
     };
 
@@ -149,7 +149,7 @@ public class BKUGUIWorker implements Runnable {
 //            
 //            Thread.sleep(2000);
 //
-            gui.showSignaturePINDialog(signPinSpec, signListener, "sign", cancelListener, "cancel", hashdataListener, "hashdata");
+            gui.showSignaturePINDialog(signPinSpec, -1, signListener, "sign", cancelListener, "cancel", hashdataListener, "hashdata");
 //
 //            Thread.sleep(4000);
 //
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
index 1714017e..5a0ba84a 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
@@ -40,27 +40,27 @@ public class BKUGuiProxy implements BKUGUIFacade {
     return delegate.getLocale();
   }
 
+//  @Override
+//  public void showCardNotSupportedDialog(ActionListener cancelListener,
+//      String actionCommand) {
+//    showDialog();
+//    delegate.showCardNotSupportedDialog(cancelListener, actionCommand);
+//  }
+//
+//  @Override
+//  public void showCardPINDialog(PINSpec pinSpec, ActionListener okListener,
+//      String okCommand, ActionListener cancelListener, String cancelCommand) {
+//    showDialog();
+//    delegate.showCardPINDialog(pinSpec, okListener, okCommand, cancelListener,
+//        cancelCommand);
+//  }
+//
   @Override
-  public void showCardNotSupportedDialog(ActionListener cancelListener,
-      String actionCommand) {
-    showDialog();
-    delegate.showCardNotSupportedDialog(cancelListener, actionCommand);
-  }
-
-  @Override
-  public void showCardPINDialog(PINSpec pinSpec, ActionListener okListener,
-      String okCommand, ActionListener cancelListener, String cancelCommand) {
-    showDialog();
-    delegate.showCardPINDialog(pinSpec, okListener, okCommand, cancelListener,
-        cancelCommand);
-  }
-
-  @Override
-  public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries,
+  public void showCardPINDialog(PINSpec pinSpec, int numRetries,
       ActionListener okListener, String okCommand,
       ActionListener cancelListener, String cancelCommand) {
     showDialog();
-    delegate.showCardPINRetryDialog(pinSpec, numRetries, okListener, okCommand,
+    delegate.showCardPINDialog(pinSpec, numRetries, okListener, okCommand,
         cancelListener, cancelCommand);
   }
 
@@ -77,57 +77,71 @@ public class BKUGuiProxy implements BKUGUIFacade {
     delegate.showErrorDialog(errorMsgKey, errorMsgParams);
   }
 
+//  @Override
+//  public void showInsertCardDialog(ActionListener cancelListener,
+//      String actionCommand) {
+//    showDialog();
+//    delegate.showInsertCardDialog(cancelListener, actionCommand);
+//  }
+//
+//  @Override
+//  public void showSignaturePINDialog(PINSpec pinSpec,
+//      ActionListener signListener, String signCommand,
+//      ActionListener cancelListener, String cancelCommand,
+//      ActionListener hashdataListener, String hashdataCommand) {
+//    showDialog();
+//    delegate.showSignaturePINDialog(pinSpec, signListener, signCommand,
+//        cancelListener, cancelCommand, hashdataListener, hashdataCommand);
+//  }
+//
   @Override
-  public void showInsertCardDialog(ActionListener cancelListener,
-      String actionCommand) {
-    showDialog();
-    delegate.showInsertCardDialog(cancelListener, actionCommand);
-  }
-
-  @Override
-  public void showSignaturePINDialog(PINSpec pinSpec,
-      ActionListener signListener, String signCommand,
-      ActionListener cancelListener, String cancelCommand,
-      ActionListener hashdataListener, String hashdataCommand) {
-    showDialog();
-    delegate.showSignaturePINDialog(pinSpec, signListener, signCommand,
-        cancelListener, cancelCommand, hashdataListener, hashdataCommand);
-  }
-
-  @Override
-  public void showSignaturePINRetryDialog(PINSpec pinSpec, int numRetries,
+  public void showSignaturePINDialog(PINSpec pinSpec, int numRetries,
       ActionListener okListener, String okCommand,
       ActionListener cancelListener, String cancelCommand,
       ActionListener hashdataListener, String hashdataCommand) {
     showDialog();
-    delegate.showSignaturePINRetryDialog(pinSpec, numRetries, okListener,
+    delegate.showSignaturePINDialog(pinSpec, numRetries, okListener,
         okCommand, cancelListener, cancelCommand, hashdataListener,
         hashdataCommand);
   }
+//
+//  @Override
+//  public void showWaitDialog(String waitMessage) {
+//    showDialog();
+//    delegate.showWaitDialog(waitMessage);
+//  }
+//
+//  @Override
+//  public void showWelcomeDialog() {
+//    showDialog();
+//    delegate.showWelcomeDialog();
+//  }
 
   @Override
-  public void showWaitDialog(String waitMessage) {
+  public void showSecureViewer(List<HashDataInput> signedReferences,
+          ActionListener okListener, 
+          String okCommand) {
     showDialog();
-    delegate.showWaitDialog(waitMessage);
+    delegate.showSecureViewer(signedReferences, okListener, okCommand);
   }
 
   @Override
-  public void showWelcomeDialog() {
+  public void showMessageDialog(String titleKey, 
+          String msgKey, Object[] msgParams,
+          String buttonKey, ActionListener okListener, String okCommand) {
     showDialog();
-    delegate.showWelcomeDialog();
+    delegate.showMessageDialog(titleKey, msgKey, msgParams, buttonKey, okListener, okCommand);
   }
 
   @Override
-  public void showHashDataInputDialog(List<HashDataInput> signedReferences, 
-          ActionListener okListener, 
-          String okCommand) {
+  public void showMessageDialog(String titleKey, String msgKey, Object[] msgParams) {
     showDialog();
-    delegate.showHashDataInputDialog(signedReferences, okListener, okCommand);
+    delegate.showMessageDialog(titleKey, msgKey, msgParams);
   }
 
   @Override
-  public void showMessageDialog(String titleKey, String msgKey, Object[] msgParams, ActionListener okListener, String okCommand) {
+  public void showMessageDialog(String titleKey, String msgKey) {
     showDialog();
-    delegate.showMessageDialog(titleKey, msgKey, msgParams, okListener, okCommand);
+    delegate.showMessageDialog(titleKey, msgKey);
   }
 }
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java
index 46f915a9..531e6591 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java
@@ -67,7 +67,7 @@ public class LocalSignRequestHandler extends SignRequestHandler {
    * @throws java.lang.Exception
    */
   @Override
-  public void displayHashDataInputs(List<ReferenceType> dsigReferences) throws Exception {
+  public void displayDataToBeSigned(List<ReferenceType> dsigReferences) throws Exception {
     if (dsigReferences == null || dsigReferences.size() < 1) {
       log.error("No hashdata input selected to be displayed: null");
       throw new Exception("No HashData Input selected to be displayed");
@@ -109,7 +109,7 @@ public class LocalSignRequestHandler extends SignRequestHandler {
       log.error("dsig:SignedInfo does not contain a data reference");
       throw new Exception("dsig:SignedInfo does not contain a data reference");
     }
-    gui.showHashDataInputDialog(selectedHashDataInputs, this, "hashDataDone");
+    gui.showSecureViewer(selectedHashDataInputs, this, "hashDataDone");
   }
 
   private ByteArrayHashDataInput getByteArrayHashDataInput(HashDataInput hashDataInput) throws IOException {
diff --git a/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/Container.java b/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/Container.java
index d15d2c1b..833dbf4d 100644
--- a/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/Container.java
+++ b/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/Container.java
@@ -1,10 +1,5 @@
 package at.gv.egiz.bku.local.app;
 
-import java.io.File;
-import java.io.IOException;
-import java.net.URL;
-import java.net.URLClassLoader;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.mortbay.jetty.Connector;
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.html b/BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.html
new file mode 100644
index 00000000..021ddfa7
--- /dev/null
+++ b/BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Untitled Document</title>
+<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
+<!--[if IE]>
+<style type="text/css"> 
+/* place css fixes for all versions of IE in this conditional comment */
+.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
+.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
+/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
+</style>
+<![endif]-->
+</head>
+
+<body class="twoColElsLtHdr">
+
+<div id="container">
+  <div id="header">
+    <h1>Online-Hilfe</h1>
+    <!-- end #header --></div>
+  <div id="sidebar1">
+    <p><img src="../../helpfiles/de/cardnotsupported.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
+    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
+    <!-- end #sidebar1 --></div>
+  <div id="mainContent">
+    <h1> Die Karte wird nicht unterstützt</h1>
+    <p>Die im Kartenleser gesteckte Chipkarte wird nicht unterstützt.</p>
+    <p>Bitte stecken Sie eine unterstützte Chipkarte (Bürgerkarte) in den Kartenleser. Derzeit werden die folgenden Chipkarten unterstützt:</p>
+   	<ul>
+       	<li><strong>e-card</strong> <br />
+   	    Chipkarte der <a href="http://www.sozialversicherung.at">Österreichischen Sozialversicherung</a></li>
+            <li><strong>a-sign premium</strong> <br />
+            Chipkarte der <a href="http://www.a-trust.at">A-Trust GmbH</a> bzw. diverse andere Chipkarten mit der Aufschrift 'a-sign premium'.</li>
+    </ul>
+    <p>Sind mehrere unterstützte Kartenleser angeschlossen, stecken sie eine unterstützte Chipkarte (Bürgerkarte) in einen der angeschlossenen Kartenleser. Wird die Chipkarte erkannt wechselt die Bildschirmanzeige. Wird die Chipkarte nicht erkannt, wird der Kartenleser möglicherweise nicht unterstützt. Stecken Sie die Chipkarte daher in einen anderen Kartenleser.</p>
+    <p><br class="clearfloat" /></p>
+  </div>
+  <div id="footer">
+  	<p>
+    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
+    </p>
+  </div>
+<!-- end #container --></div>
+</body>
+</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.png b/BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.png
new file mode 100644
index 00000000..c3b7ce6b
Binary files /dev/null and b/BKUOnline/src/main/webapp/helpfiles/de/cardnotsupported.png differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.html b/BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.html
deleted file mode 100644
index c647bf72..00000000
--- a/BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.html
+++ /dev/null
@@ -1,47 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-<title>Untitled Document</title>
-<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
-<!--[if IE]>
-<style type="text/css"> 
-/* place css fixes for all versions of IE in this conditional comment */
-.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
-.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
-/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
-</style>
-<![endif]-->
-</head>
-
-<body class="twoColElsLtHdr">
-
-<div id="container">
-  <div id="header">
-    <h1>Online-Hilfe</h1>
-    <!-- end #header --></div>
-  <div id="sidebar1">
-    <p><img src="../../helpfiles/de/help.cardnotsupported.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
-    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
-    <!-- end #sidebar1 --></div>
-  <div id="mainContent">
-    <h1> Die Karte wird nicht unterstützt</h1>
-    <p>Die im Kartenleser gesteckte Chipkarte wird nicht unterstützt.</p>
-    <p>Bitte stecken Sie eine unterstützte Chipkarte (Bürgerkarte) in den Kartenleser. Derzeit werden die folgenden Chipkarten unterstützt:</p>
-   	<ul>
-       	<li><strong>e-card</strong> <br />
-   	    Chipkarte der <a href="http://www.sozialversicherung.at">Österreichischen Sozialversicherung</a></li>
-            <li><strong>a-sign premium</strong> <br />
-            Chipkarte der <a href="http://www.a-trust.at">A-Trust GmbH</a> bzw. diverse andere Chipkarten mit der Aufschrift 'a-sign premium'.</li>
-    </ul>
-    <p>Sind mehrere unterstützte Kartenleser angeschlossen, stecken sie eine unterstützte Chipkarte (Bürgerkarte) in einen der angeschlossenen Kartenleser. Wird die Chipkarte erkannt wechselt die Bildschirmanzeige. Wird die Chipkarte nicht erkannt, wird der Kartenleser möglicherweise nicht unterstützt. Stecken Sie die Chipkarte daher in einen anderen Kartenleser.</p>
-    <p><br class="clearfloat" /></p>
-  </div>
-  <div id="footer">
-  	<p>
-    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
-    </p>
-  </div>
-<!-- end #container --></div>
-</body>
-</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.png b/BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.png
deleted file mode 100644
index c3b7ce6b..00000000
Binary files a/BKUOnline/src/main/webapp/helpfiles/de/help.cardnotsupported.png and /dev/null differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.html b/BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.html
deleted file mode 100644
index 0bfc6230..00000000
--- a/BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-<title>Untitled Document</title>
-<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
-<!--[if IE]>
-<style type="text/css"> 
-/* place css fixes for all versions of IE in this conditional comment */
-.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
-.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
-/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
-</style>
-<![endif]-->
-</head>
-
-<body class="twoColElsLtHdr">
-
-<div id="container">
-  <div id="header">
-    <h1>Online-Hilfe</h1>
-    <!-- end #header --></div>
-  <div id="sidebar1">
-    <p><img src="../../helpfiles/de/help.insertcard.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
-    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
-    <!-- end #sidebar1 --></div>
-  <div id="mainContent">
-    <h1> Bitte die Bürgerkarte in den Kartenleser stecken</h1>
-    <p>Die Software für den Zugriff auf die Bürgerkarte hat einen oder mehrere unterstützte Kartenleser gefunden.</p>
-    <p>Bitte stecken Sie nun ihre Bürgerkarte in den Kartenleser. Wird die Karte erkannt, welchselt die Bildschirmanzeige.</p>
-    <p>Sollten Sie mehrere Kartenleser angeschlossen haben, wählen Sie einen beliebigen aus. Wird die Karte im ausgewählten Kartenleser nicht erkannt, wird dieser Kartenleser eventuell nicht unterstützt. Probieren Sie es daher in einem anderen Kartenleser nochmal.
-    </p>
-    <p><br class="clearfloat" /></p>
-  </div>
-  <div id="footer">
-  	<p>
-    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
-    </p>
-  </div>
-<!-- end #container --></div>
-</body>
-</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.png b/BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.png
deleted file mode 100644
index 62a22975..00000000
Binary files a/BKUOnline/src/main/webapp/helpfiles/de/help.insertcard.png and /dev/null differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.wait.html b/BKUOnline/src/main/webapp/helpfiles/de/help.wait.html
deleted file mode 100644
index ed3db1b8..00000000
--- a/BKUOnline/src/main/webapp/helpfiles/de/help.wait.html
+++ /dev/null
@@ -1,39 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-<title>Untitled Document</title>
-<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
-<!--[if IE]>
-<style type="text/css"> 
-/* place css fixes for all versions of IE in this conditional comment */
-.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
-.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
-/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
-</style>
-<![endif]-->
-</head>
-
-<body class="twoColElsLtHdr">
-
-<div id="container">
-  <div id="header">
-    <h1>Online-Hilfe</h1>
-    <!-- end #header --></div>
-  <div id="sidebar1">
-    <p><img src="../../helpfiles/de/help.wait.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
-    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
-    <!-- end #sidebar1 --></div>
-  <div id="mainContent">
-    <h1> Bitte warten ...</h1>
-    <p>Die Software für den Zugriff auf die Bürgerkarte ist damit beschäftigt, einen Befehl auszuführen bzw. auf einen neuen Befehl vom Server zu warten.    </p>
-    <p><br class="clearfloat" /></p>
-  </div>
-  <div id="footer">
-  	<p>
-    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
-    </p>
-  </div>
-<!-- end #container --></div>
-</body>
-</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.wait.png b/BKUOnline/src/main/webapp/helpfiles/de/help.wait.png
deleted file mode 100644
index 63a38fbf..00000000
Binary files a/BKUOnline/src/main/webapp/helpfiles/de/help.wait.png and /dev/null differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.welcome.html b/BKUOnline/src/main/webapp/helpfiles/de/help.welcome.html
deleted file mode 100644
index 9796a206..00000000
--- a/BKUOnline/src/main/webapp/helpfiles/de/help.welcome.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-<title>Untitled Document</title>
-<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
-<!--[if IE]>
-<style type="text/css"> 
-/* place css fixes for all versions of IE in this conditional comment */
-.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
-.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
-/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
-</style>
-<![endif]-->
-</head>
-
-<body class="twoColElsLtHdr">
-
-<div id="container">
-  <div id="header">
-    <h1>Online-Hilfe</h1>
-    <!-- end #header --></div>
-  <div id="sidebar1">
-    <p><img src="../../helpfiles/de/help.welcome.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
-    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
-    <!-- end #sidebar1 --></div>
-  <div id="mainContent">
-    <h1> Willkommen </h1>
-    <p>Die Anzeige &quot;Willkommen&quot; erfolgt unmittelbar nachdem die Software für den Zugriff auf die Bürgerkarte erfolgreich im Browser geladen wurde.</p>
-    <p>Die Software versucht nun eine Verbindung mit dem Server aufzunehmen um Befehle für den Zugriff auf die Bürgerkarte zu erhalten.</p>
-    <p><br class="clearfloat" /></p>
-  </div>
-  <div id="footer">
-  	<p>
-    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
-    </p>
-  </div>
-<!-- end #container --></div>
-</body>
-</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/help.welcome.png b/BKUOnline/src/main/webapp/helpfiles/de/help.welcome.png
deleted file mode 100644
index 78133b4d..00000000
Binary files a/BKUOnline/src/main/webapp/helpfiles/de/help.welcome.png and /dev/null differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/insertcard.html b/BKUOnline/src/main/webapp/helpfiles/de/insertcard.html
new file mode 100644
index 00000000..f7f1a28a
--- /dev/null
+++ b/BKUOnline/src/main/webapp/helpfiles/de/insertcard.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Untitled Document</title>
+<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
+<!--[if IE]>
+<style type="text/css"> 
+/* place css fixes for all versions of IE in this conditional comment */
+.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
+.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
+/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
+</style>
+<![endif]-->
+</head>
+
+<body class="twoColElsLtHdr">
+
+<div id="container">
+  <div id="header">
+    <h1>Online-Hilfe</h1>
+    <!-- end #header --></div>
+  <div id="sidebar1">
+    <p><img src="../../helpfiles/de/insertcard.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
+    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
+    <!-- end #sidebar1 --></div>
+  <div id="mainContent">
+    <h1> Bitte die Bürgerkarte in den Kartenleser stecken</h1>
+    <p>Die Software für den Zugriff auf die Bürgerkarte hat einen oder mehrere unterstützte Kartenleser gefunden.</p>
+    <p>Bitte stecken Sie nun ihre Bürgerkarte in den Kartenleser. Wird die Karte erkannt, welchselt die Bildschirmanzeige.</p>
+    <p>Sollten Sie mehrere Kartenleser angeschlossen haben, wählen Sie einen beliebigen aus. Wird die Karte im ausgewählten Kartenleser nicht erkannt, wird dieser Kartenleser eventuell nicht unterstützt. Probieren Sie es daher in einem anderen Kartenleser nochmal.
+    </p>
+    <p><br class="clearfloat" /></p>
+  </div>
+  <div id="footer">
+  	<p>
+    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
+    </p>
+  </div>
+<!-- end #container --></div>
+</body>
+</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/insertcard.png b/BKUOnline/src/main/webapp/helpfiles/de/insertcard.png
new file mode 100644
index 00000000..62a22975
Binary files /dev/null and b/BKUOnline/src/main/webapp/helpfiles/de/insertcard.png differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/wait.html b/BKUOnline/src/main/webapp/helpfiles/de/wait.html
new file mode 100644
index 00000000..8561ff35
--- /dev/null
+++ b/BKUOnline/src/main/webapp/helpfiles/de/wait.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Untitled Document</title>
+<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
+<!--[if IE]>
+<style type="text/css"> 
+/* place css fixes for all versions of IE in this conditional comment */
+.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
+.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
+/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
+</style>
+<![endif]-->
+</head>
+
+<body class="twoColElsLtHdr">
+
+<div id="container">
+  <div id="header">
+    <h1>Online-Hilfe</h1>
+    <!-- end #header --></div>
+  <div id="sidebar1">
+    <p><img src="../../helpfiles/de/wait.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
+    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
+    <!-- end #sidebar1 --></div>
+  <div id="mainContent">
+    <h1> Bitte warten ...</h1>
+    <p>Die Software für den Zugriff auf die Bürgerkarte ist damit beschäftigt, einen Befehl auszuführen bzw. auf einen neuen Befehl vom Server zu warten.    </p>
+    <p><br class="clearfloat" /></p>
+  </div>
+  <div id="footer">
+  	<p>
+    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
+    </p>
+  </div>
+<!-- end #container --></div>
+</body>
+</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/wait.png b/BKUOnline/src/main/webapp/helpfiles/de/wait.png
new file mode 100644
index 00000000..63a38fbf
Binary files /dev/null and b/BKUOnline/src/main/webapp/helpfiles/de/wait.png differ
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/welcome.html b/BKUOnline/src/main/webapp/helpfiles/de/welcome.html
new file mode 100644
index 00000000..6c5463e5
--- /dev/null
+++ b/BKUOnline/src/main/webapp/helpfiles/de/welcome.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Untitled Document</title>
+<link href="../../helpfiles/help.css" rel="stylesheet" type="text/css" />
+<!--[if IE]>
+<style type="text/css"> 
+/* place css fixes for all versions of IE in this conditional comment */
+.twoColElsLtHdr #sidebar1 { padding-top: 30px; }
+.twoColElsLtHdr #mainContent { zoom: 1; padding-top: 15px; }
+/* the above proprietary zoom property gives IE the hasLayout it needs to avoid several bugs */
+</style>
+<![endif]-->
+</head>
+
+<body class="twoColElsLtHdr">
+
+<div id="container">
+  <div id="header">
+    <h1>Online-Hilfe</h1>
+    <!-- end #header --></div>
+  <div id="sidebar1">
+    <p><img src="../../helpfiles/de/welcome.png" alt="Bildschirmfoto des Applets" width="190" height="130"/></p>
+    <p><strong>Hinweis:</strong> Das Bildschirmfoto oben kann von der Darstellung in der Webseite abweichen.</p>
+    <!-- end #sidebar1 --></div>
+  <div id="mainContent">
+    <h1> Willkommen </h1>
+    <p>Die Anzeige &quot;Willkommen&quot; erfolgt unmittelbar nachdem die Software für den Zugriff auf die Bürgerkarte erfolgreich im Browser geladen wurde.</p>
+    <p>Die Software versucht nun eine Verbindung mit dem Server aufzunehmen um Befehle für den Zugriff auf die Bürgerkarte zu erhalten.</p>
+    <p><br class="clearfloat" /></p>
+  </div>
+  <div id="footer">
+  	<p>
+    	<a href="http://www.buergerkarte.at">Österreichische Bürgerkarte</a> | <a href="http://mocca.egovlabs.gv.at">Bürgerkartensoftware MOCCA</a>
+    </p>
+  </div>
+<!-- end #container --></div>
+</body>
+</html>
diff --git a/BKUOnline/src/main/webapp/helpfiles/de/welcome.png b/BKUOnline/src/main/webapp/helpfiles/de/welcome.png
new file mode 100644
index 00000000..78133b4d
Binary files /dev/null and b/BKUOnline/src/main/webapp/helpfiles/de/welcome.png differ
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java
new file mode 100644
index 00000000..9fca6ab9
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.smcc;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class ACOS04Card extends ACOSCard {
+
+  public ACOS04Card() {
+    pinSpecs.remove(PINSPEC_INF);
+  }
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index c2c62fd8..01b9155b 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -29,9 +29,10 @@
 package at.gv.egiz.smcc;
 
 import at.gv.egiz.smcc.util.SMCCHelper;
+import java.nio.ByteBuffer;
+import java.nio.CharBuffer;
 import java.nio.charset.Charset;
 
-import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CommandAPDU;
@@ -100,9 +101,9 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
       (byte) 0x01 // RSA // TODO: Not verified yet
   };
 
-  private static final int PINSPEC_INF = 0;
-  private static final int PINSPEC_DEC = 1;
-  private static final int PINSPEC_SIG = 2;
+  protected static final int PINSPEC_INF = 0;
+  protected static final int PINSPEC_DEC = 1;
+  protected static final int PINSPEC_SIG = 2;
 
   public ACOSCard() {
     super("at/gv/egiz/smcc/ACOSCard");
@@ -179,15 +180,12 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
         //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("inf.pin.name"));
         
         int retries = -1;
-        String pin = null;
+        char[] pin = null;
         boolean pinRequiered = false;
 
         do {
           if (pinRequiered) {
             pin = provider.providePIN(spec, retries);
-            if (pin == null) {
-              throw new CancelledException();
-            }
           }
           try {
             getCard().beginExclusive();
@@ -234,20 +232,17 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
         //new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
         
         int retries = -1;
-        String pin = null;
+        char[] pin = null;
 
         do {
           pin = provider.providePIN(spec, retries);
-          if (pin == null) {
-            throw new CancelledException();
-          }
           try {
             getCard().beginExclusive();
             
             // SELECT DF
             selectFileFID(DF_SIG);
             // VERIFY
-            retries = verifyPIN(pin, KID_PIN_SIG);
+            retries = verifyPIN(KID_PIN_SIG, pin);
             if (retries != -1) {
               throw new VerificationFailedException(retries);
             }
@@ -259,7 +254,7 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
             return psoComputDigitalSiganture();
 
           } catch (SecurityStatusNotSatisfiedException e) {
-            retries = verifyPIN(null, KID_PIN_SIG);
+            retries = verifyPIN(KID_PIN_SIG);
           } catch (VerificationFailedException e) {
             retries = e.getRetries();
           } finally {
@@ -276,15 +271,12 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
         //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("dec.pin.name"));
 
         int retries = -1;
-        String pin = null;
-        boolean pinRequiered = false;
+        char[] pin = null;
+        boolean pinRequired = false;
 
         do {
-          if (pinRequiered) {
+          if (pinRequired) {
             pin = provider.providePIN(spec, retries);
-            if (pin == null) {
-              throw new CancelledException();
-            }
           }
           try {
             getCard().beginExclusive();
@@ -292,7 +284,7 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
             // SELECT DF
             selectFileFID(DF_DEC);
             // VERIFY
-            retries = verifyPIN(pin, KID_PIN_DEC);
+            retries = verifyPIN(KID_PIN_DEC, pin);
             if (retries != -1) {
               throw new VerificationFailedException(retries);
             }
@@ -304,10 +296,10 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
           } catch (FileNotFoundException e) {
             throw new NotActivatedException();
           } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequiered = true;
-            retries = verifyPIN(null, KID_PIN_DEC);
+            pinRequired = true;
+            retries = verifyPIN(KID_PIN_DEC);
           } catch (VerificationFailedException e) {
-            pinRequiered = true;
+            pinRequired = true;
             retries = e.getRetries();
           } finally {
             getCard().endExclusive();
@@ -328,48 +320,16 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
       
   }
 
+  ////////////////////////////////////////////////////////////////////////
+  // PROTECTED METHODS (assume exclusive card access)
+  ////////////////////////////////////////////////////////////////////////
+
   protected ResponseAPDU selectFileFID(byte[] fid) throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
     return transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00,
         0x00, fid, 256));
   }
 
-  @Override
-  protected int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
-
-    CardChannel channel = getCardChannel();
-
-    ResponseAPDU resp;
-    try {
-      if (pin != null) {
-        resp = transmit(channel, new CommandAPDU(0x00, 0x20, 0x00, kid, encodePINBlock(pin)), false);
-      } else {
-        //TODO this is not supported
-        resp = transmit(channel, new CommandAPDU(0x00, 0x20, 0x00, kid), false);
-      }
-    } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
-    }
-
-    //6A 00 (falshe P1/P2) nicht in contextAID
-    //69 85 (nutzungsbedingungen nicht erfüllt) in DF_Sig und nicht sigpin
-
-    if (resp.getSW() == 0x63c0) {
-      throw new LockedException("PIN locked.");
-    } else if (resp.getSW1() == 0x63 && resp.getSW2() >> 4 == 0xc) {
-      // return number of possible retries
-      return resp.getSW2() & 0x0f;
-    } else if (resp.getSW() == 0x6983) {
-      throw new NotActivatedException();
-    } else if (resp.getSW() == 0x9000) {
-      return -1;
-    } else {
-      throw new SignatureCardException("Failed to verify pin: SW="
-          + Integer.toHexString(resp.getSW()) + ".");
-    }
-  }
-  
   private void mseSetDST(int p1, int p2, byte[] dst) throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
     ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x22, p1,
@@ -426,92 +386,294 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
     }
   }
 
-  @Override
-  public String toString() {
-    return "a-sign premium";
-  }
-
   /**
-   * ASCII encoded pin, padded with 0x00
-   * @param pin
-   * @return a 8 byte pin block 
+   *
+   * @param kid
+   * @return -1
    */
-  private byte[] encodePINBlock(String pin) {
-    byte[] asciiPIN = pin.getBytes(Charset.forName("ASCII"));
-    byte[] encodedPIN = new byte[8];
-    System.arraycopy(asciiPIN, 0, encodedPIN, 0, Math.min(asciiPIN.length,
-        encodedPIN.length));
-//    System.out.println("ASCII encoded PIN block: " + SMCCHelper.toString(encodedPIN));
-    return encodedPIN;
+  @Override
+  protected int verifyPIN(byte kid) {
+    log.debug("VERIFY PIN without PIN BLOCK not supported by ACOS");
+    return -1;
   }
 
   @Override
-  public void activatePIN(PINSpec pinSpec, String pin) throws SignatureCardException {
-    throw new SignatureCardException("PIN activation not supported by this card");
+  protected int verifyPIN(byte kid, char[] pin)
+          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException {
+    try {
+      byte[] sw;
+      if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+        log.debug("verify PIN on IFD");
+        sw = transmitControlCommand(
+                ifdCtrlCmds.get(FEATURE_VERIFY_PIN_DIRECT),
+                getPINVerifyStructure(kid));
+//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
+      } else {
+        byte[] pinBlock = encodePINBlock(pin);
+        CardChannel channel = getCardChannel();
+        ResponseAPDU resp = transmit(channel,
+                new CommandAPDU(0x00, 0x20, 0x00, kid, pinBlock), false);
+        sw = new byte[2];
+        sw[0] = (byte) resp.getSW1();
+        sw[1] = (byte) resp.getSW2();
+      }
+
+      //6A 00 (falshe P1/P2) nicht in contextAID
+      //69 85 (nutzungsbedingungen nicht erfüllt) in DF_Sig und nicht sigpin
+
+      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
+        return -1;
+      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
+        throw new LockedException("[63:c0]");
+      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
+        return sw[1] & 0x0f;
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
+        //Authentisierungsmethode gesperrt
+        throw new NotActivatedException("[69:83]");
+//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
+//        //referenzierte Daten sind reversibel gesperrt (invalidated)
+//        throw new NotActivatedException("[69:84]");
+//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
+//        //Benutzungsbedingungen nicht erfüllt
+//        throw new NotActivatedException("[69:85]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
+        throw new TimeoutException("[64:00]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
+        throw new CancelledException("[64:01]");
+      }
+      log.error("Failed to verify pin: SW="
+              + SMCCHelper.toString(sw));
+      throw new SignatureCardException(SMCCHelper.toString(sw));
+
+    } catch (CardException ex) {
+      log.error("smart card communication failed: " + ex.getMessage());
+      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
+    }
   }
 
   /**
    * SCARD_E_NOT_TRANSACTED inf/dec PIN not active (pcsc crash)
-   * @param pinSpec
-   * @param oldPIN
-   * @param newPIN
+   * @param kid
+   * @param oldPin
+   * @param newPin
+   * @return
    * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.VerificationFailedException
    * @throws at.gv.egiz.smcc.NotActivatedException
    * @throws at.gv.egiz.smcc.SignatureCardException
    */
   @Override
-  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN)
-          throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
-    Card icc = getCard();
+  protected int changePIN(byte kid, char[] oldPin, char[] newPin)
+          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException {
     try {
-      icc.beginExclusive();
-      CardChannel channel = icc.getBasicChannel();
-
-      if (pinSpec.getContextAID() != null) {
-        ResponseAPDU responseAPDU = transmit(channel,
-                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
-        if (responseAPDU.getSW() != 0x9000) {
-          icc.endExclusive();
-          String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
-                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
-          log.error(msg);
-          throw new SignatureCardException(msg);
-        }
-      }
-
-      byte[] cmd = new byte[16];
-      System.arraycopy(encodePINBlock(oldPIN), 0, cmd, 0, 8);
-      System.arraycopy(encodePINBlock(newPIN), 0, cmd, 8, 8);
+       byte[] sw;
+      if (ifdSupportsFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+        log.debug("modify PIN on IFD");
+        sw = transmitControlCommand(
+                ifdCtrlCmds.get(FEATURE_MODIFY_PIN_DIRECT),
+                getPINModifyStructure(kid));
+//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
+      } else {
+        byte[] cmd = new byte[16];
+        System.arraycopy(encodePINBlock(oldPin), 0, cmd, 0, 8);
+        System.arraycopy(encodePINBlock(newPin), 0, cmd, 8, 8);
 
-      ResponseAPDU responseAPDU = transmit(channel,
-              new CommandAPDU(0x00, 0x24, 0x00, pinSpec.getKID(), cmd), false);
+        CardChannel channel = getCardChannel();
 
-      icc.endExclusive();
+        ResponseAPDU resp = transmit(channel,
+                new CommandAPDU(0x00, 0x24, 0x00, kid, cmd), false);
 
-      log.debug("change pin returned SW=" + Integer.toHexString(responseAPDU.getSW()));
+        sw = new byte[2];
+        sw[0] = (byte) resp.getSW1();
+        sw[1] = (byte) resp.getSW2();
+      }
 
-      if (responseAPDU.getSW() == 0x63c0) {
-        log.error(pinSpec.getLocalizedName() + " locked");
-        throw new LockedException();
-      } else if (responseAPDU.getSW1() == 0x63 && responseAPDU.getSW2() >> 4 == 0xc) {
-        int retries = responseAPDU.getSW2() & 0x0f;
-        log.error("wrong " + pinSpec.getLocalizedName() + ", " + retries + " retries");
-        throw new VerificationFailedException(retries);
-      } else if (responseAPDU.getSW() == 0x6983) {
+      // activates pin (newPIN) if not active
+      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
+        return -1;
+      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
+        throw new LockedException("[63:c0]");
+      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
+        return sw[1] & 0x0f;
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
+        //Authentisierungsmethode gesperrt
         // sig-pin only (card not transacted for inf/dec pin)
-        log.error(pinSpec.getLocalizedName() + " not activated");
-        throw new NotActivatedException();
-      } else if (responseAPDU.getSW() != 0x9000) {
-        String msg = "Failed to change " + pinSpec.getLocalizedName() +
-                ": SW=" + Integer.toHexString(responseAPDU.getSW());
-        log.error(msg);
-        throw new SignatureCardException(msg);
+        throw new NotActivatedException("[69:83]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
+        throw new TimeoutException("[64:00]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
+        throw new CancelledException("[64:01]");
       }
+      log.error("Failed to change pin: SW="
+              + SMCCHelper.toString(sw));
+      throw new SignatureCardException(SMCCHelper.toString(sw));
+
     } catch (CardException ex) {
-      log.error("Failed to change " + pinSpec.getLocalizedName() +
-              ": " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
+      log.error("smart card communication failed: " + ex.getMessage());
+      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
     }
   }
+
+  /**
+   * throws SignatureCardException (PIN activation not supported by ACOS)
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  @Override
+  public void activatePIN(byte kid, char[] pin)
+          throws SignatureCardException {
+    log.error("ACTIVATE PIN not supported by ACOS");
+    throw new SignatureCardException("PIN activation not supported by this card");
+  }
+
+  /**
+   * ASCII encoded pin, padded with 0x00
+   * @param pin
+   * @return a 8 byte pin block
+   */
+  @Override
+  protected byte[] encodePINBlock(char[] pin) {
+//    byte[] asciiPIN = new String(pin).getBytes(Charset.forName("ASCII"));
+    CharBuffer chars = CharBuffer.wrap(pin);
+    ByteBuffer bytes = Charset.forName("ASCII").encode(chars);
+    byte[] asciiPIN = bytes.array();
+    byte[] encodedPIN = new byte[8];
+    System.arraycopy(asciiPIN, 0, encodedPIN, 0, Math.min(asciiPIN.length,
+        encodedPIN.length));
+//    System.out.println("ASCII encoded PIN block: " + SMCCHelper.toString(encodedPIN));
+    return encodedPIN;
+  }
+  
+  private byte[] getPINVerifyStructure(byte kid) {
+
+      byte bTimeOut = (byte) 00;            // Default time out
+      byte bTimeOut2 = (byte) 00;           // Default time out
+      byte bmFormatString = (byte) 0x82;      // 1 0001 0 01
+                                              // ^------------ System unit = byte
+                                              //   ^^^^------- PIN position in the frame = 1 byte
+                                              //        ^----- PIN justification left
+                                              //          ^^-- BCD format
+                                              // 1 0000 0 10
+                                              //          ^^-- ASCII format
+      byte bmPINBlockString = (byte) 0x08;    // 0100 0111
+                                              // ^^^^--------- PIN length size: 4 bits
+                                              //      ^^^^---- Length PIN = 7 bytes
+      byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
+                                              //     ^-------- System bit units is bit
+                                              //       ^^^^--- PIN length is at the 4th position bit
+      byte wPINMaxExtraDigitL = (byte) 0x04;  // Max=4 digits
+      byte wPINMaxExtraDigitH = (byte) 0x04;  // Min=4 digits
+      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
+      byte bNumberMessage = (byte) 0x00;      // No message
+      byte wLangIdL = (byte) 0x0C;            // - English?
+      byte wLangIdH = (byte) 0x04;            // \
+      byte bMsgIndex = (byte) 0x00;           // Default Msg
+
+      byte[] apdu = new byte[] {
+        (byte) 0x00, (byte) 0x20, (byte) 0x00, kid, (byte) 0x08,  // CLA INS P1 P2 LC
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,               // Data
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00                // Data
+      };
+
+      int offset = 0;
+      byte[] pinVerifyStructure = new byte[offset + 19 + apdu.length];
+      pinVerifyStructure[offset++] = bTimeOut;
+      pinVerifyStructure[offset++] = bTimeOut2;
+      pinVerifyStructure[offset++] = bmFormatString;
+      pinVerifyStructure[offset++] = bmPINBlockString;
+      pinVerifyStructure[offset++] = bmPINLengthFormat;
+      pinVerifyStructure[offset++] = wPINMaxExtraDigitL;
+      pinVerifyStructure[offset++] = wPINMaxExtraDigitH;
+      pinVerifyStructure[offset++] = bEntryValidationCondition;
+      pinVerifyStructure[offset++] = bNumberMessage;
+      pinVerifyStructure[offset++] = wLangIdL;
+      pinVerifyStructure[offset++] = wLangIdH;
+      pinVerifyStructure[offset++] = bMsgIndex;
+
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+
+      pinVerifyStructure[offset++] = (byte) apdu.length;
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      System.arraycopy(apdu, 0, pinVerifyStructure, offset, apdu.length);
+
+      return pinVerifyStructure;
+  }
+  
+  public byte[] getPINModifyStructure(byte kid) {
+
+      byte bTimeOut = (byte) 00;            // Default time out
+      byte bTimeOut2 = (byte) 00;           // Default time out
+      byte bmFormatString = (byte) 0x82;      // 1 0001 0 01
+                                              // ^------------ System unit = byte
+                                              //   ^^^^------- PIN position in the frame = 1 byte
+                                              //        ^----- PIN justification left
+                                              //          ^^-- BCD format
+                                              // 1 0000 0 10
+                                              //          ^^-- ASCII format
+      byte bmPINBlockString = (byte) 0x08;    // 0100 0111
+                                              // ^^^^--------- PIN length size: 4 bits
+                                              //      ^^^^---- Length PIN = 7 bytes
+      byte bmPINLengthFormat = (byte) 0x00;   // 000 0 0100
+                                              //     ^-------- System bit units is bit
+                                              //       ^^^^--- PIN length is at the 4th position bit
+      byte bInsertionOffsetOld = (byte) 0x00; // insertion position offset in bytes
+      byte bInsertionOffsetNew = (byte) 0x00; // insertion position offset in bytes
+      byte wPINMaxExtraDigitL = (byte) 0x04;  // Min=4 digits
+      byte wPINMaxExtraDigitH = (byte) 0x04;  // Max=12 digits
+      byte bConfirmPIN = (byte) 0x00;         // ??? need for confirm pin
+      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
+      byte bNumberMessage = (byte) 0x00;      // No message
+      byte wLangIdL = (byte) 0x0C;            // - English?
+      byte wLangIdH = (byte) 0x04;            // \
+      byte bMsgIndex1 = (byte) 0x00;           // Default Msg
+      byte bMsgIndex2 = (byte) 0x00;           // Default Msg
+      byte bMsgIndex3 = (byte) 0x00;           // Default Msg
+
+      byte[] apdu = new byte[] {
+        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,  // CLA INS P1 P2 LC
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,                // ...
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff                // ...
+      };
+
+      int offset = 0;
+      byte[] pinModifyStructure = new byte[offset + 24 + apdu.length];
+      pinModifyStructure[offset++] = bTimeOut;
+      pinModifyStructure[offset++] = bTimeOut2;
+      pinModifyStructure[offset++] = bmFormatString;
+      pinModifyStructure[offset++] = bmPINBlockString;
+      pinModifyStructure[offset++] = bmPINLengthFormat;
+      pinModifyStructure[offset++] = bInsertionOffsetOld;
+      pinModifyStructure[offset++] = bInsertionOffsetNew;
+      pinModifyStructure[offset++] = wPINMaxExtraDigitL;
+      pinModifyStructure[offset++] = wPINMaxExtraDigitH;
+      pinModifyStructure[offset++] = bConfirmPIN;
+      pinModifyStructure[offset++] = bEntryValidationCondition;
+      pinModifyStructure[offset++] = bNumberMessage;
+      pinModifyStructure[offset++] = wLangIdL;
+      pinModifyStructure[offset++] = wLangIdH;
+      pinModifyStructure[offset++] = bMsgIndex1;
+      pinModifyStructure[offset++] = bMsgIndex2;
+      pinModifyStructure[offset++] = bMsgIndex3;
+
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+
+      pinModifyStructure[offset++] = (byte) apdu.length;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      System.arraycopy(apdu, 0, pinModifyStructure, offset, apdu.length);
+
+      return pinModifyStructure;
+  }
+
+  @Override
+  public String toString() {
+    return "a-sign premium";
+  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index 39952bb9..6587aaf9 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -33,12 +33,12 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.ResourceBundle;
 
-import java.util.logging.Level;
-import java.util.logging.Logger;
 import javax.smartcardio.ATR;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
@@ -54,6 +54,14 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
   private static Log log = LogFactory.getLog(AbstractSignatureCard.class);
 
+  static final short GET_FEATURE_REQUEST = 3400;
+  
+  private static int getCtrlCode(short function) {
+    return 0x310000 | ((0xFFFF & function) << 2);
+  }
+
+  protected Map<Byte, Long> ifdCtrlCmds;
+
   protected List<PINSpec> pinSpecs = new ArrayList<PINSpec>();
 
   private ResourceBundle i18n;
@@ -106,11 +114,14 @@ public abstract class AbstractSignatureCard implements SignatureCard {
    */
   protected byte[] selectFileAID(byte[] dfName) throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xA4, 0x04,
-        0x00, dfName, 256));
+    ResponseAPDU resp = transmit(channel,
+            new CommandAPDU(0x00, 0xA4, 0x04, 0x00, dfName, 256));
+//            new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, dfName));
     if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("Failed to select application AID="
-          + toString(dfName) + ": SW=" + Integer.toHexString(resp.getSW()) + ".");
+      String msg = "Failed to select application AID=" + SMCCHelper.toString(dfName) +
+              ": SW=" + Integer.toHexString(resp.getSW());
+      log.error(msg);
+      throw new SignatureCardException(msg);
     } else {
       return resp.getBytes();
     }
@@ -119,10 +130,63 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   protected abstract ResponseAPDU selectFileFID(byte[] fid) throws CardException,
       SignatureCardException;
 
-  protected abstract int verifyPIN(String pin, byte kid) 
+  /**
+   * VERIFY APDU without PIN BLOCK
+   * Not supported by ACOS cards (and GemPC Pinpad?)
+   * @param kid
+   * @return the number of possible tries until card is blocked or -1 if unknown
+   * (ACOS does not support this VERIFY APDU type)
+   * @throws at.gv.egiz.smcc.LockedException
+   * @throws at.gv.egiz.smcc.NotActivatedException
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  protected abstract int verifyPIN(byte kid)
           throws LockedException, NotActivatedException, SignatureCardException;
 
-  
+  /**
+   * VERIFY APDU with PIN BLOCK
+   * If IFD supports VERIFY_PIN on pinpad, parameter pin may be empty.
+   * @param kid
+   * @param pin to be encoded in the PIN BLOCK
+   * @return -1 if VERIFY PIN was successful, or the number of possible retries
+   * @throws at.gv.egiz.smcc.LockedException
+   * @throws at.gv.egiz.smcc.NotActivatedException
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  protected abstract int verifyPIN(byte kid, char[] pin)
+          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException;
+
+  /**
+   * CHANGE(?) APDU
+   * If IFD supports VERIFY_PIN on pinpad, parameter pin may be empty.
+   * @param kid
+   * @param pin
+   * @throws at.gv.egiz.smcc.SignatureCardException if activation fails
+   */
+  protected abstract void activatePIN(byte kid, char[] pin)
+          throws CancelledException, TimeoutException, SignatureCardException;
+
+  /**
+   * CHANGE(?) APDU
+   * If IFD supports VERIFY_PIN on pinpad, parameter pin may be empty.
+   * @param kid
+   * @param pin
+   * @return -1 if CHANGE PIN was successful, or the number of possible retries
+   * @throws at.gv.egiz.smcc.SignatureCardException if change fails
+   */
+  protected abstract int changePIN(byte kid, char[] oldPin, char[] newPin)
+          throws CancelledException, TimeoutException, SignatureCardException;
+
+  /**
+   * encode the pin as needed in VERIFY/CHANGE APDUs
+   * @param pin
+   * @return
+   * @throws at.gv.egiz.smcc.SignatureCardException if the provided pin does
+   * not meet the restrictions imposed by the encoding (not the pinSpec!),
+   * such as maximum Length
+   */
+  protected abstract byte[] encodePINBlock(char[] pin) throws SignatureCardException;
+
   protected byte[] readRecord(int recordNumber) throws SignatureCardException, CardException {
     return readRecord(getCardChannel(), recordNumber);
   }
@@ -295,7 +359,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
    * @throws SignatureCardException
    * @throws CardException 
    */
-  protected byte[] readTLVFile(byte[] aid, byte[] ef, String pin, byte kid, int maxLength)
+  protected byte[] readTLVFile(byte[] aid, byte[] ef, char[] pin, byte kid, int maxLength)
       throws SignatureCardException, InterruptedException, CardException {
 
 
@@ -318,7 +382,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
     // VERIFY
     if (pin != null) {
-      int retries = verifyPIN(pin, kid);
+      int retries = verifyPIN(kid, pin);
       if (retries != -1) {
         throw new VerificationFailedException(retries);
       }
@@ -388,6 +452,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
       ifs_ = 0xFF & atr.getBytes()[6];
       log.trace("Setting IFS (information field size) to " + ifs_);
     }
+    ifdCtrlCmds = queryIFDFeatures();
   }
   
   @Override
@@ -446,39 +511,266 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   }
 
   @Override
-  public int verifyPIN(PINSpec pinSpec, String pin) throws LockedException, NotActivatedException, SignatureCardException {
-
-    Card icc = getCard();
+  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException, InterruptedException {
     try {
-      icc.beginExclusive();
-      CardChannel channel = icc.getBasicChannel();
+      getCard().beginExclusive();
 
       if (pinSpec.getContextAID() != null) {
-        ResponseAPDU responseAPDU = transmit(channel,
-                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
-        if (responseAPDU.getSW() != 0x9000) {
-          icc.endExclusive();
-          String msg = "Failed to verify PIN " +
-                  SMCCHelper.toString(new byte[]{pinSpec.getKID()}) +
-                  ": Failed to verify AID " +
-                  SMCCHelper.toString(pinSpec.getContextAID()) +
-                  ": " + SMCCHelper.toString(responseAPDU.getBytes());
-          log.error(msg);
-          throw new SignatureCardException(msg);
-        }
+        selectFileAID(pinSpec.getContextAID());
       }
-      return verifyPIN(pin, pinSpec.getKID());
+
+      int retries = verifyPIN(pinSpec.getKID());
+      do {
+        char[] pin = pinProvider.providePIN(pinSpec, retries);
+        retries = verifyPIN(pinSpec.getKID(), pin);
+      } while (retries > 0);
+      //return on -1, 0 never reached: verifyPIN throws LockedEx
 
     } catch (CardException ex) {
-      log.error("failed to verify pinspec: " + ex.getMessage(), ex);
+      log.error("failed to verify " + pinSpec.getLocalizedName() +
+              ": " + ex.getMessage(), ex);
       throw new SignatureCardException(ex);
     } finally {
       try {
-        icc.endExclusive();
+        getCard().endExclusive();
+      } catch (CardException ex) {
+        log.trace("failed to end exclusive card access: " + ex.getMessage());
+      }
+    }
+  }
+
+  @Override
+  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+          throws CancelledException, SignatureCardException, CancelledException, TimeoutException, InterruptedException {
+   try {
+      getCard().beginExclusive();
+
+      if (pinSpec.getContextAID() != null) {
+        selectFileAID(pinSpec.getContextAID());
+      }
+      char[] pin = pinProvider.providePIN(pinSpec, -1);
+      activatePIN(pinSpec.getKID(), pin);
+      
+    } catch (CardException ex) {
+      log.error("Failed to activate " + pinSpec.getLocalizedName() +
+              ": " + ex.getMessage());
+      throw new SignatureCardException(ex.getMessage(), ex);
+    } finally {
+      try {
+        getCard().endExclusive();
       } catch (CardException ex) {
         log.trace("failed to end exclusive card access: " + ex.getMessage());
       }
+    }
+  }
+
+  /**
+   * activates pin (newPIN) if not active
+   * @param pinSpec
+   * @param oldPIN
+   * @param newPIN
+   * @throws at.gv.egiz.smcc.LockedException
+   * @throws at.gv.egiz.smcc.VerificationFailedException
+   * @throws at.gv.egiz.smcc.NotActivatedException
+   * @throws at.gv.egiz.smcc.SignatureCardException
+   */
+  @Override
+  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException, InterruptedException {
+    try {
+      getCard().beginExclusive();
+
+      if (pinSpec.getContextAID() != null) {
+        selectFileAID(pinSpec.getContextAID());
+      }
+
+      int retries = verifyPIN(pinSpec.getKID());
+      do {
+        char[] newPin = pinProvider.providePIN(pinSpec, retries);
+        char[] oldPin = pinProvider.provideOldPIN(pinSpec, retries);
+        retries = changePIN(pinSpec.getKID(), oldPin, newPin);
+      } while (retries > 0);
+      //return on -1, 0 never reached: verifyPIN throws LockedEx
 
+    } catch (CardException ex) {
+      log.error("Failed to change " + pinSpec.getLocalizedName() +
+              ": " + ex.getMessage());
+      throw new SignatureCardException(ex.getMessage(), ex);
+    } finally {
+      try {
+        getCard().endExclusive();
+      } catch (CardException ex) {
+        log.trace("failed to end exclusive card access: " + ex.getMessage());
+      }
     }
   }
+
+  @Override
+  public void unblockPIN(PINSpec pinSpec, PINProvider pinProvider)
+          throws CancelledException, SignatureCardException, InterruptedException {
+    throw new SignatureCardException("Unblock not supported yet");
+  }
+
+  /////////////////////////////////////////////////////////////////////////////
+  // IFD related code
+  /////////////////////////////////////////////////////////////////////////////
+
+  /**
+   * TODO implement VERIFY_PIN_START/FINISH (feature 0x01/0x02)
+   * @return
+   */
+  @Override
+  public boolean ifdSupportsFeature(byte feature) {
+    if (ifdCtrlCmds != null) {
+      return ifdCtrlCmds.containsKey(feature);
+    }
+    return false;
+  }
+
+  protected Map<Byte, Long> queryIFDFeatures() {
+
+    if (card_ == null) {
+      throw new NullPointerException("Need connected smart card to query IFD features");
+    }
+
+    Map<Byte, Long> ifdFeatures = new HashMap<Byte, Long>();
+
+    try {
+      if (log.isTraceEnabled()) {
+        log.trace("GET_FEATURE_REQUEST CtrlCode " + Integer.toHexString(getCtrlCode(GET_FEATURE_REQUEST)));
+      }
+      byte[] resp = card_.transmitControlCommand(getCtrlCode(GET_FEATURE_REQUEST), new byte[]{});
+
+      if (log.isTraceEnabled()) {
+        log.trace("GET_FEATURE_REQUEST Response " + SMCCHelper.toString(resp));
+      }
+
+      for (int i = 0; i + 5 < resp.length; i += 6) {
+        Byte feature = new Byte(resp[i]);
+        Long ctrlCode = new Long(
+          ((0xFF & resp[i + 2]) << 24) |
+          ((0xFF & resp[i + 3]) << 16) |
+          ((0xFF & resp[i + 4]) << 8) |
+           (0xFF & resp[i + 5]));
+        if (log.isInfoEnabled()) {
+          log.info("IFD supports feature " + Integer.toHexString(feature.byteValue()) +
+                  ": " + Long.toHexString(ctrlCode.longValue()));
+        }
+        ifdFeatures.put(feature, ctrlCode);
+      }
+
+    } catch (CardException ex) {
+      log.debug("Failed to query IFD features: " + ex.getMessage());
+      log.trace(ex);
+      log.info("IFD does not support PINPad");
+      return null;
+    }
+    return ifdFeatures;
+  }
+
+
+  protected byte ifdGetKeyPressed() throws CardException {
+    if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+
+      Long controlCode = (Long) ifdCtrlCmds.get(new Byte((byte) 0x05));
+
+      byte key = 0x00;
+      while (key == 0x00) {
+
+        byte[] resp = card_.transmitControlCommand(controlCode.intValue(), new byte[] {});
+
+        if (resp != null && resp.length > 0) {
+          key = resp[0];
+        }
+      }
+
+      System.out.println("Key: " + key);
+
+    }
+
+    return 0x00;
+  }
+
+  protected byte[] ifdVerifyPINFinish() throws CardException {
+    if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+
+      Long controlCode = (Long) ifdCtrlCmds.get(new Byte((byte) 0x02));
+
+      byte[] resp = card_.transmitControlCommand(controlCode.intValue(), new byte[] {});
+
+      System.out.println("CommandResp: " + toString(resp));
+
+      return resp;
+
+    }
+
+    return null;
+  }
+
+
+  /**
+   * assumes ifdSupportsVerifyPIN() == true
+   * @param pinVerifyStructure
+   * @return
+   * @throws javax.smartcardio.CardException
+   */
+//  protected byte[] ifdVerifyPIN(byte[] pinVerifyStructure) throws CardException {
+//
+////      Long ctrlCode = (Long) ifdFeatures.get(FEATURE_IFD_PIN_PROPERTIES);
+////      if (ctrlCode != null) {
+////        if (log.isTraceEnabled()) {
+////          log.trace("PIN_PROPERTIES CtrlCode " + Integer.toHexString(ctrlCode.intValue()));
+////        }
+////        byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), new byte[] {});
+////
+////        if (log.isTraceEnabled()) {
+////          log.trace("PIN_PROPERTIES Response " + SMCCHelper.toString(resp));
+////        }
+////      }
+//
+//
+//      Long ctrlCode = (Long) ifdFeatures.get(FEATURE_VERIFY_PIN_DIRECT);
+//      if (ctrlCode == null) {
+//        throw new NullPointerException("no CtrlCode for FEATURE_VERIFY_PIN_DIRECT");
+//      }
+//
+//      if (log.isTraceEnabled()) {
+//        log.trace("VERIFY_PIN_DIRECT CtrlCode " + Integer.toHexString(ctrlCode.intValue()) +
+//                ", PIN_VERIFY_STRUCTURE " + SMCCHelper.toString(pinVerifyStructure));
+//      }
+//      byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), pinVerifyStructure);
+//
+//      if (log.isTraceEnabled()) {
+//        log.trace("VERIFY_PIN_DIRECT Response " + SMCCHelper.toString(resp));
+//      }
+//      return resp;
+//  }
+
+//  protected Long getControlCode(Byte feature) {
+//    if (ifdFeatures != null) {
+//      return ifdFeatures.get(feature);
+//    }
+//    return null;
+//  }
+
+  protected byte[] transmitControlCommand(Long ctrlCode, byte[] ctrlCommand)
+          throws CardException {
+//    Long ctrlCode = (Long) ifdFeatures.get(feature);
+    if (ctrlCode == null) {
+      throw new NullPointerException("ControlCode " +
+              Integer.toHexString(ctrlCode.intValue()) + " not supported");
+    }
+    if (log.isTraceEnabled()) {
+      log.trace("CtrlCommand (" + Integer.toHexString(ctrlCode.intValue()) +
+              ")  " + SMCCHelper.toString(ctrlCommand));
+    }
+    byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), ctrlCommand);
+
+    if (log.isTraceEnabled()) {
+      log.trace("CtrlCommand Response " + SMCCHelper.toString(resp));
+    }
+    return resp;
+  }
+
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
new file mode 100644
index 00000000..d0622aa4
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.smcc;
+
+import at.gv.egiz.smcc.*;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface ChangePINProvider extends PINProvider {
+
+  /**
+   *
+   * @param spec
+   * @param retries
+   * @return null if no old value for this pin
+   * @throws at.gv.egiz.smcc.CancelledException if cancelled by user
+   * @throws java.lang.InterruptedException
+   */
+  public char[] provideOldPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException;
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
index e0104618..8fa80dcb 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
@@ -28,8 +28,30 @@
 //
 package at.gv.egiz.smcc;
 
+/**
+ * The number of retries is not fixed and there is no way (?) to obtain this value.
+ * A PINProvider should therefore maintain an internal retry counter or flag
+ * to decide whether or not to warn the user (num retries passed in providePIN).
+ *
+ * Therefore PINProvider objects should not be reused.
+ *
+ * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
 public interface PINProvider {
-  
-  public String providePIN(PINSpec spec, int retries) throws InterruptedException;
+
+  /**
+   *
+   * @param spec
+   * @param retries num of remaining retries or -1 if unknown
+   * (a positive value does <em>not</em> necessarily signify that there was
+   * already an unsuccessful PIN verification)
+   * @return pin != null
+   * @throws at.gv.egiz.smcc.CancelledException
+   * @throws java.lang.InterruptedException
+   */
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException;
 
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index 3c5f38a2..91245c50 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -30,7 +30,6 @@ package at.gv.egiz.smcc;
 
 import at.gv.egiz.smcc.util.SMCCHelper;
 import java.util.Arrays;
-import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CommandAPDU;
@@ -223,15 +222,12 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
         //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
         
         int retries = -1;
-        String pin = null;
+        char[] pin = null;
         boolean pinRequiered = false;
 
         do {
           if (pinRequiered) {
             pin = provider.providePIN(spec, retries);
-            if (pin == null) {
-              throw new CancelledException();
-            }
           }
           try {
             getCard().beginExclusive();
@@ -240,7 +236,7 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
             throw new NotActivatedException();
           } catch (SecurityStatusNotSatisfiedException e) {
             pinRequiered = true;
-            retries = verifyPIN(null, KID_PIN_CARD);
+            retries = verifyPIN(KID_PIN_CARD);
           } catch (VerificationFailedException e) {
             pinRequiered = true;
             retries = e.getRetries();
@@ -316,20 +312,17 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
         //new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
         
         int retries = -1;
-        String pin = null;
+        char[] pin = null;
 
         do {
           try {
             getCard().beginExclusive();
             selectFileAID(AID_DF_SS);
-            retries = verifyPIN(null, KID_PIN_SS);
+            retries = verifyPIN(KID_PIN_SS); //, null);
           } finally {
             getCard().endExclusive();
           }
           pin = provider.providePIN(spec, retries);
-          if (pin == null) {
-            throw new CancelledException();
-          }
           try {
             getCard().beginExclusive();
             return createSignature(hash, AID_DF_SS, pin, KID_PIN_SS, DST_SS);
@@ -349,15 +342,12 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
         //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
  
         int retries = -1;
-        String pin = null;
+        char[] pin = null;
         boolean pinRequiered = false;
 
         do {
           if (pinRequiered) {
             pin = provider.providePIN(spec, retries);
-            if (pin == null) {
-              throw new CancelledException();
-            }
           }
           try {
             getCard().beginExclusive();
@@ -366,7 +356,7 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
             throw new NotActivatedException();
           } catch (SecurityStatusNotSatisfiedException e) {
             pinRequiered = true;
-            retries = verifyPIN(null, KID_PIN_CARD);
+            retries = verifyPIN(KID_PIN_CARD);
           } catch (VerificationFailedException e) {
             pinRequiered = true;
             retries = e.getRetries();
@@ -389,13 +379,18 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
   
   }
 
+
+  ////////////////////////////////////////////////////////////////////////
+  // PROTECTED METHODS (assume exclusive card access)
+  ////////////////////////////////////////////////////////////////////////
+
   protected ResponseAPDU selectFileFID(byte[] fid) throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
     return transmit(channel, new CommandAPDU(0x00, 0xA4, 0x02,
         0x04, fid, 256));
   }
 
-  private byte[] createSignature(byte[] hash, byte[] aid, String pin, byte kid,
+  private byte[] createSignature(byte[] hash, byte[] aid, char[] pin, byte kid,
       byte[] dst) throws CardException, SignatureCardException {
     
     // SELECT MF
@@ -403,7 +398,7 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
     // SELECT DF
     selectFileAID(aid);
     // VERIFY
-    int retries = verifyPIN(pin, kid);
+    int retries = verifyPIN(kid, pin);
     if (retries != -1) {
       throw new VerificationFailedException(retries);
     }
@@ -417,7 +412,6 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
     
   }
 
-  
   private void selectMF() throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
     ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00,
@@ -467,58 +461,85 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
     }
   }
 
-  /**
-   * VERIFY PIN
-   * <p>
-   * If <code>pin</code> is <code>null</code> only the PIN status is checked and
-   * returned.
-   * </p>
-   * 
-   * @param pin
-   *          the PIN (may be <code>null</code>)
-   * @param kid
-   *          the KID of the PIN to be verified
-   * 
-   * @return -1 if VERIFY PIN was successful, or the number of possible retries 
-   *
-   * @throws LockedException
-   *            if the pin is locked
-   * @throws NotActivatedException
-   *           if the card application has not been activated
-   * @throws SignatureCardException
-   *           if VERIFY PIN fails for some other reason (card communication error)
-   */
   @Override
-  public int verifyPIN(String pin, byte kid) throws LockedException, NotActivatedException, SignatureCardException {
+  protected int verifyPIN(byte kid, char[] pin)
+          throws LockedException, NotActivatedException, SignatureCardException {
     try {
-      CardChannel channel = getCardChannel();
-
-      ResponseAPDU resp;
-      if (pin == null) {
-        resp = transmit(channel, new CommandAPDU(0x00, 0x20, 0x00, kid));
+      byte[] sw;
+      if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+        log.debug("verify PIN on IFD");
+        sw = transmitControlCommand(
+                ifdCtrlCmds.get(FEATURE_VERIFY_PIN_DIRECT),
+                getPINVerifyStructure(kid));
+//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
       } else {
-        // BCD encode PIN and marshal PIN block
         byte[] pinBlock = encodePINBlock(pin);
-        resp = transmit(channel, new CommandAPDU(0x00, 0x20, 0x00, kid, pinBlock), false);
+        CardChannel channel = getCardChannel();
+        ResponseAPDU resp = transmit(channel,
+                new CommandAPDU(0x00, 0x20, 0x00, kid, pinBlock), false);
+        sw = new byte[2];
+        sw[0] = (byte) resp.getSW1();
+        sw[1] = (byte) resp.getSW2();
+      }
 
+      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
+        return -1;
+      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
+        throw new LockedException("[63:c0]");
+      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
+        return sw[1] & 0x0f;
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
+        //Authentisierungsmethode gesperrt
+        throw new LockedException("[69:83]");
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
+        //referenzierte Daten sind reversibel gesperrt (invalidated)
+        throw new NotActivatedException("[69:84]");
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
+        //Benutzungsbedingungen nicht erfüllt
+        throw new NotActivatedException("[69:85]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
+        throw new TimeoutException("[64:00]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
+        throw new CancelledException("[64:01]");
       }
+      log.error("Failed to verify pin: SW="
+              + SMCCHelper.toString(sw));
+      throw new SignatureCardException(SMCCHelper.toString(sw));
+      
+    } catch (CardException ex) {
+      log.error("smart card communication failed: " + ex.getMessage());
+      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
+    }
+  }
 
-      if (resp.getSW() == 0x63c0) {
-        throw new LockedException("PIN locked.");
-      } else if (resp.getSW1() == 0x63 && resp.getSW2() >> 4 == 0xc) {
-        // return number of possible retries
+  @Override
+  protected int verifyPIN(byte kid)
+          throws LockedException, NotActivatedException, SignatureCardException {
+    try {
+      CardChannel channel = getCardChannel();
+      ResponseAPDU resp = transmit(channel,
+              new CommandAPDU(0x00, 0x20, 0x00, kid), false);
+
+      if (resp.getSW() == 0x9000) {
+        return -1;
+      } else if (resp.getSW() == 0x63c0) {
+        throw new LockedException("[63:c0]");
+      } else if (resp.getSW1() == 0x63 && (resp.getSW2() & 0xf0) >> 4 == 0xc) {
         return resp.getSW2() & 0x0f;
       } else if (resp.getSW() == 0x6983) {
-        throw new LockedException();
+        //Authentisierungsmethode gesperrt
+        throw new LockedException("[69:83]");
       } else if (resp.getSW() == 0x6984) {
-        // PIN LCS = "Initialized" (-> not activated)
-        throw new NotActivatedException();
-      } else if (resp.getSW() == 0x9000) {
-        return -1; // success
-      } else {
-        throw new SignatureCardException("Failed to verify pin: SW="
-            + Integer.toHexString(resp.getSW()));
+        //referenzierte Daten sind reversibel gesperrt (invalidated)
+        throw new NotActivatedException("[69:84]");
+      } else if (resp.getSW() == 0x6985) {
+        //Benutzungsbedingungen nicht erfüllt
+        throw new NotActivatedException("[69:85]");
       }
+      log.error("Failed to verify pin: SW="
+              + Integer.toHexString(resp.getSW()));
+      throw new SignatureCardException("[" + Integer.toHexString(resp.getSW()) + "]");
+
     } catch (CardException ex) {
       log.error("smart card communication failed: " + ex.getMessage());
       throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
@@ -526,24 +547,95 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
   }
 
   @Override
-  public void reset() throws SignatureCardException {
+  protected int changePIN(byte kid, char[] oldPin, char[] newPin)
+          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException {
     try {
-      super.reset();
-      log.debug("select MF (e-card workaround)");
-      CardChannel channel = getCardChannel();
-      ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00, 0x0C));
-      if (resp.getSW() != 0x9000) {
-        throw new SignatureCardException("Failed to select MF after RESET: SW=" + Integer.toHexString(resp.getSW()) + ".");
+      byte[] sw;
+      if (ifdSupportsFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+        log.debug("modify PIN on IFD");
+        sw = transmitControlCommand(
+                ifdCtrlCmds.get(FEATURE_MODIFY_PIN_DIRECT),
+                getPINModifyStructure(kid));
+//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
+      } else {
+        byte[] cmd = new byte[16];
+        System.arraycopy(encodePINBlock(oldPin), 0, cmd, 0, 8);
+        System.arraycopy(encodePINBlock(newPin), 0, cmd, 8, 8);
+
+        CardChannel channel = getCardChannel();
+
+        ResponseAPDU resp = transmit(channel,
+                new CommandAPDU(0x00, 0x24, 0x00, kid, cmd), false);
+
+        sw = new byte[2];
+        sw[0] = (byte) resp.getSW1();
+        sw[1] = (byte) resp.getSW2();
+      }
+
+      // activates pin (newPIN) if not active
+      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
+        return -1;
+      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
+        throw new LockedException("[63:c0]");
+      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
+        return sw[1] & 0x0f;
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
+        //Authentisierungsmethode gesperrt
+        throw new LockedException("[69:83]");
+//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
+//        //referenzierte Daten sind reversibel gesperrt (invalidated)
+//        throw new NotActivatedException("[69:84]");
+//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
+//        //Benutzungsbedingungen nicht erfüllt
+//        throw new NotActivatedException("[69:85]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
+        throw new TimeoutException("[64:00]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
+        throw new CancelledException("[64:01]");
       }
+      log.error("Failed to change pin: SW="
+              + SMCCHelper.toString(sw));
+      throw new SignatureCardException(SMCCHelper.toString(sw));
     } catch (CardException ex) {
-      log.error("Failed to select MF after RESET: " + ex.getMessage(), ex);
-      throw new SignatureCardException("Failed to select MF after RESET");
+      log.error("smart card communication failed: " + ex.getMessage());
+      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
     }
   }
 
+  @Override
+  protected void activatePIN(byte kid, char[] pin)
+          throws CancelledException, TimeoutException, SignatureCardException {
+    try {
+      CardChannel channel = getCardChannel();
+      ResponseAPDU resp = transmit(channel,
+              new CommandAPDU(0x00, 0x24, 0x01, kid, encodePINBlock(pin)), false);
+
+      log.trace("activate pin returned SW=" + Integer.toHexString(resp.getSW()));
 
-  public String toString() {
-    return "e-card";
+      if (resp.getSW1() == 0x9000) {
+        return;
+      } else if (resp.getSW() == 0x6983) {
+        //Authentisierungsmethode gesperrt
+        throw new LockedException("[69:83]");
+      } else if (resp.getSW() == 0x6984) {
+        //referenzierte Daten sind reversibel gesperrt (invalidated)
+        throw new NotActivatedException("[69:84]");
+      } else if (resp.getSW() == 0x6985) {
+        //Benutzungsbedingungen nicht erfüllt
+        throw new NotActivatedException("[69:85]");
+      } else if (resp.getSW() == 0x6400) {
+        throw new TimeoutException("[64:00]");
+      } else if (resp.getSW() == 0x6401) {
+        throw new CancelledException("[64:01]");
+      }
+      log.error("Failed to activate pin: SW=" +
+              Integer.toHexString(resp.getSW()));
+      throw new SignatureCardException("[" + Integer.toHexString(resp.getSW()) + "]");
+
+    } catch (CardException ex) {
+      log.error("smart card communication failed: " + ex.getMessage());
+      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
+    }
   }
 
   /**
@@ -552,17 +644,20 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
    * @return a 8 byte pin block consisting of length byte (0x2X),
    * the BCD encoded pin and a 0xFF padding
    */
-  private byte[] encodePINBlock(String pin) {
-    char[] pinChars = pin.toCharArray();
-    int numDigits = pinChars.length;
+  @Override
+  protected byte[] encodePINBlock(char[] pin) throws SignatureCardException {
+    if (pin == null || pin.length > 12) {
+      throw new SignatureCardException("invalid pin: " + pin);
+    }
+    int numDigits = pin.length;
     int numBytes = (int) Math.ceil(numDigits/2.0);
 
     byte[] pinBlock = new byte[8];
     pinBlock[0] = (byte) (0x20 | numDigits);
 
     for (int i = 0; i < numBytes; i++) {
-      int p1 = 16*Character.digit(pinChars[i*2], 16);
-      int p2 = (i*2+1 < numDigits) ? Character.digit(pinChars[i*2+1], 16) : 0xf;
+      int p1 = 16*Character.digit(pin[i*2], 16);
+      int p2 = (i*2+1 < numDigits) ? Character.digit(pin[i*2+1], 16) : 0xf;
       pinBlock[i+1] = (byte) (p1 + p2);
     }
     Arrays.fill(pinBlock, numBytes + 1, pinBlock.length, (byte) 0xff);
@@ -570,111 +665,151 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
 
     return pinBlock;
   }
+  
+  private byte[] getPINVerifyStructure(byte kid) {
+      
+      byte bTimeOut = (byte) 00;            // Default time out
+      byte bTimeOut2 = (byte) 00;           // Default time out
+      byte bmFormatString = (byte) 0x89;      // 1 0001 0 01 
+                                              // ^------------ System unit = byte
+                                              //   ^^^^------- PIN position in the frame = 1 byte
+                                              //        ^----- PIN justification left
+                                              //          ^^-- BCD format
+      byte bmPINBlockString = (byte) 0x47;    // 0100 0111
+                                              // ^^^^--------- PIN length size: 4 bits
+                                              //      ^^^^---- Length PIN = 7 bytes
+      byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
+                                              //     ^-------- System bit units is bit
+                                              //       ^^^^--- PIN length is at the 4th position bit
+      byte wPINMaxExtraDigitL = (byte) 0x04;  // Max=4 digits
+      byte wPINMaxExtraDigitH = (byte) 0x04;  // Min=4 digits
+      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
+      byte bNumberMessage = (byte) 0x00;      // No message
+      byte wLangIdL = (byte) 0x0C;            // - English?
+      byte wLangIdH = (byte) 0x04;            // \
+      byte bMsgIndex = (byte) 0x00;           // Default Msg
+
+      byte[] apdu = new byte[] {
+        (byte) 0x00, (byte) 0x20, (byte) 0x00, kid, (byte) 0x08,  // CLA INS P1 P2 LC
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff                // ...
+      };
+
+      int offset = 0;
+      byte[] pinVerifyStructure = new byte[offset + 19 + apdu.length];
+      pinVerifyStructure[offset++] = bTimeOut;
+      pinVerifyStructure[offset++] = bTimeOut2;
+      pinVerifyStructure[offset++] = bmFormatString;
+      pinVerifyStructure[offset++] = bmPINBlockString;
+      pinVerifyStructure[offset++] = bmPINLengthFormat;
+      pinVerifyStructure[offset++] = wPINMaxExtraDigitL;
+      pinVerifyStructure[offset++] = wPINMaxExtraDigitH;
+      pinVerifyStructure[offset++] = bEntryValidationCondition;
+      pinVerifyStructure[offset++] = bNumberMessage;
+      pinVerifyStructure[offset++] = wLangIdL;
+      pinVerifyStructure[offset++] = wLangIdH;
+      pinVerifyStructure[offset++] = bMsgIndex;
+      
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      
+      pinVerifyStructure[offset++] = (byte) apdu.length;
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      pinVerifyStructure[offset++] = 0x00;
+      System.arraycopy(apdu, 0, pinVerifyStructure, offset, apdu.length);
 
-  @Override
-  public void activatePIN(PINSpec pinSpec, String pin)
-          throws SignatureCardException {
-    Card icc = getCard();
-    try {
-      icc.beginExclusive();
-      CardChannel channel = icc.getBasicChannel();
-
-      if (pinSpec.getContextAID() != null) {
-        ResponseAPDU responseAPDU = transmit(channel,
-                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
-        if (responseAPDU.getSW() != 0x9000) {
-          icc.endExclusive();
-          String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
-                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
-          log.error(msg);
-          throw new SignatureCardException(msg);
-        }
-      }
-
-      ResponseAPDU responseAPDU = transmit(channel,
-              new CommandAPDU(0x00, 0x24, 0x01, pinSpec.getKID(), encodePINBlock(pin)),
-              false);
-
-      icc.endExclusive();
-
-      log.debug("activate pin returned SW=" + Integer.toHexString(responseAPDU.getSW()));
+      return pinVerifyStructure;
+  }
 
-       if (responseAPDU.getSW() != 0x9000) {
-        String msg = "Failed to activate " + pinSpec.getLocalizedName() +
-                ": SW=" + Integer.toHexString(responseAPDU.getSW());
-        log.error(msg);
-        throw new SignatureCardException(msg);
-      }
-    } catch (CardException ex) {
-      log.error("Failed to activate " + pinSpec.getLocalizedName() +
-              ": " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
-    }
+  private byte[] getPINModifyStructure(byte kid) {
+
+      byte bTimeOut = (byte) 00;            // Default time out
+      byte bTimeOut2 = (byte) 00;           // Default time out
+      byte bmFormatString = (byte) 0x89;      // 1 0001 0 01
+                                              // ^------------ System unit = byte
+                                              //   ^^^^------- PIN position in the frame = 1 byte
+                                              //        ^----- PIN justification left
+                                              //          ^^-- BCD format
+      byte bmPINBlockString = (byte) 0x47;    // 0100 0111
+                                              // ^^^^--------- PIN length size: 4 bits
+                                              //      ^^^^---- Length PIN = 7 bytes
+      byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
+                                              //     ^-------- System bit units is bit
+                                              //       ^^^^--- PIN length is at the 4th position bit
+      byte bInsertionOffsetOld = (byte) 0x01; // insertion position offset in bytes
+      byte bInsertionOffsetNew = (byte) 0x08; // insertion position offset in bytes
+      byte wPINMaxExtraDigitL = (byte) 0x04;  // Min=4 digits
+      byte wPINMaxExtraDigitH = (byte) 0x04;  // Max=12 digits
+      byte bConfirmPIN = (byte) 0x00;         // ??? need for confirm pin
+      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
+      byte bNumberMessage = (byte) 0x00;      // No message
+      byte wLangIdL = (byte) 0x0C;            // - English?
+      byte wLangIdH = (byte) 0x04;            // \
+      byte bMsgIndex1 = (byte) 0x00;           // Default Msg
+      byte bMsgIndex2 = (byte) 0x00;           // Default Msg
+      byte bMsgIndex3 = (byte) 0x00;           // Default Msg
+
+      byte[] apdu = new byte[] {
+        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,  // CLA INS P1 P2 LC
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,                // ...
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff                // ...
+      };
+
+      int offset = 0;
+      byte[] pinModifyStructure = new byte[offset + 24 + apdu.length];
+      pinModifyStructure[offset++] = bTimeOut;
+      pinModifyStructure[offset++] = bTimeOut2;
+      pinModifyStructure[offset++] = bmFormatString;
+      pinModifyStructure[offset++] = bmPINBlockString;
+      pinModifyStructure[offset++] = bmPINLengthFormat;
+      pinModifyStructure[offset++] = bInsertionOffsetOld;
+      pinModifyStructure[offset++] = bInsertionOffsetNew;
+      pinModifyStructure[offset++] = wPINMaxExtraDigitL;
+      pinModifyStructure[offset++] = wPINMaxExtraDigitH;
+      pinModifyStructure[offset++] = bConfirmPIN;
+      pinModifyStructure[offset++] = bEntryValidationCondition;
+      pinModifyStructure[offset++] = bNumberMessage;
+      pinModifyStructure[offset++] = wLangIdL;
+      pinModifyStructure[offset++] = wLangIdH;
+      pinModifyStructure[offset++] = bMsgIndex1;
+      pinModifyStructure[offset++] = bMsgIndex2;
+      pinModifyStructure[offset++] = bMsgIndex3;
+
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+
+      pinModifyStructure[offset++] = (byte) apdu.length;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      System.arraycopy(apdu, 0, pinModifyStructure, offset, apdu.length);
+
+//      log.debug("PIN MODIFY " + SMCCHelper.toString(pinModifyStructure));
+      return pinModifyStructure;
   }
 
-  /**
-   * activates pin (newPIN) if not active
-   * @param pinSpec
-   * @param oldPIN
-   * @param newPIN
-   * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.VerificationFailedException
-   * @throws at.gv.egiz.smcc.NotActivatedException
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
   @Override
-  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN)
-          throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
-    Card icc = getCard();
+  public void reset() throws SignatureCardException {
     try {
-      icc.beginExclusive();
-      CardChannel channel = icc.getBasicChannel();
-
-      if (pinSpec.getContextAID() != null) {
-        ResponseAPDU responseAPDU = transmit(channel,
-                new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, pinSpec.getContextAID()));
-        if (responseAPDU.getSW() != 0x9000) {
-          icc.endExclusive();
-          String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
-                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
-          log.error(msg);
-          throw new SignatureCardException(msg);
-        }
-      }
-
-      byte[] cmd = new byte[16];
-      System.arraycopy(encodePINBlock(oldPIN), 0, cmd, 0, 8);
-      System.arraycopy(encodePINBlock(newPIN), 0, cmd, 8, 8);
-
-      ResponseAPDU responseAPDU = transmit(channel,
-              new CommandAPDU(0x00, 0x24, 0x00, pinSpec.getKID(), cmd), false);
-
-      icc.endExclusive();
-
-      log.debug("change pin returned SW=" + Integer.toHexString(responseAPDU.getSW()));
-
-      // activates pin (newPIN) if not active
-      if (responseAPDU.getSW() == 0x63c0) {
-        log.error(pinSpec.getLocalizedName() + " locked");
-        throw new LockedException();
-      } else if (responseAPDU.getSW1() == 0x63 && responseAPDU.getSW2() >> 4 == 0xc) {
-        int retries = responseAPDU.getSW2() & 0x0f;
-        log.error("wrong " + pinSpec.getLocalizedName() + ", " + retries + " retries");
-        throw new VerificationFailedException(retries);
-      } else if (responseAPDU.getSW() == 0x6983) {
-        log.error(pinSpec.getLocalizedName() + " locked");
-        throw new LockedException();
-      } else if (responseAPDU.getSW() != 0x9000) {
-        String msg = "Failed to change " + pinSpec.getLocalizedName() +
-                ": SW=" + Integer.toHexString(responseAPDU.getSW());
-        log.error(msg);
-        throw new SignatureCardException(msg);
+      super.reset();
+      log.debug("select MF (e-card workaround)");
+      CardChannel channel = getCardChannel();
+      ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00, 0x0C));
+      if (resp.getSW() != 0x9000) {
+        throw new SignatureCardException("Failed to select MF after RESET: SW=" + Integer.toHexString(resp.getSW()) + ".");
       }
     } catch (CardException ex) {
-      log.error("Failed to change " + pinSpec.getLocalizedName() +
-              ": " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
+      log.error("Failed to select MF after RESET: " + ex.getMessage(), ex);
+      throw new SignatureCardException("Failed to select MF after RESET");
     }
   }
 
+  public String toString() {
+    return "e-card";
+  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index d7763be0..293b9c71 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -77,11 +77,11 @@ public class SWCard implements SignatureCard {
 
   private KeyStore certifiedKeyStore;
   
-  private String certifiedKeyStorePassword;
+  private char[] certifiedKeyStorePassword;
   
   private KeyStore secureKeyStore;
   
-  private String secureKeyStorePassword;
+  private char[] secureKeyStorePassword;
   
   private Certificate certifiedCertificate;
   
@@ -195,7 +195,7 @@ public class SWCard implements SignatureCard {
   
   }
   
-  private String loadKeyStorePassword(String passwordFileName) throws SignatureCardException {
+  private char[] loadKeyStorePassword(String passwordFileName) throws SignatureCardException {
 
     String fileName = getFileName(passwordFileName);
     FileInputStream keyStorePasswordFile;
@@ -212,7 +212,7 @@ public class SWCard implements SignatureCard {
       for (int l; (l = reader.read(b)) != -1;) {
         sb.append(b, 0, l);
       }
-      return sb.toString();
+      return sb.toString().toCharArray();
     } catch (IOException e) {
       throw new SignatureCardException("Failed to read file '" + passwordFileName + "'.");
     }
@@ -237,7 +237,7 @@ public class SWCard implements SignatureCard {
     
   }
   
-  private String getPassword(KeyboxName keyboxName) throws SignatureCardException {
+  private char[] getPassword(KeyboxName keyboxName) throws SignatureCardException {
     
     if (keyboxName == KeyboxName.CERITIFIED_KEYPAIR) {
       if (certifiedKeyStorePassword == null) {
@@ -311,7 +311,7 @@ public class SWCard implements SignatureCard {
   public byte[] createSignature(byte[] hash, KeyboxName keyboxName, PINProvider provider) throws SignatureCardException, InterruptedException {
 
     // KeyStore password
-    String password = getPassword(keyboxName);
+    char[] password = getPassword(keyboxName);
 
     if (password == null) {
 
@@ -325,7 +325,7 @@ public class SWCard implements SignatureCard {
       
     }
 
-    KeyStore keyStore = getKeyStore(keyboxName, password.toCharArray());
+    KeyStore keyStore = getKeyStore(keyboxName, password);
 
     PrivateKey privateKey = null;
     
@@ -338,7 +338,7 @@ public class SWCard implements SignatureCard {
           Key key = null;
           while (key == null) {
             try {
-              key = keyStore.getKey(alias, password.toCharArray());
+              key = keyStore.getKey(alias, password);
             } catch (UnrecoverableKeyException e) {
               log.info("Failed to get Key from KeyStore. Wrong password?", e);
             }
@@ -399,15 +399,27 @@ public class SWCard implements SignatureCard {
   }
 
   @Override
-  public int verifyPIN(PINSpec pinSpec, String pin) throws LockedException, NotActivatedException, SignatureCardException {
-    return -1;
+  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+          throws LockedException, NotActivatedException, SignatureCardException {
   }
 
   @Override
-  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN) throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
+  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider) throws SignatureCardException {
+    throw new UnsupportedOperationException("Not supported yet.");
   }
 
   @Override
-  public void activatePIN(PINSpec pinSpec, String pin) throws SignatureCardException {
+  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider) throws CancelledException, SignatureCardException, InterruptedException {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider) throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public boolean ifdSupportsFeature(byte feature) {
+    return false;
   }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index 3c2273b9..2097e6d3 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -36,6 +36,14 @@ import javax.smartcardio.CardTerminal;
 
 public interface SignatureCard {
 
+  /**
+   * IFD FEATURES
+   */
+  static final Byte FEATURE_VERIFY_PIN_DIRECT = new Byte((byte) 0x06);
+  static final Byte FEATURE_MODIFY_PIN_DIRECT = new Byte((byte) 0x07);
+  static final Byte FEATURE_MCT_READER_DIRECT = new Byte((byte) 0x08);
+  static final Byte FEATURE_IFD_PIN_PROPERTIES = new Byte((byte) 0x0a);
+
   public static class KeyboxName {
 
     public static KeyboxName SECURE_SIGNATURE_KEYPAIR = new KeyboxName(
@@ -123,29 +131,29 @@ public interface SignatureCard {
    */
   public List<PINSpec> getPINSpecs();
 
-  /**
-   *
-   * @param pinSpec descriptor which pin to verify
-   * @param pin may be null to test the PIN status
-   * @return the number of remaining retries or -1
-   * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.NotActivatedException
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
-  public int verifyPIN(PINSpec pinSpec, String pin)
-          throws LockedException, NotActivatedException, SignatureCardException;
+  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+          throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException;
 
-  public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN)
-          throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException;
+  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+          throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException;
 
-  public void activatePIN(PINSpec pinSpec, String pin)
-          throws SignatureCardException;
+  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+          throws CancelledException, SignatureCardException, InterruptedException;
+
+  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
+          throws CancelledException, SignatureCardException, InterruptedException;
+
+  /**
+   * TODO
+   * @return
+   */
+  public boolean ifdSupportsFeature(byte feature);
 
   /**
    * Sets the local for evtl. required callbacks (e.g. PINSpec)
    * @param locale must not be null;
    */
   public void setLocale(Locale locale);
-  
-  
+
+
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
index ab66e9a1..5146c275 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
@@ -196,7 +196,7 @@ public class SignatureCardFactory {
             (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00
         },
         "at.gv.egiz.smcc.ACOSCard"));
-    
+
   }
 
   /**
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/TimeoutException.java b/smcc/src/main/java/at/gv/egiz/smcc/TimeoutException.java
new file mode 100644
index 00000000..d14a4c15
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/TimeoutException.java
@@ -0,0 +1,39 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class TimeoutException extends SignatureCardException {
+
+  private static final long serialVersionUID = 1L;
+
+  public TimeoutException() {
+    super();
+  }
+
+  public TimeoutException(String message, Throwable cause) {
+    super(message, cause);
+  }
+
+  public TimeoutException(String message) {
+    super(message);
+  }
+
+  public TimeoutException(Throwable cause) {
+    super(cause);
+  }
+
+}
diff --git a/smcc/src/test/resources/log4j.properties b/smcc/src/test/resources/log4j.properties
index 94662fd2..053eac17 100644
--- a/smcc/src/test/resources/log4j.properties
+++ b/smcc/src/test/resources/log4j.properties
@@ -1,5 +1,5 @@
 # loglever DEBUG, appender STDOUT
-log4j.rootLogger=DEBUG, STDOUT
+log4j.rootLogger=TRACE, STDOUT
 #log4j.logger.at.gv.egiz.slbinding.RedirectEventFilter=DEBUG, STDOUT
 
 # STDOUT appender
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java
index 23b71690..14b36e28 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractBKUWorker.java
@@ -136,7 +136,9 @@ public abstract class AbstractBKUWorker extends AbstractSMCCSTAL implements Acti
         if (oldValue != SMCCHelper.CARD_NOT_SUPPORTED) {
           actionCommandList.clear();
           actionCommandList.add("cancel");
-          gui.showCardNotSupportedDialog(this, "cancel");
+          gui.showMessageDialog(BKUGUIFacade.TITLE_CARD_NOT_SUPPORTED,
+                  BKUGUIFacade.MESSAGE_CARD_NOT_SUPPORTED, null,
+                  BKUGUIFacade.BUTTON_CANCEL, this, "cancel");
           oldValue = SMCCHelper.CARD_NOT_SUPPORTED;
         }
         break;
@@ -144,7 +146,9 @@ public abstract class AbstractBKUWorker extends AbstractSMCCSTAL implements Acti
         if (oldValue != SMCCHelper.NO_CARD) {
           actionCommandList.clear();
           actionCommandList.add("cancel");
-          gui.showInsertCardDialog(this, "cancel");
+          gui.showMessageDialog(BKUGUIFacade.TITLE_INSERTCARD,
+            BKUGUIFacade.MESSAGE_INSERTCARD, null,
+            BKUGUIFacade.BUTTON_CANCEL, this, "cancel");
           oldValue = SMCCHelper.NO_CARD;
         }
         break;
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
new file mode 100644
index 00000000..e32f08d4
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.smccstal;
+
+import at.gv.egiz.smcc.PINProvider;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public abstract class AbstractPINProvider implements PINProvider, ActionListener {
+
+  protected static final Log log = LogFactory.getLog(AbstractPINProvider.class);
+
+  protected boolean retry = false;
+
+  protected String action;
+
+  private boolean actionPerformed;
+
+//  protected void waitForAction() throws InterruptedException {
+//    super.wait();
+//  }
+
+  protected synchronized void waitForAction() throws InterruptedException {
+    try {
+      while (!actionPerformed) {
+        this.wait();
+      }
+    } catch (InterruptedException e) {
+      log.error("interrupt in waitForAction");
+      throw e;
+    }
+    actionPerformed = false;
+  }
+
+  private synchronized void actionPerformed() {
+    actionPerformed = true;
+    notify();//All();
+  }
+
+  @Override
+  public void actionPerformed(ActionEvent e) {
+    log.debug("command " + e.getActionCommand());
+    action = e.getActionCommand();
+    actionPerformed();
+  }
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
index 1cf81e05..71f35181 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractSMCCSTAL.java
@@ -121,6 +121,12 @@ public abstract class AbstractSMCCSTAL implements STAL {
     return new ErrorResponse(6000);
   }
 
+  /**
+   *
+   * @param requestList
+   * @return
+   * @throws RuntimeException with cause InterruptedException if interrupted
+   */
   @Override
   public List<STALResponse> handleRequest(List<? extends STALRequest> requestList) {
     log.debug("Got request list containing " + requestList.size()
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
index 5a54e97f..94444922 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
@@ -33,23 +33,26 @@ import at.gv.egiz.stal.InfoboxReadResponse;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
 
-public class InfoBoxReadRequestHandler extends AbstractRequestHandler implements
-    PINProvider {
+public class InfoBoxReadRequestHandler extends AbstractRequestHandler {
 
   private static Log log = LogFactory.getLog(InfoBoxReadRequestHandler.class);
 
-  private int retryCounter = 0;
+  protected PINProviderFactory pinProviderFactory;
 
   @Override
   public STALResponse handleRequest(STALRequest request) throws InterruptedException {
     if (request instanceof InfoboxReadRequest) {
       InfoboxReadRequest infoBox = (InfoboxReadRequest) request;
+      if (pinProviderFactory == null) {
+        pinProviderFactory = PINProviderFactory.getInstance(card, gui);
+      }
       try {
         if (infoBox.getInfoboxIdentifier().equals("IdentityLink")) {
           newSTALMessage("Message.RequestCaption", "Message.IdentityLink");
           log.debug("Handling identitylink infobox");
-          byte[] resp = card.getInfobox(infoBox.getInfoboxIdentifier(), this,
-              infoBox.getDomainIdentifier());
+          byte[] resp = card.getInfobox(infoBox.getInfoboxIdentifier(),
+                  pinProviderFactory.getCardPINProvider(),
+                  infoBox.getDomainIdentifier());
           if (resp == null) {
             log.info("Got null as result->user cancelled");
             return new ErrorResponse(6001);
@@ -94,8 +97,9 @@ public class InfoBoxReadRequestHandler extends AbstractRequestHandler implements
           newSTALMessage("Message.RequestCaption", "Message.InfoboxReadRequest");
           log.warn("Unknown infobox identifier: "
               + infoBox.getInfoboxIdentifier() + " trying generic request");
-          byte[] resp = card.getInfobox(infoBox.getInfoboxIdentifier(), this,
-              infoBox.getDomainIdentifier());
+          byte[] resp = card.getInfobox(infoBox.getInfoboxIdentifier(),
+                  pinProviderFactory.getCardPINProvider(),
+                  infoBox.getDomainIdentifier());
           if (resp == null) {
             return new ErrorResponse(6001);
           }
@@ -110,13 +114,15 @@ public class InfoBoxReadRequestHandler extends AbstractRequestHandler implements
         log.info("Citizen card not activated.", e);
         gui.showErrorDialog(BKUGUIFacade.ERR_CARD_NOTACTIVATED, null, this, null);
         waitForAction();
-        gui.showWaitDialog(null);
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
         return new ErrorResponse(6001);
       } catch (LockedException e) {
         log.info("Citizen card locked.", e);
         gui.showErrorDialog(BKUGUIFacade.ERR_CARD_LOCKED, null, this, null);
         waitForAction();
-        gui.showWaitDialog(null);
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
         return new ErrorResponse(6001);
       } catch (CancelledException cx) {
         log.debug("User cancelled request", cx);
@@ -135,20 +141,4 @@ public class InfoBoxReadRequestHandler extends AbstractRequestHandler implements
   public boolean requireCard() {
     return true;
   }
-
-  @Override
-  public String providePIN(PINSpec spec, int retries) throws InterruptedException {
-    if (retryCounter++ > 0) {
-      log.info("PIN wrong retrying ...");
-      gui.showCardPINRetryDialog(spec, retries, this, "ok", this, "cancel");
-    } else {
-      gui.showCardPINDialog(spec, this, "ok", this, "cancel");
-    }
-    waitForAction();
-    gui.showWaitDialog(null);
-    if (actionCommand.equals("cancel")) {
-      return null;
-    }
-    return new String(gui.getPin());
-  }
 }
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
new file mode 100644
index 00000000..670b71dc
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.smccstal;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public abstract class PINProviderFactory {
+
+  BKUGUIFacade gui;
+  
+  public static PINProviderFactory getInstance(SignatureCard forCard,
+          BKUGUIFacade gui) {
+    if (forCard.ifdSupportsFeature(SignatureCard.FEATURE_VERIFY_PIN_DIRECT)) {
+      return new PinpadPINProviderFactory(gui);
+    } else {
+      return new SoftwarePINProviderFactory(gui);
+    }
+  }
+
+  public abstract PINProvider getSignaturePINProvider(SecureViewer viewer,
+          SignedInfoType signedInfo);
+  
+  public abstract PINProvider getCardPINProvider();
+
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java
new file mode 100644
index 00000000..55321b72
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java
@@ -0,0 +1,155 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.smccstal;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.stal.HashDataInput;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.util.List;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PinpadPINProviderFactory extends PINProviderFactory {
+
+  protected PinpadPINProviderFactory(BKUGUIFacade gui) {
+    this.gui = gui;
+  }
+
+  @Override
+  public PINProvider getSignaturePINProvider(SecureViewer viewer,
+          SignedInfoType signedInfo) {
+
+    return new SignaturePinProvider(viewer, signedInfo);
+  }
+
+  @Override
+  public PINProvider getCardPINProvider() {
+    return new CardPinProvider();
+  }
+
+  class SignaturePinProvider extends AbstractPINProvider {
+
+//    protected BKUGUIFacade gui;
+    protected SecureViewer viewer;
+    protected SignedInfoType signedInfo;
+    protected List<HashDataInput> hashDataInputs;
+
+    private SignaturePinProvider(SecureViewer viewer,
+            SignedInfoType signedInfo) {
+      this.viewer = viewer;
+      this.signedInfo = signedInfo;
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+
+      showPinpadPINDialog(retries, spec);
+      retry = true;
+      return null;
+
+//      do {
+//        waitForAction();
+//        gui.showWaitDialog(null);
+//
+//        if ("hashData".equals(action)) {
+//          // show pin dialog in background
+//          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+//                  this, "sign",
+//                  this, "cancel",
+//                  this, "hashData");
+//
+//          viewer.displayDataToBeSigned(signedInfo.getReference());
+//
+//        } else if ("sign".equals(action)) {
+//          retry = true;
+//          return gui.getPin();
+//        } else if ("hashDataDone".equals(action)) {
+//          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+//                  this, "sign",
+//                  this, "cancel",
+//                  this, "hashData");
+//        } else if ("cancel".equals(action) ||
+//                "error".equals(action)) {
+//          throw new CancelledException(spec.getLocalizedName() +
+//                  " entry cancelled");
+//        }
+//      } while (true);
+    }
+
+    private void showPinpadPINDialog(int retries, PINSpec pinSpec) {
+      String title, message;
+      Object[] params;
+      if (retry) {
+        title = BKUGUIFacade.TITLE_RETRY;
+        message = BKUGUIFacade.MESSAGE_RETRIES;
+        params = new Object[]{String.valueOf(retries)};
+      } else {
+        title = BKUGUIFacade.TITLE_SIGN;
+        message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
+        String pinSize = String.valueOf(pinSpec.getMinLength());
+        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+        }
+        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
+      }
+      gui.showMessageDialog(title, message, params);
+    }
+  }
+
+  class CardPinProvider extends AbstractPINProvider {
+
+    private CardPinProvider() {
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+
+      showPinpadPINDialog(retries, spec);
+      retry = true;
+      return null;
+
+    }
+
+    private void showPinpadPINDialog(int retries, PINSpec pinSpec) {
+      String title, message;
+      Object[] params;
+      if (retry) {
+        title = BKUGUIFacade.TITLE_RETRY;
+        message = BKUGUIFacade.MESSAGE_RETRIES;
+        params = new Object[]{String.valueOf(retries)};
+      } else {
+        title = BKUGUIFacade.TITLE_CARDPIN;
+        message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
+        String pinSize = String.valueOf(pinSpec.getMinLength());
+        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+        }
+        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
+      }
+      gui.showMessageDialog(title, message, params);
+    }
+  }
+}
+
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java
new file mode 100644
index 00000000..c395679a
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.smccstal;
+
+import at.gv.egiz.stal.signedinfo.ReferenceType;
+import java.security.DigestException;
+import java.util.List;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface SecureViewer {
+
+  /**
+   * Displays the hashdata inputs for all provided dsig:SignedReferences.
+   * Implementations may verify the digest value if necessary.
+   * (LocalSignRequestHandler operates on DataObjectHashDataInput,
+   * other SignRequestHandlers should cache the HashDataInputs obtained by webservice calls,
+   * or simply forward to a HashDataInputServlet.)
+   * @param signedReferences The caller may select a subset of the references in SignedInfo to be displayed.
+   * @throws java.security.DigestException if digest values are verified and do not correspond
+   * (or any other digest computation error occurs)
+   * @throws java.lang.Exception
+   */
+  void displayDataToBeSigned(List<ReferenceType> signedReferences) 
+          throws DigestException, Exception;
+
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
index d041a8cb..ac510f38 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
@@ -17,7 +17,6 @@
 package at.gv.egiz.bku.smccstal;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
-import java.awt.event.ActionEvent;
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.security.MessageDigest;
@@ -35,12 +34,11 @@ import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
 import at.gv.egiz.smcc.PINProvider;
-import at.gv.egiz.smcc.PINSpec;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.SignatureCard.KeyboxName;
+import at.gv.egiz.smcc.TimeoutException;
 import at.gv.egiz.stal.ErrorResponse;
-import at.gv.egiz.stal.HashDataInput;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
 import at.gv.egiz.stal.SignRequest;
@@ -48,13 +46,12 @@ import at.gv.egiz.stal.SignResponse;
 import at.gv.egiz.stal.signedinfo.ObjectFactory;
 import at.gv.egiz.stal.signedinfo.SignedInfoType;
 import at.gv.egiz.stal.util.JCEAlgorithmNames;
-import java.security.DigestException;
-import java.util.List;
 
-public abstract class SignRequestHandler extends AbstractRequestHandler implements HashDataInputDisplay {
+public abstract class SignRequestHandler extends AbstractRequestHandler implements SecureViewer {
 
     private static Log log = LogFactory.getLog(SignRequestHandler.class);
     private static JAXBContext jaxbContext;
+    private PINProviderFactory pinProviderFactory;
     
     static {
         try {
@@ -84,7 +81,14 @@ public abstract class SignRequestHandler extends AbstractRequestHandler implemen
                 MessageDigest md = MessageDigest.getInstance(jceName);
                 md.update(signReq.getSignedInfo());
                 KeyboxName kb = SignatureCard.KeyboxName.getKeyboxName(signReq.getKeyIdentifier());
-                byte[] resp = card.createSignature(md.digest(), kb, new STALPinProvider(si.getValue()));
+
+                if (pinProviderFactory == null) {
+                  pinProviderFactory = PINProviderFactory.getInstance(card, gui);
+                }
+                PINProvider pinProvider = pinProviderFactory.
+                        getSignaturePINProvider(this, si.getValue());
+                
+                byte[] resp = card.createSignature(md.digest(), kb, pinProvider);
                 if (resp == null) {
                     return new ErrorResponse(6001);
                 }
@@ -95,17 +99,28 @@ public abstract class SignRequestHandler extends AbstractRequestHandler implemen
               log.info("Citizen card not activated.", e);
               gui.showErrorDialog(BKUGUIFacade.ERR_CARD_NOTACTIVATED, null, this, null);
               waitForAction();
-              gui.showWaitDialog(null);
+              gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                      BKUGUIFacade.MESSAGE_WAIT);
               return new ErrorResponse(6001);
             } catch (LockedException e) {
               log.info("Citizen card locked.", e);
               gui.showErrorDialog(BKUGUIFacade.ERR_CARD_LOCKED, null, this, null);
               waitForAction();
-              gui.showWaitDialog(null);
+              gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                      BKUGUIFacade.MESSAGE_WAIT);
               return new ErrorResponse(6001);
             } catch (CancelledException cx) {
                 log.debug("User cancelled request");
                 return new ErrorResponse(6001);
+            } catch (TimeoutException ex) {
+              log.error("Timeout during pin entry");
+              gui.showMessageDialog(BKUGUIFacade.TITLE_ENTRY_TIMEOUT,
+                      BKUGUIFacade.ERR_PIN_TIMEOUT, null,
+                      BKUGUIFacade.BUTTON_CANCEL, this, null);
+              waitForAction();
+              gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                      BKUGUIFacade.MESSAGE_WAIT);
+              return new ErrorResponse(6001);
             } catch (SignatureCardException e) {
                 log.error("Error while creating signature: " + e);
                 return new ErrorResponse(4000);
@@ -127,64 +142,64 @@ public abstract class SignRequestHandler extends AbstractRequestHandler implemen
         return true;
     }
 
-  class STALPinProvider implements PINProvider {
-    
-    protected SignedInfoType signedInfo;
-    protected List<HashDataInput> hashDataInputs;
-    private int retryCounter = 0;
-
-    public STALPinProvider(SignedInfoType signedInfo) {
-      this.signedInfo = signedInfo;
-    }
-    
-    private void showSignaturePINDialog(PINSpec spec, int retries) {
-      if (retryCounter > 0) {
-          gui.showSignaturePINRetryDialog(spec, retries, SignRequestHandler.this, "sign", SignRequestHandler.this,
-            "cancel", SignRequestHandler.this, "hashData");
-        } else {
-          gui.showSignaturePINDialog(spec, SignRequestHandler.this, "sign", SignRequestHandler.this, "cancel", SignRequestHandler.this,
-            "hashData");
-        }
-    }
-  
-    @Override
-    public String providePIN(PINSpec spec, int retries) throws InterruptedException {
-    
-      showSignaturePINDialog(spec, retries);
-      
-    do {
-      waitForAction();
-      gui.showWaitDialog(null);
-      if (actionCommand.equals("cancel")) {
-        return null;
-      } else if (actionCommand.equals("hashData")) {
-        
-        showSignaturePINDialog(spec, retries);
-          
-          try {
-            displayHashDataInputs(signedInfo.getReference());
-          } catch (DigestException ex) { 
-            log.error("Bad digest value: " + ex.getMessage());
-            gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH, new Object[] {ex.getMessage()}, SignRequestHandler.this, "error");
-          } catch (Exception ex) {
-            log.error("Could not display hashdata inputs: " + ex.getMessage());
-            gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA, new Object[] {ex.getMessage()}, SignRequestHandler.this, "error");
-          }
-        
-      } else if (actionCommand.equals("sign")) {
-        retryCounter++;
-        return new String(gui.getPin());
-      } else if (actionCommand.equals("hashDataDone")) {
-        showSignaturePINDialog(spec, retries);
-      } else if (actionCommand.equals("error")) {
-        return null;
-      }
-    } while (true);
-  }
-
+//  class SoftwarePinProvider implements PINProvider {
+//
+//    protected SignedInfoType signedInfo;
+//    protected List<HashDataInput> hashDataInputs;
+//    private boolean retry = false;
+//
+//    public SoftwarePinProvider(SignedInfoType signedInfo) {
+//      this.signedInfo = signedInfo;
+//    }
+//
+//    private void showSignaturePINDialog(PINSpec spec, int retries) {
+//      if (retry) {
+//          gui.showSignaturePINRetryDialog(spec, retries, SignRequestHandler.this, "sign", SignRequestHandler.this,
+//            "cancel", SignRequestHandler.this, "hashData");
+//        } else {
+//          gui.showSignaturePINDialog(spec, SignRequestHandler.this, "sign", SignRequestHandler.this, "cancel", SignRequestHandler.this,
+//            "hashData");
+//        }
+//    }
+//
 //    @Override
-//    public void actionPerformed(ActionEvent e) {
-//      throw new UnsupportedOperationException("Not supported yet.");
+//    public char[] providePIN(PINSpec spec, int retries)
+//            throws CancelledException, InterruptedException {
+//      showSignaturePINDialog(spec, retries);
+//
+//      do {
+//        waitForAction();
+//        gui.showWaitDialog(null);
+//        if (actionCommand.equals("hashData")) {
+//
+//          showSignaturePINDialog(spec, retries);
+//
+//            try {
+//              displayHashDataInputs(signedInfo.getReference());
+//
+//            } catch (DigestException ex) {
+//              log.error("Bad digest value: " + ex.getMessage());
+//              gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
+//                      new Object[] {ex.getMessage()},
+//                      SignRequestHandler.this, "error");
+//            } catch (Exception ex) {
+//              log.error("Could not display hashdata inputs: " +
+//                      ex.getMessage());
+//              gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
+//                      new Object[] {ex.getMessage()},
+//                      SignRequestHandler.this, "error");
+//            }
+//        } else if (actionCommand.equals("sign")) {
+//          retry = true;
+//          return gui.getPin();
+//        } else if (actionCommand.equals("hashDataDone")) {
+//          showSignaturePINDialog(spec, retries);
+//        } else if (actionCommand.equals("cancel") ||
+//                   actionCommand.equals("error")) {
+//          throw new CancelledException(spec.getLocalizedName() +
+//                  " entry cancelled");
+//        }
+//      } while (true);
 //    }
-  }
+//  }
 }
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java
new file mode 100644
index 00000000..54a34280
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java
@@ -0,0 +1,140 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.smccstal;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.*;
+import at.gv.egiz.stal.HashDataInput;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.security.DigestException;
+import java.util.List;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class SoftwarePINProviderFactory extends PINProviderFactory {
+
+  protected SoftwarePINProviderFactory(BKUGUIFacade gui) {
+    this.gui = gui;
+  }
+
+  @Override
+  public PINProvider getSignaturePINProvider(SecureViewer viewer,
+          SignedInfoType signedInfo) {
+    return new SignaturePinProvider(viewer, signedInfo);
+  }
+
+  @Override
+  public PINProvider getCardPINProvider() {
+    return new CardPinProvider();
+  }
+
+  class SignaturePinProvider extends AbstractPINProvider {
+
+//    protected BKUGUIFacade gui;
+    protected SecureViewer viewer;
+    protected SignedInfoType signedInfo;
+    protected List<HashDataInput> hashDataInputs;
+
+    private SignaturePinProvider(SecureViewer viewer,
+            SignedInfoType signedInfo) {
+      this.viewer = viewer;
+      this.signedInfo = signedInfo;
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+
+      gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+              this, "sign",
+              this, "cancel",
+              this, "hashData");
+
+      do {
+        waitForAction();
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
+
+        if ("hashData".equals(action)) {
+          // show pin dialog in background
+          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+                  this, "sign",
+                  this, "cancel",
+                  this, "hashData");
+
+          try {
+            viewer.displayDataToBeSigned(signedInfo.getReference());
+          } catch (DigestException ex) {
+            log.error("Bad digest value: " + ex.getMessage());
+            gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
+                    new Object[]{ex.getMessage()},
+                    this, "error");
+          } catch (Exception ex) {
+            log.error("Could not display hashdata inputs: " +
+                    ex.getMessage());
+            gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
+                    new Object[]{ex.getMessage()},
+                    this, "error");
+          }
+        } else if ("sign".equals(action)) {
+          retry = true;
+          return gui.getPin();
+        } else if ("hashDataDone".equals(action)) {
+          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+                  this, "sign",
+                  this, "cancel",
+                  this, "hashData");
+        } else if ("cancel".equals(action) ||
+                "error".equals(action)) {
+          throw new CancelledException(spec.getLocalizedName() +
+                  " entry cancelled");
+        }
+      } while (true);
+    }
+  }
+
+  class CardPinProvider extends AbstractPINProvider {
+
+//    protected BKUGUIFacade gui;
+
+    private CardPinProvider() {
+    }
+
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+            throws CancelledException, InterruptedException {
+
+      gui.showCardPINDialog(spec, (retry) ? retries : -1,
+              this, "ok",
+              this, "cancel");
+
+      waitForAction();
+      
+      gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+              BKUGUIFacade.MESSAGE_WAIT);
+
+      if ("cancel".equals(action)) {
+        throw new CancelledException(spec.getLocalizedName() +
+                  " entry cancelled");
+      }
+      retry = true;
+      return gui.getPin();
+    }
+  }
+}
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index b2a91784..51dfe0da 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -93,16 +93,24 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       }
 
       @Override
-      public int verifyPIN(PINSpec pinSpec, String pin) throws LockedException, NotActivatedException, SignatureCardException {
-        return -1;
+      public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider) {
       }
 
       @Override
-      public void changePIN(PINSpec pinSpec, String oldPIN, String newPIN) throws LockedException, VerificationFailedException, NotActivatedException, SignatureCardException {
+      public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider) {
       }
 
       @Override
-      public void activatePIN(PINSpec pinSpec, String pin) throws SignatureCardException {
+      public void activatePIN(PINSpec pinSpec, PINProvider pinProvider) {
+      }
+
+      @Override
+      public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider) {
+      }
+
+      @Override
+      public boolean ifdSupportsFeature(byte feature) {
+        return false;
       }
      
    };
-- 
cgit v1.2.3


From 616e06910051528674165319a1d6d161dff5859c Mon Sep 17 00:00:00 2001
From: clemenso <clemenso@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Fri, 27 Mar 2009 17:33:11 +0000
Subject: 1.1-RC6 (pinpad, pinmgmt, secureviewer)

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@323 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../gv/egiz/bku/online/applet/AppletBKUWorker.java |   5 +-
 .../egiz/bku/online/applet/AppletSecureViewer.java |  79 +--
 .../at/gv/egiz/bku/online/applet/BKUApplet.java    |  10 +-
 .../java/at/gv/egiz/bku/gui/PINManagementGUI.java  |  26 +-
 .../at/gv/egiz/bku/gui/PINManagementGUIFacade.java |   9 +-
 .../java/at/gv/egiz/bku/gui/PINStatusRenderer.java |   2 -
 .../smccstal/ext/ManagementPINProviderFactory.java |  13 +-
 .../bku/smccstal/ext/PinpadPINProviderFactory.java |  45 +-
 .../gv/egiz/bku/gui/ActivationMessages.properties  |   6 +-
 .../egiz/bku/gui/ActivationMessages_en.properties  |   6 +-
 .../main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java |  40 +-
 .../main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java   | 603 +++++++++++++--------
 .../java/at/gv/egiz/bku/gui/HashDataViewer.java    | 293 ----------
 .../at/gv/egiz/bku/gui/SecureViewerDialog.java     | 371 +++++++++++++
 .../at/gv/egiz/bku/gui/Messages.properties         |   3 +-
 .../at/gv/egiz/bku/gui/Messages_en.properties      |   1 +
 .../src/main/resources/images/ChipperlingLogo.png  | Bin 0 -> 4035 bytes
 .../test/java/at/gv/egiz/bku/gui/BKUGUITest.java   |   5 +-
 .../test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java |   4 +-
 .../at/gv/egiz/bku/local/stal/BKUGuiProxy.java     |   8 +
 .../at/gv/egiz/bku/local/stal/LocalBKUWorker.java  |   3 +-
 .../gv/egiz/bku/local/stal/LocalSecureViewer.java  | 109 ++++
 .../bku/local/stal/LocalSignRequestHandler.java    |  83 +--
 .../gv/egiz/bku/online/conf/defaultConf.properties |   3 +
 BKUOnline/src/main/resources/log4j.properties      |   2 +-
 BKUOnline/src/main/webapp/SLRequestForm.html       |  27 +
 .../at/gv/egiz/bku/binding/ExpiryRemoverTest.java  | 101 ++--
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   | 130 ++---
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     | 220 ++------
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java | 234 +++++---
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |  49 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |  15 +-
 smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java  |  77 +++
 .../java/at/gv/egiz/smcc/ccid/DefaultReader.java   | 264 +++++++++
 .../at/gv/egiz/smcc/ccid/GemplusGemPCPinpad.java   |  65 +++
 .../java/at/gv/egiz/smcc/ccid/ReaderFactory.java   |  35 ++
 .../test/java/at/gv/egiz/smcc/ACOSCardTest.java    | 135 +++++
 .../test/java/at/gv/egiz/smcc/STARCOSCardTest.java | 267 +++++++++
 .../gv/egiz/bku/smccstal/AbstractPINProvider.java  |   2 +-
 .../gv/egiz/bku/smccstal/PINProviderFactory.java   |   3 +-
 .../bku/smccstal/PinpadPINProviderFactory.java     | 131 +++--
 .../java/at/gv/egiz/bku/smccstal/SecureViewer.java |  11 +-
 .../gv/egiz/bku/smccstal/SignRequestHandler.java   |  14 +-
 .../bku/smccstal/SoftwarePINProviderFactory.java   |  25 +-
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |   7 +-
 45 files changed, 2364 insertions(+), 1177 deletions(-)
 delete mode 100644 BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/HashDataViewer.java
 create mode 100644 BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java
 create mode 100644 BKUCommonGUI/src/main/resources/images/ChipperlingLogo.png
 create mode 100644 BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSecureViewer.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ccid/GemplusGemPCPinpad.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ccid/ReaderFactory.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
index 9b9735f6..e8d8976d 100644
--- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
+++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletBKUWorker.java
@@ -18,6 +18,7 @@ package at.gv.egiz.bku.online.applet;
 
 import at.gv.egiz.bku.smccstal.AbstractBKUWorker;
 import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.smccstal.SignRequestHandler;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
 import at.gv.egiz.stal.SignRequest;
@@ -67,8 +68,10 @@ public class AppletBKUWorker extends AbstractBKUWorker implements Runnable {
       STALPortType stalPort = applet.getSTALPort();
       STALTranslator stalTranslator = applet.getSTALTranslator();
 
+      AppletSecureViewer secureViewer =
+              new AppletSecureViewer(gui, stalPort, sessionId);
       addRequestHandler(SignRequest.class,
-              new AppletSecureViewer(stalPort, sessionId));
+              new SignRequestHandler(secureViewer));
 
       GetNextRequestResponseType nextRequestResp = stalPort.connect(sessionId);
 
diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java
index e2551e2d..929cecb1 100644
--- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java
+++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletSecureViewer.java
@@ -16,17 +16,8 @@
  */
 package at.gv.egiz.bku.online.applet;
 
+import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.smccstal.SecureViewer;
-import java.security.DigestException;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import at.gv.egiz.bku.smccstal.SignRequestHandler;
 import at.gv.egiz.stal.HashDataInput;
 import at.gv.egiz.stal.impl.ByteArrayHashDataInput;
 import at.gv.egiz.stal.service.GetHashDataInputFault;
@@ -34,49 +25,73 @@ import at.gv.egiz.stal.service.STALPortType;
 import at.gv.egiz.stal.service.types.GetHashDataInputResponseType;
 import at.gv.egiz.stal.service.types.GetHashDataInputType;
 import at.gv.egiz.stal.signedinfo.ReferenceType;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.awt.event.ActionListener;
+import java.security.DigestException;
+import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 /**
- * A SignRequesthandler that obtains hashdata inputs from a STAL webservice and
- * displays these either within the applet or in a separate frame.
- * The internal viewer displays plaintext data only, other mimetypes can be saved to disk.
- * The standalone (frame) viewer displays all mimetypes.
- * 
- * (This class depends on STALService and therefore is not part of BKUCommonGUI.)
- * 
+ *
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
  */
-public class AppletSecureViewer extends SignRequestHandler {
+public class AppletSecureViewer implements SecureViewer {
 
   private static final Log log = LogFactory.getLog(AppletSecureViewer.class);
+
+  protected BKUGUIFacade gui;
   protected STALPortType stalPort;
   protected String sessId;
+  protected List<HashDataInput> verifiedDataToBeSigned;
 
-  public AppletSecureViewer(STALPortType stalPort, String sessId) {
-    if (stalPort == null || sessId == null) {
+  public AppletSecureViewer(BKUGUIFacade gui, STALPortType stalPort,
+          String sessId) {
+    if (gui == null) {
+      throw new NullPointerException("GUI must not be null");
+    }
+    if (stalPort == null) {
       throw new NullPointerException("STAL port must not be null");
     }
-    this.sessId = sessId;
+    if (sessId == null) {
+      throw new NullPointerException("session id must not be null");
+    }
+    this.gui = gui;
     this.stalPort = stalPort;
+    this.sessId = sessId;
   }
 
   /**
-   * TODO don't throw exceptions
+   * retrieves the data to be signed for
    * @param signedReferences
+   * @param okListener
+   * @param okCommand
+   * @param cancelListener
+   * @param cancelCommand
    * @throws java.security.DigestException
    * @throws java.lang.Exception
    */
   @Override
-  public void displayDataToBeSigned(List<ReferenceType> signedReferences) 
+  public void displayDataToBeSigned(SignedInfoType signedInfo,
+          ActionListener okListener, String okCommand)
           throws DigestException, Exception {
-
-  List<GetHashDataInputResponseType.Reference> hdi = getHashDataInput(signedReferences);
-    List<HashDataInput> verifiedHashDataInputs = verifyHashDataInput(signedReferences, hdi);
-
-    if (verifiedHashDataInputs.size() > 0) {
-      gui.showSecureViewer(verifiedHashDataInputs, this, "hashDataDone");
+    
+    if (verifiedDataToBeSigned == null) {
+      log.info("retrieve data to be signed for dsig:SignedInfo " +
+              signedInfo.getId());
+      List<GetHashDataInputResponseType.Reference> hdi = 
+              getHashDataInput(signedInfo.getReference());
+      verifiedDataToBeSigned = verifyHashDataInput(signedInfo.getReference(),
+              hdi);
+    }
+    if (verifiedDataToBeSigned.size() > 0) {
+      gui.showSecureViewer(verifiedDataToBeSigned, okListener, okCommand);
     } else {
-      throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)");
+      throw new Exception("No data to be signed (apart from any QualifyingProperties or a Manifest)");
     }
   }
 
@@ -110,7 +125,7 @@ public class AppletSecureViewer extends SignRequestHandler {
         }
       }
     }
-    
+
     if (request.getReference().size() < 1) {
       log.error("No signature data (apart from any QualifyingProperties or a Manifest) for session " + sessId);
       throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)");
@@ -187,7 +202,7 @@ public class AppletSecureViewer extends SignRequestHandler {
         verifiedHashDataInputs.add(new ByteArrayHashDataInput(hdi, signedRefId, mimeType, encoding));
       }
     }
-    
+
     return verifiedHashDataInputs;
   }
 
diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/BKUApplet.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/BKUApplet.java
index a4337bbd..0ddb6dc6 100644
--- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/BKUApplet.java
+++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/BKUApplet.java
@@ -34,6 +34,7 @@ import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.gui.BKUGUIImpl;
 import at.gv.egiz.stal.service.STALPortType;
 import at.gv.egiz.stal.service.STALService;
+import java.applet.AppletContext;
 import java.awt.Container;
 import javax.xml.namespace.QName;
 
@@ -207,14 +208,19 @@ public class BKUApplet extends JApplet {
    */
   protected void sendRedirect(String sessionId) {
     try {
+      AppletContext ctx = getAppletContext();
+      if (ctx == null) {
+        log.error("no applet context (applet might already have been destroyed)");
+        return;
+      }
       URL redirectURL = getURLParameter(REDIRECT_URL, sessionId);
       String redirectTarget = getParameter(REDIRECT_TARGET);
       if (redirectTarget == null) {
         log.info("Done. Redirecting to " + redirectURL + " ...");
-        getAppletContext().showDocument(redirectURL);
+        ctx.showDocument(redirectURL);
       } else {
         log.info("Done. Redirecting to " + redirectURL + " (target=" + redirectTarget + ") ...");
-        getAppletContext().showDocument(redirectURL, redirectTarget);
+        ctx.showDocument(redirectURL, redirectTarget);
       }
     } catch (MalformedURLException ex) {
       log.warn("Failed to redirect: " + ex.getMessage(), ex);
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
index 159dd29d..d1ca6c00 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
@@ -118,18 +118,18 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 pinStatusTable.setDefaultRenderer(PINSpec.class, new PINSpecRenderer());
                 pinStatusTable.setDefaultRenderer(STATUS.class, new PINStatusRenderer(cardmgmtMessages));
                 pinStatusTable.setTableHeader(null);
-
-                pinStatusTable.addMouseMotionListener(new MouseMotionAdapter() {
-
-                  @Override
-                  public void mouseMoved(MouseEvent e) {
-                    if (pinStatusTable.columnAtPoint(e.getPoint()) == 0) {
-                      pinStatusTable.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
-                    } else {
-                      pinStatusTable.setCursor(Cursor.getDefaultCursor());
-                    }
-                  }
-                });
+                pinStatusTable.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+//                pinStatusTable.addMouseMotionListener(new MouseMotionAdapter() {
+//
+//                  @Override
+//                  public void mouseMoved(MouseEvent e) {
+//                    if (pinStatusTable.columnAtPoint(e.getPoint()) == 0) {
+//                      pinStatusTable.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+//                    } else {
+//                      pinStatusTable.setCursor(Cursor.getDefaultCursor());
+//                    }
+//                  }
+//                });
 
                 final JButton activateButton = new JButton();
                 activateButton.setFont(activateButton.getFont().deriveFont(activateButton.getFont().getStyle() & ~java.awt.Font.BOLD));
@@ -392,7 +392,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 if (pinpad) {
                   JLabel pinpadLabel = new JLabel();
                   pinpadLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~Font.BOLD));
-                  String pinpadPattern = getMessage(MESSAGE_PINPAD);
+                  String pinpadPattern = getMessage(MESSAGE_VERIFYPIN_PINPAD);
                   pinpadLabel.setText(MessageFormat.format(pinpadPattern,
                           new Object[] { pinSpec.getLocalizedName(), pinSize }));
                   
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
index 45313f42..f0cc0a27 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
@@ -40,13 +40,16 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String MESSAGE_ACTIVATE_SUCCESS = "activate.success";
   public static final String MESSAGE_CHANGE_SUCCESS = "change.success";
   public static final String MESSAGE_PINMGMT = "pin.mgmt";
-  public static final String MESSAGE_PINPAD = "pinpad";
-  public static final String MESSAGE_CHANGEPIN_PINPAD = "pinpad.change";
+//  public static final String MESSAGE_PINPAD = "pinpad";
   public static final String MESSAGE_ACTIVATE_PIN = "activate.pin";
   public static final String MESSAGE_CHANGE_PIN = "change.pin";
   public static final String MESSAGE_VERIFY_PIN = "verify.pin";
   public static final String MESSAGE_UNBLOCK_PIN = "unblock.pin";
-  
+  public static final String MESSAGE_ACTIVATEPIN_PINPAD = "activate.pinpad";
+  public static final String MESSAGE_CHANGEPIN_PINPAD = "change.pinpad";
+  public static final String MESSAGE_VERIFYPIN_PINPAD = "verify.pinpad";
+  public static final String MESSAGE_UNBLOCKPIN_PINPAD = "unblock.pinpad";
+
   public static final String LABEL_OLD_PIN = "label.old.pin";
   public static final String LABEL_NEW_PIN = "label.new.pin";
   public static final String LABEL_REPEAT_PIN = "label.repeat.pin";
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
index 4cb84b77..83ff74f2 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
@@ -22,8 +22,6 @@ import java.awt.Color;
 import java.awt.Font;
 import java.util.ResourceBundle;
 import javax.swing.table.DefaultTableCellRenderer;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 
 /**
  *
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java
index b0dd8766..d635b8df 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/ManagementPINProviderFactory.java
@@ -19,6 +19,7 @@ package at.gv.egiz.bku.smccstal.ext;
 
 import at.gv.egiz.smcc.ChangePINProvider;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.smcc.ccid.CCID;
 import at.gv.egiz.smcc.PINProvider;
 import at.gv.egiz.smcc.SignatureCard;
 
@@ -33,13 +34,13 @@ public abstract class ManagementPINProviderFactory {
   
   public static ManagementPINProviderFactory getInstance(SignatureCard forCard,
           PINManagementGUIFacade gui) {
-//    if (forCard.ifdSupportsFeature(SignatureCard.FEATURE_VERIFY_PIN_DIRECT)) {
-////      forCard.ifdSupportsFeature(SignatureCard.FEATURE_MODIFY_PIN_DIRECT)
-//      return new PinpadPINProviderFactory(gui);
-//
-//    } else {
+    if (forCard.getReader().hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
+//      forCard.ifdSupportsFeature(SignatureCard.FEATURE_MODIFY_PIN_DIRECT)
+      return new PinpadPINProviderFactory(gui);
+
+    } else {
       return new SoftwarePINProviderFactory(gui);
-//    }
+    }
   }
 
   public abstract PINProvider getVerifyPINProvider();
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java
index 4176e0a9..a9ad5ef8 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PinpadPINProviderFactory.java
@@ -73,23 +73,6 @@ public class PinpadPINProviderFactory extends ManagementPINProviderFactory {
       showPinpadPINDialog(retries, spec);
       retry = true;
       return null;
-
-//      gui.showPINDialog(type, spec, (retry) ? retries : -1,
-//              this, "exec",
-//              this, "back");
-//
-//      waitForAction();
-//
-//      if ("exec".equals(action)) {
-//        gui.showWaitDialog(null);
-//        retry = true;
-//        return gui.getPin();
-//      } else if ("back".equals(action)) {
-//        throw new CancelledException();
-//      } else {
-//        log.error("unsupported command " + action);
-//        throw new CancelledException();
-//      }
     }
 
     /**
@@ -111,14 +94,38 @@ public class PinpadPINProviderFactory extends ManagementPINProviderFactory {
         title = BKUGUIFacade.TITLE_RETRY;
         message = BKUGUIFacade.MESSAGE_RETRIES;
         params = new Object[]{String.valueOf(retries)};
-      } else {
-        title = BKUGUIFacade.TITLE_SIGN;
+      } else if (type == DIALOG.VERIFY) {
+        title = PINManagementGUIFacade.TITLE_VERIFY_PIN;
         message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
         String pinSize = String.valueOf(pinSpec.getMinLength());
         if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
           pinSize += "-" + pinSpec.getMaxLength();
         }
         params = new Object[]{pinSpec.getLocalizedName(), pinSize};
+      } else if (type == DIALOG.ACTIVATE) {
+        title = PINManagementGUIFacade.TITLE_ACTIVATE_PIN;
+        message = PINManagementGUIFacade.MESSAGE_ACTIVATEPIN_PINPAD;
+        String pinSize = String.valueOf(pinSpec.getMinLength());
+        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+        }
+        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
+      } else if (type == DIALOG.CHANGE) {
+        title = PINManagementGUIFacade.TITLE_CHANGE_PIN;
+        message = PINManagementGUIFacade.MESSAGE_CHANGEPIN_PINPAD;
+        String pinSize = String.valueOf(pinSpec.getMinLength());
+        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+        }
+        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
+      } else { //if (type == DIALOG.UNBLOCK) {
+        title = PINManagementGUIFacade.TITLE_UNBLOCK_PIN;
+        message = PINManagementGUIFacade.MESSAGE_UNBLOCKPIN_PINPAD;
+        String pinSize = String.valueOf(pinSpec.getMinLength());
+        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+          pinSize += "-" + pinSpec.getMaxLength();
+        }
+        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
       }
       gui.showMessageDialog(title, message, params);
     }
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
index 4ceacb21..c6d219d4 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
@@ -24,12 +24,14 @@ title.change.success=<html>Erfolg</html>
 
 # removed message.* prefix to reuse keys as help keys
 pin.mgmt=<html>Die Karte verf\u00FCgt \u00FCber {0} PINs</html>
-pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben und best\u00E4tigen.</html>
-pinpad.change=<html>{0} ({1} stellig) am Kartenleser eingeben und best\u00E4tigen.</html>
 activate.pin=<html>{0} eingeben und best\u00E4tigen</html>
 change.pin=<html>{0} eingeben und best\u00E4tigen</html>
 unblock.pin=<html>PUK zu {0} eingeben</html>
 verify.pin=<html>{0} eingeben (TODO: Warning not activated)</html>
+verify.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben (und best\u00E4tigen).</html>
+activate.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben und wiederholen (jeweils best\u00E4tigen).</html>
+change.pinpad=<html>Alte {0} ({1} stellig) am Kartenleser eingeben, danach neue {0} eingeben und wiederholen (jeweils best\u00E4tigen). </html>
+unblock.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben (und best\u00E4tigen).</html>
 activate.success=<html>{0} wurde erfolgreich aktiviert.</html>
 change.success=<html>{0} wurde erfolgreich ge\u00E4ndert.</html>
 
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
index 9178d65c..b4bededf 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
@@ -23,11 +23,13 @@ title.change.success=<html>Success</html>
 
 # removed message.* prefix to reuse keys as help keys
 pin.mgmt=<html>The smartcard has {0} PINs</html>
-pinpad=<html>Enter {0} ({1} digits) on pinpad and confirm.</html>
-pinpad.change=<html>Enter {0} ({1} digits) on pinpad and confirm.</html>
 activate.pin=<html>Enter and confirm {0}</html>
 change.pin=<html>Enter and confirm {0}</html>
 unblock.pin=<html>Enter PUK for {0}</html>
+verify.pinpad=<html>Enter {0} ({1} digits) on cardreader (and confirm).</html>
+activate.pinpad=<html>Enter {0} ({1} digits) on cardreader and repeat (confirm in each case).</html>
+change.pinpad=<html>Enter old {0} ({1} digits) on cardreader, then enter new {0} and repeat (confirm in each case).</html>
+unblock.pinpad=<html>Enter {0} ({1} digits) on cardreader (and confirm).</html>
 activate.success=<html>{0} successfully activated</html>
 change.success=<html>{0} successfully changed</html>
 
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
index 1043b6a1..4b079428 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
@@ -43,6 +43,7 @@ public interface BKUGUIFacade {
   
   public static final String MESSAGES_BUNDLE = "at/gv/egiz/bku/gui/Messages";
   public static final String DEFAULT_BACKGROUND = "/images/BackgroundChipperling.png";
+  public static final String DEFAULT_ICON = "/images/ChipperlingLogo.png";
   public static final String HELP_IMG = "/images/help.png";
   public static final String HASHDATA_FONT = "Monospaced";
   public static final Color ERROR_COLOR = Color.RED;
@@ -58,6 +59,7 @@ public interface BKUGUIFacade {
   public static final String TITLE_WAIT = "title.wait";
   public static final String TITLE_HASHDATA = "title.hashdata";
   public static final String WINDOWTITLE_SAVE = "windowtitle.save";
+  public static final String WINDOWTITLE_ERROR = "windowtitle.error";
   public static final String WINDOWTITLE_SAVEDIR = "windowtitle.savedir";
   public static final String WINDOWTITLE_OVERWRITE = "windowtitle.overwrite";
   public static final String WINDOWTITLE_VIEWER = "windowtitle.viewer";
@@ -102,42 +104,36 @@ public interface BKUGUIFacade {
 
   public enum Style { tiny, simple, advanced };
     
-//  public void init(Container contentPane, Locale locale, Style guiStyle, URL background, ActionListener helpListener);
-
   /**
    * BKUWorker needs to init signature card with locale
    * @return
    */
   public Locale getLocale();
 
-//  public void showWelcomeDialog();
-
-  /**
-   * 
-   * @param waitMessage if null, a simple 'please wait' text is displayed
-   */
-//  public void showWaitDialog(String waitMessage);
-
-//  public void showInsertCardDialog(ActionListener cancelListener, String actionCommand);
-
-//  public void showCardNotSupportedDialog(ActionListener cancelListener, String actionCommand);
-
   public void showCardPINDialog(PINSpec pinSpec, int numRetries,
           ActionListener okListener, String okCommand,
           ActionListener cancelListener, String cancelCommand);
 
-//  public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand);
-
-  public void showSignaturePINDialog(PINSpec pinSpec, int numRetries, ActionListener signListener, String signCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand);
-
-//  public void showSignaturePINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand);
+  public void showSignaturePINDialog(PINSpec pinSpec, int numRetries,
+          ActionListener signListener, String signCommand,
+          ActionListener cancelListener, String cancelCommand,
+          ActionListener viewerListener, String viewerCommand);
 
-//  public void showPinpadSignaturePINDialog(PINSpec pinSpec, int retries);
+  public void showPinpadSignaturePINDialog(PINSpec pinSpec, int numRetries, 
+          ActionListener viewerListener, String viewerCommand);
 
   public char[] getPin();
 
-  public void showSecureViewer(List<HashDataInput> signedReferences,
-          ActionListener okListener, String okCommand);
+  /**
+   *
+   * @param dataToBeSigned
+   * @param backListener if list of references hides pin dialog, backListener
+   * receives an action when user hits 'back' button (i.e. whenever the pin-dialog
+   * needs to be re-paint)
+   * @param backCommand
+   */
+  public void showSecureViewer(List<HashDataInput> dataToBeSigned,
+          ActionListener backListener, String backCommand);
 
   public void showErrorDialog(String errorMsgKey, Object[] errorMsgParams,
           ActionListener okListener, String okCommand);
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
index 928be249..a7eebbfd 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
@@ -71,6 +71,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
     }
 
     protected HelpMouseListener helpListener;
+    protected SecureViewerDialog secureViewer;
     
     protected Container contentPane;
     protected ResourceBundle messages;
@@ -145,13 +146,16 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 @Override
                 public void run() {
                   
-                  log.debug("initializing gui");
+                  log.debug("initializing gui [" + Thread.currentThread().getName() + "]");
 
                   if (renderIconPanel) {
                     initIconPanel(background);
                     initContentPanel(null);
                   } else {
-                    initContentPanel(background);
+                    initContentPanel((background == null) ?
+                      getClass().getResource(DEFAULT_BACKGROUND) :
+                      background
+                    );
                   }
                   
                   GroupLayout layout = new GroupLayout(contentPane);
@@ -159,15 +163,27 @@ public class BKUGUIImpl implements BKUGUIFacade {
                   
                   if (renderIconPanel) {
                     layout.setHorizontalGroup(layout.createSequentialGroup()
-                        .addComponent(iconPanel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-                        .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED)
-                        .addComponent(contentPanel, GroupLayout.DEFAULT_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE));
-                    layout.setVerticalGroup(layout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                      .addComponent(iconPanel, GroupLayout.Alignment.TRAILING, GroupLayout.DEFAULT_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                      .addComponent(contentPanel, GroupLayout.DEFAULT_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE));
+                            .addContainerGap()
+                            .addComponent(iconPanel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                            .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED)
+                            .addComponent(contentPanel, GroupLayout.DEFAULT_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                            .addContainerGap());
+                    layout.setVerticalGroup(layout.createSequentialGroup()
+                            .addContainerGap()
+                            .addGroup(layout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                              .addComponent(iconPanel, GroupLayout.Alignment.TRAILING, GroupLayout.DEFAULT_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+                              .addComponent(contentPanel, GroupLayout.DEFAULT_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
+                            .addContainerGap());
                   } else {
-                    layout.setHorizontalGroup(layout.createSequentialGroup().addComponent(contentPanel));
-                    layout.setVerticalGroup(layout.createSequentialGroup().addComponent(contentPanel));
+                    layout.setHorizontalGroup(layout.createSequentialGroup()
+                            // left border
+                            .addContainerGap()
+                            .addComponent(contentPanel)
+                            .addContainerGap());
+                    layout.setVerticalGroup(layout.createSequentialGroup()
+                            .addContainerGap()
+                            .addComponent(contentPanel)
+                            .addContainerGap());
                   }
                 }
             });
@@ -178,11 +194,12 @@ public class BKUGUIImpl implements BKUGUIFacade {
     
     protected void initIconPanel(URL background) {
       if (background == null) {
-        background = getClass().getResource(DEFAULT_BACKGROUND);
+        background = getClass().getResource(DEFAULT_ICON);
       }
       if ("file".equals(background.getProtocol())) {
-        log.warn("file:// background images not permitted: " + background);
-        background = getClass().getResource(DEFAULT_BACKGROUND);
+        log.warn("file:// background images not permitted: " + background +
+                ", loading default background");
+        background = getClass().getResource(DEFAULT_ICON);
       }
       log.debug("loading icon panel background " + background);
       
@@ -194,26 +211,24 @@ public class BKUGUIImpl implements BKUGUIFacade {
       iconPanel.setLayout(iconPanelLayout);
       iconPanelLayout.setHorizontalGroup(
         iconPanelLayout.createSequentialGroup()
-          .addContainerGap()
           .addComponent(iconLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
-          // no gap here (contentPanel has containerGap)
       iconPanelLayout.setVerticalGroup(
         iconPanelLayout.createSequentialGroup()
-          .addContainerGap()
-          .addComponent(iconLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-          .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE));
+          .addComponent(iconLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE));
     }
 
     protected void initContentPanel(URL background) { 
 
+//      if (background == null) {
+//        background = getClass().getResource(DEFAULT_BACKGROUND);
+//      }
       if (background == null) {
-        background = getClass().getResource(DEFAULT_BACKGROUND);
-      }
-      if (background == null) {
+        log.debug("no background image set");
           contentPanel = new JPanel();
       } else {
           if ("file".equals(background.getProtocol())) {
-            log.warn("file:// background images not permitted: " + background);
+            log.warn("file:// background images not permitted: " + background +
+                    ", loading default background");
             background = getClass().getResource(DEFAULT_BACKGROUND);
           }
           log.debug("loading background " + background);
@@ -257,34 +272,29 @@ public class BKUGUIImpl implements BKUGUIFacade {
       GroupLayout contentPanelLayout = new GroupLayout(contentPanel);
       contentPanel.setLayout(contentPanelLayout);
 
-      GroupLayout.ParallelGroup horizontalContentInner = contentPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
+      // align header, main and button to the right
+      GroupLayout.ParallelGroup horizontalContent =
+              contentPanelLayout.createParallelGroup(GroupLayout.Alignment.TRAILING); //LEADING);
+      GroupLayout.SequentialGroup verticalContent =
+              contentPanelLayout.createSequentialGroup();
+
       if (renderHeaderPanel) {
-        horizontalContentInner
+        horizontalContent
                 .addComponent(headerPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE);
+        verticalContent
+                .addComponent(headerPanel, 0, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
+
       }
-      horizontalContentInner
+      horizontalContent
               .addComponent(mainPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-              .addComponent(buttonPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE);
-      GroupLayout.SequentialGroup horizontalContentOuter = contentPanelLayout.createSequentialGroup();
-      if (!renderIconPanel) {
-        horizontalContentOuter
-                .addContainerGap();
-      }
-      horizontalContentOuter
-              .addGroup(horizontalContentInner)
-              .addContainerGap();
-      contentPanelLayout.setHorizontalGroup(horizontalContentOuter);
-      
-      GroupLayout.SequentialGroup verticalContent = contentPanelLayout.createSequentialGroup();
-      verticalContent.addContainerGap();
-      if (renderHeaderPanel) {
-        verticalContent.addComponent(headerPanel, 0, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED);
-      }
-      verticalContent.addComponent(mainPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE) 
-        .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED)
-        .addComponent(buttonPanel, 0, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-        .addContainerGap();
+              .addComponent(buttonPanel, 0, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE); //Short.MAX_VALUE);
+      verticalContent
+              .addComponent(mainPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
+              .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED)
+              .addComponent(buttonPanel, 0, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE);
+
+      contentPanelLayout.setHorizontalGroup(horizontalContent); //Outer);
       contentPanelLayout.setVerticalGroup(verticalContent);
     }
 
@@ -521,7 +531,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
             @Override
             public void run() {
 
-              log.debug("show card-pin dialog");
+              log.debug("show card-pin dialog [" + Thread.currentThread().getName() + "]");
       
                 mainPanel.removeAll();
                 buttonPanel.removeAll();
@@ -653,7 +663,6 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 buttonPanel.setLayout(buttonPanelLayout);
 
                 GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
-                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                         .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
                 GroupLayout.Group buttonVertical;
                 
@@ -700,6 +709,128 @@ public class BKUGUIImpl implements BKUGUIFacade {
 //        showSignaturePINDialog(pinSpec, -1, signListener, signCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
 //    }
 
+    @Override
+    public void showPinpadSignaturePINDialog(final PINSpec pinSpec, final int numRetries,
+//            final ActionListener cancelListener, final String cancelCommand,
+            final ActionListener hashdataListener, final String hashdataCommand) {
+
+        log.debug("scheduling pinpad signature-pin dialog");
+
+        SwingUtilities.invokeLater(new Runnable() {
+
+            @Override
+            public void run() {
+
+              log.debug("show pinpad signature-pin dialog [" + Thread.currentThread().getName() + "]");
+
+                mainPanel.removeAll();
+                buttonPanel.removeAll();
+
+                if (renderHeaderPanel) {
+                  if (numRetries < 0) {
+                      titleLabel.setText(getMessage(TITLE_SIGN));
+                  } else {
+                      titleLabel.setText(getMessage(TITLE_RETRY));
+                  }
+                }
+
+                JLabel infoLabel = new JLabel();
+                if (numRetries < 0) {
+                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                  if (shortText) {
+                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
+                  } else {
+                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
+                  }
+                  infoLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+                  infoLabel.setForeground(HYPERLINK_COLOR);
+                  infoLabel.addMouseListener(new MouseAdapter() {
+
+                      @Override
+                      public void mouseClicked(MouseEvent me) {
+                          ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
+                          hashdataListener.actionPerformed(e);
+                      }
+                  });
+                  helpListener.setHelpTopic(HELP_SIGNPIN);
+                } else {
+                  String retryPattern;
+                  if (numRetries < 2) {
+                    retryPattern = getMessage(MESSAGE_LAST_RETRY);
+                  } else {
+                    retryPattern = getMessage(MESSAGE_RETRIES);
+                  }
+                  infoLabel.setText(MessageFormat.format(retryPattern, new Object[]{String.valueOf(numRetries)}));
+                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() | java.awt.Font.BOLD));
+                  infoLabel.setForeground(ERROR_COLOR);
+                  helpListener.setHelpTopic(HELP_RETRY);
+                }
+
+                String pinSize = String.valueOf(pinSpec.getMinLength());
+                if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
+                    pinSize += "-" + pinSpec.getMaxLength();
+                }
+
+                String msgPattern = getMessage(MESSAGE_ENTERPIN_PINPAD);
+                String msg = MessageFormat.format(msgPattern, new Object[] {
+                  pinSpec.getLocalizedName(), pinSize });
+
+                JLabel msgLabel = new JLabel();
+                msgLabel.setFont(msgLabel.getFont().deriveFont(msgLabel.getFont().getStyle() & ~Font.BOLD));
+                msgLabel.setText(msg);
+
+                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+                mainPanel.setLayout(mainPanelLayout);
+
+                GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
+                        .addComponent(infoLabel);
+                GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                        .addComponent(infoLabel);
+
+                if (!renderHeaderPanel) {
+                  infoHorizontal
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                          .addComponent(helpLabel);
+                  infoVertical
+                          .addComponent(helpLabel);
+                }
+
+                mainPanelLayout.setHorizontalGroup(
+                  mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                    .addGroup(infoHorizontal)
+                    .addComponent(msgLabel));
+
+                mainPanelLayout.setVerticalGroup(
+                  mainPanelLayout.createSequentialGroup()
+                    .addGroup(infoVertical)
+                    .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                    .addComponent(msgLabel));
+
+                //no cancel button (cancel via pinpad)
+//                if (renderCancelButton) {
+//                    JButton cancelButton = new JButton();
+//                    cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+//                    cancelButton.setText(getMessage(BUTTON_CANCEL));
+//                    cancelButton.setActionCommand(cancelCommand);
+//                    cancelButton.addActionListener(cancelListener);
+//
+//                    GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+//                    buttonPanel.setLayout(buttonPanelLayout);
+//
+//                    GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
+//                            .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
+//                    GroupLayout.SequentialGroup buttonVertical = buttonPanelLayout.createSequentialGroup()
+//                            .addComponent(cancelButton);
+//
+//                    buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
+//                    buttonPanelLayout.setVerticalGroup(buttonVertical);
+//                }
+
+                contentPanel.validate();
+            }
+        });
+    }
+
     @Override
     public void showSignaturePINDialog(final PINSpec pinSpec, final int numRetries,
             final ActionListener signListener, final String signCommand,
@@ -717,7 +848,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
             @Override
             public void run() {
               
-              log.debug("show signature-pin dialog");
+              log.debug("show signature-pin dialog [" + Thread.currentThread().getName() + "]");
       
                 mainPanel.removeAll();
                 buttonPanel.removeAll();
@@ -730,6 +861,38 @@ public class BKUGUIImpl implements BKUGUIFacade {
                   }
                 }
 
+                JLabel infoLabel = new JLabel();
+                if (numRetries < 0) {
+                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+                  if (shortText) {
+                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
+                  } else {
+                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
+                  }
+                  infoLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+                  infoLabel.setForeground(HYPERLINK_COLOR);
+                  infoLabel.addMouseListener(new MouseAdapter() {
+
+                      @Override
+                      public void mouseClicked(MouseEvent me) {
+                          ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
+                          hashdataListener.actionPerformed(e);
+                      }
+                  });
+                  helpListener.setHelpTopic(HELP_SIGNPIN);
+                } else {
+                  String retryPattern;
+                  if (numRetries < 2) {
+                    retryPattern = getMessage(MESSAGE_LAST_RETRY);
+                  } else {
+                    retryPattern = getMessage(MESSAGE_RETRIES);
+                  }
+                  infoLabel.setText(MessageFormat.format(retryPattern, new Object[]{String.valueOf(numRetries)}));
+                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() | java.awt.Font.BOLD));
+                  infoLabel.setForeground(ERROR_COLOR);
+                  helpListener.setHelpTopic(HELP_RETRY);
+                }
+
                 JButton signButton = new JButton();
                 signButton.setFont(signButton.getFont().deriveFont(signButton.getFont().getStyle() & ~java.awt.Font.BOLD));
                 signButton.setText(getMessage(BUTTON_SIGN));
@@ -765,46 +928,14 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 }
                 pinsizeLabel.setText(MessageFormat.format(pinsizePattern, new Object[]{pinSize}));
 
-                JLabel infoLabel = new JLabel();
-                if (numRetries < 0) {
-                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                  if (shortText) {
-                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
-                  } else {
-                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
-                  }
-                  infoLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
-                  infoLabel.setForeground(HYPERLINK_COLOR);
-                  infoLabel.addMouseListener(new MouseAdapter() {
-
-                      @Override
-                      public void mouseClicked(MouseEvent me) {
-                          ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
-                          hashdataListener.actionPerformed(e);
-                      }
-                  });
-                  helpListener.setHelpTopic(HELP_SIGNPIN);
-                } else {
-                  String retryPattern;
-                  if (numRetries < 2) {
-                    retryPattern = getMessage(MESSAGE_LAST_RETRY);
-                  } else {
-                    retryPattern = getMessage(MESSAGE_RETRIES);
-                  }
-                  infoLabel.setText(MessageFormat.format(retryPattern, new Object[]{String.valueOf(numRetries)}));
-                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() | java.awt.Font.BOLD));
-                  infoLabel.setForeground(ERROR_COLOR);
-                  helpListener.setHelpTopic(HELP_RETRY);
-                }
-
                 GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
                 mainPanel.setLayout(mainPanelLayout);
-                
+
                 GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
                         .addComponent(infoLabel);
                 GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
                         .addComponent(infoLabel);
-                       
+
                 if (!renderHeaderPanel) {
                   infoHorizontal
                           .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
@@ -814,8 +945,8 @@ public class BKUGUIImpl implements BKUGUIFacade {
                 }
 
                 // align pinfield and pinsize to the right
-                GroupLayout.ParallelGroup pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.TRAILING);
-                GroupLayout.Group pinVertical;
+                GroupLayout.Group pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.TRAILING);
+                GroupLayout.SequentialGroup pinVertical = mainPanelLayout.createSequentialGroup();
 
                 if (pinLabelPos == PinLabelPosition.ABOVE) {
                   pinHorizontal
@@ -823,20 +954,25 @@ public class BKUGUIImpl implements BKUGUIFacade {
                             .addComponent(signPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
                             .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
                           .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE);
-                  pinVertical = mainPanelLayout.createSequentialGroup()
+                  pinVertical
                           .addComponent(signPinLabel)
                           .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE);
-                } else {
+                          .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(pinsizeLabel);
+                } else { // PinLabelPosition.LEFT
                   pinHorizontal
                           .addGroup(mainPanelLayout.createSequentialGroup()
                             .addComponent(signPinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
                             .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
                             .addComponent(pinField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
                           .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE);
-                  pinVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
-                          .addComponent(signPinLabel)
-                          .addComponent(pinField);
+                  pinVertical
+                          .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                            .addComponent(signPinLabel)
+                            .addComponent(pinField))
+                          .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                          .addComponent(pinsizeLabel);
                 }
 
                 mainPanelLayout.setHorizontalGroup(
@@ -848,18 +984,14 @@ public class BKUGUIImpl implements BKUGUIFacade {
                   mainPanelLayout.createSequentialGroup()
                     .addGroup(infoVertical)
                     .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                    .addGroup(pinVertical)
-                    .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                    .addComponent(pinsizeLabel));
+                    .addGroup(pinVertical));
 
                 GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
                 buttonPanel.setLayout(buttonPanelLayout);
 
-                GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
-                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-                        .addComponent(signButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
+                GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup();
                 GroupLayout.Group buttonVertical;
-                
+
                 if (renderCancelButton) {
                   JButton cancelButton = new JButton();
                   cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
@@ -868,17 +1000,19 @@ public class BKUGUIImpl implements BKUGUIFacade {
                   cancelButton.addActionListener(cancelListener);
 
                   buttonHorizontal
+                          .addComponent(signButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
                           .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
                           .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
-                  
                   buttonVertical = buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
                           .addComponent(signButton)
-                          .addComponent(cancelButton); 
+                          .addComponent(cancelButton);
                 } else {
+                  buttonHorizontal
+                          .addComponent(signButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
                   buttonVertical = buttonPanelLayout.createSequentialGroup()
                           .addComponent(signButton);
                 }
-                
+
                 buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
                 buttonPanelLayout.setVerticalGroup(buttonVertical);
 
@@ -951,7 +1085,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
           @Override
             public void run() {
 
-                log.debug("show message dialog");
+                log.debug("show message dialog [" + Thread.currentThread().getName() + "]");
 
                 mainPanel.removeAll();
                 buttonPanel.removeAll();
@@ -1011,7 +1145,6 @@ public class BKUGUIImpl implements BKUGUIFacade {
 
                   buttonPanelLayout.setHorizontalGroup(
                     buttonPanelLayout.createSequentialGroup()
-                          .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                           .addComponent(okButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
                   buttonPanelLayout.setVerticalGroup(
                     buttonPanelLayout.createSequentialGroup()
@@ -1084,68 +1217,69 @@ public class BKUGUIImpl implements BKUGUIFacade {
         }
         return null;
     }
+
+
+    ////////////////////////////////////////////////////////////////////////////
+    // SECURE VIEWER
+    ////////////////////////////////////////////////////////////////////////////
+
     
     /**
-     * TODO handle multiple references in HashDataViewer
      * @param signedReferences
-     * @param okListener
+     * @param backListener gets notified if pin-dialog has to be redrawn
+     * (signedRefencesList returns via BACK button)
      * @param okCommand
      */
     @Override
-    public void showSecureViewer(final List<HashDataInput> signedReferences,
-            final ActionListener okListener, 
-            final String okCommand) {
-      
-      if (signedReferences == null) {
-        showErrorDialog(getMessage(ERR_NO_HASHDATA), new Object[] {"No SignedReferences provided"}, okListener, okCommand);
-        return;
-      }
+    public void showSecureViewer(final List<HashDataInput> dataToBeSigned,
+            final ActionListener backListener, final String backCommand) {
       
-      if (signedReferences.size() == 1) {
+      if (dataToBeSigned == null) {
+        showErrorDialog(getMessage(ERR_NO_HASHDATA),
+                new Object[] {"no signature data provided"},
+                backListener, backCommand);
+      } else if (dataToBeSigned.size() == 1) {
         try {
-          log.debug("scheduling hashdata viewer");
+          log.debug("scheduling secure viewer");
 
-          SwingUtilities.invokeAndWait(new Runnable() {
+          SwingUtilities.invokeLater(new Runnable() {
 
             @Override
             public void run() {
-              ActionListener saveHashDataListener = new ActionListener() {
-
-                @Override
-                public void actionPerformed(ActionEvent e) {
-                  HashDataInput hdi = signedReferences.get(0);
-                  showSaveHashDataInputDialog(Collections.singletonList(hdi), okListener, okCommand);
-                }
-              };
-              showHashDataViewer(signedReferences.get(0), saveHashDataListener, "save");
+              showSecureViewer(dataToBeSigned.get(0)); 
             }
           });
        
-        } catch (InterruptedException ex) {
-          log.error("Failed to display HashDataViewer: " + ex.getMessage());
-        } catch (InvocationTargetException ex) {
-          log.error("Failed to display HashDataViewer: " + ex.getMessage());
+        } catch (Exception ex) { //InterruptedException InvocationTargetException
+          log.error("Failed to display secure viewer: " + ex.getMessage());
+          log.trace(ex);
+          showErrorDialog(ERR_UNKNOWN, null, backListener, backCommand);
         }
       } else {
-        showSignedReferencesListDialog(signedReferences, okListener, okCommand);
+        showSignedReferencesListDialog(dataToBeSigned, backListener, backCommand);
       }
     }
     
     /**
      * has to be called from event dispatcher thread
+     * This method blocks until the dialog's close button is pressed.
      * @param hashDataText
      * @param saveListener
      * @param saveCommand
      */
-    private void showHashDataViewer(final HashDataInput hashDataInput, final ActionListener saveListener, final String saveCommand) {
+    private void showSecureViewer(HashDataInput dataToBeSigned) {
       
-      log.debug("show hashdata viewer");
-
-      ActionListener l = helpListener.getActionListener();
-      HashDataViewer.showHashDataInput(contentPane, hashDataInput, messages, saveListener, saveCommand, l);
+      log.debug("show secure viewer [" + Thread.currentThread().getName() + "]");
+      if (secureViewer == null) {
+        secureViewer = new SecureViewerDialog(null, messages,
+                helpListener.getActionListener());
+      }
+      secureViewer.setContent(dataToBeSigned);
+      log.trace("show secure viewer returned");
     }
     
-    private void showSignedReferencesListDialog(final List<HashDataInput> signedReferences, final ActionListener backListener, final String backCommand) {
+    private void showSignedReferencesListDialog(final List<HashDataInput> signedReferences,
+            final ActionListener backListener, final String backCommand) {
       
       log.debug("scheduling signed references list dialog");
       
@@ -1154,7 +1288,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
         @Override
         public void run() {
           
-          log.debug("show signed references list dialog");
+          log.debug("show signed references list dialog [" + Thread.currentThread().getName() + "]");
           
           mainPanel.removeAll();
           buttonPanel.removeAll();
@@ -1202,13 +1336,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
                   int selectionIdx = lsm.getMinSelectionIndex();
                   if (selectionIdx >= 0) {
                     final HashDataInput selection = signedReferences.get(selectionIdx);
-                    showHashDataViewer(selection, new ActionListener() {
-
-                      @Override
-                      public void actionPerformed(ActionEvent e) {
-                        showSaveHashDataInputDialog(Collections.singletonList(selection), null, null);
-                      }
-                    }, "save");
+                    showSecureViewer(selection);
                   }
                 }
               });
@@ -1255,9 +1383,8 @@ public class BKUGUIImpl implements BKUGUIFacade {
           buttonPanel.setLayout(buttonPanelLayout);
 
           buttonPanelLayout.setHorizontalGroup(buttonPanelLayout.createSequentialGroup()
-                  .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
                   .addComponent(backButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-          buttonPanelLayout.setVerticalGroup(buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+          buttonPanelLayout.setVerticalGroup(buttonPanelLayout.createSequentialGroup()
                   .addComponent(backButton));
 
           contentPanel.validate();
@@ -1266,96 +1393,101 @@ public class BKUGUIImpl implements BKUGUIFacade {
     }
     
     /**
-     * 
-     * @param signedRefs
      * @param okListener may be null
-     * @param okCommand
      */
-    private void showSaveHashDataInputDialog(final List<HashDataInput> signedRefs, final ActionListener okListener, final String okCommand) {
-      
-      log.debug("scheduling save hashdatainput dialog");
-      
-      SwingUtilities.invokeLater(new Runnable() {
+//    private void showSaveDialog(final List<HashDataInput> signedRefs,
+//            final ActionListener okListener, final String okCommand) {
+//
+//      log.debug("scheduling save dialog");
+//
+//      SwingUtilities.invokeLater(new Runnable() {
+//
+//        @Override
+//        public void run() {
+//
+//          log.debug("show save dialog");
+//
+//          String userHome = System.getProperty("user.home");
+//
+//          JFileChooser fileDialog = new JFileChooser(userHome);
+//          fileDialog.setMultiSelectionEnabled(false);
+//          fileDialog.setDialogType(JFileChooser.SAVE_DIALOG);
+//          fileDialog.setFileHidingEnabled(true);
+//          if (signedRefs.size() == 1) {
+//            fileDialog.setDialogTitle(getMessage(WINDOWTITLE_SAVE));
+//            fileDialog.setFileSelectionMode(JFileChooser.FILES_ONLY);
+//            String mimeType = signedRefs.get(0).getMimeType();
+//            MimeFilter mimeFilter = new MimeFilter(mimeType, messages);
+//            fileDialog.setFileFilter(mimeFilter);
+//            String filename = getMessage(SAVE_HASHDATAINPUT_PREFIX) + MimeFilter.getExtension(mimeType);
+//            fileDialog.setSelectedFile(new File(userHome, filename));
+//          } else {
+//            fileDialog.setDialogTitle(getMessage(WINDOWTITLE_SAVEDIR));
+//            fileDialog.setFileSelectionMode(JFileChooser.DIRECTORIES_ONLY);
+//          }
+//
+//          //parent contentPane -> placed over applet
+//          switch (fileDialog.showSaveDialog(fileDialog)) {
+//            case JFileChooser.APPROVE_OPTION:
+//              File f = fileDialog.getSelectedFile();
+//              for (HashDataInput hashDataInput : signedRefs) {
+//                String mimeType = hashDataInput.getMimeType();
+//                String id = hashDataInput.getReferenceId();
+//                File file;
+//                if (f.isDirectory()) {
+//                  String filename = getMessage(SAVE_HASHDATAINPUT_PREFIX) + '_' + id + MimeFilter.getExtension(mimeType);
+//                  file = new File(f, filename);
+//                } else {
+//                  file = f;
+//                }
+//                if (file.exists()) {
+//                  String ovrwrt = getMessage(MESSAGE_OVERWRITE);
+//                  int overwrite = JOptionPane.showConfirmDialog(fileDialog, MessageFormat.format(ovrwrt, file), getMessage(WINDOWTITLE_OVERWRITE), JOptionPane.OK_CANCEL_OPTION);
+//                  if (overwrite != JOptionPane.OK_OPTION) {
+//                    continue;
+//                  }
+//                }
+//                if (log.isDebugEnabled()) {
+//                    log.debug("writing hashdata input " + id + " (" + mimeType + ") to file " + file);
+//                }
+//                FileOutputStream fos = null;
+//                try {
+//                    fos = new FileOutputStream(file);
+//                    BufferedOutputStream bos = new BufferedOutputStream(fos);
+//                    InputStream hdi = hashDataInput.getHashDataInput();
+//                    int b;
+//                    while ((b = hdi.read()) != -1) {
+//                        bos.write(b);
+//                    }
+//                    bos.flush();
+//                    bos.close();
+//                } catch (IOException ex) {
+//                    log.error("Failed to write " + file + ": " + ex.getMessage());
+//                    showErrorDialog(ERR_WRITE_HASHDATA, new Object[] {ex.getMessage()}, null, null);
+//                    ex.printStackTrace();
+//                } finally {
+//                    try {
+//                        fos.close();
+//                    } catch (IOException ex) {
+//                    }
+//                }
+//              }
+//              break;
+//            case JFileChooser.CANCEL_OPTION :
+//              log.debug("cancelled save dialog");
+//              break;
+//          }
+//          if (okListener != null) {
+//            okListener.actionPerformed(new ActionEvent(fileDialog, ActionEvent.ACTION_PERFORMED, okCommand));
+//          }
+//        }
+//      });
+//    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // UTILITY METHODS
+    ////////////////////////////////////////////////////////////////////////////
 
-        @Override
-        public void run() {
-          
-          log.debug("show save hashdatainput dialog");
-      
-          String userHome = System.getProperty("user.home");
-          
-          JFileChooser fileDialog = new JFileChooser(userHome); 
-          fileDialog.setMultiSelectionEnabled(false);
-          fileDialog.setDialogType(JFileChooser.SAVE_DIALOG);
-          fileDialog.setFileHidingEnabled(true);
-          if (signedRefs.size() == 1) {
-            fileDialog.setDialogTitle(getMessage(WINDOWTITLE_SAVE));
-            fileDialog.setFileSelectionMode(JFileChooser.FILES_ONLY);
-            String mimeType = signedRefs.get(0).getMimeType();
-            MimeFilter mimeFilter = new MimeFilter(mimeType, messages);
-            fileDialog.setFileFilter(mimeFilter);
-            String filename = getMessage(SAVE_HASHDATAINPUT_PREFIX) + MimeFilter.getExtension(mimeType);
-            fileDialog.setSelectedFile(new File(userHome, filename));
-          } else {
-            fileDialog.setDialogTitle(getMessage(WINDOWTITLE_SAVEDIR));
-            fileDialog.setFileSelectionMode(JFileChooser.DIRECTORIES_ONLY);
-          }
-          
-          //parent contentPane -> placed over applet
-          switch (fileDialog.showSaveDialog(fileDialog)) {
-            case JFileChooser.APPROVE_OPTION:
-              File f = fileDialog.getSelectedFile();
-              for (HashDataInput hashDataInput : signedRefs) {
-                String mimeType = hashDataInput.getMimeType();
-                String id = hashDataInput.getReferenceId();
-                File file;
-                if (f.isDirectory()) {
-                  String filename = getMessage(SAVE_HASHDATAINPUT_PREFIX) + '_' + id + MimeFilter.getExtension(mimeType);
-                  file = new File(f, filename);
-                } else {
-                  file = f;
-                }
-                if (file.exists()) {
-                  String ovrwrt = getMessage(MESSAGE_OVERWRITE);
-                  int overwrite = JOptionPane.showConfirmDialog(fileDialog, MessageFormat.format(ovrwrt, file), getMessage(WINDOWTITLE_OVERWRITE), JOptionPane.OK_CANCEL_OPTION);
-                  if (overwrite != JOptionPane.OK_OPTION) {
-                    continue;
-                  }
-                }
-                if (log.isDebugEnabled()) {
-                    log.debug("Writing HashDataInput " + id + " (" + mimeType + ") to file " + file);
-                }
-                FileOutputStream fos = null;
-                try {
-                    fos = new FileOutputStream(file);
-                    BufferedOutputStream bos = new BufferedOutputStream(fos);
-                    InputStream hdi = hashDataInput.getHashDataInput();
-                    int b;
-                    while ((b = hdi.read()) != -1) {
-                        bos.write(b);
-                    }
-                    bos.flush();
-                    bos.close();
-                } catch (IOException ex) {
-                    log.error("Failed to write HashDataInput to file " + file + ": " + ex.getMessage());
-                    showErrorDialog(ERR_WRITE_HASHDATA, new Object[] {ex.getMessage()}, null, null);
-                    ex.printStackTrace();
-                } finally {
-                    try {
-                        fos.close();
-                    } catch (IOException ex) {
-                    }
-                }    
-              }  
-          }
-          log.debug("done saving hashdatainput");
-          if (okListener != null) {
-            okListener.actionPerformed(new ActionEvent(fileDialog, ActionEvent.ACTION_PERFORMED, okCommand));
-          }
-        }
-      });
-    }
-    
     private void registerHelpListener(ActionListener helpListener) {
       if (helpListener != null) {
         this.helpListener = new HelpMouseListener(helpListener);
@@ -1371,6 +1503,11 @@ public class BKUGUIImpl implements BKUGUIFacade {
       }
     }
 
+
+    ////////////////////////////////////////////////////////////////////////////
+    // INITIALIZERS (MAY BE OVERRIDDEN BY SUBCLASSES)
+    ////////////////////////////////////////////////////////////////////////////
+
     /**
      * Called from constructor.
      * Subclasses may override this method to ensure the message bundle is loaded
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/HashDataViewer.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/HashDataViewer.java
deleted file mode 100644
index 6c097b2a..00000000
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/HashDataViewer.java
+++ /dev/null
@@ -1,293 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package at.gv.egiz.bku.gui;
-
-import at.gv.egiz.bku.gui.html.RestrictedHTMLEditorKit;
-import at.gv.egiz.stal.HashDataInput;
-import java.awt.Component;
-import java.awt.Container;
-import java.awt.Cursor;
-import java.awt.Dimension;
-import java.awt.Font;
-import java.awt.Frame;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import java.awt.event.MouseAdapter;
-import java.awt.event.MouseEvent;
-import java.io.BufferedReader;
-import java.io.InputStreamReader;
-import java.io.Reader;
-import java.nio.charset.Charset;
-import java.text.MessageFormat;
-import java.util.ResourceBundle;
-import javax.swing.GroupLayout;
-import javax.swing.ImageIcon;
-import javax.swing.JButton;
-import javax.swing.JDialog;
-import javax.swing.JEditorPane;
-import javax.swing.JLabel;
-import javax.swing.JOptionPane;
-import javax.swing.JPanel;
-import javax.swing.JScrollPane;
-import javax.swing.LayoutStyle;
-import javax.swing.text.Document;
-import javax.swing.text.EditorKit;
-import javax.swing.text.StyledEditorKit;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class HashDataViewer extends JDialog
-        implements ActionListener {
-
-  public static final String PLAINTEXT_FONT = "Monospaced";
-  protected static final Log log = LogFactory.getLog(HashDataViewer.class);
-
-  private static HashDataViewer dialog;
-  
-  protected ResourceBundle messages;
-  
-  /**
-   * 
-   * @param signedReferences currently, only one hashdata input (the first in the list) is displayed
-   */
-  public static void showHashDataInput(HashDataInput hashDataInput,
-          ResourceBundle messages,
-          ActionListener saveListener,
-          String saveCommand,
-          ActionListener helpListener) {
-    showHashDataInput(null, hashDataInput, messages, saveListener, saveCommand, helpListener);
-  }
-  
-  /**
-   * 
-   * @param frameComp owner
-   */
-  public static void showHashDataInput(Component frameComp,
-          HashDataInput hashDataInput,
-          ResourceBundle messages,
-          ActionListener saveListener,
-          String saveCommand,
-          ActionListener helpListener) {
-    
-    Frame frame = null;
-    if (frameComp != null) {
-      JOptionPane.getFrameForComponent(frameComp);
-    }
-    dialog = new HashDataViewer(frame, 
-            messages,
-            hashDataInput, 
-            saveListener, 
-            saveCommand, 
-            helpListener);
-    dialog.setVisible(true);
-  }
-
-  private HashDataViewer(Frame frame,
-          ResourceBundle messages,
-          HashDataInput hashDataInput,
-          ActionListener saveListener,
-          String saveCommand,
-          ActionListener helpListener) {
-    super(frame, messages.getString(BKUGUIFacade.WINDOWTITLE_VIEWER), true);
-    this.messages = messages;
-
-    Charset cs;
-    if (hashDataInput.getEncoding() == null) {
-      cs = Charset.forName("UTF-8");
-    } else {
-      try {
-        cs = Charset.forName(hashDataInput.getEncoding());
-      } catch (Exception ex) {
-        log.debug("charset " + hashDataInput.getEncoding() + " not supported, assuming UTF-8: " + ex.getMessage());
-        cs = Charset.forName("UTF-8");
-      }  
-    }
-    
-    
-    InputStreamReader isr = new InputStreamReader(hashDataInput.getHashDataInput(), cs);
-    Reader content = new BufferedReader(isr);
-  
-    JPanel hashDataPanel = createViewerPanel(content, 
-            hashDataInput.getMimeType(), 
-            helpListener);
-    JPanel buttonPanel = createButtonPanel(saveListener, saveCommand);
-    initContentPane(new Dimension(600, 400), hashDataPanel, buttonPanel);
-
-    pack();
-    if (frame != null) {
-      setLocationRelativeTo(frame);
-    } else {
-      setLocationByPlatform(true);
-    }
-  }
-
-  private void initContentPane(Dimension preferredSize, JPanel viewerPanel, JPanel buttonPanel) {
-    Container contentPane = getContentPane();
-    contentPane.setPreferredSize(preferredSize);
-
-    GroupLayout mainLayout = new GroupLayout(contentPane);
-    contentPane.setLayout(mainLayout);
-
-    mainLayout.setHorizontalGroup(
-            mainLayout.createSequentialGroup().addContainerGap().addGroup(
-            mainLayout.createParallelGroup(GroupLayout.Alignment.LEADING).addComponent(viewerPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE).addComponent(buttonPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)).addContainerGap());
-    mainLayout.setVerticalGroup(
-            mainLayout.createSequentialGroup()
-              .addContainerGap()
-              .addComponent(viewerPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-              .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED)
-              .addComponent(buttonPanel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
-              .addContainerGap());
-  }
-
-  /**
-   * 
-   * @param messages
-   * @param content
-   * @param mimeType defaults to text/plain if null 
-   * @param encoding must be null if document contains charset declaration (e.g. HTML page), otherwise the parser crashes
-   * @param helpListener may be null
-   * @return
-   */
-  private JPanel createViewerPanel(Reader content, 
-          String mimeType, 
-          final ActionListener helpListener) {
-
-    if (mimeType == null) {
-      mimeType = "text/plain";
-    }
-    log.debug("viewer dialog: " + mimeType);
-
-    JEditorPane viewer = new JEditorPane();
-    viewer.setEditable(false);
-    viewer.setContentType(mimeType);
-    
-    if ("text/plain".equals(mimeType)) {
-      viewer.setEditorKit(new StyledEditorKit());
-      viewer.setFont(new Font(PLAINTEXT_FONT, viewer.getFont().getStyle(), viewer.getFont().getSize()));
-//    } else if ("text/html".equals(mimeType)) {
-//      viewer.setEditorKit(new RestrictedHTMLEditorKit());
-    } else if ("application/xhtml+xml".equals(mimeType)) {
-      viewer.setContentType("text/html");
-    }
-    
-    EditorKit editorKit = viewer.getEditorKit();
-    Document document = editorKit.createDefaultDocument();
-//    document.putProperty("IgnoreCharsetDirective", new Boolean(true));
-    
-    try {
-        viewer.read(content, document);
-        content.close();
-    } catch (Exception ex) {
-      log.error(ex.getMessage(), ex);
-      String p = messages.getString(BKUGUIFacade.ERR_VIEWER);
-      viewer.setText(MessageFormat.format(p, ex.getMessage()));
-    }
-
-    JScrollPane scrollPane = new JScrollPane(viewer);
-    scrollPane.setPreferredSize(viewer.getPreferredSize());
-    scrollPane.setAlignmentX(LEFT_ALIGNMENT);
-    viewer.setCaretPosition(0);
-
-    JPanel viewerPanel = new JPanel();
-    GroupLayout viewerPanelLayout = new GroupLayout(viewerPanel);
-    viewerPanel.setLayout(viewerPanelLayout);
-
-    GroupLayout.SequentialGroup infoHorizontal = viewerPanelLayout.createSequentialGroup();
-    GroupLayout.ParallelGroup infoVertical = viewerPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
-
-    if ("application/xhtml+xml".equals(mimeType)) {
-      JLabel viewerLabel = new JLabel();
-      viewerLabel.setText(messages.getString(BKUGUIFacade.WARNING_XHTML));
-      viewerLabel.setFont(viewerLabel.getFont().deriveFont(viewerLabel.getFont().getStyle() | java.awt.Font.BOLD));
-      viewerLabel.setLabelFor(viewer);
-
-      infoHorizontal.addComponent(viewerLabel);
-      infoVertical.addComponent(viewerLabel);
-    }
-
-    if (helpListener != null) {
-      JLabel helpLabel = new JLabel();
-      helpLabel.setIcon(new ImageIcon(getClass().getResource(BKUGUIFacade.HELP_IMG)));
-      helpLabel.getAccessibleContext().setAccessibleName(messages.getString(BKUGUIFacade.ALT_HELP));
-      helpLabel.addMouseListener(new MouseAdapter() {
-
-        @Override
-        public void mouseClicked(MouseEvent arg0) {
-            ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, BKUGUIFacade.HELP_HASHDATAVIEWER);
-            helpListener.actionPerformed(e);
-        }
-      });
-      helpLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
-
-      infoHorizontal
-              .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-              .addComponent(helpLabel);
-      infoVertical
-              .addComponent(helpLabel);
-    }
-
-    viewerPanelLayout.setHorizontalGroup(
-          viewerPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-            .addGroup(infoHorizontal)
-            .addComponent(scrollPane));
-    viewerPanelLayout.setVerticalGroup(
-          viewerPanelLayout.createSequentialGroup()
-            .addGroup(infoVertical)
-            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-            .addComponent(scrollPane));
-
-    
-    return viewerPanel;
-  }
-  
-  private JPanel createButtonPanel(ActionListener saveListener, String saveCommand) {
-    JButton closeButton = new JButton();
-    closeButton.setText(messages.getString(BKUGUIFacade.BUTTON_CLOSE));
-    closeButton.addActionListener(this);
-
-    JButton saveButton = new JButton();
-    saveButton.setText(messages.getString(BKUGUIFacade.BUTTON_SAVE));
-    saveButton.setActionCommand(saveCommand);
-    saveButton.addActionListener(saveListener);
-
-    int buttonSize = closeButton.getPreferredSize().width;
-    if (saveButton.getPreferredSize().width > buttonSize) {
-      buttonSize = saveButton.getPreferredSize().width;
-    }
-
-    JPanel buttonPanel = new JPanel();
-    GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-    buttonPanel.setLayout(buttonPanelLayout);
-
-    buttonPanelLayout.setHorizontalGroup(
-            buttonPanelLayout.createSequentialGroup().addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE).addComponent(saveButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE).addPreferredGap(LayoutStyle.ComponentPlacement.RELATED).addComponent(closeButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-    buttonPanelLayout.setVerticalGroup(
-            buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE).addComponent(saveButton).addComponent(closeButton));
-
-    return buttonPanel;
-  }
-
-  @Override
-  public void actionPerformed(ActionEvent e) {
-    HashDataViewer.dialog.setVisible(false);
-  }
-}
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java
new file mode 100644
index 00000000..6a16306b
--- /dev/null
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java
@@ -0,0 +1,371 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.gui;
+
+import at.gv.egiz.stal.HashDataInput;
+import java.awt.Container;
+import java.awt.Cursor;
+import java.awt.Dimension;
+import java.awt.Font;
+import java.awt.Frame;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import java.awt.event.MouseAdapter;
+import java.awt.event.MouseEvent;
+import java.io.BufferedOutputStream;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.Reader;
+import java.nio.charset.Charset;
+import java.text.MessageFormat;
+import java.util.ResourceBundle;
+import javax.swing.GroupLayout;
+import javax.swing.ImageIcon;
+import javax.swing.JButton;
+import javax.swing.JDialog;
+import javax.swing.JEditorPane;
+import javax.swing.JFileChooser;
+import javax.swing.JLabel;
+import javax.swing.JOptionPane;
+import javax.swing.JPanel;
+import javax.swing.JScrollPane;
+import javax.swing.LayoutStyle;
+import javax.swing.SwingUtilities;
+import javax.swing.text.Document;
+import javax.swing.text.EditorKit;
+import javax.swing.text.StyledEditorKit;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class SecureViewerDialog extends JDialog implements ActionListener {
+
+  public static final String PLAINTEXT_FONT = "Monospaced";
+  public static final Dimension VIEWER_DIMENSION = new Dimension(600, 400);
+  protected static final Log log = LogFactory.getLog(SecureViewerDialog.class);
+
+//  private static SecureViewerDialog dialog;
+  protected ResourceBundle messages;
+  protected JEditorPane viewer;
+  protected JLabel viewerLabel;
+  protected JScrollPane scrollPane;
+  protected HashDataInput content; //remember for save dialog
+
+  /**
+   * Create and display a modal SecureViewer dialog.
+   * This method blocks until the dialog's close button is pressed.
+   * 
+   * @param owner, dialog is positioned relative to its owner
+   * (if null, at default location of native windowing system)
+   */
+//  public static void showDataToBeSigned(HashDataInput dataToBeSigned,
+//          ResourceBundle messages,
+//          ActionListener saveListener, String saveCommand,
+//          ActionListener helpListener) {
+//
+////      Frame ownerFrame = (owner != null) ?
+////        JOptionPane.getFrameForComponent(owner) :
+////        null;
+//    dialog = new SecureViewerDialog(null, messages,
+//            saveListener, saveCommand, helpListener);
+//    dialog.setContent(dataToBeSigned);
+//    dialog.setVisible(true);
+//  }
+  public SecureViewerDialog(Frame owner, ResourceBundle messages,
+//          ActionListener saveListener, String saveCommand,
+          ActionListener helpListener) {
+    super(owner, messages.getString(BKUGUIFacade.WINDOWTITLE_VIEWER), true);
+    this.messages = messages;
+
+    initContentPane(VIEWER_DIMENSION,
+            createViewerPanel(helpListener),
+            createButtonPanel()); //saveListener, saveCommand));
+
+    pack();
+    if (owner != null) {
+      setLocationRelativeTo(owner);
+    } else {
+      setLocationByPlatform(true);
+    }
+  }
+
+  private void initContentPane(Dimension preferredSize,
+          JPanel viewerPanel, JPanel buttonPanel) {
+    Container contentPane = getContentPane();
+    contentPane.setPreferredSize(preferredSize);
+
+    GroupLayout mainLayout = new GroupLayout(contentPane);
+    contentPane.setLayout(mainLayout);
+
+    mainLayout.setHorizontalGroup(
+            mainLayout.createSequentialGroup().addContainerGap().addGroup(
+            mainLayout.createParallelGroup(GroupLayout.Alignment.LEADING).addComponent(viewerPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE).addComponent(buttonPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)).addContainerGap());
+    mainLayout.setVerticalGroup(
+            mainLayout.createSequentialGroup().addContainerGap().addComponent(viewerPanel, 0, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE).addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED).addComponent(buttonPanel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE).addContainerGap());
+  }
+
+  /**
+   * @param helpListener may be null
+   */
+  private JPanel createViewerPanel(final ActionListener helpListener) {
+    viewer = new JEditorPane();
+    viewer.setEditable(false);
+
+    scrollPane = new JScrollPane();
+
+    JPanel viewerPanel = new JPanel();
+    GroupLayout viewerPanelLayout = new GroupLayout(viewerPanel);
+    viewerPanel.setLayout(viewerPanelLayout);
+
+    GroupLayout.SequentialGroup infoHorizontal = viewerPanelLayout.createSequentialGroup();
+    GroupLayout.ParallelGroup infoVertical = viewerPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING);
+
+    viewerLabel = new JLabel();
+    viewerLabel.setFont(viewerLabel.getFont().deriveFont(viewerLabel.getFont().getStyle() | java.awt.Font.BOLD));
+//    viewerLabel.setLabelFor(viewer);
+
+    infoHorizontal.addComponent(viewerLabel);
+    infoVertical.addComponent(viewerLabel);
+
+    if (helpListener != null) {
+      JLabel helpLabel = new JLabel();
+      helpLabel.setIcon(new ImageIcon(getClass().getResource(BKUGUIFacade.HELP_IMG)));
+      helpLabel.getAccessibleContext().setAccessibleName(messages.getString(BKUGUIFacade.ALT_HELP));
+      helpLabel.addMouseListener(new MouseAdapter() {
+
+        @Override
+        public void mouseClicked(MouseEvent arg0) {
+          ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, BKUGUIFacade.HELP_HASHDATAVIEWER);
+          helpListener.actionPerformed(e);
+        }
+      });
+      helpLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+
+      infoHorizontal.addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE).addComponent(helpLabel);
+      infoVertical.addComponent(helpLabel);
+    }
+
+    viewerPanelLayout.setHorizontalGroup(
+            viewerPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING).addGroup(infoHorizontal).addComponent(scrollPane));
+    viewerPanelLayout.setVerticalGroup(
+            viewerPanelLayout.createSequentialGroup().addGroup(infoVertical).addPreferredGap(LayoutStyle.ComponentPlacement.RELATED).addComponent(scrollPane));
+
+    return viewerPanel;
+  }
+
+  /**
+   * Sets the hashdataInput to be displayed and makes the dialog visible.
+   * This method blocks until the dialog's close button is pressed.
+   * 
+   * @param mimeType defaults to text/plain if null
+   * @param encoding must be null if document contains charset declaration (e.g. HTML page), otherwise the parser crashes
+
+   * @param hashDataInput
+   */
+  public void setContent(HashDataInput hashDataInput) {
+
+    this.content = null;
+
+    String mimeType = hashDataInput.getMimeType();
+    if (mimeType == null) {
+      mimeType = "text/plain";
+    }
+    log.debug("secure viewer mime type: " + mimeType);
+    // loads editorkit for text/plain if unrecognized
+    viewer.setContentType(mimeType);
+
+    if ("text/plain".equals(mimeType)) {
+      viewer.setEditorKit(new StyledEditorKit());
+      viewer.setFont(new Font(PLAINTEXT_FONT, viewer.getFont().getStyle(), viewer.getFont().getSize()));
+//    } else if ("text/html".equals(mimeType)) {
+//      viewer.setEditorKit(new RestrictedHTMLEditorKit());
+    } else if ("application/xhtml+xml".equals(mimeType)) {
+      viewer.setContentType("text/html");
+    }
+
+    EditorKit editorKit = viewer.getEditorKit();
+    Document document = editorKit.createDefaultDocument();
+//    document.putProperty("IgnoreCharsetDirective", new Boolean(true));
+
+    try {
+      Charset cs = (hashDataInput.getEncoding() == null) ? Charset.forName("UTF-8") : Charset.forName(hashDataInput.getEncoding());
+      log.debug("secure viewer encoding: " + cs.toString());
+
+      InputStreamReader isr = new InputStreamReader(hashDataInput.getHashDataInput(), cs);
+      Reader contentReader = new BufferedReader(isr);
+      viewer.read(contentReader, document);
+      contentReader.close();
+
+      this.content = hashDataInput;
+
+//    } catch (IllegalCharsetNameException ex) {
+//    } catch (UnsupportedCharsetException ex) {
+    } catch (Exception ex) {
+      log.error(ex.getMessage(), ex);
+      String p = messages.getString(BKUGUIFacade.ERR_VIEWER);
+      viewer.setText(MessageFormat.format(p, ex.getMessage()));
+    }
+    viewer.setCaretPosition(0);
+
+    scrollPane.setViewportView(viewer);
+    scrollPane.setPreferredSize(viewer.getPreferredSize());
+    scrollPane.setAlignmentX(LEFT_ALIGNMENT);
+
+    if ("application/xhtml+xml".equals(mimeType)) {
+      viewerLabel.setText(messages.getString(BKUGUIFacade.WARNING_XHTML));
+    } else {
+      viewerLabel.setText("");
+    }
+
+    setVisible(true);
+  }
+
+  private JPanel createButtonPanel() { //ActionListener saveListener, String saveCommand) {
+    JButton closeButton = new JButton();
+    closeButton.setText(messages.getString(BKUGUIFacade.BUTTON_CLOSE));
+    closeButton.setActionCommand("close");
+    closeButton.addActionListener(this);
+    
+    JButton saveButton = new JButton();
+    saveButton.setText(messages.getString(BKUGUIFacade.BUTTON_SAVE));
+    saveButton.setActionCommand("save");
+    saveButton.addActionListener(this);
+
+    int buttonSize = closeButton.getPreferredSize().width;
+    if (saveButton.getPreferredSize().width > buttonSize) {
+      buttonSize = saveButton.getPreferredSize().width;
+    }
+
+    JPanel buttonPanel = new JPanel();
+    GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+    buttonPanel.setLayout(buttonPanelLayout);
+
+    buttonPanelLayout.setHorizontalGroup(
+            buttonPanelLayout.createSequentialGroup().addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE).addComponent(saveButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE).addPreferredGap(LayoutStyle.ComponentPlacement.RELATED).addComponent(closeButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
+    buttonPanelLayout.setVerticalGroup(
+            buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE).addComponent(saveButton).addComponent(closeButton));
+
+    return buttonPanel;
+  }
+
+  @Override
+  public void actionPerformed(ActionEvent e) {
+    if ("close".equals(e.getActionCommand())) {
+//    SecureViewerDialog.dialog.setVisible(false);
+      log.trace("closing secure viewer");
+      setVisible(false);
+      log.trace("secure viewer closed");
+    } else if ("save".equals(e.getActionCommand())) {
+      log.trace("display secure viewer save dialog");
+      showSaveDialog(content, null, null);
+      log.trace("done secure viewer save");
+    } else {
+      log.warn("unknown action command " + e.getActionCommand());
+    }
+  }
+
+  private void showSaveDialog(final HashDataInput hashDataInput,
+          final ActionListener okListener, final String okCommand) {
+
+    log.debug("scheduling save dialog [" + Thread.currentThread().getName() + "]");
+
+    SwingUtilities.invokeLater(new Runnable() {
+
+      @Override
+      public void run() {
+
+        log.debug("show save dialog [" + Thread.currentThread().getName() + "]");
+
+        String userHome = System.getProperty("user.home");
+
+        JFileChooser fileDialog = new JFileChooser(userHome);
+        fileDialog.setMultiSelectionEnabled(false);
+        fileDialog.setDialogType(JFileChooser.SAVE_DIALOG);
+        fileDialog.setFileHidingEnabled(true);
+        fileDialog.setDialogTitle(messages.getString(BKUGUIFacade.WINDOWTITLE_SAVE));
+        fileDialog.setFileSelectionMode(JFileChooser.FILES_ONLY);
+        String mimeType = hashDataInput.getMimeType();
+        MimeFilter mimeFilter = new MimeFilter(mimeType, messages);
+        fileDialog.setFileFilter(mimeFilter);
+        String filename = messages.getString(BKUGUIFacade.SAVE_HASHDATAINPUT_PREFIX) +
+                MimeFilter.getExtension(mimeType);
+        fileDialog.setSelectedFile(new File(userHome, filename));
+
+        //parent contentPane -> placed over applet
+        switch (fileDialog.showSaveDialog(fileDialog)) {
+          case JFileChooser.APPROVE_OPTION:
+            File file = fileDialog.getSelectedFile();
+            String id = hashDataInput.getReferenceId();
+            if (file.exists()) {
+              String msgPattern = messages.getString(BKUGUIFacade.MESSAGE_OVERWRITE);
+              int overwrite = JOptionPane.showConfirmDialog(fileDialog,
+                      MessageFormat.format(msgPattern, file),
+                      messages.getString(BKUGUIFacade.WINDOWTITLE_OVERWRITE),
+                      JOptionPane.OK_CANCEL_OPTION);
+              if (overwrite != JOptionPane.OK_OPTION) {
+                return;
+              }
+            }
+            if (log.isDebugEnabled()) {
+              log.debug("writing hashdata input " + id + " (" + mimeType + ") to file " + file);
+            }
+            FileOutputStream fos = null;
+            try {
+              fos = new FileOutputStream(file);
+              BufferedOutputStream bos = new BufferedOutputStream(fos);
+              InputStream hdi = hashDataInput.getHashDataInput();
+              int b;
+              while ((b = hdi.read()) != -1) {
+                bos.write(b);
+              }
+              bos.flush();
+              bos.close();
+            } catch (IOException ex) {
+              log.error("Failed to write " + file + ": " + ex.getMessage());
+              log.debug(ex);
+              String errPattern = messages.getString(BKUGUIFacade.ERR_WRITE_HASHDATA);
+              JOptionPane.showMessageDialog(fileDialog,
+                      MessageFormat.format(errPattern, ex.getMessage()),
+                      messages.getString(BKUGUIFacade.WINDOWTITLE_ERROR),
+                      JOptionPane.ERROR_MESSAGE);
+            } finally {
+              try {
+                if (fos != null) {
+                  fos.close();
+                }
+              } catch (IOException ex) {
+              }
+            }
+            break;
+          case JFileChooser.CANCEL_OPTION:
+            log.debug("cancelled save dialog");
+            break;
+        }
+        if (okListener != null) {
+          okListener.actionPerformed(new ActionEvent(fileDialog, ActionEvent.ACTION_PERFORMED, okCommand));
+        }
+      }
+    });
+  }
+}
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
index 6d651b2d..9bfe8fb1 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
@@ -25,6 +25,7 @@ title.retry=<html>Falsche PIN</html>
 title.wait=<html>Bitte warten</html>
 title.hashdata=<html>Signaturdaten</html>
 windowtitle.save=Signaturdaten speichern
+windowtitle.error=Fehler
 windowtitle.savedir=Signaturdaten in Verzeichnis speichern
 windowtitle.overwrite=Datei \u00FCberschreiben?
 windowtitle.viewer=Signaturdaten
@@ -79,7 +80,7 @@ error.unknown.param=<html>Ein Fehler trat auf: {0}</html>
 error.unknown=<html>Ein Fehler trat auf</html>
 error.test=<html>Fehler1 {0} - Fehler2 {1}</html>
 error.card.locked=<html>B\u00FCrgerkarte ist gesperrt</html>
-error.card.notactivated=<html>B\u00FCrgerkartenfunktion ist nicht aktiviert</html>
+error.card.notactivated=<html>Die B\u00FCrgerkarte ist nicht aktiviert</html>
 error.pin.timeout=<html>Zeit\u00FCberschreitung bei Eingabe der PIN</html>
 error.viewer=Der Inhalt kann nicht dargestellt werden: {0}
 error.external.link=<html>Externer Link {0} wird nicht ge\u00F6ffnet</html>
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
index 2fb66969..a36f9b83 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
@@ -25,6 +25,7 @@ title.retry=<html>Wrong PIN</html>
 title.wait=<html>Please wait</html>
 title.hashdata=<html>Signature data</html>
 windowtitle.save=Save signature data
+windowtitle.error=Error
 windowtitle.savedir=Save signature data to directory
 windowtitle.overwrite=Overwrite file?
 windowtitle.viewer=Signature data
diff --git a/BKUCommonGUI/src/main/resources/images/ChipperlingLogo.png b/BKUCommonGUI/src/main/resources/images/ChipperlingLogo.png
new file mode 100644
index 00000000..eee4be4f
Binary files /dev/null and b/BKUCommonGUI/src/main/resources/images/ChipperlingLogo.png differ
diff --git a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUITest.java b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUITest.java
index c8cff617..b3eaf8c7 100644
--- a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUITest.java
+++ b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUITest.java
@@ -39,8 +39,9 @@ public class BKUGUITest {
     public void testBKUGUI() {
         JFrame testFrame = new JFrame("BKUGUITest");
         Container contentPane = testFrame.getContentPane();
-        contentPane.setPreferredSize(new Dimension(170, 150));
-        BKUGUIFacade gui = new BKUGUIImpl(contentPane, null, BKUGUIFacade.Style.tiny, null, null);
+//        contentPane.setPreferredSize(new Dimension(170, 150));
+        contentPane.setPreferredSize(new Dimension(290, 190));
+        BKUGUIFacade gui = new BKUGUIImpl(contentPane, null, BKUGUIFacade.Style.advanced, null, null);
         BKUGUIWorker worker = new BKUGUIWorker();
         worker.init(gui);
         testFrame.pack();
diff --git a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
index 194e18b0..5475a45b 100644
--- a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
+++ b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
@@ -149,7 +149,9 @@ public class BKUGUIWorker implements Runnable {
 //            
 //            Thread.sleep(2000);
 //
-            gui.showSignaturePINDialog(signPinSpec, -1, signListener, "sign", cancelListener, "cancel", hashdataListener, "hashdata");
+//            gui.showSignaturePINDialog(signPinSpec, -1, signListener, "sign", cancelListener, "cancel", hashdataListener, "hashdata");
+
+    gui.showPinpadSignaturePINDialog(signPinSpec, -1, hashdataListener, "hashdata");
 //
 //            Thread.sleep(4000);
 //
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
index 5a0ba84a..3f560967 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/BKUGuiProxy.java
@@ -144,4 +144,12 @@ public class BKUGuiProxy implements BKUGUIFacade {
     showDialog();
     delegate.showMessageDialog(titleKey, msgKey);
   }
+
+  @Override
+  public void showPinpadSignaturePINDialog(PINSpec pinSpec, int numRetries,
+          ActionListener viewerListener, String viewerCommand) {
+    showDialog();
+    delegate.showPinpadSignaturePINDialog(pinSpec, numRetries,
+            viewerListener, viewerCommand);
+  }
 }
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java
index 61cc7c4c..a782de1a 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalBKUWorker.java
@@ -37,7 +37,8 @@ public class LocalBKUWorker extends AbstractBKUWorker {
   public LocalBKUWorker(BKUGUIFacade gui, JDialog container) {
     super(gui);
     this.container = container;
-    addRequestHandler(SignRequest.class, new LocalSignRequestHandler());
+    addRequestHandler(SignRequest.class, 
+            new LocalSignRequestHandler(new LocalSecureViewer(gui)));
   }
 
   @Override
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSecureViewer.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSecureViewer.java
new file mode 100644
index 00000000..cbe5af7a
--- /dev/null
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSecureViewer.java
@@ -0,0 +1,109 @@
+
+package at.gv.egiz.bku.local.stal;
+
+import at.gv.egiz.bku.slcommands.impl.DataObjectHashDataInput;
+import at.gv.egiz.bku.smccstal.SecureViewer;
+import java.io.IOException;
+import java.util.ArrayList;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.stal.HashDataInput;
+import at.gv.egiz.stal.impl.ByteArrayHashDataInput;
+import at.gv.egiz.stal.signedinfo.ReferenceType;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.awt.event.ActionListener;
+import java.io.ByteArrayOutputStream;
+import java.io.InputStream;
+import java.util.Collections;
+import java.util.List;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+public class LocalSecureViewer implements SecureViewer {
+
+  private static final Log log = LogFactory.getLog(LocalSignRequestHandler.class);
+  private List<HashDataInput> hashDataInputs = Collections.EMPTY_LIST;
+
+  protected BKUGUIFacade gui;
+
+  public LocalSecureViewer(BKUGUIFacade gui) {
+    this.gui = gui;
+  }
+
+  public void setDataToBeSigned(List<HashDataInput> dataToBeSigned) {
+    this.hashDataInputs = dataToBeSigned;
+  }
+
+  /**
+   *
+   * @param dsigReferences
+   * @throws java.lang.Exception
+   */
+  @Override
+  public void displayDataToBeSigned(SignedInfoType signedInfo,
+          ActionListener okListener, String okCommand)
+          throws Exception {
+    if (signedInfo.getReference().size() == 0) {
+      log.error("No hashdata input selected to be displayed: null");
+      throw new Exception("No HashData Input selected to be displayed");
+    }
+
+    ArrayList<HashDataInput> selectedHashDataInputs = new ArrayList<HashDataInput>();
+    for (ReferenceType dsigRef : signedInfo.getReference()) {
+      // don't get Manifest, QualifyingProperties, ...
+      if (dsigRef.getType() == null) {
+        String dsigRefId = dsigRef.getId();
+        if (dsigRefId != null) {
+          boolean hdiAvailable = false;
+          for (HashDataInput hashDataInput : hashDataInputs) {
+            if (dsigRefId.equals(hashDataInput.getReferenceId())) {
+              log.debug("display hashdata input for dsig:SignedReference " +
+                      dsigRefId);
+              selectedHashDataInputs.add(
+                      ensureCachedHashDataInput(hashDataInput));
+              hdiAvailable = true;
+              break;
+            }
+          }
+          if (!hdiAvailable) {
+            log.error("no hashdata input for dsig:SignedReference " + dsigRefId);
+            throw new Exception(
+              "No HashDataInput available for dsig:SignedReference " + dsigRefId);
+          }
+        } else {
+          throw new Exception(
+            "Cannot get HashDataInput for dsig:Reference without Id attribute");
+        }
+      }
+    }
+
+    if (selectedHashDataInputs.size() < 1) {
+      log.error("dsig:SignedInfo does not contain a data reference");
+      throw new Exception("dsig:SignedInfo does not contain a data reference");
+    }
+    gui.showSecureViewer(selectedHashDataInputs, okListener, okCommand);
+  }
+
+
+  private HashDataInput ensureCachedHashDataInput(HashDataInput hashDataInput)
+          throws IOException {
+    if (!(hashDataInput instanceof DataObjectHashDataInput)) {
+      
+      log.warn("expected DataObjectHashDataInput for LocalSignRequestHandler, got " +
+              hashDataInput.getClass().getName());
+
+      InputStream hdIs = hashDataInput.getHashDataInput();
+      ByteArrayOutputStream baos = new ByteArrayOutputStream(hdIs.available());
+      int b;
+      while ((b = hdIs.read()) != -1) {
+        baos.write(b);
+      }
+      hashDataInput = new ByteArrayHashDataInput(baos.toByteArray(),
+              hashDataInput.getReferenceId(),
+              hashDataInput.getMimeType(),
+              hashDataInput.getEncoding());
+    }
+    return hashDataInput;
+  }
+
+}
diff --git a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java
index 531e6591..492b8a05 100644
--- a/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java
+++ b/BKULocal/src/main/java/at/gv/egiz/bku/local/stal/LocalSignRequestHandler.java
@@ -16,9 +16,7 @@
  */
 package at.gv.egiz.bku.local.stal;
 
-import at.gv.egiz.bku.slcommands.impl.DataObjectHashDataInput;
-import java.io.IOException;
-import java.util.ArrayList;
+import at.gv.egiz.bku.smccstal.SecureViewer;
 import java.util.Collections;
 import java.util.List;
 
@@ -40,9 +38,16 @@ import java.io.InputStream;
  * @author clemens
  */
 public class LocalSignRequestHandler extends SignRequestHandler {
+//        implements SecureViewer {
 
   private static final Log log = LogFactory.getLog(LocalSignRequestHandler.class);
-  private List<HashDataInput> hashDataInputs = Collections.EMPTY_LIST;
+
+  protected LocalSecureViewer secureViewer;
+
+  public LocalSignRequestHandler(LocalSecureViewer secureViewer) {
+    super(secureViewer);
+  }
+
 
   /**
    * If the request is a SIGN request, it contains a list of DataObjectHashDataInput 
@@ -53,75 +58,13 @@ public class LocalSignRequestHandler extends SignRequestHandler {
    */
   @SuppressWarnings("unchecked")
   @Override
-  public STALResponse handleRequest(STALRequest request) throws InterruptedException {
+  public STALResponse handleRequest(STALRequest request) 
+          throws InterruptedException {
+    
     if (request instanceof SignRequest) {
       SignRequest signReq = (SignRequest) request;
-      hashDataInputs = signReq.getHashDataInput();
+      secureViewer.setDataToBeSigned(signReq.getHashDataInput());
     }
     return super.handleRequest(request);
   }
-
-  /**
-   * 
-   * @param dsigReferences
-   * @throws java.lang.Exception
-   */
-  @Override
-  public void displayDataToBeSigned(List<ReferenceType> dsigReferences) throws Exception {
-    if (dsigReferences == null || dsigReferences.size() < 1) {
-      log.error("No hashdata input selected to be displayed: null");
-      throw new Exception("No HashData Input selected to be displayed");
-    }
-
-    ArrayList<HashDataInput> selectedHashDataInputs = new ArrayList<HashDataInput>();
-    for (ReferenceType dsigRef : dsigReferences) {
-      // don't get Manifest, QualifyingProperties, ...
-      if (dsigRef.getType() == null) {
-        String dsigRefId = dsigRef.getId();
-        if (dsigRefId != null) {
-          boolean hdiAvailable = false;
-          for (HashDataInput hashDataInput : hashDataInputs) {
-            if (dsigRefId.equals(hashDataInput.getReferenceId())) {
-              log.debug("display hashdata input for dsig:SignedReference " + dsigRefId);
-              if (!(hashDataInput instanceof DataObjectHashDataInput)) {
-                log.warn(
-                  "expected DataObjectHashDataInput for LocalSignRequestHandler, got " + hashDataInput.getClass().getName());
-                hashDataInput = getByteArrayHashDataInput(hashDataInput);
-              }
-              selectedHashDataInputs.add(hashDataInput);
-              hdiAvailable = true;
-              break;
-            }
-          }
-          if (!hdiAvailable) {
-            log.error("no hashdata input for dsig:SignedReference " + dsigRefId);
-            throw new Exception(
-              "No HashDataInput available for dsig:SignedReference " + dsigRefId);
-          }
-        } else {
-          throw new Exception(
-            "Cannot get HashDataInput for dsig:Reference without Id attribute");
-        }
-      }
-    }
-
-    if (selectedHashDataInputs.size() < 1) {
-      log.error("dsig:SignedInfo does not contain a data reference");
-      throw new Exception("dsig:SignedInfo does not contain a data reference");
-    }
-    gui.showSecureViewer(selectedHashDataInputs, this, "hashDataDone");
-  }
-
-  private ByteArrayHashDataInput getByteArrayHashDataInput(HashDataInput hashDataInput) throws IOException {
-
-    InputStream hdIs = hashDataInput.getHashDataInput();
-    ByteArrayOutputStream baos = new ByteArrayOutputStream(hdIs.available());
-    int b;
-    while ((b = hdIs.read()) != -1) {
-      baos.write(b);
-    }
-    ByteArrayHashDataInput hdi = new ByteArrayHashDataInput(baos.toByteArray(), hashDataInput.getReferenceId(), hashDataInput.getMimeType(), hashDataInput.getEncoding());
-
-    return hdi;
-  }
 }
diff --git a/BKUOnline/src/main/resources/at/gv/egiz/bku/online/conf/defaultConf.properties b/BKUOnline/src/main/resources/at/gv/egiz/bku/online/conf/defaultConf.properties
index e2f07481..04c9c7bf 100644
--- a/BKUOnline/src/main/resources/at/gv/egiz/bku/online/conf/defaultConf.properties
+++ b/BKUOnline/src/main/resources/at/gv/egiz/bku/online/conf/defaultConf.properties
@@ -40,9 +40,12 @@ SSL.sslProtocol=TLS
 # warning do not set the following property to true
 # its intended for debugging and testing only 
 SSL.disableAllChecks=false
+#SSL.disableHostnameVerification=true
 
 # ------------ END SSL Config  --------------------
 
+#UserAgent=citizen-card-environment/1.2 MOCCA/1.0
+
 ValidateHashDataInputs=true
 AppletTimeout=300000
 
diff --git a/BKUOnline/src/main/resources/log4j.properties b/BKUOnline/src/main/resources/log4j.properties
index f608c83d..25ea9faa 100644
--- a/BKUOnline/src/main/resources/log4j.properties
+++ b/BKUOnline/src/main/resources/log4j.properties
@@ -30,7 +30,7 @@ log4j.appender.STDOUT.layout.ConversionPattern=%-5p | %t | %c %x - %m%n
 log4j.appender.file=org.apache.log4j.RollingFileAppender
 log4j.appender.file.maxFileSize=500KB
 log4j.appender.file.maxBackupIndex=9
-log4j.appender.file.File=${catalina.home}/logs/bkuonline.log
+log4j.appender.file.File=${catalina.base}/logs/bkuonline.log
 log4j.appender.file.threshold=trace
 log4j.appender.file.layout=org.apache.log4j.PatternLayout
 log4j.appender.file.layout.ConversionPattern=%d{ABSOLUTE} %5p | %t | %c{1}:%L - %m%n
\ No newline at end of file
diff --git a/BKUOnline/src/main/webapp/SLRequestForm.html b/BKUOnline/src/main/webapp/SLRequestForm.html
index 9ff7b68a..4714e82f 100644
--- a/BKUOnline/src/main/webapp/SLRequestForm.html
+++ b/BKUOnline/src/main/webapp/SLRequestForm.html
@@ -103,6 +103,33 @@
 </sl:InfoboxReadRequest>
 -->
 <!--
+<?xml version="1.0" encoding="UTF-8"?>
+<sl:CreateXMLSignatureRequest
+   xmlns:sl="http://www.buergerkarte.at/namespaces/securitylayer/1.2#">
+  <sl:KeyboxIdentifier>SecureSignatureKeypair</sl:KeyboxIdentifier>
+   <sl:DataObjectInfo Structure="enveloping">
+     <sl:DataObject>
+       <sl:XMLContent>Ich bin ein einfacher Text.</sl:XMLContent>
+     </sl:DataObject>
+    <sl:TransformsInfo>
+      <sl:FinalDataMetaInfo>
+       <sl:MimeType>text/plain</sl:MimeType>
+       </sl:FinalDataMetaInfo>
+    </sl:TransformsInfo>
+  </sl:DataObjectInfo>
+  <sl:DataObjectInfo Structure="enveloping">
+     <sl:DataObject>
+       <sl:XMLContent><html xmlns="http://www.w3.org/1999/xhtml"><head><title>TestXHTML</title><style/></head><body><p>Ich bin ein einfacher Text.</p></body></html></sl:XMLContent>
+     </sl:DataObject>
+    <sl:TransformsInfo>
+      <sl:FinalDataMetaInfo>
+       <sl:MimeType>application/xhtml+xml</sl:MimeType>
+       </sl:FinalDataMetaInfo>
+    </sl:TransformsInfo>
+  </sl:DataObjectInfo>
+</sl:CreateXMLSignatureRequest>
+-->
+<!--
 <?xml version='1.0' encoding='UTF-8'?>
 <sl10:InfoboxUpdateRequest xmlns:sl10='http://www.buergerkarte.at/namespaces/securitylayer/1.2#'>
     <sl10:InfoboxIdentifier>CardChannel</sl10:InfoboxIdentifier>
diff --git a/bkucommon/src/test/java/at/gv/egiz/bku/binding/ExpiryRemoverTest.java b/bkucommon/src/test/java/at/gv/egiz/bku/binding/ExpiryRemoverTest.java
index 61729567..0e64e7a2 100644
--- a/bkucommon/src/test/java/at/gv/egiz/bku/binding/ExpiryRemoverTest.java
+++ b/bkucommon/src/test/java/at/gv/egiz/bku/binding/ExpiryRemoverTest.java
@@ -14,54 +14,57 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package at.gv.egiz.bku.binding;
-
+package at.gv.egiz.bku.binding;
+
 import java.net.MalformedURLException;
 
-import org.junit.Test;
-import static org.junit.Assert.*;
-
-public class ExpiryRemoverTest {
-  
-  @Test
-  public void testMe() throws InterruptedException, MalformedURLException {
-    BindingProcessorManager manager = new BindingProcessorManagerImpl(new DummyStalFactory(),
-        new SLCommandInvokerImpl());
-    BindingProcessor bp = manager.createBindingProcessor("http://www.at", null);
-    ExpiryRemover remover = new ExpiryRemover();
-    remover.setBindingProcessorManager(manager);
-    remover.execute();
-    manager.process(bp);
-    remover.execute();
-    assertTrue(manager.getManagedIds().size() == 1);
-    remover.setMaxAcceptedAge(1000);
-    Thread.sleep(500);
-    remover.execute();
-    assertTrue(manager.getManagedIds().size() == 1);
-    Thread.sleep(510);
-    remover.execute();
-    assertTrue(manager.getManagedIds().size() == 0);
-  }
-  
-  @Test
-  public void testMe2() throws InterruptedException, MalformedURLException {
-    BindingProcessorManager manager = new BindingProcessorManagerImpl(new DummyStalFactory(),
-        new SLCommandInvokerImpl());
-    BindingProcessor bp = manager.createBindingProcessor("http://www.iaik.at", null);
-    ExpiryRemover remover = new ExpiryRemover();
-    remover.setBindingProcessorManager(manager);
-    remover.execute();
-    manager.process(bp);
-    remover.execute();
-    assertTrue(manager.getManagedIds().size() == 1);
-    remover.setMaxAcceptedAge(1000);
-    Thread.sleep(500);
-    remover.execute();
-    assertTrue(manager.getManagedIds().size() == 1);
-    bp.updateLastAccessTime();
-    Thread.sleep(510);
-    remover.execute();
-    assertTrue(manager.getManagedIds().size() == 1);
-  }
-
-}
+import org.junit.Ignore;
+import org.junit.Test;
+import static org.junit.Assert.*;
+
+public class ExpiryRemoverTest {
+  
+  @Test
+  @Ignore
+  public void testMe() throws InterruptedException, MalformedURLException {
+    BindingProcessorManager manager = new BindingProcessorManagerImpl(new DummyStalFactory(),
+        new SLCommandInvokerImpl());
+    BindingProcessor bp = manager.createBindingProcessor("http://www.at", null);
+    ExpiryRemover remover = new ExpiryRemover();
+    remover.setBindingProcessorManager(manager);
+    remover.execute();
+    manager.process(bp);
+    remover.execute();
+    assertTrue(manager.getManagedIds().size() == 1);
+    remover.setMaxAcceptedAge(1000);
+    Thread.sleep(500);
+    remover.execute();
+    assertTrue(manager.getManagedIds().size() == 1);
+    Thread.sleep(510);
+    remover.execute();
+    assertTrue(manager.getManagedIds().size() == 0);
+  }
+  
+  @Test
+  @Ignore
+  public void testMe2() throws InterruptedException, MalformedURLException {
+    BindingProcessorManager manager = new BindingProcessorManagerImpl(new DummyStalFactory(),
+        new SLCommandInvokerImpl());
+    BindingProcessor bp = manager.createBindingProcessor("http://www.iaik.at", null);
+    ExpiryRemover remover = new ExpiryRemover();
+    remover.setBindingProcessorManager(manager);
+    remover.execute();
+    manager.process(bp);
+    remover.execute();
+    assertTrue(manager.getManagedIds().size() == 1);
+    remover.setMaxAcceptedAge(1000);
+    Thread.sleep(500);
+    remover.execute();
+    assertTrue(manager.getManagedIds().size() == 1);
+    bp.updateLastAccessTime();
+    Thread.sleep(510);
+    remover.execute();
+    assertTrue(manager.getManagedIds().size() == 1);
+  }
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index 01b9155b..06e4a018 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -28,6 +28,7 @@
 //
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.ccid.CCID;
 import at.gv.egiz.smcc.util.SMCCHelper;
 import java.nio.ByteBuffer;
 import java.nio.CharBuffer;
@@ -41,7 +42,7 @@ import javax.smartcardio.ResponseAPDU;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
+public class ACOSCard extends AbstractSignatureCard {
 
   private static Log log = LogFactory.getLog(ACOSCard.class);
 
@@ -180,22 +181,23 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
         //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("inf.pin.name"));
         
         int retries = -1;
-        char[] pin = null;
-        boolean pinRequiered = false;
+        boolean pinRequired = false;
 
         do {
-          if (pinRequiered) {
-            pin = provider.providePIN(spec, retries);
-          }
           try {
             getCard().beginExclusive();
-            return readTLVFile(AID_DEC, EF_INFOBOX, pin, KID_PIN_INF, EF_INFOBOX_MAX_SIZE);
+            if (pinRequired) {
+              char[] pin = provider.providePIN(spec, retries);
+              return readTLVFile(AID_DEC, EF_INFOBOX, pin, spec.getKID(), EF_INFOBOX_MAX_SIZE);
+            } else {
+              return readTLVFile(AID_DEC, EF_INFOBOX, EF_INFOBOX_MAX_SIZE);
+            }
           } catch (FileNotFoundException e) {
             throw new NotActivatedException();
           } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequiered = true;
+            pinRequired = true;
           } catch (VerificationFailedException e) {
-            pinRequiered = true;
+            pinRequired = true;
             retries = e.getRetries();
           } finally {
             getCard().endExclusive();
@@ -402,10 +404,10 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
           throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException {
     try {
       byte[] sw;
-      if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+      if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
         log.debug("verify PIN on IFD");
-        sw = transmitControlCommand(
-                ifdCtrlCmds.get(FEATURE_VERIFY_PIN_DIRECT),
+        sw = reader.transmitControlCommand(
+                CCID.FEATURE_VERIFY_PIN_DIRECT,
                 getPINVerifyStructure(kid));
 //        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
       } else {
@@ -466,10 +468,10 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
           throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException {
     try {
        byte[] sw;
-      if (ifdSupportsFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+      if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_DIRECT)) {
         log.debug("modify PIN on IFD");
-        sw = transmitControlCommand(
-                ifdCtrlCmds.get(FEATURE_MODIFY_PIN_DIRECT),
+        sw = reader.transmitControlCommand(
+                CCID.FEATURE_MODIFY_PIN_DIRECT,
                 getPINModifyStructure(kid));
 //        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
       } else {
@@ -543,34 +545,37 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
   }
   
   private byte[] getPINVerifyStructure(byte kid) {
-
-      byte bTimeOut = (byte) 00;            // Default time out
-      byte bTimeOut2 = (byte) 00;           // Default time out
-      byte bmFormatString = (byte) 0x82;      // 1 0001 0 01
+      
+      byte bTimeOut = reader.getbTimeOut();   
+      byte bTimeOut2 = reader.getbTimeOut2(); 
+      byte bmFormatString = (byte) 0x82;      // 1 0000 0 10
                                               // ^------------ System unit = byte
                                               //   ^^^^------- PIN position in the frame = 1 byte
                                               //        ^----- PIN justification left
-                                              //          ^^-- BCD format
-                                              // 1 0000 0 10
                                               //          ^^-- ASCII format
-      byte bmPINBlockString = (byte) 0x08;    // 0100 0111
-                                              // ^^^^--------- PIN length size: 4 bits
-                                              //      ^^^^---- Length PIN = 7 bytes
-      byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
+      byte bmPINBlockString = (byte) 0x08;    // 0000 1000
+                                              // ^^^^--------- PIN length size: 0 bits
+                                              //      ^^^^---- Length PIN = 8 bytes
+      byte bmPINLengthFormat = (byte) 0x00;   // 000 0 0000
                                               //     ^-------- System bit units is bit
-                                              //       ^^^^--- PIN length is at the 4th position bit
-      byte wPINMaxExtraDigitL = (byte) 0x04;  // Max=4 digits
-      byte wPINMaxExtraDigitH = (byte) 0x04;  // Min=4 digits
-      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
+                                              //       ^^^^--- no PIN length
+      byte wPINMaxExtraDigitL =
+              (reader.getwPINMaxExtraDigitL() < (byte) 0x08) ?
+                reader.getwPINMaxExtraDigitL() : (byte) 0x08;
+      byte wPINMaxExtraDigitH =               
+              (reader.getwPINMaxExtraDigitH() > (byte) 0x00) ?
+                reader.getwPINMaxExtraDigitH() : (byte) 0x00;
+      byte bEntryValidationCondition = 
+              reader.getbEntryValidationCondition();
       byte bNumberMessage = (byte) 0x00;      // No message
-      byte wLangIdL = (byte) 0x0C;            // - English?
-      byte wLangIdH = (byte) 0x04;            // \
-      byte bMsgIndex = (byte) 0x00;           // Default Msg
+      byte wLangIdL = (byte) 0x0C;            
+      byte wLangIdH = (byte) 0x04;            
+      byte bMsgIndex = (byte) 0x00;           
 
       byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x20, (byte) 0x00, kid, (byte) 0x08,  // CLA INS P1 P2 LC
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,               // Data
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00                // Data
+        (byte) 0x00, (byte) 0x20, (byte) 0x00, kid, (byte) 0x08, 
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,      
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00       
       };
 
       int offset = 0;
@@ -603,40 +608,43 @@ public class ACOSCard extends AbstractSignatureCard implements SignatureCard {
   
   public byte[] getPINModifyStructure(byte kid) {
 
-      byte bTimeOut = (byte) 00;            // Default time out
-      byte bTimeOut2 = (byte) 00;           // Default time out
-      byte bmFormatString = (byte) 0x82;      // 1 0001 0 01
+      byte bTimeOut = reader.getbTimeOut();
+      byte bTimeOut2 = reader.getbTimeOut2();
+      byte bmFormatString = (byte) 0x82;      // 1 0000 0 10
                                               // ^------------ System unit = byte
                                               //   ^^^^------- PIN position in the frame = 1 byte
                                               //        ^----- PIN justification left
-                                              //          ^^-- BCD format
-                                              // 1 0000 0 10
                                               //          ^^-- ASCII format
-      byte bmPINBlockString = (byte) 0x08;    // 0100 0111
-                                              // ^^^^--------- PIN length size: 4 bits
-                                              //      ^^^^---- Length PIN = 7 bytes
-      byte bmPINLengthFormat = (byte) 0x00;   // 000 0 0100
+      byte bmPINBlockString = (byte) 0x08;    // 0000 1000
+                                              // ^^^^--------- PIN length size: 0 bits
+                                              //      ^^^^---- Length PIN = 8 bytes
+      byte bmPINLengthFormat = (byte) 0x00;   // 000 0 0000
                                               //     ^-------- System bit units is bit
-                                              //       ^^^^--- PIN length is at the 4th position bit
+                                              //       ^^^^--- no PIN length 
       byte bInsertionOffsetOld = (byte) 0x00; // insertion position offset in bytes
-      byte bInsertionOffsetNew = (byte) 0x00; // insertion position offset in bytes
-      byte wPINMaxExtraDigitL = (byte) 0x04;  // Min=4 digits
-      byte wPINMaxExtraDigitH = (byte) 0x04;  // Max=12 digits
-      byte bConfirmPIN = (byte) 0x00;         // ??? need for confirm pin
-      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
-      byte bNumberMessage = (byte) 0x00;      // No message
-      byte wLangIdL = (byte) 0x0C;            // - English?
-      byte wLangIdH = (byte) 0x04;            // \
-      byte bMsgIndex1 = (byte) 0x00;           // Default Msg
-      byte bMsgIndex2 = (byte) 0x00;           // Default Msg
-      byte bMsgIndex3 = (byte) 0x00;           // Default Msg
+      byte bInsertionOffsetNew = (byte) 0x08; 
+      byte wPINMaxExtraDigitL =
+              (reader.getwPINMaxExtraDigitL() < (byte) 0x08) ?
+                reader.getwPINMaxExtraDigitL() : (byte) 0x08;
+      byte wPINMaxExtraDigitH =
+              (reader.getwPINMaxExtraDigitH() > (byte) 0x00) ?
+                reader.getwPINMaxExtraDigitH() : (byte) 0x00;
+      byte bConfirmPIN = (byte) 0x03;
+      byte bEntryValidationCondition =
+              reader.getbEntryValidationCondition();
+      byte bNumberMessage = (byte) 0x03;      
+      byte wLangIdL = (byte) 0x0C;            
+      byte wLangIdH = (byte) 0x04;            
+      byte bMsgIndex1 = (byte) 0x00;           
+      byte bMsgIndex2 = (byte) 0x01;           
+      byte bMsgIndex3 = (byte) 0x02;           
 
       byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,  // CLA INS P1 P2 LC
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,                // ...
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff                // ...
+        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,  
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00        
       };
 
       int offset = 0;
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index 6587aaf9..47c27369 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -28,6 +28,9 @@
 //
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.ccid.CCID;
+import at.gv.egiz.smcc.ccid.DefaultReader;
+import at.gv.egiz.smcc.ccid.ReaderFactory;
 import at.gv.egiz.smcc.util.SMCCHelper;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -39,6 +42,8 @@ import java.util.Locale;
 import java.util.Map;
 import java.util.ResourceBundle;
 
+import java.util.logging.Level;
+import java.util.logging.Logger;
 import javax.smartcardio.ATR;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
@@ -54,14 +59,6 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
   private static Log log = LogFactory.getLog(AbstractSignatureCard.class);
 
-  static final short GET_FEATURE_REQUEST = 3400;
-  
-  private static int getCtrlCode(short function) {
-    return 0x310000 | ((0xFFFF & function) << 2);
-  }
-
-  protected Map<Byte, Long> ifdCtrlCmds;
-
   protected List<PINSpec> pinSpecs = new ArrayList<PINSpec>();
 
   private ResourceBundle i18n;
@@ -76,7 +73,8 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   /**
    * The card terminal that connects the {@link #card_}.  
    */
-  private CardTerminal cardTerminal;
+//  private CardTerminal cardTerminal;
+  protected CCID reader;
 
   protected AbstractSignatureCard(String resourceBundleName) {
     this.resourceBundleName = resourceBundleName;
@@ -341,16 +339,34 @@ public abstract class AbstractSignatureCard implements SignatureCard {
    */
   protected byte[] readTLVFile(byte[] aid, byte[] ef, int maxLength)
       throws SignatureCardException, InterruptedException, CardException {
-    return readTLVFile(aid, ef, null, (byte) 0, maxLength);
+    // SELECT FILE (AID)
+    selectFileAID(aid);
+
+    // SELECT FILE (EF)
+    ResponseAPDU resp = selectFileFID(ef);
+    if (resp.getSW() == 0x6a82) {
+      // EF not found
+      throw new FileNotFoundException("EF " + toString(ef) + " not found.");
+    } else if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("SELECT FILE with "
+          + "FID="
+          + toString(ef)
+          + " failed ("
+          + "SW="
+          + Integer.toHexString(resp.getSW()) + ").");
+    }
+
+    return readBinaryTLV(maxLength, (byte) 0x30);
+//    return readTLVFile(aid, ef, null, (byte) 0, maxLength);
   }
 
   /**
-   * Read the content of a TLV file wich may require a PIN.
+   * Read the content of a TLV file wich requires a PIN.
    * 
    * @param aid the application ID (AID)
    * @param ef the elementary file (EF)
    * @param kid the key ID (KID) of the corresponding PIN
-   * @param provider the PINProvider
+   * @param pin the pin or null if VERIFY on pinpad
    * @param spec the PINSpec
    * @param maxLength the maximum length of the file
    * 
@@ -381,12 +397,10 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     }
 
     // VERIFY
-    if (pin != null) {
       int retries = verifyPIN(kid, pin);
       if (retries != -1) {
         throw new VerificationFailedException(retries);
       }
-    }
    
     return readBinaryTLV(maxLength, (byte) 0x30);
       
@@ -443,16 +457,16 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   }
 
   
+  @Override
   public void init(Card card, CardTerminal cardTerminal) {
-    card_ = card;
-    this.cardTerminal = cardTerminal;
+    this.card_ = card;
+    this.reader = ReaderFactory.getReader(card, cardTerminal);
     ATR atr = card.getATR();
     byte[] atrBytes = atr.getBytes();
     if (atrBytes.length >= 6) {
       ifs_ = 0xFF & atr.getBytes()[6];
       log.trace("Setting IFS (information field size) to " + ifs_);
     }
-    ifdCtrlCmds = queryIFDFeatures();
   }
   
   @Override
@@ -464,6 +478,11 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     return card_.getBasicChannel();
   }
 
+  @Override
+  public CCID getReader() {
+    return reader;
+  }
+
   @Override
   public void setLocale(Locale locale) {
     if (locale == null) {
@@ -497,9 +516,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
       log.debug("Disconnect and reset smart card.");
       card_.disconnect(true);
       log.debug("Reconnect smart card.");
-      if (cardTerminal != null) {
-        card_ = cardTerminal.connect("*");
-      }
+      card_ = reader.connect();
     } catch (CardException e) {
       throw new SignatureCardException("Failed to reset card.", e);
     }
@@ -520,6 +537,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
         selectFileAID(pinSpec.getContextAID());
       }
 
+      // -1 if ok or unknown
       int retries = verifyPIN(pinSpec.getKID());
       do {
         char[] pin = pinProvider.providePIN(pinSpec, retries);
@@ -611,166 +629,4 @@ public abstract class AbstractSignatureCard implements SignatureCard {
           throws CancelledException, SignatureCardException, InterruptedException {
     throw new SignatureCardException("Unblock not supported yet");
   }
-
-  /////////////////////////////////////////////////////////////////////////////
-  // IFD related code
-  /////////////////////////////////////////////////////////////////////////////
-
-  /**
-   * TODO implement VERIFY_PIN_START/FINISH (feature 0x01/0x02)
-   * @return
-   */
-  @Override
-  public boolean ifdSupportsFeature(byte feature) {
-    if (ifdCtrlCmds != null) {
-      return ifdCtrlCmds.containsKey(feature);
-    }
-    return false;
-  }
-
-  protected Map<Byte, Long> queryIFDFeatures() {
-
-    if (card_ == null) {
-      throw new NullPointerException("Need connected smart card to query IFD features");
-    }
-
-    Map<Byte, Long> ifdFeatures = new HashMap<Byte, Long>();
-
-    try {
-      if (log.isTraceEnabled()) {
-        log.trace("GET_FEATURE_REQUEST CtrlCode " + Integer.toHexString(getCtrlCode(GET_FEATURE_REQUEST)));
-      }
-      byte[] resp = card_.transmitControlCommand(getCtrlCode(GET_FEATURE_REQUEST), new byte[]{});
-
-      if (log.isTraceEnabled()) {
-        log.trace("GET_FEATURE_REQUEST Response " + SMCCHelper.toString(resp));
-      }
-
-      for (int i = 0; i + 5 < resp.length; i += 6) {
-        Byte feature = new Byte(resp[i]);
-        Long ctrlCode = new Long(
-          ((0xFF & resp[i + 2]) << 24) |
-          ((0xFF & resp[i + 3]) << 16) |
-          ((0xFF & resp[i + 4]) << 8) |
-           (0xFF & resp[i + 5]));
-        if (log.isInfoEnabled()) {
-          log.info("IFD supports feature " + Integer.toHexString(feature.byteValue()) +
-                  ": " + Long.toHexString(ctrlCode.longValue()));
-        }
-        ifdFeatures.put(feature, ctrlCode);
-      }
-
-    } catch (CardException ex) {
-      log.debug("Failed to query IFD features: " + ex.getMessage());
-      log.trace(ex);
-      log.info("IFD does not support PINPad");
-      return null;
-    }
-    return ifdFeatures;
-  }
-
-
-  protected byte ifdGetKeyPressed() throws CardException {
-    if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
-
-      Long controlCode = (Long) ifdCtrlCmds.get(new Byte((byte) 0x05));
-
-      byte key = 0x00;
-      while (key == 0x00) {
-
-        byte[] resp = card_.transmitControlCommand(controlCode.intValue(), new byte[] {});
-
-        if (resp != null && resp.length > 0) {
-          key = resp[0];
-        }
-      }
-
-      System.out.println("Key: " + key);
-
-    }
-
-    return 0x00;
-  }
-
-  protected byte[] ifdVerifyPINFinish() throws CardException {
-    if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
-
-      Long controlCode = (Long) ifdCtrlCmds.get(new Byte((byte) 0x02));
-
-      byte[] resp = card_.transmitControlCommand(controlCode.intValue(), new byte[] {});
-
-      System.out.println("CommandResp: " + toString(resp));
-
-      return resp;
-
-    }
-
-    return null;
-  }
-
-
-  /**
-   * assumes ifdSupportsVerifyPIN() == true
-   * @param pinVerifyStructure
-   * @return
-   * @throws javax.smartcardio.CardException
-   */
-//  protected byte[] ifdVerifyPIN(byte[] pinVerifyStructure) throws CardException {
-//
-////      Long ctrlCode = (Long) ifdFeatures.get(FEATURE_IFD_PIN_PROPERTIES);
-////      if (ctrlCode != null) {
-////        if (log.isTraceEnabled()) {
-////          log.trace("PIN_PROPERTIES CtrlCode " + Integer.toHexString(ctrlCode.intValue()));
-////        }
-////        byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), new byte[] {});
-////
-////        if (log.isTraceEnabled()) {
-////          log.trace("PIN_PROPERTIES Response " + SMCCHelper.toString(resp));
-////        }
-////      }
-//
-//
-//      Long ctrlCode = (Long) ifdFeatures.get(FEATURE_VERIFY_PIN_DIRECT);
-//      if (ctrlCode == null) {
-//        throw new NullPointerException("no CtrlCode for FEATURE_VERIFY_PIN_DIRECT");
-//      }
-//
-//      if (log.isTraceEnabled()) {
-//        log.trace("VERIFY_PIN_DIRECT CtrlCode " + Integer.toHexString(ctrlCode.intValue()) +
-//                ", PIN_VERIFY_STRUCTURE " + SMCCHelper.toString(pinVerifyStructure));
-//      }
-//      byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), pinVerifyStructure);
-//
-//      if (log.isTraceEnabled()) {
-//        log.trace("VERIFY_PIN_DIRECT Response " + SMCCHelper.toString(resp));
-//      }
-//      return resp;
-//  }
-
-//  protected Long getControlCode(Byte feature) {
-//    if (ifdFeatures != null) {
-//      return ifdFeatures.get(feature);
-//    }
-//    return null;
-//  }
-
-  protected byte[] transmitControlCommand(Long ctrlCode, byte[] ctrlCommand)
-          throws CardException {
-//    Long ctrlCode = (Long) ifdFeatures.get(feature);
-    if (ctrlCode == null) {
-      throw new NullPointerException("ControlCode " +
-              Integer.toHexString(ctrlCode.intValue()) + " not supported");
-    }
-    if (log.isTraceEnabled()) {
-      log.trace("CtrlCommand (" + Integer.toHexString(ctrlCode.intValue()) +
-              ")  " + SMCCHelper.toString(ctrlCommand));
-    }
-    byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), ctrlCommand);
-
-    if (log.isTraceEnabled()) {
-      log.trace("CtrlCommand Response " + SMCCHelper.toString(resp));
-    }
-    return resp;
-  }
-
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index 91245c50..bc6a2316 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -28,6 +28,7 @@
 //
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.ccid.DefaultReader;
 import at.gv.egiz.smcc.util.SMCCHelper;
 import java.util.Arrays;
 import javax.smartcardio.CardChannel;
@@ -38,7 +39,7 @@ import javax.smartcardio.ResponseAPDU;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-public class STARCOSCard extends AbstractSignatureCard implements SignatureCard {
+public class STARCOSCard extends AbstractSignatureCard {
 
   /**
    * Logging facility.
@@ -153,8 +154,8 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
 
   public static final byte KID_PIN_CARD = (byte) 0x01;
 
-  private static final int PINSPEC_CARD = 0;
-  private static final int PINSPEC_SS = 1;
+  public static final int PINSPEC_CARD = 0;
+  public static final int PINSPEC_SS = 1;
 
   /**
    * Creates an new instance.
@@ -217,28 +218,29 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
   
     try {
       if ("IdentityLink".equals(infobox)) {
- 
+
         PINSpec spec = pinSpecs.get(PINSPEC_CARD);
         //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
-        
+
         int retries = -1;
-        char[] pin = null;
-        boolean pinRequiered = false;
+        boolean pinRequired = false;
 
         do {
-          if (pinRequiered) {
-            pin = provider.providePIN(spec, retries);
-          }
           try {
             getCard().beginExclusive();
-            return readTLVFile(AID_INFOBOX, EF_INFOBOX, pin, KID_PIN_CARD, 2000);
+            if (pinRequired) {
+              char[] pin = provider.providePIN(spec, retries);
+              return readTLVFile(AID_INFOBOX, EF_INFOBOX, pin, spec.getKID(), 2000);
+            } else {
+              return readTLVFile(AID_INFOBOX, EF_INFOBOX, 2000);
+            }
           } catch (FileNotFoundException e) {
             throw new NotActivatedException();
           } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequiered = true;
+            pinRequired = true;
             retries = verifyPIN(KID_PIN_CARD);
           } catch (VerificationFailedException e) {
-            pinRequiered = true;
+            pinRequired = true;
             retries = e.getRetries();
           } finally {
             getCard().endExclusive();
@@ -246,54 +248,43 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
         } while (retries != 0);
 
         throw new LockedException();
-
         
       } else if ("EHIC".equals(infobox)) {
-        
         try {
           getCard().beginExclusive();
           return readTLVFile(AID_SV_PERSONENDATEN, FID_EHIC, 126);
         } finally {
           getCard().endExclusive();
         }
-        
       } else if ("Grunddaten".equals(infobox)) {
-        
         try {
           getCard().beginExclusive();
           return readTLVFile(AID_SV_PERSONENDATEN, FID_GRUNDDATEN, 550);
         } finally {
           getCard().endExclusive();
         }
-        
       } else if ("SV-Personenbindung".equals(infobox)) {
-        
         try {
           getCard().beginExclusive();
           return readTLVFile(AID_SV_PERSONENDATEN, FID_SV_PERSONENBINDUNG, 500);
         } finally {
           getCard().endExclusive();
         }
-        
       } else if ("Status".equals(infobox)) {
-        
         try {
           getCard().beginExclusive();
           return readRecords(AID_SV_PERSONENDATEN, FID_STATUS, 1, 5);
         } finally {
           getCard().endExclusive();
         }
-        
       } else {
         throw new IllegalArgumentException("Infobox '" + infobox
             + "' not supported.");
       }
-      
     } catch (CardException e) {
       log.warn(e);
       throw new SignatureCardException("Failed to access card.", e);
     }
-  
   }
 
   @Override
@@ -466,10 +457,10 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
           throws LockedException, NotActivatedException, SignatureCardException {
     try {
       byte[] sw;
-      if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+      if (reader.hasFeature(DefaultReader.FEATURE_VERIFY_PIN_DIRECT)) {
         log.debug("verify PIN on IFD");
-        sw = transmitControlCommand(
-                ifdCtrlCmds.get(FEATURE_VERIFY_PIN_DIRECT),
+        sw = reader.transmitControlCommand(
+                DefaultReader.FEATURE_VERIFY_PIN_DIRECT,
                 getPINVerifyStructure(kid));
 //        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
       } else {
@@ -551,10 +542,10 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
           throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException {
     try {
       byte[] sw;
-      if (ifdSupportsFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+      if (reader.hasFeature(DefaultReader.FEATURE_MODIFY_PIN_DIRECT)) {
         log.debug("modify PIN on IFD");
-        sw = transmitControlCommand(
-                ifdCtrlCmds.get(FEATURE_MODIFY_PIN_DIRECT),
+        sw = reader.transmitControlCommand(
+                DefaultReader.FEATURE_MODIFY_PIN_DIRECT,
                 getPINModifyStructure(kid));
 //        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
       } else {
@@ -606,31 +597,43 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
   protected void activatePIN(byte kid, char[] pin)
           throws CancelledException, TimeoutException, SignatureCardException {
     try {
-      CardChannel channel = getCardChannel();
-      ResponseAPDU resp = transmit(channel,
-              new CommandAPDU(0x00, 0x24, 0x01, kid, encodePINBlock(pin)), false);
+      byte[] sw;
+      if (reader.hasFeature(DefaultReader.FEATURE_MODIFY_PIN_DIRECT)) {
+        log.debug("activate PIN on IFD");
+        sw = reader.transmitControlCommand(
+                DefaultReader.FEATURE_MODIFY_PIN_DIRECT,
+                getActivatePINModifyStructure(kid));
+//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
+      } else {
+        CardChannel channel = getCardChannel();
+        ResponseAPDU resp = transmit(channel,
+                new CommandAPDU(0x00, 0x24, 0x01, kid, encodePINBlock(pin)), false);
 
-      log.trace("activate pin returned SW=" + Integer.toHexString(resp.getSW()));
+        sw = new byte[2];
+        sw[0] = (byte) resp.getSW1();
+        sw[1] = (byte) resp.getSW2();
+        log.trace("activate pin returned SW=" + Integer.toHexString(resp.getSW()));
+      }
 
-      if (resp.getSW1() == 0x9000) {
+      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
         return;
-      } else if (resp.getSW() == 0x6983) {
+      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
         //Authentisierungsmethode gesperrt
         throw new LockedException("[69:83]");
-      } else if (resp.getSW() == 0x6984) {
-        //referenzierte Daten sind reversibel gesperrt (invalidated)
-        throw new NotActivatedException("[69:84]");
-      } else if (resp.getSW() == 0x6985) {
-        //Benutzungsbedingungen nicht erfüllt
-        throw new NotActivatedException("[69:85]");
-      } else if (resp.getSW() == 0x6400) {
+//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
+//        //referenzierte Daten sind reversibel gesperrt (invalidated)
+//        throw new NotActivatedException("[69:84]");
+//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
+//        //Benutzungsbedingungen nicht erfüllt
+//        throw new NotActivatedException("[69:85]");
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
         throw new TimeoutException("[64:00]");
-      } else if (resp.getSW() == 0x6401) {
+      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
         throw new CancelledException("[64:01]");
       }
-      log.error("Failed to activate pin: SW=" +
-              Integer.toHexString(resp.getSW()));
-      throw new SignatureCardException("[" + Integer.toHexString(resp.getSW()) + "]");
+      log.error("Failed to activate pin: SW="
+              + SMCCHelper.toString(sw));
+      throw new SignatureCardException(SMCCHelper.toString(sw));
 
     } catch (CardException ex) {
       log.error("smart card communication failed: " + ex.getMessage());
@@ -667,9 +670,8 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
   }
   
   private byte[] getPINVerifyStructure(byte kid) {
-      
-      byte bTimeOut = (byte) 00;            // Default time out
-      byte bTimeOut2 = (byte) 00;           // Default time out
+      byte bTimeOut = reader.getbTimeOut(); 
+      byte bTimeOut2 = reader.getbTimeOut2(); // time out after first entry
       byte bmFormatString = (byte) 0x89;      // 1 0001 0 01 
                                               // ^------------ System unit = byte
                                               //   ^^^^------- PIN position in the frame = 1 byte
@@ -681,9 +683,14 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
       byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
                                               //     ^-------- System bit units is bit
                                               //       ^^^^--- PIN length is at the 4th position bit
-      byte wPINMaxExtraDigitL = (byte) 0x04;  // Max=4 digits
-      byte wPINMaxExtraDigitH = (byte) 0x04;  // Min=4 digits
-      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
+      byte wPINMaxExtraDigitL =               // Max=12 digits (Gemplus support max 8)
+              (reader.getwPINMaxExtraDigitL() < (byte) 0x12) ?
+                reader.getwPINMaxExtraDigitL() : (byte) 0x12;
+      byte wPINMaxExtraDigitH =               // Min=4/6 digits TODO card/ss pin (min: 4/6)
+              (reader.getwPINMaxExtraDigitH() > (byte) 0x04) ?
+                reader.getwPINMaxExtraDigitH() : (byte) 0x04;
+      byte bEntryValidationCondition = 
+              reader.getbEntryValidationCondition();  
       byte bNumberMessage = (byte) 0x00;      // No message
       byte wLangIdL = (byte) 0x0C;            // - English?
       byte wLangIdH = (byte) 0x04;            // \
@@ -725,38 +732,99 @@ public class STARCOSCard extends AbstractSignatureCard implements SignatureCard
 
   private byte[] getPINModifyStructure(byte kid) {
 
-      byte bTimeOut = (byte) 00;            // Default time out
-      byte bTimeOut2 = (byte) 00;           // Default time out
-      byte bmFormatString = (byte) 0x89;      // 1 0001 0 01
-                                              // ^------------ System unit = byte
-                                              //   ^^^^------- PIN position in the frame = 1 byte
-                                              //        ^----- PIN justification left
-                                              //          ^^-- BCD format
-      byte bmPINBlockString = (byte) 0x47;    // 0100 0111
-                                              // ^^^^--------- PIN length size: 4 bits
-                                              //      ^^^^---- Length PIN = 7 bytes
-      byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
-                                              //     ^-------- System bit units is bit
-                                              //       ^^^^--- PIN length is at the 4th position bit
-      byte bInsertionOffsetOld = (byte) 0x01; // insertion position offset in bytes
-      byte bInsertionOffsetNew = (byte) 0x08; // insertion position offset in bytes
-      byte wPINMaxExtraDigitL = (byte) 0x04;  // Min=4 digits
-      byte wPINMaxExtraDigitH = (byte) 0x04;  // Max=12 digits
-      byte bConfirmPIN = (byte) 0x00;         // ??? need for confirm pin
-      byte bEntryValidationCondition = 0x02;  // Max size reach or Validation key pressed
-      byte bNumberMessage = (byte) 0x00;      // No message
-      byte wLangIdL = (byte) 0x0C;            // - English?
-      byte wLangIdH = (byte) 0x04;            // \
-      byte bMsgIndex1 = (byte) 0x00;           // Default Msg
-      byte bMsgIndex2 = (byte) 0x00;           // Default Msg
-      byte bMsgIndex3 = (byte) 0x00;           // Default Msg
+      byte bTimeOut = reader.getbTimeOut();   // s.o.
+      byte bTimeOut2 = reader.getbTimeOut2(); // s.o.
+      byte bmFormatString = (byte) 0x89;      // s.o.
+      byte bmPINBlockString = (byte) 0x47;    // s.o.
+      byte bmPINLengthFormat = (byte) 0x04;   // s.o.
+      byte bInsertionOffsetOld = (byte) 0x00; // insertion position offset in bytes
+      byte bInsertionOffsetNew = (byte) 0x08; // (add 1 from bmFormatString b3)
+      byte wPINMaxExtraDigitL = 
+              (reader.getwPINMaxExtraDigitL() < (byte) 0x12) ?
+                reader.getwPINMaxExtraDigitL() : (byte) 0x12;
+      byte wPINMaxExtraDigitH =               // Min=4/6 digits TODO card/ss pin (min: 4/6)
+              (reader.getwPINMaxExtraDigitH() > (byte) 0x04) ?
+                reader.getwPINMaxExtraDigitH() : (byte) 0x04;
+      byte bConfirmPIN = (byte) 0x03;         // current pin entry + confirmation
+      byte bEntryValidationCondition =
+              reader.getbEntryValidationCondition();
+      byte bNumberMessage = (byte) 0x03;      // 3 messages
+      byte wLangIdL = (byte) 0x0C;            
+      byte wLangIdH = (byte) 0x04;            
+      byte bMsgIndex1 = (byte) 0x00;          // insertion
+      byte bMsgIndex2 = (byte) 0x01;          // modification
+      byte bMsgIndex3 = (byte) 0x02;          // confirmation
 
       byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,  // CLA INS P1 P2 LC
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,                // ...
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff                // ...
+        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10, 
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,      
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,      
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,      
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff       
+      };
+
+      int offset = 0;
+      byte[] pinModifyStructure = new byte[offset + 24 + apdu.length];
+      pinModifyStructure[offset++] = bTimeOut;
+      pinModifyStructure[offset++] = bTimeOut2;
+      pinModifyStructure[offset++] = bmFormatString;
+      pinModifyStructure[offset++] = bmPINBlockString;
+      pinModifyStructure[offset++] = bmPINLengthFormat;
+      pinModifyStructure[offset++] = bInsertionOffsetOld;
+      pinModifyStructure[offset++] = bInsertionOffsetNew;
+      pinModifyStructure[offset++] = wPINMaxExtraDigitL;
+      pinModifyStructure[offset++] = wPINMaxExtraDigitH;
+      pinModifyStructure[offset++] = bConfirmPIN;
+      pinModifyStructure[offset++] = bEntryValidationCondition;
+      pinModifyStructure[offset++] = bNumberMessage;
+      pinModifyStructure[offset++] = wLangIdL;
+      pinModifyStructure[offset++] = wLangIdH;
+      pinModifyStructure[offset++] = bMsgIndex1;
+      pinModifyStructure[offset++] = bMsgIndex2;
+      pinModifyStructure[offset++] = bMsgIndex3;
+
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+
+      pinModifyStructure[offset++] = (byte) apdu.length;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      pinModifyStructure[offset++] = 0x00;
+      System.arraycopy(apdu, 0, pinModifyStructure, offset, apdu.length);
+
+//      log.debug("PIN MODIFY " + SMCCHelper.toString(pinModifyStructure));
+      return pinModifyStructure;
+  }
+  private byte[] getActivatePINModifyStructure(byte kid) {
+
+      byte bTimeOut = reader.getbTimeOut();   
+      byte bTimeOut2 = reader.getbTimeOut2(); 
+      byte bmFormatString = (byte) 0x89;      
+      byte bmPINBlockString = (byte) 0x47;    
+      byte bmPINLengthFormat = (byte) 0x04;   
+      byte bInsertionOffsetOld = (byte) 0x00; // ignored
+      byte bInsertionOffsetNew = (byte) 0x00; 
+      byte wPINMaxExtraDigitL =
+              (reader.getwPINMaxExtraDigitL() < (byte) 0x12) ?
+                reader.getwPINMaxExtraDigitL() : (byte) 0x12;
+      byte wPINMaxExtraDigitH =               // Min=4/6 digits TODO card/ss pin (min: 4/6)
+              (reader.getwPINMaxExtraDigitH() > (byte) 0x04) ?
+                reader.getwPINMaxExtraDigitH() : (byte) 0x04;
+      byte bConfirmPIN = (byte) 0x01;         // confirm, no current pin entry
+      byte bEntryValidationCondition =
+              reader.getbEntryValidationCondition();
+      byte bNumberMessage = (byte) 0x02;      // 2 messages
+      byte wLangIdL = (byte) 0x0c;
+      byte wLangIdH = (byte) 0x04;
+      byte bMsgIndex1 = (byte) 0x01;          // modification prompt
+      byte bMsgIndex2 = (byte) 0x02;          // confirmation prompt
+      byte bMsgIndex3 = (byte) 0x00;           
+
+      byte[] apdu = new byte[] {
+        (byte) 0x00, (byte) 0x24, (byte) 0x01, kid, (byte) 0x08,
+        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff
       };
 
       int offset = 0;
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index 293b9c71..253ac7a0 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -17,6 +17,7 @@
 
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.ccid.CCID;
 import java.io.ByteArrayOutputStream;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -44,6 +45,7 @@ import java.util.Locale;
 
 import java.util.Map;
 import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
 import javax.smartcardio.CardTerminal;
 
 import org.apache.commons.logging.Log;
@@ -419,7 +421,50 @@ public class SWCard implements SignatureCard {
   }
 
   @Override
-  public boolean ifdSupportsFeature(byte feature) {
-    return false;
+  public CCID getReader() {
+    return new CCID() {
+
+      @Override
+      public boolean hasFeature(Byte feature) {
+        return false;
+      }
+
+      @Override
+      public byte[] transmitControlCommand(Byte feature, byte[] ctrlCommand)
+              throws SignatureCardException {
+        throw new SignatureCardException(CCID.FEATURES[feature.intValue()] +
+                " not supported");
+      }
+
+      @Override
+      public byte getbTimeOut() {
+        return 0;
+      }
+
+      @Override
+      public byte getbTimeOut2() {
+        return 0;
+      }
+
+      @Override
+      public byte getwPINMaxExtraDigitL() {
+        return 0x12;
+      }
+
+      @Override
+      public byte getwPINMaxExtraDigitH() {
+        return 0x00;
+      }
+
+      @Override
+      public byte getbEntryValidationCondition() {
+        return 0x02;
+      }
+
+      @Override
+      public Card connect() {
+        return null;
+      }
+    };
   }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index 2097e6d3..ad530ad5 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -28,6 +28,7 @@
 //
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.ccid.CCID;
 import java.util.List;
 import java.util.Locale;
 
@@ -36,14 +37,6 @@ import javax.smartcardio.CardTerminal;
 
 public interface SignatureCard {
 
-  /**
-   * IFD FEATURES
-   */
-  static final Byte FEATURE_VERIFY_PIN_DIRECT = new Byte((byte) 0x06);
-  static final Byte FEATURE_MODIFY_PIN_DIRECT = new Byte((byte) 0x07);
-  static final Byte FEATURE_MCT_READER_DIRECT = new Byte((byte) 0x08);
-  static final Byte FEATURE_IFD_PIN_PROPERTIES = new Byte((byte) 0x0a);
-
   public static class KeyboxName {
 
     public static KeyboxName SECURE_SIGNATURE_KEYPAIR = new KeyboxName(
@@ -143,11 +136,7 @@ public interface SignatureCard {
   public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
           throws CancelledException, SignatureCardException, InterruptedException;
 
-  /**
-   * TODO
-   * @return
-   */
-  public boolean ifdSupportsFeature(byte feature);
+  public CCID getReader();
 
   /**
    * Sets the local for evtl. required callbacks (e.g. PINSpec)
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java b/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java
new file mode 100644
index 00000000..2c56ce98
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.ccid;
+
+import at.gv.egiz.smcc.*;
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface CCID {
+
+
+  String[] FEATURES = new String[]{"NO_FEATURE",
+    "FEATURE_VERIFY_PIN_START",
+    "FEATURE_VERIFY_PIN_FINISH",
+    "FEATURE_MODIFY_PIN_START",
+    "FEATURE_MODIFY_PIN_FINISH",
+    "FEATURE_GET_KEY_PRESSED",
+    "FEATURE_VERIFY_PIN_DIRECT",
+    "FEATURE_MODIFY_PIN_DIRECT",
+    "FEATURE_MCT_READER_DIRECT",
+    "FEATURE_MCT_UNIVERSAL",
+    "FEATURE_IFD_PIN_PROPERTIES",
+    "FEATURE_ABORT",
+    "FEATURE_SET_SPE_MESSAGE",
+    "FEATURE_VERIFY_PIN_DIRECT_APP_ID",
+    "FEATURE_MODIFY_PIN_DIRECT_APP_ID",
+    "FEATURE_WRITE_DISPLAY",
+    "FEATURE_GET_KEY",
+    "FEATURE_IFD_DISPLAY_PROPERTIES"};
+  
+  Byte FEATURE_IFD_PIN_PROPERTIES = new Byte((byte) 10);
+  Byte FEATURE_MCT_READER_DIRECT = new Byte((byte) 8);
+  Byte FEATURE_MODIFY_PIN_DIRECT = new Byte((byte) 7);
+  Byte FEATURE_VERIFY_PIN_DIRECT = new Byte((byte) 6);
+  
+  Card connect() throws CardException;
+
+  boolean hasFeature(Byte feature);
+
+  /**
+   *
+   * @param feature the corresponding control code will be transmitted
+   * @param ctrlCommand
+   * @return
+   * @throws at.gv.egiz.smcc.SignatureCardException if feature is not supported
+   * or card communication fails
+   */
+  byte[] transmitControlCommand(Byte feature, byte[] ctrlCommand) throws SignatureCardException;
+
+  /**
+   * allow subclasses to override default (deal with reader bugs)
+   * @return
+   */
+  byte getbTimeOut();
+  byte getbTimeOut2();
+  byte getwPINMaxExtraDigitL();
+  byte getwPINMaxExtraDigitH();
+  byte getbEntryValidationCondition();
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java b/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java
new file mode 100644
index 00000000..2cc77dc9
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java
@@ -0,0 +1,264 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.ccid;
+
+import at.gv.egiz.smcc.*;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import java.util.HashMap;
+import java.util.Map;
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class DefaultReader implements CCID {
+
+  protected final static Log log = LogFactory.getLog(DefaultReader.class);
+
+  private static int CTL_CODE(int code) {
+    return 0x42000000 + code;
+  }
+
+  int IOCTL_GET_FEATURE_REQUEST = CTL_CODE(3400);
+
+
+  protected Card icc;
+  protected CardTerminal ct;
+
+  /**
+   * supported features and respective control codes
+   */
+  protected Map<Byte, Integer> features;
+
+  public DefaultReader(Card icc, CardTerminal ct) {
+    if (icc == null || ct == null) {
+      throw new NullPointerException("no card or card terminal provided");
+    }
+    this.icc = icc;
+    this.ct = ct;
+    features = queryFeatures(); 
+  }
+
+  public Card connect() throws CardException { //SignatureCardException {
+//      try {
+    icc = ct.connect("*");
+    return icc;
+//      } catch (CardException ex) {
+//        log.error(ex.getMessage(), ex);
+//        throw new SignatureCardException("Failed to connect to card: " + ex.getMessage());
+//      }
+  }
+
+  Map<Byte, Integer> queryFeatures() {
+    Map<Byte, Integer> features = new HashMap<Byte, Integer>();
+
+    if (icc == null) {
+      log.warn("invalid card handle, cannot query ifd features");
+    } else {
+      try {
+        if (log.isTraceEnabled()) {
+          log.trace("GET_FEATURE_REQUEST " +
+                  Integer.toHexString(IOCTL_GET_FEATURE_REQUEST) +
+                  " on " + ct.getName());
+        }
+        byte[] resp = icc.transmitControlCommand(IOCTL_GET_FEATURE_REQUEST,
+                new byte[]{});
+
+        if (log.isTraceEnabled()) {
+          log.trace("Response TLV " + SMCCHelper.toString(resp));
+        }
+        // tag
+        // length in bytes (always 4)
+        // control code value for supported feature (in big endian)
+        for (int i = 0; i < resp.length; i += 6) {
+          Byte feature = new Byte(resp[i]);
+          int ioctlBigEndian = (resp[i + 2] << 24) |
+                  (resp[i + 3] << 16) | (resp[i + 4] << 8) | resp[i + 5];
+          Integer ioctl = new Integer(ioctlBigEndian);
+          if (log.isInfoEnabled()) {
+            log.info("CCID supports " + FEATURES[feature.intValue()] +
+                    ": " + Integer.toHexString(ioctl.intValue()));
+          }
+          features.put(feature, ioctl);
+        }
+      } catch (CardException ex) {
+        log.debug("Failed to query CCID features: " + ex.getMessage());
+        log.trace(ex);
+        log.info("CCID does not support PINPad");
+      }
+    }
+    return features;
+  }
+
+  @Override
+  public boolean hasFeature(Byte feature) {
+    if (features != null) {
+      return features.containsKey(feature);
+    }
+    return false;
+  }
+
+//  public Integer getIOCTL(Byte feature) {
+//    if (features != null) {
+//      return features.get(feature);
+//    }
+//    return null;
+//  }
+
+  @Override
+  public byte[] transmitControlCommand(Byte feature, byte[] ctrlCommand)
+          throws SignatureCardException {
+    try {
+      if (!features.containsKey(feature)) {
+        throw new SignatureCardException(FEATURES[feature.intValue()] + " not supported");
+      }
+      int ioctl = features.get(feature);
+      if (log.isTraceEnabled()) {
+        log.trace("CtrlCommand (" + Integer.toHexString(ioctl) +
+                ")  " + SMCCHelper.toString(ctrlCommand));
+      }
+      byte[] resp = icc.transmitControlCommand(ioctl, ctrlCommand);
+      if (log.isTraceEnabled()) {
+        log.trace("CtrlCommand Response " + SMCCHelper.toString(resp));
+      }
+      return resp;
+    } catch (CardException ex) {
+      log.error(ex.getMessage());
+      throw new SignatureCardException("Failed to transmit CtrlCommand for " +
+              FEATURES[feature.intValue()]);
+    }
+  }
+
+
+  @Override
+  public byte getbTimeOut() {
+    return (byte) 0x3c;    // (max 1min on ReinerSCT),
+                           // 0x00=default, 0x1e = 30sec
+  }
+
+  @Override
+  public byte getbTimeOut2() {
+    return (byte) 0x00;    // default
+  }
+
+  @Override
+  public byte getwPINMaxExtraDigitL() {
+    return (byte) 0x12;
+  }
+
+  @Override
+  public byte getwPINMaxExtraDigitH() {
+    return (byte) 0x00;
+  }
+
+  @Override
+  public byte getbEntryValidationCondition() {
+    return (byte) 0x02;    // validation key pressed
+  }
+
+
+  //  protected byte ifdGetKeyPressed() throws CardException {
+//    if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+//
+//      Long controlCode = (Long) IFD_IOCTL.get(new Byte((byte) 0x05));
+//
+//      byte key = 0x00;
+//      while (key == 0x00) {
+//
+//        byte[] resp = card_.transmitControlCommand(controlCode.intValue(), new byte[] {});
+//
+//        if (resp != null && resp.length > 0) {
+//          key = resp[0];
+//        }
+//      }
+//
+//      System.out.println("Key: " + key);
+//
+//    }
+//
+//    return 0x00;
+//  }
+//
+//  protected byte[] ifdVerifyPINFinish() throws CardException {
+//    if (ifdSupportsFeature(FEATURE_VERIFY_PIN_DIRECT)) {
+//
+//      Long controlCode = (Long) IFD_IOCTL.get(new Byte((byte) 0x02));
+//
+//      byte[] resp = card_.transmitControlCommand(controlCode.intValue(), new byte[] {});
+//
+//      System.out.println("CommandResp: " + toString(resp));
+//
+//      return resp;
+//
+//    }
+//
+//    return null;
+//  }
+
+
+  /**
+   * assumes ifdSupportsVerifyPIN() == true
+   * @param pinVerifyStructure
+   * @return
+   * @throws javax.smartcardio.CardException
+   */
+//  protected byte[] ifdVerifyPIN(byte[] pinVerifyStructure) throws CardException {
+//
+////      Long ctrlCode = (Long) ifdFeatures.get(FEATURE_IFD_PIN_PROPERTIES);
+////      if (ctrlCode != null) {
+////        if (log.isTraceEnabled()) {
+////          log.trace("PIN_PROPERTIES CtrlCode " + Integer.toHexString(ctrlCode.intValue()));
+////        }
+////        byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), new byte[] {});
+////
+////        if (log.isTraceEnabled()) {
+////          log.trace("PIN_PROPERTIES Response " + SMCCHelper.toString(resp));
+////        }
+////      }
+//
+//
+//      Long ctrlCode = (Long) ifdFeatures.get(FEATURE_VERIFY_PIN_DIRECT);
+//      if (ctrlCode == null) {
+//        throw new NullPointerException("no CtrlCode for FEATURE_VERIFY_PIN_DIRECT");
+//      }
+//
+//      if (log.isTraceEnabled()) {
+//        log.trace("VERIFY_PIN_DIRECT CtrlCode " + Integer.toHexString(ctrlCode.intValue()) +
+//                ", PIN_VERIFY_STRUCTURE " + SMCCHelper.toString(pinVerifyStructure));
+//      }
+//      byte[] resp = card_.transmitControlCommand(ctrlCode.intValue(), pinVerifyStructure);
+//
+//      if (log.isTraceEnabled()) {
+//        log.trace("VERIFY_PIN_DIRECT Response " + SMCCHelper.toString(resp));
+//      }
+//      return resp;
+//  }
+
+//  protected Long getControlCode(Byte feature) {
+//    if (ifdFeatures != null) {
+//      return ifdFeatures.get(feature);
+//    }
+//    return null;
+//  }
+
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ccid/GemplusGemPCPinpad.java b/smcc/src/main/java/at/gv/egiz/smcc/ccid/GemplusGemPCPinpad.java
new file mode 100644
index 00000000..903b11fc
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ccid/GemplusGemPCPinpad.java
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.ccid;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardTerminal;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class GemplusGemPCPinpad extends DefaultReader {
+
+  protected final static Log log = LogFactory.getLog(GemplusGemPCPinpad.class);
+
+  public GemplusGemPCPinpad(Card icc, CardTerminal ct) {
+    super(icc, ct);
+    log.info("Initializing Gemplus GemPC Pinpad reader");
+    log.info("Gemplus GemPC Pinpad allows PINs to have 4-8 digits");
+
+  }
+
+  @Override
+  public byte getbTimeOut() {
+    return (byte) 0x3c;    // 0x00 default = 15sec
+                           // max 40sec (?)
+  }
+
+  @Override
+  public byte getbTimeOut2() {
+    return (byte) 0x00;    // 0x00 default = 15sec
+  }
+
+  @Override
+  public byte getwPINMaxExtraDigitL() {
+    return (byte) 0x08; 
+  }
+
+  @Override
+  public byte getwPINMaxExtraDigitH() {
+    return (byte) 0x04;
+  }
+
+  @Override
+  public byte getbEntryValidationCondition() {
+    return (byte) 0x02;    // validation key pressed
+  }
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ccid/ReaderFactory.java b/smcc/src/main/java/at/gv/egiz/smcc/ccid/ReaderFactory.java
new file mode 100644
index 00000000..2cfcef19
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ccid/ReaderFactory.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.smcc.ccid;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardTerminal;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class ReaderFactory {
+
+  public static CCID getReader(Card icc, CardTerminal ct) {
+    if ("Gemplus GemPC Pinpad 00 00".equals(ct.getName())) {
+      return new GemplusGemPCPinpad(icc, ct);
+    }
+    return new DefaultReader(icc, ct);
+  }
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java
new file mode 100644
index 00000000..5839d14a
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java
@@ -0,0 +1,135 @@
+/*
+ * To change this template, choose Tools | Templates
+ * and open the template in the editor.
+ */
+
+package at.gv.egiz.smcc;
+
+import at.gv.egiz.smcc.SignatureCard.KeyboxName;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import java.util.List;
+import java.util.Locale;
+import javax.smartcardio.ResponseAPDU;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+import org.junit.Test;
+import static org.junit.Assert.*;
+
+/**
+ *
+ * @author clemens
+ */
+@Ignore
+public class ACOSCardTest {
+
+  static ACOSCard card;
+  static PINSpec infPin, decPin, sigPin;
+
+    public ACOSCardTest() {
+    }
+
+  @BeforeClass
+  public static void setUpClass() throws Exception {
+    SMCCHelper smccHelper = new SMCCHelper();
+      switch (smccHelper.getResultCode()) {
+        case SMCCHelper.CARD_FOUND:
+          SignatureCard sigCard = smccHelper.getSignatureCard(Locale.GERMAN);
+          if (sigCard instanceof ACOSCard) {
+            System.out.println("ACOS card found");
+            card = (ACOSCard) sigCard;
+            List<PINSpec> pinSpecs = card.getPINSpecs();
+            infPin = pinSpecs.get(ACOSCard.PINSPEC_INF);
+            decPin = pinSpecs.get(ACOSCard.PINSPEC_DEC);
+            sigPin = pinSpecs.get(ACOSCard.PINSPEC_SIG);
+          } else {
+            throw new Exception("not STARCOS card: " + sigCard.toString());
+          }
+          break;
+        default:
+          throw new Exception("no card found");
+      }
+  }
+
+  @AfterClass
+  public static void tearDownClass() throws Exception {
+  }
+
+    @Before
+    public void setUp() {
+    }
+
+    @After
+    public void tearDown() {
+    }
+
+
+
+  /**
+   * Test of verifyPIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testVerifyPIN_pinpad() throws Exception {
+    System.out.println("verifyPIN (pinpad)");
+    assertNotNull(card);
+
+    card.verifyPIN(decPin, new PINProvider() {
+
+      @Override
+      public char[] providePIN(PINSpec spec, int retries) {
+        return null;
+      }
+    });
+  }
+
+  /**
+   * Test of verifyPIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testVerifyPIN_internal() throws Exception {
+    System.out.println("verifyPIN (internal)");
+    assertNotNull(card);
+
+    card.reset();
+
+    card.getCard().beginExclusive();
+
+    // 0x6700 without sending an APDU prior to send CtrlCmd
+    System.out.println("WARNING: this command will fail if no card " +
+            "communication took place prior to sending the CtrlCommand");
+    int retries = card.verifyPIN(decPin.getKID(), null); //"1397".toCharArray());
+
+    System.out.println("VERIFY PIN returned " + retries);
+    card.getCard().endExclusive();
+  }
+
+  /**
+   * Test of changePIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testChangePIN() throws Exception {
+    System.out.println("changePIN");
+    assertNotNull(card);
+
+    card.reset();
+    int retries = card.changePIN(decPin.getKID(), null, null);
+
+    System.out.println("CHANGE PIN returned " + retries);
+  }
+
+  /**
+   * Test of reset method, of class STARCOSCard.
+   */
+  @Test
+  public void testReset() throws Exception {
+    System.out.println("reset");
+    assertNotNull(card);
+    card.reset();
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java
new file mode 100644
index 00000000..9be8db00
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java
@@ -0,0 +1,267 @@
+/*
+ * To change this template, choose Tools | Templates
+ * and open the template in the editor.
+ */
+
+package at.gv.egiz.smcc;
+
+import at.gv.egiz.smcc.SignatureCard.KeyboxName;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import java.util.List;
+import java.util.Locale;
+import javax.smartcardio.ResponseAPDU;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+import org.junit.Test;
+import static org.junit.Assert.*;
+
+/**
+ *
+ * @author clemens
+ */
+@Ignore
+public class STARCOSCardTest {
+
+  static STARCOSCard card;
+  static PINSpec cardPin, ssPin;
+
+    public STARCOSCardTest() {
+    }
+
+  @BeforeClass
+  public static void setUpClass() throws Exception {
+    SMCCHelper smccHelper = new SMCCHelper();
+      switch (smccHelper.getResultCode()) {
+        case SMCCHelper.CARD_FOUND:
+          SignatureCard sigCard = smccHelper.getSignatureCard(Locale.GERMAN);
+          if (sigCard instanceof STARCOSCard) {
+            System.out.println("STARCOS card found");
+            card = (STARCOSCard) sigCard;
+            List<PINSpec> pinSpecs = card.getPINSpecs();
+            cardPin = pinSpecs.get(STARCOSCard.PINSPEC_CARD);
+            ssPin = pinSpecs.get(STARCOSCard.PINSPEC_SS);
+
+          } else {
+            throw new Exception("not STARCOS card: " + sigCard.toString());
+          }
+          break;
+        default:
+          throw new Exception("no card found");
+      }
+  }
+
+  @AfterClass
+  public static void tearDownClass() throws Exception {
+  }
+
+    @Before
+    public void setUp() {
+    }
+
+    @After
+    public void tearDown() {
+    }
+
+  /**
+   * Test of getCertificate method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testGetCertificate() throws Exception {
+    System.out.println("getCertificate");
+    KeyboxName keyboxName = null;
+    STARCOSCard instance = new STARCOSCard();
+    byte[] expResult = null;
+    byte[] result = instance.getCertificate(keyboxName);
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+  /**
+   * Test of getInfobox method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testGetInfobox() throws Exception {
+    System.out.println("getInfobox");
+    String infobox = "";
+    PINProvider provider = null;
+    String domainId = "";
+    STARCOSCard instance = new STARCOSCard();
+    byte[] expResult = null;
+    byte[] result = instance.getInfobox(infobox, provider, domainId);
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+  /**
+   * Test of createSignature method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testCreateSignature() throws Exception {
+    System.out.println("createSignature");
+    byte[] hash = null;
+    KeyboxName keyboxName = null;
+    PINProvider provider = null;
+    STARCOSCard instance = new STARCOSCard();
+    byte[] expResult = null;
+    byte[] result = instance.createSignature(hash, keyboxName, provider);
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+  /**
+   * Test of selectFileFID method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testSelectFileFID() throws Exception {
+    System.out.println("selectFileFID");
+    byte[] fid = null;
+    STARCOSCard instance = new STARCOSCard();
+    ResponseAPDU expResult = null;
+    ResponseAPDU result = instance.selectFileFID(fid);
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+  /**
+   * Test of verifyPIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testVerifyPIN_pinpad() throws Exception {
+    System.out.println("verifyPIN (pinpad)");
+    assertNotNull(card);
+
+    card.verifyPIN(cardPin, new PINProvider() {
+
+      @Override
+      public char[] providePIN(PINSpec spec, int retries) {
+        return null;
+      }
+    });
+  }
+
+  /**
+   * Test of verifyPIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testVerifyPIN_internal() throws Exception {
+    System.out.println("verifyPIN (internal)");
+    assertNotNull(card);
+
+    card.reset();
+
+    card.getCard().beginExclusive();
+
+    // 0x6700 without sending an APDU prior to send CtrlCmd
+    System.out.println("WARNING: this command will fail if no card " +
+            "communication took place prior to sending the CtrlCommand");
+    int retries = card.verifyPIN(cardPin.getKID(), null); //"1397".toCharArray());
+
+    System.out.println("VERIFY PIN returned " + retries);
+    card.getCard().endExclusive();
+  }
+
+  /**
+   * Test of verifyPIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testVerifyPIN_byte() throws Exception {
+    System.out.println("verifyPIN");
+    byte kid = 0;
+    STARCOSCard instance = new STARCOSCard();
+    int expResult = 0;
+    int result = instance.verifyPIN(kid);
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+  /**
+   * Test of changePIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testChangePIN() throws Exception {
+    System.out.println("changePIN");
+    assertNotNull(card);
+
+    card.reset();
+    int retries = card.changePIN(cardPin.getKID(), null, null);
+
+    System.out.println("CHANGE PIN returned " + retries);
+  }
+
+  /**
+   * Test of activatePIN method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testActivatePIN() throws Exception {
+    System.out.println("activatePIN");
+    assertNotNull(card);
+
+    card.reset();
+    card.activatePIN(cardPin, new PINProvider() {
+
+      @Override
+      public char[] providePIN(PINSpec spec, int retries) throws CancelledException, InterruptedException {
+        return null;
+      }
+    });
+  }
+
+  /**
+   * Test of encodePINBlock method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testEncodePINBlock() throws Exception {
+    System.out.println("encodePINBlock");
+    char[] pin = null;
+    STARCOSCard instance = new STARCOSCard();
+    byte[] expResult = null;
+    byte[] result = instance.encodePINBlock(pin);
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+  /**
+   * Test of reset method, of class STARCOSCard.
+   */
+  @Test
+  public void testReset() throws Exception {
+    System.out.println("reset");
+    assertNotNull(card);
+    card.reset();
+  }
+
+  /**
+   * Test of toString method, of class STARCOSCard.
+   */
+  @Test
+  @Ignore
+  public void testToString() {
+    System.out.println("toString");
+    STARCOSCard instance = new STARCOSCard();
+    String expResult = "";
+    String result = instance.toString();
+    assertEquals(expResult, result);
+    // TODO review the generated test code and remove the default call to fail.
+    fail("The test case is a prototype.");
+  }
+
+}
\ No newline at end of file
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
index e32f08d4..e2499023 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
@@ -35,7 +35,7 @@ public abstract class AbstractPINProvider implements PINProvider, ActionListener
 
   protected String action;
 
-  private boolean actionPerformed;
+  protected boolean actionPerformed;
 
 //  protected void waitForAction() throws InterruptedException {
 //    super.wait();
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
index 670b71dc..ce1b2d00 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
@@ -18,6 +18,7 @@
 package at.gv.egiz.bku.smccstal;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.ccid.CCID;
 import at.gv.egiz.smcc.PINProvider;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.stal.signedinfo.SignedInfoType;
@@ -32,7 +33,7 @@ public abstract class PINProviderFactory {
   
   public static PINProviderFactory getInstance(SignatureCard forCard,
           BKUGUIFacade gui) {
-    if (forCard.ifdSupportsFeature(SignatureCard.FEATURE_VERIFY_PIN_DIRECT)) {
+    if (forCard.getReader().hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
       return new PinpadPINProviderFactory(gui);
     } else {
       return new SoftwarePINProviderFactory(gui);
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java
index 55321b72..c109ceba 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PinpadPINProviderFactory.java
@@ -21,9 +21,8 @@ import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.PINProvider;
 import at.gv.egiz.smcc.PINSpec;
-import at.gv.egiz.stal.HashDataInput;
 import at.gv.egiz.stal.signedinfo.SignedInfoType;
-import java.util.List;
+import java.security.DigestException;
 
 /**
  *
@@ -51,8 +50,9 @@ public class PinpadPINProviderFactory extends PINProviderFactory {
 
 //    protected BKUGUIFacade gui;
     protected SecureViewer viewer;
+    protected ViewerThread viewerThread;
     protected SignedInfoType signedInfo;
-    protected List<HashDataInput> hashDataInputs;
+
 
     private SignaturePinProvider(SecureViewer viewer,
             SignedInfoType signedInfo) {
@@ -60,61 +60,92 @@ public class PinpadPINProviderFactory extends PINProviderFactory {
       this.signedInfo = signedInfo;
     }
 
+    protected class ViewerThread extends Thread {
+
+      PINSpec pinSpec;
+      int retries;
+
+      public ViewerThread(PINSpec pinSpec, int retries) {
+        this.pinSpec = pinSpec;
+        this.retries = retries;
+      }
+
+      @Override
+      public void run() {
+
+        try {
+
+          gui.showPinpadSignaturePINDialog(pinSpec, retries,
+              SignaturePinProvider.this, "secureViewer");
+
+          while (true) {
+            waitForAction();
+
+            if ("secureViewer".equals(action)) {
+              viewer.displayDataToBeSigned(signedInfo,
+                      SignaturePinProvider.this, "pinEntry");
+            } else if ("pinEntry".equals(action)) {
+              gui.showPinpadSignaturePINDialog(pinSpec, retries,
+                      SignaturePinProvider.this, "secureViewer");
+            } else {
+              log.error("unsupported action command: " + action);
+            }
+          }
+
+        } catch (DigestException ex) {
+          log.error("Bad digest value: " + ex.getMessage());
+          gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
+                  new Object[]{ex.getMessage()});
+        } catch (InterruptedException ex) {
+          log.info("pinpad secure viewer thread interrupted");
+        } catch (Exception ex) {
+          log.error("Could not display hashdata inputs: " +
+                  ex.getMessage());
+          gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
+                  new Object[]{ex.getMessage()});
+        }
+      }
+    }
+
     @Override
     public char[] providePIN(PINSpec spec, int retries)
             throws CancelledException, InterruptedException {
 
-      showPinpadPINDialog(retries, spec);
+      if (viewerThread != null) {
+        updateViewerThread(retries);
+      } else {
+        viewerThread = new ViewerThread(spec, -1);
+        viewerThread.start();
+      }
+//      if (viewerThread != null) {
+//        log.trace("interrupt old secure viewer thread");
+//        viewerThread.interrupt();
+//      }
+//      viewerThread = new ViewerThread(spec, (retry) ? retries : -1);
+//      log.trace("start new secure viewer thread");
+//      viewerThread.start();
+
       retry = true;
       return null;
-
-//      do {
-//        waitForAction();
-//        gui.showWaitDialog(null);
-//
-//        if ("hashData".equals(action)) {
-//          // show pin dialog in background
-//          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
-//                  this, "sign",
-//                  this, "cancel",
-//                  this, "hashData");
-//
-//          viewer.displayDataToBeSigned(signedInfo.getReference());
-//
-//        } else if ("sign".equals(action)) {
-//          retry = true;
-//          return gui.getPin();
-//        } else if ("hashDataDone".equals(action)) {
-//          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
-//                  this, "sign",
-//                  this, "cancel",
-//                  this, "hashData");
-//        } else if ("cancel".equals(action) ||
-//                "error".equals(action)) {
-//          throw new CancelledException(spec.getLocalizedName() +
-//                  " entry cancelled");
-//        }
-//      } while (true);
     }
 
-    private void showPinpadPINDialog(int retries, PINSpec pinSpec) {
-      String title, message;
-      Object[] params;
-      if (retry) {
-        title = BKUGUIFacade.TITLE_RETRY;
-        message = BKUGUIFacade.MESSAGE_RETRIES;
-        params = new Object[]{String.valueOf(retries)};
-      } else {
-        title = BKUGUIFacade.TITLE_SIGN;
-        message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
-        String pinSize = String.valueOf(pinSpec.getMinLength());
-        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
-          pinSize += "-" + pinSpec.getMaxLength();
-        }
-        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
-      }
-      gui.showMessageDialog(title, message, params);
+    private synchronized void updateViewerThread(int retries) {
+      log.trace("update viewer thread");
+      viewerThread.retries = retries;
+      action = "pinEntry";
+      actionPerformed = true;
+      notify();
     }
+
+
+//    @Override
+//    protected void finalize() throws Throwable {
+//      if (viewerThread != null) {
+//        viewerThread.interrupt();
+//      }
+//      log.info("finalizing Pinpad SignaturePinProvider");
+//      super.finalize();
+//    }
   }
 
   class CardPinProvider extends AbstractPINProvider {
@@ -151,5 +182,5 @@ public class PinpadPINProviderFactory extends PINProviderFactory {
       gui.showMessageDialog(title, message, params);
     }
   }
-}
+  }
 
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java
index c395679a..2ee37dc1 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SecureViewer.java
@@ -14,12 +14,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-
 package at.gv.egiz.bku.smccstal;
 
-import at.gv.egiz.stal.signedinfo.ReferenceType;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.awt.event.ActionListener;
 import java.security.DigestException;
-import java.util.List;
 
 /**
  *
@@ -38,7 +37,7 @@ public interface SecureViewer {
    * (or any other digest computation error occurs)
    * @throws java.lang.Exception
    */
-  void displayDataToBeSigned(List<ReferenceType> signedReferences) 
-          throws DigestException, Exception;
-
+  void displayDataToBeSigned(SignedInfoType signedInfo,
+          ActionListener okListener, String okCommand)
+        throws DigestException, Exception;
 }
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
index ac510f38..7a4f6572 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
@@ -33,7 +33,6 @@ import org.apache.commons.logging.LogFactory;
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
-import at.gv.egiz.smcc.PINProvider;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.SignatureCard.KeyboxName;
@@ -47,11 +46,12 @@ import at.gv.egiz.stal.signedinfo.ObjectFactory;
 import at.gv.egiz.stal.signedinfo.SignedInfoType;
 import at.gv.egiz.stal.util.JCEAlgorithmNames;
 
-public abstract class SignRequestHandler extends AbstractRequestHandler implements SecureViewer {
+public class SignRequestHandler extends AbstractRequestHandler {
 
     private static Log log = LogFactory.getLog(SignRequestHandler.class);
     private static JAXBContext jaxbContext;
     private PINProviderFactory pinProviderFactory;
+    private SecureViewer secureViewer;
     
     static {
         try {
@@ -61,6 +61,10 @@ public abstract class SignRequestHandler extends AbstractRequestHandler implemen
         }
     }
 
+    public SignRequestHandler(SecureViewer secureViewer) {
+      this.secureViewer = secureViewer;
+    }
+
     @SuppressWarnings("unchecked")
     @Override
     public STALResponse handleRequest(STALRequest request) throws InterruptedException {
@@ -85,10 +89,8 @@ public abstract class SignRequestHandler extends AbstractRequestHandler implemen
                 if (pinProviderFactory == null) {
                   pinProviderFactory = PINProviderFactory.getInstance(card, gui);
                 }
-                PINProvider pinProvider = pinProviderFactory.
-                        getSignaturePINProvider(this, si.getValue());
-                
-                byte[] resp = card.createSignature(md.digest(), kb, pinProvider);
+                byte[] resp = card.createSignature(md.digest(), kb, 
+                        pinProviderFactory.getSignaturePINProvider(secureViewer, si.getValue()));
                 if (resp == null) {
                     return new ErrorResponse(6001);
                 }
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java
index 54a34280..7d36c2c3 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SoftwarePINProviderFactory.java
@@ -49,7 +49,6 @@ public class SoftwarePINProviderFactory extends PINProviderFactory {
 //    protected BKUGUIFacade gui;
     protected SecureViewer viewer;
     protected SignedInfoType signedInfo;
-    protected List<HashDataInput> hashDataInputs;
 
     private SignaturePinProvider(SecureViewer viewer,
             SignedInfoType signedInfo) {
@@ -64,22 +63,14 @@ public class SoftwarePINProviderFactory extends PINProviderFactory {
       gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
               this, "sign",
               this, "cancel",
-              this, "hashData");
+              this, "secureViewer");
 
       do {
         waitForAction();
-        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
-                BKUGUIFacade.MESSAGE_WAIT);
-
-        if ("hashData".equals(action)) {
-          // show pin dialog in background
-          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
-                  this, "sign",
-                  this, "cancel",
-                  this, "hashData");
 
+        if ("secureViewer".equals(action)) {
           try {
-            viewer.displayDataToBeSigned(signedInfo.getReference());
+            viewer.displayDataToBeSigned(signedInfo, this, "pinEntry");
           } catch (DigestException ex) {
             log.error("Bad digest value: " + ex.getMessage());
             gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
@@ -93,17 +84,23 @@ public class SoftwarePINProviderFactory extends PINProviderFactory {
                     this, "error");
           }
         } else if ("sign".equals(action)) {
+          gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
           retry = true;
           return gui.getPin();
-        } else if ("hashDataDone".equals(action)) {
+        } else if ("pinEntry".equals(action)) {
           gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
                   this, "sign",
                   this, "cancel",
-                  this, "hashData");
+                  this, "secureViewer");
         } else if ("cancel".equals(action) ||
                 "error".equals(action)) {
+          gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
           throw new CancelledException(spec.getLocalizedName() +
                   " entry cancelled");
+        } else {
+          log.error("unknown action command " + action);
         }
       } while (true);
     }
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index 51dfe0da..1c1cb833 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -1,5 +1,6 @@
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.ccid.CCID;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -109,10 +110,10 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       }
 
       @Override
-      public boolean ifdSupportsFeature(byte feature) {
-        return false;
+      public CCID getReader() {
+        throw new UnsupportedOperationException("Not supported yet.");
       }
-     
+
    };
     return false;
   }
-- 
cgit v1.2.3


From 6cb4a071eab9a3b8cf78b8ec7e407aa148f2d038 Mon Sep 17 00:00:00 2001
From: mcentner <mcentner@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Wed, 1 Jul 2009 13:03:41 +0000
Subject: Major refactoring of SMCC

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@381 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../smccstal/ext/PINManagementRequestHandler.java  |  306 ++----
 .../java/at/gv/egiz/bku/local/app/BKULauncher.java |    3 -
 BKUOnline/src/main/webapp/WEB-INF/wsdl/stal.wsdl   |    2 +-
 smcc/pom.xml                                       |    5 +
 smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java |   30 -
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   | 1089 ++++++++++---------
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     |  541 +---------
 .../at/gv/egiz/smcc/CardNotSupportedException.java |   44 +-
 .../java/at/gv/egiz/smcc/ChangePINProvider.java    |   33 +-
 .../gv/egiz/smcc/ChangeReferenceDataAPDUSpec.java  |   95 ++
 .../at/gv/egiz/smcc/ExclSignatureCardProxy.java    |  110 ++
 smcc/src/main/java/at/gv/egiz/smcc/Exclusive.java  |   28 +
 .../main/java/at/gv/egiz/smcc/LogCardChannel.java  |  129 +++
 .../at/gv/egiz/smcc/NewReferenceDataAPDUSpec.java  |   60 ++
 .../at/gv/egiz/smcc/PINConfirmationException.java  |    2 +
 .../java/at/gv/egiz/smcc/PINFormatException.java   |    2 +
 .../java/at/gv/egiz/smcc/PINMgmtSignatureCard.java |   41 +
 .../gv/egiz/smcc/PINOperationAbortedException.java |    2 +
 .../src/main/java/at/gv/egiz/smcc/PINProvider.java |   44 +-
 smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java    |   34 +-
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java | 1110 ++++++++------------
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |   61 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |   69 +-
 .../at/gv/egiz/smcc/SignatureCardException.java    |   45 +-
 .../java/at/gv/egiz/smcc/SignatureCardFactory.java |   49 +-
 .../main/java/at/gv/egiz/smcc/VerifyAPDUSpec.java  |  200 ++++
 smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java  |   28 +-
 .../java/at/gv/egiz/smcc/ccid/DefaultReader.java   |  357 ++++++-
 .../at/gv/egiz/smcc/conf/SMCCConfiguration.java    |    2 +
 .../java/at/gv/egiz/smcc/util/ISO7816Utils.java    |  359 +++++++
 .../egiz/smcc/util/TransparentFileInputStream.java |  194 ++++
 .../test/java/at/gv/egiz/smcc/ACOSCardTest.java    |  135 ---
 .../test/java/at/gv/egiz/smcc/AbstractAppl.java    |   56 +
 smcc/src/test/java/at/gv/egiz/smcc/CardAppl.java   |   43 +
 .../test/java/at/gv/egiz/smcc/CardChannelEmul.java |   52 +
 smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java   |  106 ++
 .../java/at/gv/egiz/smcc/CardTerminalEmul.java     |   64 ++
 smcc/src/test/java/at/gv/egiz/smcc/CardTest.java   |  298 ++++++
 .../test/java/at/gv/egiz/smcc/CardTestSuite.java   |   29 +
 smcc/src/test/java/at/gv/egiz/smcc/File.java       |   38 +
 smcc/src/test/java/at/gv/egiz/smcc/PIN.java        |   41 +
 .../test/java/at/gv/egiz/smcc/STARCOSCardTest.java |  267 -----
 .../egiz/smcc/TransparentFileInputStreamTest.java  |  208 ++++
 .../test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java |  151 +++
 .../test/java/at/gv/egiz/smcc/acos/A03ApplSIG.java |   77 ++
 .../at/gv/egiz/smcc/acos/A03CardChannelEmul.java   |   98 ++
 .../java/at/gv/egiz/smcc/acos/A03CardEmul.java     |   36 +
 .../java/at/gv/egiz/smcc/acos/A03CardTest.java     |   91 ++
 .../test/java/at/gv/egiz/smcc/acos/A04ApplDEC.java |  296 ++++++
 .../test/java/at/gv/egiz/smcc/acos/A04ApplSIG.java |   87 ++
 .../at/gv/egiz/smcc/acos/A04CardChannelEmul.java   |   75 ++
 .../java/at/gv/egiz/smcc/acos/A04CardEmul.java     |   37 +
 .../java/at/gv/egiz/smcc/acos/A04CardTest.java     |  143 +++
 .../test/java/at/gv/egiz/smcc/acos/ACOSAppl.java   |   79 ++
 .../java/at/gv/egiz/smcc/acos/ACOSApplDEC.java     |  334 ++++++
 .../java/at/gv/egiz/smcc/acos/ACOSApplSIG.java     |  302 ++++++
 .../at/gv/egiz/smcc/acos/ACOSCardChannelEmul.java  |  261 +++++
 .../java/at/gv/egiz/smcc/acos/ACOSCardEmul.java    |   38 +
 .../java/at/gv/egiz/smcc/acos/ACOSCardTest.java    |  243 +++++
 .../at/gv/egiz/smcc/acos/ACOSCardTestSuite.java    |   27 +
 .../java/at/gv/egiz/smcc/starcos/STARCOSAppl.java  |   95 ++
 .../starcos/STARCOSApplGewoehnlicheSignatur.java   |  332 ++++++
 .../gv/egiz/smcc/starcos/STARCOSApplInfobox.java   |  160 +++
 .../smcc/starcos/STARCOSApplSichereSignatur.java   |  347 ++++++
 .../egiz/smcc/starcos/STARCOSCardChannelEmul.java  |  375 +++++++
 .../at/gv/egiz/smcc/starcos/STARCOSCardEmul.java   |   50 +
 .../at/gv/egiz/smcc/starcos/STARCOSCardTest.java   |  297 ++++++
 .../at/gv/egiz/smcc/util/ISO7816UtilsTest.java     |  175 +++
 .../bku/smccstal/InfoBoxReadRequestHandler.java    |    4 +-
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |   35 +-
 70 files changed, 8026 insertions(+), 2630 deletions(-)
 delete mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ChangeReferenceDataAPDUSpec.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ExclSignatureCardProxy.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/Exclusive.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/LogCardChannel.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/NewReferenceDataAPDUSpec.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/VerifyAPDUSpec.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/util/TransparentFileInputStream.java
 delete mode 100644 smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/CardAppl.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/CardChannelEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/CardTerminalEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/CardTestSuite.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/File.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/PIN.java
 delete mode 100644 smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/TransparentFileInputStreamTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplSIG.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardChannelEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplDEC.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplSIG.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardChannelEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSAppl.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardChannelEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTestSuite.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/util/ISO7816UtilsTest.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
index 72a7c4cc..e0b09d63 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
@@ -16,41 +16,32 @@
  */
 package at.gv.egiz.bku.smccstal.ext;
 
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade;
-import at.gv.egiz.bku.gui.PINManagementGUIFacade.DIALOG;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
 import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
-import at.gv.egiz.bku.smccstal.PINProviderFactory;
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
 import at.gv.egiz.smcc.PINConfirmationException;
 import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINMgmtSignatureCard;
 import at.gv.egiz.smcc.PINOperationAbortedException;
-import at.gv.egiz.smcc.PINProvider;
 import at.gv.egiz.smcc.PINSpec;
-import at.gv.egiz.smcc.STARCOSCard;
-import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.TimeoutException;
-import at.gv.egiz.smcc.VerificationFailedException;
-import at.gv.egiz.smcc.util.SMCCHelper;
+import at.gv.egiz.smcc.PINMgmtSignatureCard.PIN_STATE;
 import at.gv.egiz.stal.ErrorResponse;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
 import at.gv.egiz.stal.ext.PINManagementRequest;
 import at.gv.egiz.stal.ext.PINManagementResponse;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import javax.smartcardio.Card;
-import javax.smartcardio.CardChannel;
-import javax.smartcardio.CardException;
-import javax.smartcardio.CommandAPDU;
-import javax.smartcardio.ResponseAPDU;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 
 /**
  *
@@ -60,23 +51,36 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
   protected static final Log log = LogFactory.getLog(PINManagementRequestHandler.class);
 
-  protected Map<PINSpec, STATUS> pinStatuses;
+  protected Map<PINSpec, STATUS> pinStates = new HashMap<PINSpec, STATUS>();
 
   @Override
   public STALResponse handleRequest(STALRequest request) throws InterruptedException {
     if (request instanceof PINManagementRequest) {
 
-      PINManagementGUIFacade gui = (PINManagementGUIFacade) this.gui;
+    PINManagementGUIFacade gui = (PINManagementGUIFacade) this.gui;
+      
+    PINSpec selectedPIN = null;
 
-      PINSpec selectedPIN = null;
+    try {
 
-      try {
+      if (card instanceof PINMgmtSignatureCard) {
 
-      pinStatuses = getPINStatuses();
-      
-      gui.showPINManagementDialog(pinStatuses,
-              this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
-              this, "cancel");
+        // update all PIN states
+        for (PINSpec pinSpec : ((PINMgmtSignatureCard) card).getPINSpecs()) {
+          updatePINState(pinSpec, STATUS.UNKNOWN);
+        }
+        
+        gui.showPINManagementDialog(pinStates, this, "activate_enterpin",
+              "change_enterpin", "unblock_enterpuk", "verify_enterpin", this,
+              "cancel");
+        
+      } else {
+        
+        // card does not support PIN management
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_UNSUPPORTED_CARD,
+              null, this, "cancel");
+        
+      }
 
       while (true) {
 
@@ -97,9 +101,9 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
           try {
             if ("activate_enterpin".equals(actionCommand)) {
               log.info("activate " + selectedPIN.getLocalizedName());
-              card.activatePIN(selectedPIN,
+              ((PINMgmtSignatureCard) card).activatePIN(selectedPIN,
                       ppfac.getActivatePINProvider());
-              updatePINStatus(selectedPIN, STATUS.ACTIV);
+              updatePINState(selectedPIN, STATUS.ACTIV);
               gui.showMessageDialog(PINManagementGUIFacade.TITLE_ACTIVATE_SUCCESS,
                       PINManagementGUIFacade.MESSAGE_ACTIVATE_SUCCESS,
                       new Object[] {selectedPIN.getLocalizedName()},
@@ -107,9 +111,9 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
               waitForAction();
             } else if ("change_enterpin".equals(actionCommand)) {
               log.info("change " + selectedPIN.getLocalizedName());
-              card.changePIN(selectedPIN, 
+              ((PINMgmtSignatureCard) card).changePIN(selectedPIN, 
                       ppfac.getChangePINProvider());
-              updatePINStatus(selectedPIN, STATUS.ACTIV);
+              updatePINState(selectedPIN, STATUS.ACTIV);
               gui.showMessageDialog(PINManagementGUIFacade.TITLE_CHANGE_SUCCESS,
                       PINManagementGUIFacade.MESSAGE_CHANGE_SUCCESS,
                       new Object[] {selectedPIN.getLocalizedName()},
@@ -118,13 +122,13 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
             } else if ("unblock_enterpuk".equals(actionCommand)) {
               log.info("unblock " + selectedPIN.getLocalizedName());
-              card.unblockPIN(selectedPIN,
+              ((PINMgmtSignatureCard) card).unblockPIN(selectedPIN,
                       ppfac.getUnblockPINProvider());
             } else if ("verify_enterpin".equals(actionCommand)) {
               log.info("verify " + selectedPIN.getLocalizedName());
-              card.verifyPIN(selectedPIN,
+              ((PINMgmtSignatureCard) card).verifyPIN(selectedPIN,
                       ppfac.getVerifyPINProvider());
-              updatePINStatus(selectedPIN, STATUS.ACTIV);
+              updatePINState(selectedPIN, STATUS.ACTIV);
             }
           } catch (CancelledException ex) {
             log.trace("cancelled");
@@ -137,14 +141,14 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
             waitForAction();
           } catch (LockedException ex) {
             log.error(selectedPIN.getLocalizedName() + " locked");
-            updatePINStatus(selectedPIN, STATUS.BLOCKED);
+            updatePINState(selectedPIN, STATUS.BLOCKED);
             gui.showErrorDialog(PINManagementGUIFacade.ERR_LOCKED,
                     new Object[] {selectedPIN.getLocalizedName()},
                     this, null);
             waitForAction();
           } catch (NotActivatedException ex) {
             log.error(selectedPIN.getLocalizedName() + " not active");
-            updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
+            updatePINState(selectedPIN, STATUS.NOT_ACTIV);
             gui.showErrorDialog(PINManagementGUIFacade.ERR_NOT_ACTIVE,
                     new Object[] {selectedPIN.getLocalizedName()},
                     this, null);
@@ -176,7 +180,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
         } // end if
 
         selectedPIN = null;
-        gui.showPINManagementDialog(pinStatuses,
+        gui.showPINManagementDialog(pinStates,
                 this, "activate_enterpin", "change_enterpin", "unblock_enterpuk", "verify_enterpin",
                 this, "cancel");
       } // end while
@@ -206,70 +210,6 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
     return true;
   }
 
-  private Map<PINSpec, STATUS> getPINStatuses() throws GetPINStatusException {
-    HashMap<PINSpec, STATUS> pinStatuses = new HashMap<PINSpec, STATUS>();
-    List<PINSpec> pins = card.getPINSpecs();
-
-    if (card instanceof STARCOSCard) {
-      Card icc = card.getCard();
-      try {
-        icc.beginExclusive();
-        CardChannel channel = icc.getBasicChannel();
-
-        for (PINSpec pinSpec : pins) {
-          byte kid = pinSpec.getKID();
-          byte[] contextAID = pinSpec.getContextAID();
-
-          if (contextAID != null) {
-            CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
-            ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
-            if (responseAPDU.getSW() != 0x9000) {
-              icc.endExclusive();
-              String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
-                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
-              log.error(msg);
-              throw new GetPINStatusException(msg);
-            }
-          }
-
-          CommandAPDU verifyAPDU = new CommandAPDU(new byte[] {
-            (byte) 0x00, (byte) 0x20, (byte) 00, kid });
-          ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
-
-          STATUS status = STATUS.UNKNOWN;
-          if (responseAPDU.getSW() == 0x6984) {
-            status = STATUS.NOT_ACTIV;
-          } else if (responseAPDU.getSW() == 0x63c0) {
-            status = STATUS.BLOCKED;
-          } else if (responseAPDU.getSW1() == 0x63) {
-            status = STATUS.ACTIV;
-          }
-          if (log.isDebugEnabled()) {
-            log.debug("PIN " + pinSpec.getLocalizedName() +
-                    " status: " + SMCCHelper.toString(responseAPDU.getBytes()));
-          }
-          pinStatuses.put(pinSpec, status);
-        }
-        return pinStatuses;
-
-      } catch (CardException ex) {
-        log.error("Failed to get PIN status: " + ex.getMessage(), ex);
-        throw new GetPINStatusException(ex.getMessage());
-      } finally {
-        try {
-          icc.endExclusive();
-        } catch (CardException ex) {
-          log.trace("failed to end exclusive card access: " + ex.getMessage());
-        }
-      }
-    } else {
-      for (PINSpec pinSpec : pins) {
-        pinStatuses.put(pinSpec, STATUS.UNKNOWN);
-      }
-    }
-    return pinStatuses;
-  }
-
   /**
    * query status for STARCOS card,
    * assume provided status for ACOS card
@@ -277,154 +217,28 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
    * @param status
    * @throws at.gv.egiz.smcc.SignatureCardException if query status fails
    */
-  private void updatePINStatus(PINSpec pinSpec, STATUS status) throws GetPINStatusException {
-    if (card instanceof STARCOSCard) {
-      Card icc = card.getCard();
-      try {
-        icc.beginExclusive();
-        CardChannel channel = icc.getBasicChannel();
-
-          byte kid = pinSpec.getKID();
-          byte[] contextAID = pinSpec.getContextAID();
-
-          if (contextAID != null) {
-            CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
-            ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
-            if (responseAPDU.getSW() != 0x9000) {
-              icc.endExclusive();
-              String msg = "Select AID " + SMCCHelper.toString(pinSpec.getContextAID()) +
-                  ": SW=" + Integer.toHexString(responseAPDU.getSW());
-              log.error(msg);
-              throw new GetPINStatusException(msg);
-            }
-          }
-
-          CommandAPDU verifyAPDU = new CommandAPDU(new byte[] {
-            (byte) 0x00, (byte) 0x20, (byte) 00, kid });
-          ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
-
-          status = STATUS.UNKNOWN;
-          if (responseAPDU.getSW() == 0x6984) {
-            status = STATUS.NOT_ACTIV;
-          } else if (responseAPDU.getSW() == 0x63c0) {
-            status = STATUS.BLOCKED;
-          } else if (responseAPDU.getSW1() == 0x63) {
-            status = STATUS.ACTIV;
-          }
-          if (log.isDebugEnabled()) {
-            log.debug(pinSpec.getLocalizedName() +
-                    " status: " + SMCCHelper.toString(responseAPDU.getBytes()));
-          }
-          pinStatuses.put(pinSpec, status);
-
-      } catch (CardException ex) {
-        log.error("Failed to get PIN status: " + ex.getMessage(), ex);
-        throw new GetPINStatusException(ex.getMessage());
-      } finally {
-        try {
-          icc.endExclusive();
-        } catch (CardException ex) {
-          log.warn("failed to end exclusive card access: " + ex.getMessage());
-        }
-      }
+  private void updatePINState(PINSpec pinSpec, STATUS status)
+      throws GetPINStatusException {
+
+    PINMgmtSignatureCard pmCard = ((PINMgmtSignatureCard) card);
+    PIN_STATE pinState;
+    try {
+      pinState = pmCard.getPINState(pinSpec);
+    } catch (SignatureCardException e) {
+      String msg = "Failed to get PIN status for pin '"
+          + pinSpec.getLocalizedName() + "'.";
+      log.info(msg, e);
+      throw new GetPINStatusException(msg);
+    }
+    if (pinState == PIN_STATE.ACTIV) {
+      pinStates.put(pinSpec, STATUS.ACTIV);
+    } else if (pinState == PIN_STATE.NOT_ACTIV) {
+      pinStates.put(pinSpec, STATUS.NOT_ACTIV);
+    } else if (pinState == PIN_STATE.BLOCKED) {
+      pinStates.put(pinSpec, STATUS.BLOCKED);
     } else {
-      pinStatuses.put(pinSpec, status);
+      pinStates.put(pinSpec, status);
     }
   }
 
-//  /**
-//   * provides oldPin and newPin from one dialog,
-//   * and don't know whether providePIN() or provideOldPIN() is called first.
-//   */
-//  class SoftwarePinProvider implements PINProvider {
-//
-//    private PINManagementGUIFacade.DIALOG type;
-//    private boolean retry = false;
-//
-//    private char[] newPin;
-//    private char[] oldPin;
-//
-//    public SoftwarePinProvider(DIALOG type) {
-//      this.type = type;
-//    }
-//
-//    @Override
-//    public char[] providePIN(PINSpec spec, int retries)
-//            throws CancelledException, InterruptedException {
-//      if (newPin == null) {
-//        getPINs(spec, retries);
-//      }
-//      char[] pin = newPin;
-//      newPin = null;
-//      return pin;
-//    }
-//
-//    @Override
-//    public char[] provideOldPIN(PINSpec spec, int retries)
-//            throws CancelledException, InterruptedException {
-//      if (oldPin == null) {
-//        getPINs(spec, retries);
-//      }
-//      char[] pin = oldPin;
-//      oldPin = null;
-//      return pin;
-//    }
-//
-//    private void getPINs(PINSpec spec, int retries)
-//            throws InterruptedException, CancelledException {
-//      PINManagementGUIFacade gui =
-//              (PINManagementGUIFacade) PINManagementRequestHandler.this.gui;
-//
-//      if (retry) {
-//        gui.showPINDialog(type, spec, retries,
-//              PINManagementRequestHandler.this, "exec",
-//              PINManagementRequestHandler.this, "back");
-//      } else {
-//        gui.showPINDialog(type, spec,
-//              PINManagementRequestHandler.this, "exec",
-//              PINManagementRequestHandler.this, "back");
-//      }
-//      waitForAction();
-//
-//      if (actionCommand.equals("exec")) {
-//        gui.showWaitDialog(null);
-//        retry = true;
-//        oldPin = gui.getOldPin();
-//        newPin = gui.getPin();
-//      } else if (actionCommand.equals("back")) {
-//        throw new CancelledException();
-//      } else {
-//        log.error("unsupported command " + actionCommand);
-//        throw new CancelledException();
-//      }
-//    }
-//  }
-//
-//
-//  class PinpadPinProvider implements PINProvider {
-//
-//    private PINManagementGUIFacade.DIALOG type;
-//    private boolean retry = false;
-//
-//    public PinpadPinProvider(DIALOG type) {
-//      this.type = type;
-//    }
-//
-//    @Override
-//    public char[] providePIN(PINSpec spec, int retries) {
-//      log.debug("provide pin for " + type);
-//      if (retry) {
-//        ((PINManagementGUIFacade) gui).showPinpadPINDialog(type, spec, retries);
-//      } else {
-//        ((PINManagementGUIFacade) gui).showPinpadPINDialog(type, spec, -1);
-//        retry = true;
-//      }
-//      return null;
-//    }
-//
-//    @Override
-//    public char[] provideOldPIN(PINSpec spec, int retries) {
-//      return null;
-//    }
-//  }
 }
diff --git a/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/BKULauncher.java b/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/BKULauncher.java
index 09695808..213114d0 100644
--- a/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/BKULauncher.java
+++ b/BKULocalApp/src/main/java/at/gv/egiz/bku/local/app/BKULauncher.java
@@ -24,9 +24,6 @@ import org.apache.commons.cli.PosixParser;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import at.gv.egiz.bku.local.ui.BKUControllerInterface;
-import at.gv.egiz.bku.local.ui.TrayIconDialog;
-import at.gv.egiz.bku.utils.HexDump;
 import at.gv.egiz.bku.utils.StreamUtil;
 
 public class BKULauncher implements BKUControllerInterface {
diff --git a/BKUOnline/src/main/webapp/WEB-INF/wsdl/stal.wsdl b/BKUOnline/src/main/webapp/WEB-INF/wsdl/stal.wsdl
index 9ef43f39..dc7ad8f1 100644
--- a/BKUOnline/src/main/webapp/WEB-INF/wsdl/stal.wsdl
+++ b/BKUOnline/src/main/webapp/WEB-INF/wsdl/stal.wsdl
@@ -24,7 +24,7 @@
     xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/">
     <types>
         <xsd:schema targetNamespace="http://www.egiz.gv.at/wsdl/stal">
-            <xsd:import namespace="http://www.egiz.gv.at/stal" schemaLocation="stal-service.xsd"/>
+            <xsd:import namespace="http://www.egiz.gv.at/stal" schemaLocation="stal.xsd"/>
             <!--xsd:import namespace="http://www.egiz.gv.at/stal" schemaLocation="stal-extended.xsd"/-->
         </xsd:schema>
         <!-- test 
diff --git a/smcc/pom.xml b/smcc/pom.xml
index 6a9f52a3..ce414318 100644
--- a/smcc/pom.xml
+++ b/smcc/pom.xml
@@ -32,6 +32,11 @@
       <artifactId>junit</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>iaik</groupId>
+      <artifactId>iaik_jce_full_signed</artifactId>
+      <scope>test</scope>
+    </dependency>
     <!-- FIXME just for testing 
     <dependency>
       <groupId>iaik</groupId>
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java
deleted file mode 100644
index 9fca6ab9..00000000
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOS04Card.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.smcc;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class ACOS04Card extends ACOSCard {
-
-  public ACOS04Card() {
-    pinSpecs.remove(PINSPEC_INF);
-  }
-
-}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index d064b821..9825978c 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -1,48 +1,47 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.ccid.CCID;
-import at.gv.egiz.smcc.util.SMCCHelper;
-import java.nio.ByteBuffer;
-import java.nio.CharBuffer;
-import java.nio.charset.Charset;
-
+import java.io.IOException;
+import java.security.AlgorithmParameters;
+import java.security.GeneralSecurityException;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.crypto.Cipher;
+import javax.crypto.SecretKey;
+import javax.crypto.SecretKeyFactory;
+import javax.crypto.spec.DESedeKeySpec;
+import javax.crypto.spec.IvParameterSpec;
+import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
 import javax.smartcardio.CommandAPDU;
 import javax.smartcardio.ResponseAPDU;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-public class ACOSCard extends AbstractSignatureCard {
+import at.gv.egiz.smcc.util.ISO7816Utils;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import at.gv.egiz.smcc.util.TransparentFileInputStream;
+
+public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureCard {
 
   private static Log log = LogFactory.getLog(ACOSCard.class);
 
@@ -69,6 +68,8 @@ public class ACOSCard extends AbstractSignatureCard {
       (byte) 0x01 };
 
   public static final byte[] EF_INFOBOX = new byte[] { (byte) 0xc0, (byte) 0x02 };
+  
+  public static final byte[] EF_INFO = new byte[] { (byte) 0xd0, (byte) 0x02 };
 
   public static final int EF_INFOBOX_MAX_SIZE = 1500;
 
@@ -90,7 +91,7 @@ public class ACOSCard extends AbstractSignatureCard {
       (byte) 0x14 // ECDSA
   };
 
-  public static final byte[] DST_DEC = new byte[] { (byte) 0x84, (byte) 0x01, // tag
+  public static final byte[] AT_DEC = new byte[] { (byte) 0x84, (byte) 0x01, // tag
       // ,
       // length
       // (
@@ -102,123 +103,278 @@ public class ACOSCard extends AbstractSignatureCard {
       (byte) 0x01 // RSA // TODO: Not verified yet
   };
 
-  protected static final int PINSPEC_INF = 0;
-  protected static final int PINSPEC_DEC = 1;
-  protected static final int PINSPEC_SIG = 2;
+  private static final PINSpec DEC_PIN_SPEC = new PINSpec(0, 8, "[0-9]",
+      "at/gv/egiz/smcc/ACOSCard", "dec.pin.name", KID_PIN_DEC, AID_DEC);
+
+  private static final PINSpec SIG_PIN_SPEC = new PINSpec(0, 8, "[0-9]",
+      "at/gv/egiz/smcc/ACOSCard", "sig.pin.name", KID_PIN_SIG, AID_SIG);
+
+  private static final PINSpec INF_PIN_SPEC = new PINSpec(0, 8, "[0-9]",
+      "at/gv/egiz/smcc/ACOSCard", "inf.pin.name", KID_PIN_INF, AID_DEC);
+  
+  /**
+   * The version of the card's digital signature application.
+   */
+  protected int appVersion = -1;
 
   public ACOSCard() {
     super("at/gv/egiz/smcc/ACOSCard");
-    pinSpecs.add(PINSPEC_INF,
-            new PINSpec(0, 8, "[0-9]", getResourceBundle().getString("inf.pin.name"), KID_PIN_INF, AID_DEC));
-    pinSpecs.add(PINSPEC_DEC, 
-            new PINSpec(0, 8, "[0-9]", getResourceBundle().getString("dec.pin.name"), KID_PIN_DEC, AID_DEC));
-    pinSpecs.add(PINSPEC_SIG, 
-            new PINSpec(0, 8, "[0-9]", getResourceBundle().getString("sig.pin.name"), KID_PIN_SIG, AID_SIG));
   }
 
-  /* (non-Javadoc)
-   * @see at.gv.egiz.smcc.SignatureCard#getCertificate(at.gv.egiz.smcc.SignatureCard.KeyboxName)
-   */
   @Override
+  public void init(Card card, CardTerminal cardTerminal) {
+    super.init(card, cardTerminal);
+
+    // determine application version
+    try {
+      CardChannel channel = getCardChannel();
+      // SELECT application
+      execSELECT_AID(channel, AID_SIG);
+      // SELECT file
+      execSELECT_FID(channel, EF_INFO);
+      // READ BINARY
+      TransparentFileInputStream is = ISO7816Utils.openTransparentFileInputStream(channel, 8);
+      appVersion = is.read();
+      log.info("a-sign premium application version = " + appVersion);
+    } catch (FileNotFoundException e) {
+      appVersion = 1;
+      log.info("a-sign premium application version = " + appVersion);
+    } catch (SignatureCardException e) {
+      log.warn(e);
+      appVersion = 0;
+    } catch (IOException e) {
+      log.warn(e);
+      appVersion = 0;
+    } catch (CardException e) {
+      log.warn(e);
+      appVersion = 0;
+    } 
+    
+    pinSpecs.add(DEC_PIN_SPEC);
+    pinSpecs.add(SIG_PIN_SPEC);
+    if (appVersion < 2) {
+      pinSpecs.add(INF_PIN_SPEC);
+    }
+
+  }
+
+  @Override
+  @Exclusive
   public byte[] getCertificate(KeyboxName keyboxName)
       throws SignatureCardException, InterruptedException {
-  
-    try {
-      
+    
+      byte[] aid;
+      byte[] fid;
       if (keyboxName == KeyboxName.SECURE_SIGNATURE_KEYPAIR) {
-        
-        try {
-          getCard().beginExclusive();
-          byte[] certificate = readTLVFile(AID_SIG, EF_C_CH_DS, EF_C_CH_DS_MAX_SIZE);
-          if (certificate == null) {
-            throw new NotActivatedException();
-          }
-          return certificate;
-        } catch (FileNotFoundException e) {
-          throw new NotActivatedException();
-        } finally {
-          getCard().endExclusive();
-        }
-        
+        aid = AID_SIG;
+        fid = EF_C_CH_DS;
       } else if (keyboxName == KeyboxName.CERITIFIED_KEYPAIR) {
-        
-        try {
-          getCard().beginExclusive();
-          byte[] certificate = readTLVFile(AID_DEC, EF_C_CH_EKEY, EF_C_CH_EKEY_MAX_SIZE);
-          if (certificate == null) {
-            throw new NotActivatedException();
-          }
-          return certificate;
-        } catch (FileNotFoundException e) {
-          throw new NotActivatedException();
-        } finally {
-          getCard().endExclusive();
-        }
-        
+        aid = AID_DEC;
+        fid = EF_C_CH_EKEY;
       } else {
         throw new IllegalArgumentException("Keybox " + keyboxName
             + " not supported.");
       }
 
-    } catch (CardException e) {
-      log.warn(e);
-      throw new SignatureCardException("Failed to access card.", e);
-    }
-    
+      try {
+        CardChannel channel = getCardChannel();
+        // SELECT application
+        execSELECT_AID(channel, aid);
+        // SELECT file
+        byte[] fcx = execSELECT_FID(channel, fid);
+        int maxSize = -1;
+        if (getAppVersion() < 2) {
+          maxSize = ISO7816Utils.getLengthFromFCx(fcx);
+          log.debug("Size of selected file = " + maxSize);
+        }
+        // READ BINARY
+        byte[] certificate = ISO7816Utils.readTransparentFileTLV(channel, maxSize, (byte) 0x30);
+        if (certificate == null) {
+          throw new NotActivatedException();
+        }
+        return certificate;
+      } catch (FileNotFoundException e) {
+        throw new NotActivatedException();
+      } catch (CardException e) {
+        log.info("Failed to get certificate.", e);
+        throw new SignatureCardException(e);
+      } 
+
+      
   }
 
-  /* (non-Javadoc)
-   * @see at.gv.egiz.smcc.SignatureCard#getInfobox(java.lang.String, at.gv.egiz.smcc.PINProvider, java.lang.String)
-   */
   @Override
+  @Exclusive
   public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
       throws SignatureCardException, InterruptedException {
+    
+    if ("IdentityLink".equals(infobox)) {
+      if (getAppVersion() < 2) {
+        return getIdentityLinkV1(provider, domainId);
+      } else {
+        return getIdentityLinkV2(provider, domainId);
+      }
+    } else {
+      throw new IllegalArgumentException("Infobox '" + infobox
+          + "' not supported.");
+    }
+  
+  }
+
+  protected byte[] getIdentityLinkV1(PINProvider provider, String domainId) 
+      throws SignatureCardException, InterruptedException {
+    
+    try {
+      CardChannel channel = getCardChannel();
+      // SELECT application
+      execSELECT_AID(channel, AID_DEC);
+      // SELECT file
+      byte[] fcx = execSELECT_FID(channel, EF_INFOBOX);
+      int maxSize = ISO7816Utils.getLengthFromFCx(fcx);
+      log.debug("Size of selected file = " + maxSize);
+      // READ BINARY
+      while(true) {
+        try {
+          return ISO7816Utils.readTransparentFileTLV(channel, maxSize, (byte) 0x30);
+        } catch (SecurityStatusNotSatisfiedException e) {
+          verifyPINLoop(channel, INF_PIN_SPEC, provider);
+        }
+      }
+      
+    } catch (FileNotFoundException e) {
+      throw new NotActivatedException();
+    } catch (CardException e) {
+      log.info("Faild to get infobox.", e);
+      throw new SignatureCardException(e);
+    }
+    
+  }
   
+  protected byte[] getIdentityLinkV2(PINProvider provider, String domainId)
+      throws SignatureCardException, InterruptedException {
+    
     try {
-      if ("IdentityLink".equals(infobox)) {
- 
-        PINSpec spec = pinSpecs.get(PINSPEC_INF);
-        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("inf.pin.name"));
+      CardChannel channel = getCardChannel();
+      // SELECT application
+      execSELECT_AID(channel, AID_DEC);
+      // SELECT file
+      execSELECT_FID(channel, EF_INFOBOX);
+      
+      // READ BINARY
+      TransparentFileInputStream is = ISO7816Utils.openTransparentFileInputStream(channel, -1);
+      
+      int b = is.read();
+      if (b == 0x00) {
+        return null;
+      }
+      if (b != 0x41 || is.read() != 0x49 || is.read() != 0x4b) {
+        String msg = "Infobox structure invalid.";
+        log.info(msg);
+        throw new SignatureCardException(msg);
+      }
         
-        int retries = -1;
-        boolean pinRequired = false;
+      b = is.read();
+      if (b != 0x01) {
+        String msg = "Infobox structure v" + b + " not supported.";
+        log.info(msg);
+        throw new SignatureCardException(msg);
+      }
+      
+      while ((b = is.read()) != 0x01 && b != 00) {
+        is.read(); // modifiers
+        is.skip(is.read() + (is.read() << 8)); // length
+      }
+      
+      if (b != 0x01) {
+        return null; 
+      }
+      
+      int modifiers = is.read();
+      int length = is.read() + (is.read() << 8);
 
-        do {
-          try {
-            getCard().beginExclusive();
-            if (pinRequired) {
-              char[] pin = provider.providePIN(spec, retries);
-              return readTLVFile(AID_DEC, EF_INFOBOX, pin, spec.getKID(), EF_INFOBOX_MAX_SIZE);
-            } else {
-              return readTLVFile(AID_DEC, EF_INFOBOX, EF_INFOBOX_MAX_SIZE);
-            }
-          } catch (FileNotFoundException e) {
-            throw new NotActivatedException();
-          } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequired = true;
-          } catch (VerificationFailedException e) {
-            pinRequired = true;
-            retries = e.getRetries();
-          } finally {
-            getCard().endExclusive();
-          }
-        } while (retries != 0);
+      byte[] bytes;
+      byte[] key = null;
+      
+      switch (modifiers) {
+      case 0x00:
+        bytes = new byte[length];
+        break;
+      case 0x01:
+        key = new byte[is.read() + (is.read() << 8)];
+        is.read(key);
+        bytes = new byte[length - key.length - 2];
+        break;
+      default:
+        String msg = "Compressed infobox structure not yet supported.";
+        log.info(msg);
+        throw new SignatureCardException(msg);
+      }
+      
+      is.read(bytes);
+      
+      if (key == null) {
+        return bytes;
+      }
 
-        throw new LockedException();
+      execMSE(channel, 0x41, 0xb8, new byte[] {
+          (byte) 0x84, (byte) 0x01, (byte) 0x88, (byte) 0x80, (byte) 0x01,
+          (byte) 0x02 });
 
-      } else {
-        throw new IllegalArgumentException("Infobox '" + infobox
-            + "' not supported.");
-      }
 
+      byte[] plainKey = null;
+
+      while (true) {
+        try {
+          plainKey = execPSO_DECIPHER(channel, key);
+          break;
+        } catch(SecurityStatusNotSatisfiedException e) {
+          verifyPINLoop(channel, DEC_PIN_SPEC, provider);
+        }
+      }
+      
+      try {
+        Cipher cipher = Cipher
+            .getInstance("DESede/CBC/PKCS5Padding");
+        byte[] iv = new byte[8];
+        Arrays.fill(iv, (byte) 0x00);
+        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
+        AlgorithmParameters parameters = AlgorithmParameters
+            .getInstance("DESede");
+        parameters.init(ivParameterSpec);
+
+        DESedeKeySpec keySpec = new DESedeKeySpec(plainKey);
+        SecretKeyFactory keyFactory = SecretKeyFactory
+            .getInstance("DESede");
+        SecretKey secretKey = keyFactory.generateSecret(keySpec);
+
+        cipher.init(Cipher.DECRYPT_MODE, secretKey, parameters);
+
+        return cipher.doFinal(bytes);
+
+      } catch (GeneralSecurityException e) {
+        String msg = "Failed to decrypt infobox.";
+        log.info(msg, e);
+        throw new SignatureCardException(msg, e);
+      }
+      
+      
+    } catch (FileNotFoundException e) {
+      throw new NotActivatedException();
     } catch (CardException e) {
-      log.warn(e);
-      throw new SignatureCardException("Failed to access card.", e);
+      log.info("Faild to get infobox.", e);
+      throw new SignatureCardException(e);
+    } catch (IOException e) {
+      if (e.getCause() instanceof SignatureCardException) {
+        throw (SignatureCardException) e.getCause();
+      } else {
+        throw new SignatureCardException(e);
+      }
     }
-  
+    
   }
-
+  
   @Override
+  @Exclusive
   public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
       PINProvider provider) throws SignatureCardException, InterruptedException {
   
@@ -228,87 +384,40 @@ public class ACOSCard extends AbstractSignatureCard {
   
     try {
       
-      if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)) {
-
-        PINSpec spec = pinSpecs.get(PINSPEC_SIG);
-        //new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
-        
-        int retries = -1;
-        char[] pin = null;
-
-        do {
-          pin = provider.providePIN(spec, retries);
-          try {
-            getCard().beginExclusive();
-            
-            // SELECT DF
-            selectFileFID(DF_SIG);
-            // VERIFY
-            retries = verifyPIN(KID_PIN_SIG, pin);
-            if (retries != -1) {
-              throw new VerificationFailedException(retries);
-            }
-            // MSE: SET DST
-            mseSetDST(0x81, 0xb6, DST_SIG);
-            // PSO: HASH
-            psoHash(hash);
-            // PSO: COMPUTE DIGITAL SIGNATURE
-            return psoComputDigitalSiganture();
+      CardChannel channel = getCardChannel();
 
-          } catch (SecurityStatusNotSatisfiedException e) {
-            retries = verifyPIN(KID_PIN_SIG);
-          } catch (VerificationFailedException e) {
-            retries = e.getRetries();
-          } finally {
-            getCard().endExclusive();
-          }
-        } while (retries != 0);
+      if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)) {
 
-        throw new LockedException();
+        PINSpec spec = SIG_PIN_SPEC;
         
+        // SELECT application
+        execSELECT_AID(channel, AID_SIG);
+        // MANAGE SECURITY ENVIRONMENT : SET DST
+        execMSE(channel, 0x41, 0xb6, DST_SIG);
+        // VERIFY
+        verifyPINLoop(channel, spec, provider);
+        // PERFORM SECURITY OPERATION : HASH
+        execPSO_HASH(channel, hash);
+        // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATRE
+        return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel);
     
       } else if (KeyboxName.CERITIFIED_KEYPAIR.equals(keyboxName)) {
         
-        PINSpec spec = pinSpecs.get(PINSPEC_DEC);
-        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("dec.pin.name"));
-
-        int retries = -1;
-        char[] pin = null;
-        boolean pinRequired = false;
+        PINSpec spec = DEC_PIN_SPEC;
 
-        do {
-          if (pinRequired) {
-            pin = provider.providePIN(spec, retries);
-          }
+        // SELECT application
+        execSELECT_AID(channel, AID_DEC);
+        // MANAGE SECURITY ENVIRONMENT : SET AT
+        execMSE(channel, 0x41, 0xa4, AT_DEC);
+        
+        while (true) {
           try {
-            getCard().beginExclusive();
-            
-            // SELECT DF
-            selectFileFID(DF_DEC);
-            // VERIFY
-            retries = verifyPIN(KID_PIN_DEC, pin);
-            if (retries != -1) {
-              throw new VerificationFailedException(retries);
-            }
-            // MSE: SET DST
-            mseSetDST(0x41, 0xa4, DST_DEC);
             // INTERNAL AUTHENTICATE
-            return internalAuthenticate(hash);
-            
-          } catch (FileNotFoundException e) {
-            throw new NotActivatedException();
+            return execINTERNAL_AUTHENTICATE(channel, hash);
           } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequired = true;
-            retries = verifyPIN(KID_PIN_DEC);
-          } catch (VerificationFailedException e) {
-            pinRequired = true;
-            retries = e.getRetries();
-          } finally {
-            getCard().endExclusive();
+            verifyPINLoop(channel, spec, provider);
           }
-        } while (retries != 0);
-
-        throw new LockedException();
+        }
 
       } else {
         throw new IllegalArgumentException("KeyboxName '" + keyboxName
@@ -321,377 +430,311 @@ public class ACOSCard extends AbstractSignatureCard {
     } 
       
   }
+  
+  public int getAppVersion() {
+    return appVersion;
+  }
 
-  ////////////////////////////////////////////////////////////////////////
-  // PROTECTED METHODS (assume exclusive card access)
-  ////////////////////////////////////////////////////////////////////////
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.AbstractSignatureCard#verifyPIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.PINProvider)
+   */
+  @Override
+  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+      throws LockedException, NotActivatedException, CancelledException,
+      TimeoutException, SignatureCardException, InterruptedException {
 
-  protected ResponseAPDU selectFileFID(byte[] fid) throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
-    return transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00,
-        0x00, fid, 256));
+    
+    try {
+      // SELECT application
+      execSELECT_AID(channel, pinSpec.getContextAID());
+      // VERIFY
+      verifyPIN(channel, pinSpec, pinProvider, -1);
+    } catch (CardException e) {
+      log.info("Failed to verify PIN.", e);
+      throw new SignatureCardException("Failed to verify PIN.", e);
+    }
+
   }
+  
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.AbstractSignatureCard#changePIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.ChangePINProvider)
+   */
+  @Override
+  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+      throws LockedException, NotActivatedException, CancelledException,
+      TimeoutException, SignatureCardException, InterruptedException {
 
-  private void mseSetDST(int p1, int p2, byte[] dst) throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x22, p1,
-        p2, dst));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("MSE:SET DST failed: SW="
-          + Integer.toHexString(resp.getSW()));
+    
+    try {
+      // SELECT application
+      execSELECT_AID(channel, pinSpec.getContextAID());
+      // CHANGE REFERENCE DATA
+      changePIN(channel, pinSpec, pinProvider, -1);
+    } catch (CardException e) {
+      log.info("Failed to change PIN.", e);
+      throw new SignatureCardException("Failed to change PIN.", e);
     }
+
   }
 
-  private void psoHash(byte[] hash) throws CardException, SignatureCardException {
-    CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x2A, 0x90,
-        0x81, hash));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("PSO:HASH failed: SW="
-          + Integer.toHexString(resp.getSW()));
-    }
+  @Override
+  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+      throws CancelledException, SignatureCardException, CancelledException,
+      TimeoutException, InterruptedException {
+    log.error("ACTIVATE PIN not supported by ACOS");
+    throw new SignatureCardException("PIN activation not supported by this card.");
   }
 
-  private byte[] psoComputDigitalSiganture() throws CardException,
-      SignatureCardException {
-    CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x2A, 0x9E,
-        0x9A, 256));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException(
-          "PSO: COMPUTE DIGITAL SIGNATRE failed: SW="
-              + Integer.toHexString(resp.getSW()));
-    } else {
-      return resp.getData();
-    }
+  @Override
+  public void unblockPIN(PINSpec pinSpec, PINProvider pinProvider)
+      throws CancelledException, SignatureCardException, InterruptedException {
+    throw new SignatureCardException("Unblock PIN not supported.");
   }
   
-  private byte[] internalAuthenticate(byte[] hash) throws CardException, SignatureCardException {
-    byte[] digestInfo = new byte[] {
-        (byte) 0x30, (byte) 0x21, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x05, (byte) 0x2B, (byte) 0x0E, 
-        (byte) 0x03, (byte) 0x02, (byte) 0x1A, (byte) 0x05, (byte) 0x00, (byte) 0x04
-    };
-    
-    byte[] data = new byte[digestInfo.length + hash.length + 1];
-    
-    System.arraycopy(digestInfo, 0, data, 0, digestInfo.length);
-    data[digestInfo.length] = (byte) hash.length;
-    System.arraycopy(hash, 0, data, digestInfo.length + 1, hash.length);
-    
-    CardChannel channel = getCardChannel();
-    
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x88, 0x10, 0x00, data, 256));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("INTERNAL AUTHENTICATE failed: SW=" + Integer.toHexString(resp.getSW()));
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.PINMgmtSignatureCard#getPINSpecs()
+   */
+  @Override
+  public List<PINSpec> getPINSpecs() {
+    if (getAppVersion() < 2) {
+      return Arrays.asList(new PINSpec[] {DEC_PIN_SPEC, SIG_PIN_SPEC, INF_PIN_SPEC});
     } else {
-      return resp.getData();
+      return Arrays.asList(new PINSpec[] {DEC_PIN_SPEC, SIG_PIN_SPEC});
     }
   }
 
-  /**
-   *
-   * @param kid
-   * @return -1
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.PINMgmtSignatureCard#getPINStatus(at.gv.egiz.smcc.PINSpec)
    */
   @Override
-  protected int verifyPIN(byte kid) {
-    log.debug("VERIFY PIN without PIN BLOCK not supported by ACOS");
-    return -1;
+  public PIN_STATE getPINState(PINSpec pinSpec) throws SignatureCardException {
+    return PIN_STATE.UNKNOWN;
   }
 
   @Override
-  protected int verifyPIN(byte kid, char[] pin)
-          throws LockedException, NotActivatedException, CancelledException, TimeoutException, PINFormatException, PINOperationAbortedException, SignatureCardException {
-    try {
-      byte[] sw;
-      if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-        log.debug("verify pin on cardreader");
-        sw = reader.verifyPinDirect(getPINVerifyStructure(kid));
-//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
-      } else if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_START)) {
-        log.debug("verify pin on cardreader");
-        sw = reader.verifyPin(getPINVerifyStructure(kid));
-      } else {
-        byte[] pinBlock = encodePINBlock(pin);
-        CardChannel channel = getCardChannel();
-        ResponseAPDU resp = transmit(channel,
-                new CommandAPDU(0x00, 0x20, 0x00, kid, pinBlock), false);
-        sw = new byte[2];
-        sw[0] = (byte) resp.getSW1();
-        sw[1] = (byte) resp.getSW2();
-      }
+  public String toString() {
+    return "a-sign premium";
+  }
 
-      //6A 00 (falshe P1/P2) nicht in contextAID
-      //69 85 (nutzungsbedingungen nicht erfüllt) in DF_Sig und nicht sigpin
-
-      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
-        return -1;
-      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
-        throw new LockedException("[63:c0]");
-      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
-        return sw[1] & 0x0f;
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
-        //Authentisierungsmethode gesperrt
-        throw new NotActivatedException("[69:83]");
-//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
-//        //referenzierte Daten sind reversibel gesperrt (invalidated)
-//        throw new NotActivatedException("[69:84]");
-//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
-//        //Benutzungsbedingungen nicht erfüllt
-//        throw new NotActivatedException("[69:85]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
-        throw new TimeoutException("[64:00]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
-        throw new CancelledException("[64:01]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x03) {
-        throw new PINFormatException("[64:03]");
-      }
-      log.error("Failed to verify pin: SW="
-              + SMCCHelper.toString(sw));
-      throw new SignatureCardException(SMCCHelper.toString(sw));
+  ////////////////////////////////////////////////////////////////////////
+  // PROTECTED METHODS (assume exclusive card access)
+  ////////////////////////////////////////////////////////////////////////
 
-    } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
-    }
+  protected void verifyPINLoop(CardChannel channel, PINSpec spec, PINProvider provider)
+      throws InterruptedException, LockedException, NotActivatedException,
+      TimeoutException, PINFormatException, PINOperationAbortedException,
+      SignatureCardException, CardException {
+    
+    int retries = -1;
+    do {
+      retries = verifyPIN(channel, spec, provider, retries);
+    } while (retries > 0);
+    
   }
 
-  /**
-   * SCARD_E_NOT_TRANSACTED inf/dec PIN not active (pcsc crash)
-   * @param kid
-   * @param oldPin
-   * @param newPin
-   * @return
-   * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.NotActivatedException
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
-  @Override
-  protected int changePIN(byte kid, char[] oldPin, char[] newPin)
-          throws LockedException, NotActivatedException, CancelledException, PINFormatException, PINConfirmationException, TimeoutException, PINOperationAbortedException, SignatureCardException {
-    try {
-       byte[] sw;
-      if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_DIRECT)) {
-        log.debug("modify pin on cardreader");
-        sw = reader.modifyPinDirect(getPINModifyStructure(kid));
-      } else if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_START)) {
-        log.debug("modify pin on cardreader");
-        sw = reader.modifyPin(getPINModifyStructure(kid));
-      } else {
-        byte[] cmd = new byte[16];
-        System.arraycopy(encodePINBlock(oldPin), 0, cmd, 0, 8);
-        System.arraycopy(encodePINBlock(newPin), 0, cmd, 8, 8);
-
-        CardChannel channel = getCardChannel();
+  protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
+      PINProvider provider, int retries) throws InterruptedException, CardException, SignatureCardException {
+    
+    VerifyAPDUSpec apduSpec = new VerifyAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x00, pinSpec.getKID(), (byte) 0x08,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00 }, 
+        0, VerifyAPDUSpec.PIN_FORMAT_ASCII, 8);
+    
+    ResponseAPDU resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    
+    if (resp.getSW() == 0x9000) {
+      return -1;
+    }
+    if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    }
 
-        ResponseAPDU resp = transmit(channel,
-                new CommandAPDU(0x00, 0x24, 0x00, kid, cmd), false);
+    switch (resp.getSW()) {
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
+  
+    default:
+      String msg = "VERIFY failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
 
-        sw = new byte[2];
-        sw[0] = (byte) resp.getSW1();
-        sw[1] = (byte) resp.getSW2();
-      }
+  }
 
-      // activates pin (newPIN) if not active
-      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
-        return -1;
-      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
-        throw new LockedException("[63:c0]");
-      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
-        return sw[1] & 0x0f;
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
-        //Authentisierungsmethode gesperrt
-        // sig-pin only (card not transacted for inf/dec pin)
-        throw new NotActivatedException("[69:83]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
-        throw new TimeoutException("[64:00]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
-        throw new CancelledException("[64:01]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x02) {
-        throw new PINConfirmationException("[64:02]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x03) {
-        throw new PINFormatException("[64:03]");
-      } else if (sw[0] == (byte) 0x6a && sw[1] == (byte) 0x80) {
-        log.info("invalid parameter, assume wrong pin size");
-        throw new PINFormatException("[6a:80]");
-      }
-      log.error("Failed to change pin: SW="
-              + SMCCHelper.toString(sw));
-      throw new SignatureCardException(SMCCHelper.toString(sw));
+  protected int changePIN(CardChannel channel, PINSpec pinSpec,
+      ChangePINProvider pinProvider, int retries) throws CancelledException, InterruptedException, CardException, SignatureCardException {
+
+    ChangeReferenceDataAPDUSpec apduSpec = new ChangeReferenceDataAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x24, (byte) 0x00, pinSpec.getKID(), (byte) 0x10,  
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00        
+        }, 
+        0, VerifyAPDUSpec.PIN_FORMAT_ASCII, 8);
+    
+    
+    
+    ResponseAPDU resp = reader.modify(channel, apduSpec, pinSpec, pinProvider, retries);
+    
+    if (resp.getSW() == 0x9000) {
+      return -1;
+    }
+    if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    }
+    
+    switch (resp.getSW()) {
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
+  
+    default:
+      String msg = "CHANGE REFERENCE DATA failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+    
+  }
 
-    } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
+  protected byte[] execSELECT_AID(CardChannel channel, byte[] aid)
+      throws SignatureCardException, CardException {
+
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x04, 0x00, aid, 256));
+
+    if (resp.getSW() == 0x6A82) {
+      String msg = "File or application not found AID="
+          + SMCCHelper.toString(aid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new FileNotFoundException(msg);
+    } else if (resp.getSW() != 0x9000) {
+      String msg = "Failed to select application AID="
+          + SMCCHelper.toString(aid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    } else {
+      return resp.getBytes();
     }
+
   }
+  
+  protected byte[] execSELECT_FID(CardChannel channel, byte[] fid)
+      throws SignatureCardException, CardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x00, 0x00, fid, 256));
+    
+    if (resp.getSW() == 0x6A82) {
+      String msg = "File or application not found FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new FileNotFoundException(msg);
+    } else if (resp.getSW() != 0x9000) {
+      String msg = "Failed to select application FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.error(msg);
+      throw new SignatureCardException(msg);
+    } else {
+      return resp.getBytes();
+    }
 
-  /**
-   * throws SignatureCardException (PIN activation not supported by ACOS)
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
-  @Override
-  public void activatePIN(byte kid, char[] pin)
-          throws SignatureCardException {
-    log.error("ACTIVATE PIN not supported by ACOS");
-    throw new SignatureCardException("PIN activation not supported by this card");
+    
   }
+  
+  protected void execMSE(CardChannel channel, int p1,
+      int p2, byte[] data) throws SignatureCardException, CardException {
 
-  /**
-   * ASCII encoded pin, padded with 0x00
-   * @param pin
-   * @return a 8 byte pin block
-   */
-  @Override
-  protected byte[] encodePINBlock(char[] pin) {
-//    byte[] asciiPIN = new String(pin).getBytes(Charset.forName("ASCII"));
-    CharBuffer chars = CharBuffer.wrap(pin);
-    ByteBuffer bytes = Charset.forName("ASCII").encode(chars);
-    byte[] asciiPIN = bytes.array();
-    byte[] encodedPIN = new byte[8];
-    System.arraycopy(asciiPIN, 0, encodedPIN, 0, Math.min(asciiPIN.length,
-        encodedPIN.length));
-//    System.out.println("ASCII encoded PIN block: " + SMCCHelper.toString(encodedPIN));
-    return encodedPIN;
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x22, p1, p2, data));
+
+    if (resp.getSW() != 0x9000) {
+      String msg = "MSE failed: SW="
+          + Integer.toHexString(resp.getSW());
+      log.error(msg);
+      throw new SignatureCardException(msg);
+    } 
+    
   }
   
-  private byte[] getPINVerifyStructure(byte kid) {
-      
-      byte bTimeOut = reader.getbTimeOut();   
-      byte bTimeOut2 = reader.getbTimeOut2(); 
-      byte bmFormatString = (byte) 0x82;      // 1 0000 0 10
-                                              // ^------------ System unit = byte
-                                              //   ^^^^------- PIN position in the frame = 1 byte
-                                              //        ^----- PIN justification left
-                                              //          ^^-- ASCII format
-      byte bmPINBlockString = (byte) 0x08;    // 0000 1000
-                                              // ^^^^--------- PIN length size: 0 bits
-                                              //      ^^^^---- Length PIN = 8 bytes
-      byte bmPINLengthFormat = (byte) 0x00;   // 000 0 0000
-                                              //     ^-------- System bit units is bit
-                                              //       ^^^^--- no PIN length
-      byte wPINMaxExtraDigitL = //TODO compare ints, not bytes
-              (reader.getwPINMaxExtraDigitL() < (byte) 0x08) ?
-                reader.getwPINMaxExtraDigitL() : (byte) 0x08;
-      byte wPINMaxExtraDigitH =               
-              (reader.getwPINMaxExtraDigitH() > (byte) 0x00) ?
-                reader.getwPINMaxExtraDigitH() : (byte) 0x00;
-      byte bEntryValidationCondition = 
-              reader.getbEntryValidationCondition();
-      byte bNumberMessage = (byte) 0x00;      // No message
-      byte wLangIdL = (byte) 0x0C;            
-      byte wLangIdH = (byte) 0x04;            
-      byte bMsgIndex = (byte) 0x00;           
-
-      byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x20, (byte) 0x00, kid, (byte) 0x08, 
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,      
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00       
-      };
-
-      int offset = 0;
-      byte[] pinVerifyStructure = new byte[offset + 19 + apdu.length];
-      pinVerifyStructure[offset++] = bTimeOut;
-      pinVerifyStructure[offset++] = bTimeOut2;
-      pinVerifyStructure[offset++] = bmFormatString;
-      pinVerifyStructure[offset++] = bmPINBlockString;
-      pinVerifyStructure[offset++] = bmPINLengthFormat;
-      pinVerifyStructure[offset++] = wPINMaxExtraDigitL;
-      pinVerifyStructure[offset++] = wPINMaxExtraDigitH;
-      pinVerifyStructure[offset++] = bEntryValidationCondition;
-      pinVerifyStructure[offset++] = bNumberMessage;
-      pinVerifyStructure[offset++] = wLangIdL;
-      pinVerifyStructure[offset++] = wLangIdH;
-      pinVerifyStructure[offset++] = bMsgIndex;
-
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-
-      pinVerifyStructure[offset++] = (byte) apdu.length;
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      System.arraycopy(apdu, 0, pinVerifyStructure, offset, apdu.length);
-
-      return pinVerifyStructure;
+  protected byte[] execPSO_DECIPHER(CardChannel channel, byte [] cipher) throws CardException, SignatureCardException {
+    
+    byte[] data = new byte[cipher.length + 1];
+    data[0] = 0x00;
+    System.arraycopy(cipher, 0, data, 1, cipher.length);
+    ResponseAPDU resp = channel.transmit(new CommandAPDU(0x00, 0x2A, 0x80, 0x86, data, 256));
+    if (resp.getSW() == 0x6982) {
+      throw new SecurityStatusNotSatisfiedException();
+    } else if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException(
+          "PSO - DECIPHER failed: SW="
+          + Integer.toHexString(resp.getSW()));
+    }
+    
+    return resp.getData();
+    
   }
   
-  public byte[] getPINModifyStructure(byte kid) {
-
-      byte bTimeOut = reader.getbTimeOut();
-      byte bTimeOut2 = reader.getbTimeOut2();
-      byte bmFormatString = (byte) 0x82;      // 1 0000 0 10
-                                              // ^------------ System unit = byte
-                                              //   ^^^^------- PIN position in the frame = 1 byte
-                                              //        ^----- PIN justification left
-                                              //          ^^-- ASCII format
-      byte bmPINBlockString = (byte) 0x08;    // 0000 1000
-                                              // ^^^^--------- PIN length size: 0 bits
-                                              //      ^^^^---- Length PIN = 8 bytes
-      byte bmPINLengthFormat = (byte) 0x00;   // 000 0 0000
-                                              //     ^-------- System bit units is bit
-                                              //       ^^^^--- no PIN length 
-      byte bInsertionOffsetOld = (byte) 0x00; // insertion position offset in bytes
-      byte bInsertionOffsetNew = (byte) 0x08; 
-      byte wPINMaxExtraDigitL =
-              (reader.getwPINMaxExtraDigitL() < (byte) 0x08) ?
-                reader.getwPINMaxExtraDigitL() : (byte) 0x08;
-      byte wPINMaxExtraDigitH =
-              (reader.getwPINMaxExtraDigitH() > (byte) 0x00) ?
-                reader.getwPINMaxExtraDigitH() : (byte) 0x00;
-      byte bConfirmPIN = (byte) 0x03;
-      byte bEntryValidationCondition =
-              reader.getbEntryValidationCondition();
-      byte bNumberMessage = (byte) 0x03;      
-      byte wLangIdL = (byte) 0x0C;            
-      byte wLangIdH = (byte) 0x04;            
-      byte bMsgIndex1 = (byte) 0x00;           
-      byte bMsgIndex2 = (byte) 0x01;           
-      byte bMsgIndex3 = (byte) 0x02;           
-
-      byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10,  
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,       
-        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00        
-      };
-
-      int offset = 0;
-      byte[] pinModifyStructure = new byte[offset + 24 + apdu.length];
-      pinModifyStructure[offset++] = bTimeOut;
-      pinModifyStructure[offset++] = bTimeOut2;
-      pinModifyStructure[offset++] = bmFormatString;
-      pinModifyStructure[offset++] = bmPINBlockString;
-      pinModifyStructure[offset++] = bmPINLengthFormat;
-      pinModifyStructure[offset++] = bInsertionOffsetOld;
-      pinModifyStructure[offset++] = bInsertionOffsetNew;
-      pinModifyStructure[offset++] = wPINMaxExtraDigitL;
-      pinModifyStructure[offset++] = wPINMaxExtraDigitH;
-      pinModifyStructure[offset++] = bConfirmPIN;
-      pinModifyStructure[offset++] = bEntryValidationCondition;
-      pinModifyStructure[offset++] = bNumberMessage;
-      pinModifyStructure[offset++] = wLangIdL;
-      pinModifyStructure[offset++] = wLangIdH;
-      pinModifyStructure[offset++] = bMsgIndex1;
-      pinModifyStructure[offset++] = bMsgIndex2;
-      pinModifyStructure[offset++] = bMsgIndex3;
-
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-
-      pinModifyStructure[offset++] = (byte) apdu.length;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      System.arraycopy(apdu, 0, pinModifyStructure, offset, apdu.length);
-
-      return pinModifyStructure;
+  protected void execPSO_HASH(CardChannel channel, byte[] hash) throws CardException, SignatureCardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x2A, 0x90, 0x81, hash));
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("PSO - HASH failed: SW="
+          + Integer.toHexString(resp.getSW()));
+    }
+    
   }
+  
+  protected byte[] execPSO_COMPUTE_DIGITAL_SIGNATURE(CardChannel channel) throws CardException,
+      SignatureCardException {
 
-  @Override
-  public String toString() {
-    return "a-sign premium";
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, 256));
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException(
+          "PSO - COMPUTE DIGITAL SIGNATRE failed: SW="
+              + Integer.toHexString(resp.getSW()));
+    } else {
+      return resp.getData();
+    }
+
+  }
+  
+  protected byte[] execINTERNAL_AUTHENTICATE(CardChannel channel, byte[] hash) throws CardException,
+      SignatureCardException {
+
+    byte[] digestInfo = new byte[] { (byte) 0x30, (byte) 0x21, (byte) 0x30,
+        (byte) 0x09, (byte) 0x06, (byte) 0x05, (byte) 0x2B, (byte) 0x0E,
+        (byte) 0x03, (byte) 0x02, (byte) 0x1A, (byte) 0x05, (byte) 0x00,
+        (byte) 0x04 };
+    
+    byte[] data = new byte[digestInfo.length + hash.length + 1];
+    
+    System.arraycopy(digestInfo, 0, data, 0, digestInfo.length);
+    data[digestInfo.length] = (byte) hash.length;
+    System.arraycopy(hash, 0, data, digestInfo.length + 1, hash.length);
+    
+    ResponseAPDU resp = channel.transmit(new CommandAPDU(0x00, 0x88, 0x10, 0x00, data, 256));
+    if (resp.getSW() == 0x6982) {
+      throw new SecurityStatusNotSatisfiedException();
+    } else if (resp.getSW() == 0x6983) {
+      throw new LockedException();
+    } else if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("INTERNAL AUTHENTICATE failed: SW="
+          + Integer.toHexString(resp.getSW()));
+    } else {
+      return resp.getData();
+    }
   }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index f0f8b8c8..54b4c7fe 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -1,55 +1,37 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.ccid.CCID;
-import at.gv.egiz.smcc.ccid.ReaderFactory;
-import at.gv.egiz.smcc.util.SMCCHelper;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 import java.util.ResourceBundle;
 
-import javax.smartcardio.ATR;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CardTerminal;
-import javax.smartcardio.CommandAPDU;
-import javax.smartcardio.ResponseAPDU;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
+import at.gv.egiz.smcc.ccid.CCID;
+import at.gv.egiz.smcc.ccid.ReaderFactory;
+
 public abstract class AbstractSignatureCard implements SignatureCard {
 
   private static Log log = LogFactory.getLog(AbstractSignatureCard.class);
@@ -61,14 +43,8 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
   private Locale locale = Locale.getDefault();
 
-  int ifs_ = 254;
-
   private Card card_;
   
-  /**
-   * The card terminal that connects the {@link #card_}.  
-   */
-//  private CardTerminal cardTerminal;
   protected CCID reader;
 
   protected AbstractSignatureCard(String resourceBundleName) {
@@ -89,379 +65,10 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     return sb.toString();
   }
 
-  /**
-   * Select an application using AID as DF name according to ISO/IEC 7816-4
-   * section 8.2.2.2.
-   * 
-   * @param dfName
-   *          AID of the application to be selected
-   * 
-   * @return the response data of the response APDU if SW=0x9000
-   * 
-   * @throws CardException
-   *           if card communication fails
-   * 
-   * @throws SignatureCardException
-   *           if application selection fails (e.g. an application with the
-   *           given AID is not present on the card)
-   */
-  protected byte[] selectFileAID(byte[] dfName) throws CardException, SignatureCardException {
-    CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel,
-            new CommandAPDU(0x00, 0xA4, 0x04, 0x00, dfName, 256));
-//            new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, dfName));
-    if (resp.getSW() != 0x9000) {
-      String msg = "Failed to select application AID=" + SMCCHelper.toString(dfName) +
-              ": SW=" + Integer.toHexString(resp.getSW());
-      log.error(msg);
-      throw new SignatureCardException(msg);
-    } else {
-      return resp.getBytes();
-    }
-  }
-
-  protected abstract ResponseAPDU selectFileFID(byte[] fid) throws CardException,
-      SignatureCardException;
-
-  /**
-   * VERIFY APDU without PIN BLOCK
-   * Not supported by ACOS cards (and GemPC Pinpad?)
-   * @param kid
-   * @return the number of possible tries until card is blocked or -1 if unknown
-   * (ACOS does not support this VERIFY APDU type)
-   * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.NotActivatedException
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
-  protected abstract int verifyPIN(byte kid)
-          throws LockedException, NotActivatedException, SignatureCardException;
-
-  /**
-   * VERIFY APDU with PIN BLOCK
-   * If IFD supports VERIFY_PIN on pinpad, parameter pin may be empty.
-   * @param kid
-   * @param pin to be encoded in the PIN BLOCK
-   * @return -1 if VERIFY PIN was successful, or the number of possible retries
-   * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.NotActivatedException
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
-  protected abstract int verifyPIN(byte kid, char[] pin)
-          throws LockedException, NotActivatedException, CancelledException, PINFormatException, TimeoutException, PINOperationAbortedException, SignatureCardException;
-  
-  /**
-   * CHANGE(?) APDU
-   * If IFD supports VERIFY_PIN on pinpad, parameter pin may be empty.
-   * @param kid
-   * @param pin
-   * @throws at.gv.egiz.smcc.SignatureCardException if activation fails
-   */
-  protected abstract void activatePIN(byte kid, char[] pin)
-          throws CancelledException, PINFormatException, PINConfirmationException, TimeoutException, PINOperationAbortedException, SignatureCardException;
-
-  /**
-   * CHANGE(?) APDU
-   * If IFD supports VERIFY_PIN on pinpad, parameter pin may be empty.
-   * @param kid
-   * @param pin
-   * @return -1 if CHANGE PIN was successful, or the number of possible retries
-   * @throws at.gv.egiz.smcc.SignatureCardException if change fails
-   */
-  protected abstract int changePIN(byte kid, char[] oldPin, char[] newPin)
-          throws LockedException, NotActivatedException, CancelledException, PINFormatException, PINConfirmationException, TimeoutException, PINOperationAbortedException, SignatureCardException;
-
-  /**
-   * encode the pin as needed in VERIFY/CHANGE APDUs
-   * @param pin
-   * @return
-   * @throws at.gv.egiz.smcc.SignatureCardException if the provided pin does
-   * not meet the restrictions imposed by the encoding (not the pinSpec!),
-   * such as maximum Length
-   */
-  protected abstract byte[] encodePINBlock(char[] pin) throws SignatureCardException;
-
-  protected byte[] readRecord(int recordNumber) throws SignatureCardException, CardException {
-    return readRecord(getCardChannel(), recordNumber);
-  }
-
-  protected byte[] readRecord(CardChannel channel, int recordNumber) throws SignatureCardException, CardException {
-    
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xB2,
-        recordNumber, 0x04, 256));
-    if (resp.getSW() == 0x9000) {
-      return resp.getData();
-    } else {
-      throw new SignatureCardException("Failed to read records. SW=" + Integer.toHexString(resp.getSW()));
-    }
-     
-  }
-  
-  protected byte[] readBinary(CardChannel channel, int offset, int len)
-      throws CardException, SignatureCardException {
-
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xB0,
-        0x7F & (offset >> 8), offset & 0xFF, len));
-    if (resp.getSW() == 0x9000) {
-      return resp.getData();
-    } else if (resp.getSW() == 0x6982) {
-      throw new SecurityStatusNotSatisfiedException();
-    } else {
-      throw new SignatureCardException("Failed to read bytes (" + offset + "+"
-          + len + "): SW=" + Integer.toHexString(resp.getSW()));
-    }
-
-  }
-
-  protected int readBinary(int offset, int len, byte[] b) throws CardException,
-      SignatureCardException {
-
-    if (b.length < len) {
-      throw new IllegalArgumentException(
-          "Length of b must not be less than len.");
-    }
-
-    CardChannel channel = getCardChannel();
-
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xB0,
-        0x7F & (offset >> 8), offset & 0xFF, len));
-    if (resp.getSW() == 0x9000) {
-      System.arraycopy(resp.getData(), 0, b, 0, len);
-    }
-
-    return resp.getSW();
-
-  }
-
-  protected byte[] readBinaryTLV(int maxSize, byte expectedType) throws CardException,
-      SignatureCardException {
-
-    CardChannel channel = getCardChannel();
-
-    // read first chunk
-    int len = Math.min(maxSize, ifs_);
-    byte[] chunk = readBinary(channel, 0, len);
-    if (chunk.length > 0 && chunk[0] != expectedType) {
-      return null;
-    }
-    int offset = chunk.length;
-    int actualSize = maxSize;
-    if (chunk.length > 3) {
-      if ((chunk[1] & 0x80) > 0) {
-        int octets = (0x0F & chunk[1]);
-        actualSize = 2 + octets;
-        for (int i = 1; i <= octets; i++) {
-          actualSize += (0xFF & chunk[i + 1]) << ((octets - i) * 8);
-        }
-      } else {
-        actualSize = 2 + chunk[1];
-      }
-    }
-    ByteBuffer buffer = ByteBuffer.allocate(actualSize);
-    buffer.put(chunk, 0, Math.min(actualSize, chunk.length));
-    while (offset < actualSize) {
-      len = Math.min(ifs_, actualSize - offset);
-      chunk = readBinary(channel, offset, len);
-      buffer.put(chunk);
-      offset += chunk.length;
-    }
-    return buffer.array();
-
-  }
-
-  protected byte[] readRecords(byte[] aid, byte[] ef, int start, int end) throws SignatureCardException, InterruptedException {
-    
-    try {
-      
-      // SELECT FILE (AID)
-      byte[] rb = selectFileAID(aid);
-      if (rb[rb.length - 2] != (byte) 0x90 || rb[rb.length - 1] != (byte) 0x00) {
-
-        throw new SignatureCardException("SELECT FILE with "
-            + "AID="
-            + toString(aid)
-            + " failed ("
-            + "SW="
-            + Integer.toHexString((0xFF & (int) rb[rb.length - 1])
-                | (0xFF & (int) rb[rb.length - 2]) << 8) + ").");
-
-      }
-
-      // SELECT FILE (EF)
-      ResponseAPDU resp = selectFileFID(ef);
-      if (resp.getSW() == 0x6a82) {
-        
-        // EF not found
-        throw new FileNotFoundException("EF " + toString(ef) + " not found.");
-        
-      } else if (resp.getSW() != 0x9000) {
-
-        throw new SignatureCardException("SELECT FILE with "
-            + "FID="
-            + toString(ef)
-            + " failed ("
-            + "SW="
-            + Integer.toHexString(resp.getSW()) + ").");
-        
-      }
-      
-      ByteArrayOutputStream bytes = new ByteArrayOutputStream();
-      
-      for (int i = start; i <= end; i++) {
-        bytes.write(readRecord(i));
-      }
-      
-      return bytes.toByteArray();
-      
-    } catch (CardException e) {
-      throw new SignatureCardException("Failed to acces card.", e);
-    } catch (IOException e) {
-      throw new SignatureCardException("Failed to read records.", e);
-    }
-    
-  }
-  
-  /**
-   * Read the content of a TLV file.
-   * 
-   * @param aid the application ID (AID)
-   * @param ef the elementary file (EF)
-   * @param maxLength the maximum length of the file
-   * 
-   * @return the content of the file
-   * 
-   * @throws SignatureCardException
-   * @throws CardException 
-   */
-  protected byte[] readTLVFile(byte[] aid, byte[] ef, int maxLength)
-      throws SignatureCardException, InterruptedException, CardException {
-    // SELECT FILE (AID)
-    selectFileAID(aid);
-
-    // SELECT FILE (EF)
-    ResponseAPDU resp = selectFileFID(ef);
-    if (resp.getSW() == 0x6a82) {
-      // EF not found
-      throw new FileNotFoundException("EF " + toString(ef) + " not found.");
-    } else if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("SELECT FILE with "
-          + "FID="
-          + toString(ef)
-          + " failed ("
-          + "SW="
-          + Integer.toHexString(resp.getSW()) + ").");
-    }
-
-    return readBinaryTLV(maxLength, (byte) 0x30);
-//    return readTLVFile(aid, ef, null, (byte) 0, maxLength);
-  }
-
-  /**
-   * Read the content of a TLV file wich requires a PIN.
-   * 
-   * @param aid the application ID (AID)
-   * @param ef the elementary file (EF)
-   * @param kid the key ID (KID) of the corresponding PIN
-   * @param pin the pin or null if VERIFY on pinpad
-   * @param spec the PINSpec
-   * @param maxLength the maximum length of the file
-   * 
-   * @return the content of the file
-   * 
-   * @throws SignatureCardException
-   * @throws CardException 
-   */
-  protected byte[] readTLVFile(byte[] aid, byte[] ef, char[] pin, byte kid, int maxLength)
-      throws SignatureCardException, InterruptedException, CardException {
-
-
-    // SELECT FILE (AID)
-    selectFileAID(aid);
-
-    // SELECT FILE (EF)
-    ResponseAPDU resp = selectFileFID(ef);
-    if (resp.getSW() == 0x6a82) {
-      // EF not found
-      throw new FileNotFoundException("EF " + toString(ef) + " not found.");
-    } else if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("SELECT FILE with "
-          + "FID="
-          + toString(ef)
-          + " failed ("
-          + "SW="
-          + Integer.toHexString(resp.getSW()) + ").");
-    }
-
-    // VERIFY
-      int retries = verifyPIN(kid, pin);
-      if (retries != -1) {
-        throw new VerificationFailedException(retries);
-      }
-   
-    return readBinaryTLV(maxLength, (byte) 0x30);
-      
-    
-  }
-  
-  /**
-   * Transmit the given command APDU using the given card channel.
-   * 
-   * @param channel
-   *          the card channel
-   * @param commandAPDU
-   *          the command APDU
-   * @param logData
-   *          <code>true</code> if command APDU data may be logged, or
-   *          <code>false</code> otherwise
-   * 
-   * @return the corresponding response APDU
-   * 
-   * @throws CardException
-   *           if smart card communication fails
-   */
-  protected ResponseAPDU transmit(CardChannel channel, CommandAPDU commandAPDU, boolean logData)
-      throws CardException {
-    
-    if (log.isTraceEnabled()) {
-      log.trace(commandAPDU 
-          + (logData ? "\n" + toString(commandAPDU.getBytes()) : ""));
-      long t0 = System.currentTimeMillis();
-      ResponseAPDU responseAPDU = channel.transmit(commandAPDU);
-      long t1 = System.currentTimeMillis();
-      log.trace(responseAPDU + "\n[" + (t1 - t0) + "ms] "
-          + (logData ? "\n" + toString(responseAPDU.getBytes()) : ""));
-      return responseAPDU;
-    } else {
-      return channel.transmit(commandAPDU);
-    }
-    
-  }
-
-  /**
-   * Transmit the given command APDU using the given card channel.
-   * 
-   * @param channel the card channel
-   * @param commandAPDU the command APDU
-   * 
-   * @return the corresponding response APDU
-   * 
-   * @throws CardException if smart card communication fails
-   */
-  protected ResponseAPDU transmit(CardChannel channel, CommandAPDU commandAPDU)
-      throws CardException {
-    return transmit(channel, commandAPDU, true);
-  }
-
-  
   @Override
   public void init(Card card, CardTerminal cardTerminal) {
     this.card_ = card;
     this.reader = ReaderFactory.getInstance().getReader(card, cardTerminal);
-    ATR atr = card.getATR();
-    byte[] atrBytes = atr.getBytes();
-    if (atrBytes.length >= 6) {
-      ifs_ = 0xFF & atr.getBytes()[6];
-      log.trace("Setting IFS (information field size) to " + ifs_);
-    }
   }
   
   @Override
@@ -470,7 +77,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   }
 
   protected CardChannel getCardChannel() {
-    return card_.getBasicChannel();
+    return new LogCardChannel(card_.getBasicChannel());
   }
 
   @Override
@@ -517,112 +124,4 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     }
   }
 
-  @Override
-  public List<PINSpec> getPINSpecs() {
-    return pinSpecs;
-  }
-
-  @Override
-  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
-          throws LockedException, NotActivatedException, CancelledException, TimeoutException, SignatureCardException, InterruptedException {
-    try {
-      getCard().beginExclusive();
-
-      if (pinSpec.getContextAID() != null) {
-        selectFileAID(pinSpec.getContextAID());
-      }
-
-      // -1 if ok or unknown
-      int retries = verifyPIN(pinSpec.getKID());
-      do {
-        char[] pin = pinProvider.providePIN(pinSpec, retries);
-        retries = verifyPIN(pinSpec.getKID(), pin);
-      } while (retries > 0);
-      //return on -1, 0 never reached: verifyPIN throws LockedEx
-
-    } catch (CardException ex) {
-      log.error("failed to verify " + pinSpec.getLocalizedName() +
-              ": " + ex.getMessage(), ex);
-      throw new SignatureCardException(ex);
-    } finally {
-      try {
-        getCard().endExclusive();
-      } catch (CardException ex) {
-        log.trace("failed to end exclusive card access: " + ex.getMessage());
-      }
-    }
-  }
-
-  @Override
-  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
-          throws CancelledException, SignatureCardException, CancelledException, TimeoutException, InterruptedException {
-   try {
-      getCard().beginExclusive();
-
-      if (pinSpec.getContextAID() != null) {
-        selectFileAID(pinSpec.getContextAID());
-      }
-      char[] pin = pinProvider.providePIN(pinSpec, -1);
-      activatePIN(pinSpec.getKID(), pin);
-      
-    } catch (CardException ex) {
-      log.error("Failed to activate " + pinSpec.getLocalizedName() +
-              ": " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
-    } finally {
-      try {
-        getCard().endExclusive();
-      } catch (CardException ex) {
-        log.trace("failed to end exclusive card access: " + ex.getMessage());
-      }
-    }
-  }
-
-  /**
-   * activates pin (newPIN) if not active
-   * @param pinSpec
-   * @param oldPIN
-   * @param newPIN
-   * @throws at.gv.egiz.smcc.LockedException
-   * @throws at.gv.egiz.smcc.VerificationFailedException
-   * @throws at.gv.egiz.smcc.NotActivatedException
-   * @throws at.gv.egiz.smcc.SignatureCardException
-   */
-  @Override
-  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
-          throws LockedException, NotActivatedException, CancelledException,
-          TimeoutException, SignatureCardException, InterruptedException {
-    try {
-      getCard().beginExclusive();
-
-      if (pinSpec.getContextAID() != null) {
-        selectFileAID(pinSpec.getContextAID());
-      }
-
-      int retries = verifyPIN(pinSpec.getKID());
-      do {
-        char[] newPin = pinProvider.providePIN(pinSpec, retries);
-        char[] oldPin = pinProvider.provideOldPIN(pinSpec, retries);
-        retries = changePIN(pinSpec.getKID(), oldPin, newPin);
-      } while (retries > 0);
-      //return on -1, 0 never reached: verifyPIN throws LockedEx
-
-    } catch (CardException ex) {
-      log.error("Failed to change " + pinSpec.getLocalizedName() +
-              ": " + ex.getMessage());
-      throw new SignatureCardException(ex.getMessage(), ex);
-    } finally {
-      try {
-        getCard().endExclusive();
-      } catch (CardException ex) {
-        log.trace("failed to end exclusive card access: " + ex.getMessage());
-      }
-    }
-  }
-
-  @Override
-  public void unblockPIN(PINSpec pinSpec, PINProvider pinProvider)
-          throws CancelledException, SignatureCardException, InterruptedException {
-    throw new SignatureCardException("Unblock not supported yet");
-  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/CardNotSupportedException.java b/smcc/src/main/java/at/gv/egiz/smcc/CardNotSupportedException.java
index e2a5fe16..1cde093d 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/CardNotSupportedException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/CardNotSupportedException.java
@@ -1,31 +1,19 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
 package at.gv.egiz.smcc;
 
 public class CardNotSupportedException extends Exception {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
index d0622aa4..41010551 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
@@ -1,24 +1,21 @@
 /*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.*;
-
 /**
  *
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ChangeReferenceDataAPDUSpec.java b/smcc/src/main/java/at/gv/egiz/smcc/ChangeReferenceDataAPDUSpec.java
new file mode 100644
index 00000000..0b10d88f
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ChangeReferenceDataAPDUSpec.java
@@ -0,0 +1,95 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class ChangeReferenceDataAPDUSpec extends VerifyAPDUSpec {
+  
+  /**
+   * The offset for the insertion of the old PIN. (Default: 0)
+   */
+  protected int pinInsertionOffsetOld = 0;
+  
+  /**
+   * The offset for the insertion of the new PIN. (Default:
+   * {@link VerifyAPDUSpec#pinLength} + 1})
+   */
+  protected int pinInsertionOffsetNew = pinLength;
+
+  public ChangeReferenceDataAPDUSpec(byte[] apdu, int pinPosition, int pinFormat, int pinLength) {
+    super(apdu, pinPosition, pinFormat, pinLength);
+  }
+
+  /**
+   * @param apdu
+   * @param pinPosition
+   * @param pinFormat
+   * @param pinLength
+   * @param pinLengthSize
+   * @param pinLengthPos
+   */
+  public ChangeReferenceDataAPDUSpec(byte[] apdu, int pinPosition,
+      int pinFormat, int pinLength, int pinLengthSize, int pinLengthPos) {
+    super(apdu, pinPosition, pinFormat, pinLength, pinLengthSize, pinLengthPos);
+  }
+  
+  /**
+   * @param apdu
+   * @param pinPosition
+   * @param pinFormat
+   * @param pinLength
+   * @param pinLengthSize
+   * @param pinLengthPos
+   * @param pinInsertionOffsetNew
+   */
+  public ChangeReferenceDataAPDUSpec(byte[] apdu, int pinPosition,
+      int pinFormat, int pinLength, int pinLengthSize, int pinLengthPos,
+      int pinInsertionOffsetNew) {
+    super(apdu, pinPosition, pinFormat, pinLength, pinLengthSize, pinLengthPos);
+    this.pinInsertionOffsetNew = pinInsertionOffsetNew;
+  }
+
+  /**
+   * @return the pinInsertionOffsetOld
+   */
+  public int getPinInsertionOffsetOld() {
+    return pinInsertionOffsetOld;
+  }
+
+  /**
+   * @param pinInsertionOffsetOld the pinInsertionOffsetOld to set
+   */
+  public void setPinInsertionOffsetOld(int pinInsertionOffsetOld) {
+    this.pinInsertionOffsetOld = pinInsertionOffsetOld;
+  }
+
+  /**
+   * @return the pinInsertionOffsetNew
+   */
+  public int getPinInsertionOffsetNew() {
+    return pinInsertionOffsetNew;
+  }
+
+  /**
+   * @param pinInsertionOffsetNew the pinInsertionOffsetNew to set
+   */
+  public void setPinInsertionOffsetNew(int pinInsertionOffsetNew) {
+    this.pinInsertionOffsetNew = pinInsertionOffsetNew;
+  }
+
+  
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ExclSignatureCardProxy.java b/smcc/src/main/java/at/gv/egiz/smcc/ExclSignatureCardProxy.java
new file mode 100644
index 00000000..bfbd0063
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ExclSignatureCardProxy.java
@@ -0,0 +1,110 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+import java.util.ArrayList;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+public class ExclSignatureCardProxy implements InvocationHandler {
+  
+  private static Log log = LogFactory.getLog(ExclSignatureCardProxy.class);
+
+  private static final Method init;
+  
+  static {
+    try {
+      init = SignatureCard.class.getMethod("init", new Class<?>[] { Card.class,
+          CardTerminal.class });
+    } catch (SecurityException e) {
+      throw new RuntimeException(e);
+    } catch (NoSuchMethodException e) {
+      throw new RuntimeException(e);
+    }
+  }
+  
+  private SignatureCard signatureCard;
+  
+  public ExclSignatureCardProxy(SignatureCard signatureCard) {
+    this.signatureCard = signatureCard;
+  }
+
+  public static SignatureCard newInstance(SignatureCard signatureCard) {
+    ArrayList<Class<?>> proxyInterfaces = new ArrayList<Class<?>>();
+    proxyInterfaces.add(SignatureCard.class);
+    if (PINMgmtSignatureCard.class.isAssignableFrom(signatureCard.getClass())) {
+      proxyInterfaces.add(PINMgmtSignatureCard.class);
+    }
+    ClassLoader loader = signatureCard.getClass().getClassLoader();
+    return (SignatureCard) Proxy.newProxyInstance(loader, proxyInterfaces
+        .toArray(new Class[proxyInterfaces.size()]),
+        new ExclSignatureCardProxy(signatureCard));
+  }
+  
+  public static PINMgmtSignatureCard newInstance(PINMgmtSignatureCard signatureCard) {
+    return null;
+  }
+
+  @Override
+  public Object invoke(Object proxy, Method method, Object[] args)
+      throws Throwable {
+
+    Card card = null;
+    
+    Method target = signatureCard.getClass().getMethod(method.getName(),
+        method.getParameterTypes());
+    
+    if (target.isAnnotationPresent(Exclusive.class)) {
+      card = (Card) ((method.equals(init)) 
+        ? args[0]
+        : signatureCard.getCard());
+    }
+    
+    if (card != null) {
+      try {
+        log.trace("Invoking method " + method.getName() + "() with exclusive access.");
+        card.beginExclusive();
+      } catch (CardException e) {
+        log.info("Failed to get exclusive access to signature card "
+            + signatureCard.toString() + ".");
+        throw new SignatureCardException(e);
+      }
+    }
+      
+    try {
+      return method.invoke(signatureCard, args);
+    } catch (InvocationTargetException e) {
+      throw e.getTargetException();
+    } finally {
+      if (card != null) {
+        card.endExclusive();
+      }
+    }
+    
+  
+  }
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/Exclusive.java b/smcc/src/main/java/at/gv/egiz/smcc/Exclusive.java
new file mode 100644
index 00000000..b796b045
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/Exclusive.java
@@ -0,0 +1,28 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface Exclusive {
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/LogCardChannel.java b/smcc/src/main/java/at/gv/egiz/smcc/LogCardChannel.java
new file mode 100644
index 00000000..3fc80fa1
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/LogCardChannel.java
@@ -0,0 +1,129 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.nio.ByteBuffer;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+public class LogCardChannel extends CardChannel {
+  
+  protected static Log log = LogFactory.getLog(LogCardChannel.class);
+  
+  private CardChannel channel;
+  
+  public LogCardChannel(CardChannel channel) {
+    if (channel == null) {
+      throw new NullPointerException();
+    }
+    this.channel = channel;
+  }
+
+  @Override
+  public void close() throws CardException {
+    channel.close();
+  }
+
+  @Override
+  public Card getCard() {
+    return channel.getCard();
+  }
+
+  @Override
+  public int getChannelNumber() {
+    return channel.getChannelNumber();
+  }
+
+  @Override
+  public ResponseAPDU transmit(CommandAPDU command) throws CardException {
+    if (log.isTraceEnabled()) {
+      switch (command.getINS()) {
+      case 0x20:    // VERIFY
+      case 0x21:    // VERIFY
+      case 0x24: {  // CHANGE REFERENCE DATA 
+        // Don't log possibly sensitive command data 
+        StringBuilder sb = new StringBuilder();
+        sb.append(command);
+        sb.append('\n');
+        byte[] c = new byte[4];
+        c[0] = (byte) command.getCLA();
+        c[1] = (byte) command.getINS();
+        c[2] = (byte) command.getP1();
+        c[3] = (byte) command.getP2();
+        sb.append(toString(c));
+        if (command.getNc() > 0) {
+          sb.append(':');
+          sb.append(toString(new byte[] {(byte) command.getNc()}));
+          for (int i = 0; i < command.getNc(); i++) {
+            sb.append(":XX");
+          }
+        }
+        if (command.getNe() > 0) {
+          sb.append(':');
+          sb.append(toString(new byte[] {(byte) command.getNe()}));
+        }
+        log.trace(sb.toString());
+      }; break;
+
+      default:
+        log.trace(command + "\n" + toString(command.getBytes()));
+      }
+      long t0 = System.currentTimeMillis();
+      ResponseAPDU response = channel.transmit(command);
+      long t1 = System.currentTimeMillis();
+      log.trace(response + " [" + (t1 - t0) + "ms]\n" + toString(response.getBytes()));
+      return response;
+    } else {
+      return channel.transmit(command);
+    }
+  }
+
+  @Override
+  public int transmit(ByteBuffer command, ByteBuffer response) throws CardException {
+    if (log.isTraceEnabled()) {
+      long t0 = System.currentTimeMillis();
+      int l = channel.transmit(command, response);
+      long t1 = System.currentTimeMillis();
+      log.trace("[" + (t1 - t0) + "ms]");
+      return l;
+    } else {
+      return channel.transmit(command, response);
+    }
+  }
+
+  private String toString(byte[] b) {
+    StringBuffer sb = new StringBuffer();
+    if (b != null && b.length > 0) {
+      sb.append(Integer.toHexString((b[0] & 240) >> 4));
+      sb.append(Integer.toHexString(b[0] & 15));
+    }
+    for (int i = 1; i < b.length; i++) {
+      sb.append(':');
+      sb.append(Integer.toHexString((b[i] & 240) >> 4));
+      sb.append(Integer.toHexString(b[i] & 15));
+    }
+    return sb.toString();
+  }
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/NewReferenceDataAPDUSpec.java b/smcc/src/main/java/at/gv/egiz/smcc/NewReferenceDataAPDUSpec.java
new file mode 100644
index 00000000..2eadaf26
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/NewReferenceDataAPDUSpec.java
@@ -0,0 +1,60 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class NewReferenceDataAPDUSpec extends VerifyAPDUSpec {
+  
+  /**
+   * The offset for the insertion of the new PIN. (Default:
+   * {@link VerifyAPDUSpec#pinLength} + 1})
+   */
+  protected int pinInsertionOffsetNew = 0;
+
+  public NewReferenceDataAPDUSpec(byte[] apdu, int pinPosition, int pinFormat, int pinLength) {
+    super(apdu, pinPosition, pinFormat, pinLength);
+  }
+
+  /**
+   * @param apdu
+   * @param pinPosition
+   * @param pinFormat
+   * @param pinLength
+   * @param pinLengthSize
+   * @param pinLengthPos
+   */
+  public NewReferenceDataAPDUSpec(byte[] apdu, int pinPosition,
+      int pinFormat, int pinLength, int pinLengthSize, int pinLengthPos) {
+    super(apdu, pinPosition, pinFormat, pinLength, pinLengthSize, pinLengthPos);
+  }
+
+  /**
+   * @return the pinInsertionOffsetNew
+   */
+  public int getPinInsertionOffsetNew() {
+    return pinInsertionOffsetNew;
+  }
+
+  /**
+   * @param pinInsertionOffsetNew the pinInsertionOffsetNew to set
+   */
+  public void setPinInsertionOffsetNew(int pinInsertionOffsetNew) {
+    this.pinInsertionOffsetNew = pinInsertionOffsetNew;
+  }
+
+  
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java b/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java
index 115e6d5f..eaf38435 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java
@@ -24,6 +24,8 @@ package at.gv.egiz.smcc;
  */
 public class PINConfirmationException extends SignatureCardException {
 
+  private static final long serialVersionUID = 1L;
+
   public PINConfirmationException() {
     super();
   }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java b/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java
index 28a13fdb..774fcdf5 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java
@@ -24,6 +24,8 @@ package at.gv.egiz.smcc;
  */
 public class PINFormatException extends SignatureCardException {
 
+  private static final long serialVersionUID = 1L;
+
   public PINFormatException() {
     super();
   }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java
new file mode 100644
index 00000000..53738612
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java
@@ -0,0 +1,41 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.util.List;
+
+public interface PINMgmtSignatureCard extends SignatureCard {
+
+  public enum PIN_STATE {UNKNOWN, ACTIV, NOT_ACTIV, BLOCKED};
+  
+  public List<PINSpec> getPINSpecs();
+
+  public PIN_STATE getPINState(PINSpec pinSpec) throws SignatureCardException;
+  
+  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+  throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException;
+
+  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+  throws LockedException, NotActivatedException, CancelledException, PINFormatException, SignatureCardException, InterruptedException;
+
+  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+  throws CancelledException, SignatureCardException, InterruptedException;
+
+  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
+  throws CancelledException, SignatureCardException, InterruptedException;
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINOperationAbortedException.java b/smcc/src/main/java/at/gv/egiz/smcc/PINOperationAbortedException.java
index 7337f59e..51e4904e 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINOperationAbortedException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINOperationAbortedException.java
@@ -24,6 +24,8 @@ package at.gv.egiz.smcc;
  */
 public class PINOperationAbortedException extends SignatureCardException {
 
+  private static final long serialVersionUID = 1L;
+
   public PINOperationAbortedException() {
     super();
   }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
index 8fa80dcb..5c294b5b 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
@@ -1,31 +1,19 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
 package at.gv.egiz.smcc;
 
 /**
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java b/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java
index d180ddf0..b8ffafab 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINSpec.java
@@ -14,9 +14,9 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-
 package at.gv.egiz.smcc;
 
+import java.util.Locale;
 import java.util.ResourceBundle;
 
 /**
@@ -31,7 +31,7 @@ public class PINSpec {
     
     String rexepPattern_;
     
-    ResourceBundle resourceBundle_;
+    String resourceBundleName_;
     
     String name_;
 
@@ -49,17 +49,17 @@ public class PINSpec {
      * @param kid the keyId for this pin
      */
     public PINSpec(int minLenght, int maxLength, String rexepPattern, 
-        ResourceBundle resourceBundle, String name, byte kid, byte[] contextAID) {
+        String resourceBundleName, String name, byte kid, byte[] contextAID) {
         
         minLength_ = minLenght;
         maxLength_ = maxLength;
         rexepPattern_ = rexepPattern;
-        resourceBundle_ = resourceBundle;
+        resourceBundleName_ = resourceBundleName;
         name_ = name;
         kid_ = kid;
         context_aid_ = contextAID;
     }
-    
+
     public PINSpec(int minLenght, int maxLength, String rexepPattern, 
         String name, byte kid, byte[] contextAID) {
         
@@ -71,14 +71,26 @@ public class PINSpec {
         context_aid_ = contextAID;
     }
     
-    
-    
     public String getLocalizedName() {
+      
+      if (resourceBundleName_ != null) {
+        ResourceBundle resourceBundle = ResourceBundle.getBundle(resourceBundleName_);
+        return resourceBundle.getString(name_);
+      } else {
+        return name_;
+      }
         
-        return (resourceBundle_ != null) 
-            ? resourceBundle_.getString(name_)
-            : name_;
-        
+    }
+    
+    public String getLocalizedName(Locale locale) {
+      
+      if (resourceBundleName_ != null) {
+        ResourceBundle resourceBundle = ResourceBundle.getBundle(resourceBundleName_, locale);
+        return resourceBundle.getString(name_);
+      } else {
+        return name_;
+      }
+      
     }
 
     public int getMaxLength() {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index e622f65a..83c0197a 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -1,36 +1,27 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.ccid.CCID;
-import at.gv.egiz.smcc.util.SMCCHelper;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.util.Arrays;
+import java.util.List;
+
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CommandAPDU;
@@ -39,7 +30,10 @@ import javax.smartcardio.ResponseAPDU;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-public class STARCOSCard extends AbstractSignatureCard {
+import at.gv.egiz.smcc.util.ISO7816Utils;
+import at.gv.egiz.smcc.util.SMCCHelper;
+
+public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatureCard {
 
   /**
    * Logging facility.
@@ -154,133 +148,131 @@ public class STARCOSCard extends AbstractSignatureCard {
 
   public static final byte KID_PIN_CARD = (byte) 0x01;
 
-  public static final int PINSPEC_CARD = 0;
-  public static final int PINSPEC_SS = 1;
+  private static final PINSpec CARD_PIN_SPEC =
+    new PINSpec(4, 12, "[0-9]", 
+        "at/gv/egiz/smcc/STARCOSCard", "card.pin.name", KID_PIN_CARD, null);
+  
+  private static final PINSpec SS_PIN_SPEC =
+    new PINSpec(6, 12, "[0-9]", 
+        "at/gv/egiz/smcc/STARCOSCard", "sig.pin.name", KID_PIN_SS, AID_DF_SS);
 
   /**
    * Creates an new instance.
    */
   public STARCOSCard() {
     super("at/gv/egiz/smcc/STARCOSCard");
-    pinSpecs.add(PINSPEC_CARD, 
-            new PINSpec(4, 12, "[0-9]",
-              getResourceBundle().getString("card.pin.name"),
-              KID_PIN_CARD, null));
-    pinSpecs.add(PINSPEC_SS,
-            new PINSpec(6, 12, "[0-9]",
-              getResourceBundle().getString("sig.pin.name"),
-              KID_PIN_SS, AID_DF_SS));
+    pinSpecs.add(CARD_PIN_SPEC);
+    pinSpecs.add(SS_PIN_SPEC);
   }
  
   @Override
+  @Exclusive
   public byte[] getCertificate(KeyboxName keyboxName)
       throws SignatureCardException, InterruptedException {
 
-    try {
-      
-      if (keyboxName == KeyboxName.SECURE_SIGNATURE_KEYPAIR) {
-        
-        try {
-          getCard().beginExclusive();
-          return readTLVFile(AID_DF_SS, EF_C_X509_CH_DS, 2000);
-        } catch (FileNotFoundException e) {
-          throw new NotActivatedException();
-        } finally {
-          getCard().endExclusive();
-        }
-        
-      } else if (keyboxName == KeyboxName.CERITIFIED_KEYPAIR) {
-
-        try {
-          getCard().beginExclusive();
-          return readTLVFile(AID_DF_GS, EF_C_X509_CH_AUT, 2000);
-        } catch (FileNotFoundException e) {
-          throw new NotActivatedException();
-        } finally {
-          getCard().endExclusive();
-        }
+    byte[] aid;
+    byte[] fid;
+    if (keyboxName == KeyboxName.SECURE_SIGNATURE_KEYPAIR) {
+      aid = AID_DF_SS;
+      fid = EF_C_X509_CH_DS;
+    } else if (keyboxName == KeyboxName.CERITIFIED_KEYPAIR) {
+      aid = AID_DF_GS;
+      fid = EF_C_X509_CH_AUT;
+    } else {
+      throw new IllegalArgumentException("Keybox " + keyboxName
+          + " not supported.");
+    }
 
-      } else {
-        throw new IllegalArgumentException("Keybox " + keyboxName
-            + " not supported.");
+    try {
+      CardChannel channel = getCardChannel();
+      // SELECT application
+      execSELECT_AID(channel, aid);
+      // SELECT file
+      execSELECT_FID(channel, fid);
+      // READ BINARY
+      byte[] certificate = ISO7816Utils.readTransparentFileTLV(channel, -1, (byte) 0x30);
+      if (certificate == null) {
+        throw new NotActivatedException();
       }
-      
+      return certificate;
+    } catch (FileNotFoundException e) {
+      throw new NotActivatedException();
     } catch (CardException e) {
-      log.warn(e);
-      throw new SignatureCardException("Failed to access card.", e);
+      log.info("Failed to get certificate.", e);
+      throw new SignatureCardException(e);
     }
 
   }
   
   @Override
+  @Exclusive
   public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
       throws SignatureCardException, InterruptedException {
   
     try {
       if ("IdentityLink".equals(infobox)) {
 
-        PINSpec spec = pinSpecs.get(PINSPEC_CARD);
-        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
-
-        int retries = -1;
-        boolean pinRequired = false;
+        PINSpec spec = CARD_PIN_SPEC;
+        
+        CardChannel channel = getCardChannel();
+        // SELECT application
+        execSELECT_AID(channel, AID_INFOBOX);
+        // SELECT file
+        execSELECT_FID(channel, EF_INFOBOX);
 
-        do {
+        while (true) {
           try {
-            getCard().beginExclusive();
-            if (pinRequired) {
-              char[] pin = provider.providePIN(spec, retries);
-              return readTLVFile(AID_INFOBOX, EF_INFOBOX, pin, spec.getKID(), 2000);
-            } else {
-              return readTLVFile(AID_INFOBOX, EF_INFOBOX, 2000);
-            }
-          } catch (FileNotFoundException e) {
-            throw new NotActivatedException();
+            return ISO7816Utils.readTransparentFileTLV(channel, -1, (byte) 0x30);
           } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequired = true;
-            retries = verifyPIN(KID_PIN_CARD);
-          } catch (VerificationFailedException e) {
-            pinRequired = true;
-            retries = e.getRetries();
-          } finally {
-            getCard().endExclusive();
+            verifyPINLoop(channel, spec, provider);
           }
-        } while (retries != 0);
-
-        throw new LockedException();
-        
-      } else if ("EHIC".equals(infobox)) {
-        try {
-          getCard().beginExclusive();
-          return readTLVFile(AID_SV_PERSONENDATEN, FID_EHIC, 126);
-        } finally {
-          getCard().endExclusive();
-        }
-      } else if ("Grunddaten".equals(infobox)) {
-        try {
-          getCard().beginExclusive();
-          return readTLVFile(AID_SV_PERSONENDATEN, FID_GRUNDDATEN, 550);
-        } finally {
-          getCard().endExclusive();
-        }
-      } else if ("SV-Personenbindung".equals(infobox)) {
-        try {
-          getCard().beginExclusive();
-          return readTLVFile(AID_SV_PERSONENDATEN, FID_SV_PERSONENBINDUNG, 500);
-        } finally {
-          getCard().endExclusive();
         }
+        
       } else if ("Status".equals(infobox)) {
+        
+        CardChannel channel = getCardChannel();
+        // SELECT application
+        execSELECT_AID(channel, AID_SV_PERSONENDATEN);
+        // SELECT file
+        execSELECT_FID(channel, FID_STATUS);
+        // READ RECORDS
+        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
         try {
-          getCard().beginExclusive();
-          return readRecords(AID_SV_PERSONENDATEN, FID_STATUS, 1, 5);
-        } finally {
-          getCard().endExclusive();
+          for (int record = 1; record <= 5; record++) {
+            byte[] rb = ISO7816Utils.readRecord(channel, record);
+            bytes.write(rb);
+          }
+        } catch (IOException e) {
+          throw new SignatureCardException("Failed to read infobox '" + infobox
+              + "'.", e);
         }
+        return bytes.toByteArray();
+        
       } else {
-        throw new IllegalArgumentException("Infobox '" + infobox
-            + "' not supported.");
+
+        byte[] fid;
+        
+        if ("EHIC".equals(infobox)) {
+          fid = FID_EHIC;
+        } else if ("Grunddaten".equals(infobox)) {
+          fid = FID_GRUNDDATEN;
+        } else if ("SV-Personenbindung".equals(infobox)) {
+          fid = FID_SV_PERSONENBINDUNG;
+        } else {
+          throw new IllegalArgumentException("Infobox '" + infobox
+              + "' not supported.");
+        }
+       
+        CardChannel channel = getCardChannel();
+        // SELECT application
+        execSELECT_AID(channel, AID_SV_PERSONENDATEN);
+        // SELECT file
+        execSELECT_FID(channel, fid);
+        // READ BINARY
+        return ISO7816Utils.readTransparentFileTLV(channel, -1, (byte) 0x30);
+        
       }
+        
     } catch (CardException e) {
       log.warn(e);
       throw new SignatureCardException("Failed to access card.", e);
@@ -288,6 +280,7 @@ public class STARCOSCard extends AbstractSignatureCard {
   }
 
   @Override
+  @Exclusive
   public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
       PINProvider provider) throws SignatureCardException, InterruptedException {
   
@@ -297,68 +290,44 @@ public class STARCOSCard extends AbstractSignatureCard {
   
     try {
       
+      CardChannel channel = getCardChannel();
+      
       if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)) {
 
-        PINSpec spec = pinSpecs.get(PINSPEC_SS);
-        //new PINSpec(6, 10, "[0-9]", getResourceBundle().getString("sig.pin.name"));
+        PINSpec spec = SS_PIN_SPEC;
+        
+        // SELECT MF
+        execSELECT_MF(channel);
+        // SELECT application
+        execSELECT_AID(channel, AID_DF_SS);
+        // VERIFY
+        verifyPINLoop(channel, spec, provider);
+        // MANAGE SECURITY ENVIRONMENT : SET DST
+        execMSE(channel, 0x41, 0xb6, DST_SS);
+        // PERFORM SECURITY OPERATION : HASH
+        execPSO_HASH(channel, hash);
+        // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
+        return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel);
         
-        int retries = -1;
-        char[] pin = null;
-
-        do {
-          try {
-            getCard().beginExclusive();
-            selectFileAID(AID_DF_SS);
-            retries = verifyPIN(KID_PIN_SS); //, null);
-          } finally {
-            getCard().endExclusive();
-          }
-          pin = provider.providePIN(spec, retries);
-          try {
-            getCard().beginExclusive();
-            return createSignature(hash, AID_DF_SS, pin, KID_PIN_SS, DST_SS);
-          } catch (VerificationFailedException e) {
-            retries = e.getRetries();
-          } catch (PINFormatException e) {
-            log.debug("wrong pin size entered, retry");
-          } finally {
-            getCard().endExclusive();
-          }
-        } while (retries != 0);
-
-        throw new LockedException();
-
- 
       } else if (KeyboxName.CERITIFIED_KEYPAIR.equals(keyboxName)) {
 
-        PINSpec spec = pinSpecs.get(PINSPEC_CARD);
-        //new PINSpec(4, 4, "[0-9]", getResourceBundle().getString("card.pin.name"));
- 
-        int retries = -1;
-        char[] pin = null;
-        boolean pinRequiered = false;
-
-        do {
-          if (pinRequiered) {
-            pin = provider.providePIN(spec, retries);
-          }
+        PINSpec spec = CARD_PIN_SPEC;
+        
+        // SELECT application
+        execSELECT_AID(channel, AID_DF_GS);
+        // MANAGE SECURITY ENVIRONMENT : SET DST
+        execMSE(channel, 0x41, 0xb6, DST_GS);
+        // PERFORM SECURITY OPERATION : HASH
+        execPSO_HASH(channel, hash);
+        
+        while (true) {
           try {
-            getCard().beginExclusive();
-            return createSignature(hash, AID_DF_GS, pin, KID_PIN_CARD, DST_GS);
-          } catch (FileNotFoundException e) {
-            throw new NotActivatedException();
+            // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
+            return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel);
           } catch (SecurityStatusNotSatisfiedException e) {
-            pinRequiered = true;
-            retries = verifyPIN(KID_PIN_CARD);
-          } catch (VerificationFailedException e) {
-            pinRequiered = true;
-            retries = e.getRetries();
-          } finally {
-            getCard().endExclusive();
+            verifyPINLoop(channel, spec, provider);
           }
-        } while (retries != 0);
-
-        throw new LockedException();
+        }
         
       } else {
         throw new IllegalArgumentException("KeyboxName '" + keyboxName
@@ -372,529 +341,366 @@ public class STARCOSCard extends AbstractSignatureCard {
   
   }
 
-
-  ////////////////////////////////////////////////////////////////////////
-  // PROTECTED METHODS (assume exclusive card access)
-  ////////////////////////////////////////////////////////////////////////
-
-  protected ResponseAPDU selectFileFID(byte[] fid) throws CardException, SignatureCardException {
-    CardChannel channel = getCardChannel();
-    return transmit(channel, new CommandAPDU(0x00, 0xA4, 0x02,
-        0x04, fid, 256));
-  }
-
-  private byte[] createSignature(byte[] hash, byte[] aid, char[] pin, byte kid,
-      byte[] dst) throws CardException, SignatureCardException {
-    
-    // SELECT MF
-    selectMF();
-    // SELECT DF
-    selectFileAID(aid);
-    // VERIFY
-    int retries = verifyPIN(kid, pin);
-    if (retries != -1) {
-      throw new VerificationFailedException(retries);
-    }
-    // MSE: SET DST
-    mseSetDST(dst);
-    // PSO: HASH
-    psoHash(hash);
-    // PSO: COMPUTE DIGITAL SIGNATURE
-    return psoComputDigitalSiganture();
-
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.AbstractSignatureCard#verifyPIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.PINProvider)
+   */
+  @Override
+  @Exclusive
+  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+      throws LockedException, NotActivatedException, CancelledException,
+      TimeoutException, SignatureCardException, InterruptedException {
     
-  }
-
-  private void selectMF() throws CardException, SignatureCardException {
     CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00,
-        0x0C));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("Failed to select MF: SW="
-          + Integer.toHexString(resp.getSW()) + ".");
+    
+    try {
+      if (pinSpec.getContextAID() != null) {
+        // SELECT application
+        execSELECT_AID(channel, pinSpec.getContextAID());
+      }
+      int retries = verifyPIN(channel, pinSpec, null, 0);
+      verifyPIN(channel, pinSpec, pinProvider, retries);
+    } catch (CardException e) {
+      log.info("Failed to verify PIN.", e);
+      throw new SignatureCardException("Failed to verify PIN.", e);
     }
+    
   }
-
-  private void mseSetDST(byte[] dst) throws CardException, SignatureCardException {
+  
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.AbstractSignatureCard#changePIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.ChangePINProvider)
+   */
+  @Override
+  @Exclusive
+  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+      throws LockedException, NotActivatedException, CancelledException,
+      TimeoutException, SignatureCardException, InterruptedException {
+    
     CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x22, 0x41,
-        0xB6, dst));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("MSE:SET DST failed: SW="
-          + Integer.toHexString(resp.getSW()));
+    
+    try {
+      if (pinSpec.getContextAID() != null) {
+        // SELECT application
+        execSELECT_AID(channel, pinSpec.getContextAID());
+      }
+      int retries = verifyPIN(channel, pinSpec, null, 0);
+      changePIN(channel, pinSpec, pinProvider, retries);
+    } catch (CardException e) {
+      log.info("Failed to change PIN.", e);
+      throw new SignatureCardException("Failed to change PIN.", e);
     }
+    
   }
 
-  private void psoHash(byte[] hash) throws CardException, SignatureCardException {
-    byte[] data = new byte[hash.length + 2];
-    data[0] = (byte) 0x90; // tag
-    data[1] = (byte) (hash.length); // length
-    System.arraycopy(hash, 0, data, 2, hash.length);
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.AbstractSignatureCard#activatePIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.PINProvider)
+   */
+  @Override
+  @Exclusive
+  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+      throws CancelledException, SignatureCardException, CancelledException,
+      TimeoutException, InterruptedException {
 
     CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x2A, 0x90,
-        0xA0, data));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("PSO:HASH failed: SW="
-          + Integer.toHexString(resp.getSW()));
-    }
-  }
 
-  private byte[] psoComputDigitalSiganture() throws CardException,
-      SignatureCardException {
-    CardChannel channel = getCardChannel();
-    ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0x2A, 0x9E,
-        0x9A, 256));
-    if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException(
-          "PSO: COMPUTE DIGITAL SIGNATRE failed: SW="
-              + Integer.toHexString(resp.getSW()));
-    } else {
-      return resp.getData();
+    try {
+      if (pinSpec.getContextAID() != null) {
+        // SELECT application
+        execSELECT_AID(channel, pinSpec.getContextAID());
+      }
+      activatePIN(channel, pinSpec, pinProvider);
+    } catch (CardException e) {
+      log.info("Failed to activate PIN.", e);
+      throw new SignatureCardException("Failed to activate PIN.", e);
     }
+    
   }
 
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.PINMgmtSignatureCard#unblockPIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.PINProvider)
+   */
   @Override
-  protected int verifyPIN(byte kid, char[] pin)
-          throws LockedException, NotActivatedException, TimeoutException, CancelledException, PINFormatException, PINOperationAbortedException, SignatureCardException {
-    try {
-      byte[] sw;
-      if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-        log.debug("verify pin on cardreader");
-        sw = reader.verifyPinDirect(getPINVerifyStructure(kid));
-//        int sw = (resp[resp.length-2] & 0xff) << 8 | resp[resp.length-1] & 0xff;
-      } else if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_START)) {
-        log.debug("verify pin on cardreader");
-        sw = reader.verifyPin(getPINVerifyStructure(kid));
-      } else {
-        byte[] pinBlock = encodePINBlock(pin);
-        CardChannel channel = getCardChannel();
-        ResponseAPDU resp = transmit(channel,
-                new CommandAPDU(0x00, 0x20, 0x00, kid, pinBlock), false);
-        sw = new byte[2];
-        sw[0] = (byte) resp.getSW1();
-        sw[1] = (byte) resp.getSW2();
-      }
-
-      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
-        return -1;
-      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
-        throw new LockedException("[63:c0]");
-      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
-        return sw[1] & 0x0f;
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
-        //Authentisierungsmethode gesperrt
-        throw new LockedException("[69:83]");
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
-        //referenzierte Daten sind reversibel gesperrt (invalidated)
-        throw new NotActivatedException("[69:84]");
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
-        //Benutzungsbedingungen nicht erfüllt
-        throw new NotActivatedException("[69:85]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
-        throw new TimeoutException("[64:00]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
-        throw new CancelledException("[64:01]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x03) {
-        throw new PINFormatException("[64:03]");
-      }
-      log.error("Failed to verify pin: SW="
-              + SMCCHelper.toString(sw));
-      throw new SignatureCardException(SMCCHelper.toString(sw));
-      
-    } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
-    }
+  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
+      throws CancelledException, SignatureCardException, InterruptedException {
+    throw new SignatureCardException("Unblock PIN is not supported.");
   }
 
   @Override
-  protected int verifyPIN(byte kid)
-          throws LockedException, NotActivatedException, SignatureCardException {
+  public void reset() throws SignatureCardException {
     try {
+      super.reset();
+      log.debug("select MF (e-card workaround)");
       CardChannel channel = getCardChannel();
-      ResponseAPDU resp = transmit(channel,
-              new CommandAPDU(0x00, 0x20, 0x00, kid), false);
-
-      if (resp.getSW() == 0x9000) {
-        return -1;
-      } else if (resp.getSW() == 0x63c0) {
-        throw new LockedException("[63:c0]");
-      } else if (resp.getSW1() == 0x63 && (resp.getSW2() & 0xf0) >> 4 == 0xc) {
-        return resp.getSW2() & 0x0f;
-      } else if (resp.getSW() == 0x6983) {
-        //Authentisierungsmethode gesperrt
-        throw new LockedException("[69:83]");
-      } else if (resp.getSW() == 0x6984) {
-        //referenzierte Daten sind reversibel gesperrt (invalidated)
-        throw new NotActivatedException("[69:84]");
-      } else if (resp.getSW() == 0x6985) {
-        //Benutzungsbedingungen nicht erfüllt
-        throw new NotActivatedException("[69:85]");
+      ResponseAPDU resp = channel.transmit(new CommandAPDU(0x00, 0xA4, 0x00, 0x0C));
+      if (resp.getSW() != 0x9000) {
+        throw new SignatureCardException("Failed to select MF after RESET: SW=" + Integer.toHexString(resp.getSW()) + ".");
       }
-      log.error("Failed to verify pin: SW="
-              + Integer.toHexString(resp.getSW()));
-      throw new SignatureCardException("[" + Integer.toHexString(resp.getSW()) + "]");
-
     } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
+      log.error("Failed to select MF after RESET: " + ex.getMessage(), ex);
+      throw new SignatureCardException("Failed to select MF after RESET");
     }
   }
 
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.PINMgmtSignatureCard#getPINSpecs()
+   */
   @Override
-  protected int changePIN(byte kid, char[] oldPin, char[] newPin)
-          throws LockedException, CancelledException, PINFormatException, PINConfirmationException, TimeoutException, PINOperationAbortedException, SignatureCardException {
-    try {
-      byte[] sw;
-      if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_DIRECT)) {
-        log.debug("modify pin on cardreader");
-        sw = reader.modifyPinDirect(getPINModifyStructure(kid));
-      } else if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_START)) {
-        log.debug("modify pin on cardreader");
-        sw = reader.modifyPin(getPINModifyStructure(kid));
-      } else {
-        byte[] cmd = new byte[16];
-        System.arraycopy(encodePINBlock(oldPin), 0, cmd, 0, 8);
-        System.arraycopy(encodePINBlock(newPin), 0, cmd, 8, 8);
-
-        CardChannel channel = getCardChannel();
-
-        ResponseAPDU resp = transmit(channel,
-                new CommandAPDU(0x00, 0x24, 0x00, kid, cmd), false);
-
-        sw = new byte[2];
-        sw[0] = (byte) resp.getSW1();
-        sw[1] = (byte) resp.getSW2();
-      }
-
-      // activates pin (newPIN) if not active
-      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
-        return -1;
-      } else if (sw[0] == (byte) 0x63 && sw[1] == (byte) 0xc0) {
-        throw new LockedException("[63:c0]");
-      } else if (sw[0] == (byte) 0x63 && (sw[1] & 0xf0) >> 4 == 0xc) {
-        return sw[1] & 0x0f;
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
-        //Authentisierungsmethode gesperrt
-        throw new LockedException("[69:83]");
-//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
-//        //referenzierte Daten sind reversibel gesperrt (invalidated)
-//        throw new NotActivatedException("[69:84]");
-//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
-//        //Benutzungsbedingungen nicht erfüllt
-//        throw new NotActivatedException("[69:85]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
-        throw new TimeoutException("[64:00]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
-        throw new CancelledException("[64:01]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x02) {
-        throw new PINConfirmationException("[64:02]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x03) {
-        throw new PINFormatException("[64:03]");
-      } else if (sw[0] == (byte) 0x6a && sw[1] == (byte) 0x80) {
-        log.info("invalid parameter, assume wrong pin size");
-        throw new PINFormatException("[6a:80]");
-      }
-      log.error("Failed to change pin: SW="
-              + SMCCHelper.toString(sw));
-      throw new SignatureCardException(SMCCHelper.toString(sw));
-    } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
-    }
+  public List<PINSpec> getPINSpecs() {
+    return Arrays.asList(new PINSpec[] {CARD_PIN_SPEC, SS_PIN_SPEC});
   }
 
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.PINMgmtSignatureCard#getPINStatus(at.gv.egiz.smcc.PINSpec)
+   */
   @Override
-  protected void activatePIN(byte kid, char[] pin)
-          throws CancelledException, PINFormatException, PINConfirmationException, TimeoutException, PINOperationAbortedException, SignatureCardException {
+  public PIN_STATE getPINState(PINSpec pinSpec) throws SignatureCardException {
+    
+    CardChannel channel = getCardChannel();
+    
     try {
-      byte[] sw;
-      if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_DIRECT)) {
-        log.debug("activate pin on cardreader");
-        sw = reader.modifyPinDirect(getActivatePINModifyStructure(kid));
-      } else if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_START)) {
-        log.debug("activate pin on cardreader");
-        sw = reader.modifyPin(getActivatePINModifyStructure(kid));
-      } else {
-        CardChannel channel = getCardChannel();
-        ResponseAPDU resp = transmit(channel,
-                new CommandAPDU(0x00, 0x24, 0x01, kid, encodePINBlock(pin)), false);
-
-        sw = new byte[2];
-        sw[0] = (byte) resp.getSW1();
-        sw[1] = (byte) resp.getSW2();
-        log.trace("activate pin returned SW=" + Integer.toHexString(resp.getSW()));
-      }
-
-      if (sw[0] == (byte) 0x90 && sw[1] == (byte) 0x00) {
-        return;
-      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x83) {
-        //Authentisierungsmethode gesperrt
-        throw new LockedException("[69:83]");
-//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x84) {
-//        //referenzierte Daten sind reversibel gesperrt (invalidated)
-//        throw new NotActivatedException("[69:84]");
-//      } else if (sw[0] == (byte) 0x69 && sw[1] == (byte) 0x85) {
-//        //Benutzungsbedingungen nicht erfüllt
-//        throw new NotActivatedException("[69:85]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x00) {
-        throw new TimeoutException("[64:00]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x01) {
-        throw new CancelledException("[64:01]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x02) {
-        throw new PINConfirmationException("[64:02]");
-      } else if (sw[0] == (byte) 0x64 && sw[1] == (byte) 0x03) {
-        throw new PINFormatException("[64:03]");
+      if (pinSpec.getContextAID() != null) {
+        // SELECT AID
+        execSELECT_AID(channel, pinSpec.getContextAID());
       }
-      log.error("Failed to activate pin: SW="
-              + SMCCHelper.toString(sw));
-      throw new SignatureCardException(SMCCHelper.toString(sw));
-
-    } catch (CardException ex) {
-      log.error("smart card communication failed: " + ex.getMessage());
-      throw new SignatureCardException("smart card communication failed: " + ex.getMessage(), ex);
+      verifyPIN(channel, pinSpec, null, 0);
+      return PIN_STATE.ACTIV;
+    } catch (InterruptedException e) {
+      return PIN_STATE.UNKNOWN;
+    } catch (LockedException e) {
+      return PIN_STATE.BLOCKED;
+    } catch (NotActivatedException e) {
+      return PIN_STATE.NOT_ACTIV;
+    } catch (CardException e) {
+      log.error("Failed to get PIN status.", e);
+      throw new SignatureCardException("Failed to get PIN status.", e);
     }
+    
   }
 
-  /**
-   * BCD encodes the pin, pads with 0xFF and prepends the pins length
-   * @param pin
-   * @return a 8 byte pin block consisting of length byte (0x2X),
-   * the BCD encoded pin and a 0xFF padding
-   */
-  @Override
-  protected byte[] encodePINBlock(char[] pin) throws SignatureCardException {
-    if (pin == null || pin.length > 12) {
-      throw new SignatureCardException("invalid pin: " + pin);
+  public String toString() {
+    return "e-card";
+  }
+  
+  ////////////////////////////////////////////////////////////////////////
+  // PROTECTED METHODS (assume exclusive card access)
+  ////////////////////////////////////////////////////////////////////////
+  
+  protected void verifyPINLoop(CardChannel channel, PINSpec spec, PINProvider provider)
+      throws LockedException, NotActivatedException, SignatureCardException,
+      InterruptedException, CardException {
+    
+    int retries = verifyPIN(channel, spec, null, -1);
+    do {
+      retries = verifyPIN(channel, spec, provider, retries);
+    } while (retries > 0);
+    
+  }
+  
+  protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
+      PINProvider provider, int retries) throws SignatureCardException,
+      LockedException, NotActivatedException, InterruptedException,
+      CardException {
+    
+    VerifyAPDUSpec apduSpec = new VerifyAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x00, pinSpec.getKID(), (byte) 0x08,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
+    
+    ResponseAPDU resp;
+    if (provider != null) {
+      resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    } else {
+      resp = channel.transmit(new CommandAPDU(0x00, 0x20, 0x00, pinSpec.getKID()));
+    }
+    
+    if (resp.getSW() == 0x9000) {
+      return -1;
+    }
+    if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    }
+    
+    switch (resp.getSW()) {
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
+    case 0x6984:
+      // reference data not usable
+      throw new NotActivatedException();
+    case 0x6985:
+      // conditions of use not satisfied
+      throw new NotActivatedException();
+  
+    default:
+      String msg = "VERIFY failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+    
+  }
+  
+  protected int changePIN(CardChannel channel, PINSpec pinSpec,
+      ChangePINProvider pinProvider, int retries) throws CancelledException,
+      InterruptedException, CardException, SignatureCardException {
+    
+    ChangeReferenceDataAPDUSpec apduSpec = new ChangeReferenceDataAPDUSpec(
+        new byte[] { 
+            (byte) 0x00, (byte) 0x24, (byte) 0x00, pinSpec.getKID(), (byte) 0x10, 
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, 
+            (byte) 0xff, (byte) 0xff, (byte) 0xff, 
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, 
+            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4, 8);
+    
+    ResponseAPDU resp = reader.modify(channel, apduSpec, pinSpec, pinProvider, retries);
+    
+    if (resp.getSW() == 0x9000) {
+      return -1;
     }
-    int numDigits = pin.length;
-    int numBytes = (int) Math.ceil(numDigits/2.0);
+    if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    }
+    
+    switch (resp.getSW()) {
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
+  
+    default:
+      String msg = "CHANGE REFERENCE DATA failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+   
+    
+  }
 
-    byte[] pinBlock = new byte[8];
-    pinBlock[0] = (byte) (0x20 | numDigits);
+  protected int activatePIN(CardChannel channel, PINSpec pinSpec,
+      PINProvider provider) throws SignatureCardException,
+      InterruptedException, CardException {
+    
+    NewReferenceDataAPDUSpec apduSpec = new NewReferenceDataAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x01, pinSpec.getKID(), (byte) 0x08,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
+    
+    ResponseAPDU resp = reader.activate(channel, apduSpec, pinSpec, provider);
+    
+    switch (resp.getSW()) {
+    
+    case 0x9000:
+      return -1;
 
-    for (int i = 0; i < numBytes; i++) {
-      int p1 = 16*Character.digit(pin[i*2], 16);
-      int p2 = (i*2+1 < numDigits) ? Character.digit(pin[i*2+1], 16) : 0xf;
-      pinBlock[i+1] = (byte) (p1 + p2);
-    }
-    Arrays.fill(pinBlock, numBytes + 1, pinBlock.length, (byte) 0xff);
-//    log.trace("BCD encoded PIN block: " + SMCCHelper.toString(pinBlock));
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
 
-    return pinBlock;
+    default:
+      String msg = "CHANGE REFERENCE DATA failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+    
   }
   
-  private byte[] getPINVerifyStructure(byte kid) {
-      byte bTimeOut = reader.getbTimeOut(); 
-      byte bTimeOut2 = reader.getbTimeOut2(); // time out after first entry
-      byte bmFormatString = (byte) 0x89;      // 1 0001 0 01 
-                                              // ^------------ System unit = byte
-                                              //   ^^^^------- PIN position in the frame = 1 byte
-                                              //        ^----- PIN justification left
-                                              //          ^^-- BCD format
-      byte bmPINBlockString = (byte) 0x47;    // 0100 0111
-                                              // ^^^^--------- PIN length size: 4 bits
-                                              //      ^^^^---- Length PIN = 7 bytes
-      byte bmPINLengthFormat = (byte) 0x04;   // 000 0 0100
-                                              //     ^-------- System bit units is bit
-                                              //       ^^^^--- PIN length is at the 4th position bit
-      //TODO compare ints, not bytes
-      byte wPINMaxExtraDigitL =               // Max=12 digits 
-              (reader.getwPINMaxExtraDigitL() < (byte) 0x0c) ?
-                reader.getwPINMaxExtraDigitL() : (byte) 0x0c;
-      byte wPINMaxExtraDigitH =               // Min=4/6 digits TODO card/ss pin (min: 4/6)
-              (reader.getwPINMaxExtraDigitH() > (byte) 0x04) ?
-                reader.getwPINMaxExtraDigitH() : (byte) 0x04;
-      byte bEntryValidationCondition = 
-              reader.getbEntryValidationCondition();  
-      byte bNumberMessage = (byte) 0x00;      // No message
-      byte wLangIdL = (byte) 0x0C;            // - English?
-      byte wLangIdH = (byte) 0x04;            // \
-      byte bMsgIndex = (byte) 0x00;           // Default Msg
-
-      byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x20, (byte) 0x00, kid, (byte) 0x08,  // CLA INS P1 P2 LC
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,               // Data
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff                // ...
-      };
-
-      int offset = 0;
-      byte[] pinVerifyStructure = new byte[offset + 19 + apdu.length];
-      pinVerifyStructure[offset++] = bTimeOut;
-      pinVerifyStructure[offset++] = bTimeOut2;
-      pinVerifyStructure[offset++] = bmFormatString;
-      pinVerifyStructure[offset++] = bmPINBlockString;
-      pinVerifyStructure[offset++] = bmPINLengthFormat;
-      pinVerifyStructure[offset++] = wPINMaxExtraDigitL;
-      pinVerifyStructure[offset++] = wPINMaxExtraDigitH;
-      pinVerifyStructure[offset++] = bEntryValidationCondition;
-      pinVerifyStructure[offset++] = bNumberMessage;
-      pinVerifyStructure[offset++] = wLangIdL;
-      pinVerifyStructure[offset++] = wLangIdH;
-      pinVerifyStructure[offset++] = bMsgIndex;
-      
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      
-      pinVerifyStructure[offset++] = (byte) apdu.length;
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      pinVerifyStructure[offset++] = 0x00;
-      System.arraycopy(apdu, 0, pinVerifyStructure, offset, apdu.length);
-
-      return pinVerifyStructure;
+  protected void execSELECT_MF(CardChannel channel) throws CardException, SignatureCardException {
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x00, 0x0C));
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("Failed to select MF: SW="
+          + Integer.toHexString(resp.getSW()) + ".");
+    }
   }
 
-  private byte[] getPINModifyStructure(byte kid) {
-
-      byte bTimeOut = reader.getbTimeOut();   // s.o.
-      byte bTimeOut2 = reader.getbTimeOut2(); // s.o.
-      byte bmFormatString = (byte) 0x89;      // s.o.
-      byte bmPINBlockString = (byte) 0x47;    // s.o.
-      byte bmPINLengthFormat = (byte) 0x04;   // s.o.
-      byte bInsertionOffsetOld = (byte) 0x00; // insertion position offset in bytes
-      byte bInsertionOffsetNew = (byte) 0x08; // (add 1 from bmFormatString b3)
-      byte wPINMaxExtraDigitL = 
-              (reader.getwPINMaxExtraDigitL() < (byte) 0x0c) ?
-                reader.getwPINMaxExtraDigitL() : (byte) 0x0c;
-      byte wPINMaxExtraDigitH =               // Min=4/6 digits TODO card/ss pin (min: 4/6)
-              (reader.getwPINMaxExtraDigitH() > (byte) 0x04) ?
-                reader.getwPINMaxExtraDigitH() : (byte) 0x04;
-      byte bConfirmPIN = (byte) 0x03;         // current pin entry + confirmation
-      byte bEntryValidationCondition =
-              reader.getbEntryValidationCondition();
-      byte bNumberMessage = (byte) 0x03;      // 3 messages
-      byte wLangIdL = (byte) 0x0C;            
-      byte wLangIdH = (byte) 0x04;            
-      byte bMsgIndex1 = (byte) 0x00;          // insertion
-      byte bMsgIndex2 = (byte) 0x01;          // modification
-      byte bMsgIndex3 = (byte) 0x02;          // confirmation
-
-      byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x24, (byte) 0x00, kid, (byte) 0x10, 
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,      
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,      
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,      
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff       
-      };
-
-      int offset = 0;
-      byte[] pinModifyStructure = new byte[offset + 24 + apdu.length];
-      pinModifyStructure[offset++] = bTimeOut;
-      pinModifyStructure[offset++] = bTimeOut2;
-      pinModifyStructure[offset++] = bmFormatString;
-      pinModifyStructure[offset++] = bmPINBlockString;
-      pinModifyStructure[offset++] = bmPINLengthFormat;
-      pinModifyStructure[offset++] = bInsertionOffsetOld;
-      pinModifyStructure[offset++] = bInsertionOffsetNew;
-      pinModifyStructure[offset++] = wPINMaxExtraDigitL;
-      pinModifyStructure[offset++] = wPINMaxExtraDigitH;
-      pinModifyStructure[offset++] = bConfirmPIN;
-      pinModifyStructure[offset++] = bEntryValidationCondition;
-      pinModifyStructure[offset++] = bNumberMessage;
-      pinModifyStructure[offset++] = wLangIdL;
-      pinModifyStructure[offset++] = wLangIdH;
-      pinModifyStructure[offset++] = bMsgIndex1;
-      pinModifyStructure[offset++] = bMsgIndex2;
-      pinModifyStructure[offset++] = bMsgIndex3;
-
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-
-      pinModifyStructure[offset++] = (byte) apdu.length;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      System.arraycopy(apdu, 0, pinModifyStructure, offset, apdu.length);
-
-//      log.debug("PIN MODIFY " + SMCCHelper.toString(pinModifyStructure));
-      return pinModifyStructure;
+  protected byte[] execSELECT_AID(CardChannel channel, byte[] aid)
+      throws SignatureCardException, CardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x04, 0x00, aid, 256));
+    
+    if (resp.getSW() == 0x6A82) {
+      String msg = "File or application not found AID="
+          + SMCCHelper.toString(aid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new FileNotFoundException(msg);
+    } else if (resp.getSW() != 0x9000) {
+      String msg = "Failed to select application AID="
+          + SMCCHelper.toString(aid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    } else {
+      return resp.getBytes();
+    }
+    
   }
-  private byte[] getActivatePINModifyStructure(byte kid) {
-
-      byte bTimeOut = reader.getbTimeOut();   
-      byte bTimeOut2 = reader.getbTimeOut2(); 
-      byte bmFormatString = (byte) 0x89;      
-      byte bmPINBlockString = (byte) 0x47;    
-      byte bmPINLengthFormat = (byte) 0x04;   
-      byte bInsertionOffsetOld = (byte) 0x00; // ignored
-      byte bInsertionOffsetNew = (byte) 0x00; 
-      byte wPINMaxExtraDigitL =
-              (reader.getwPINMaxExtraDigitL() < (byte) 0x12) ?
-                reader.getwPINMaxExtraDigitL() : (byte) 0x12;
-      byte wPINMaxExtraDigitH =               // Min=4/6 digits TODO card/ss pin (min: 4/6)
-              (reader.getwPINMaxExtraDigitH() > (byte) 0x04) ?
-                reader.getwPINMaxExtraDigitH() : (byte) 0x04;
-      byte bConfirmPIN = (byte) 0x01;         // confirm, no current pin entry
-      byte bEntryValidationCondition =
-              reader.getbEntryValidationCondition();
-      byte bNumberMessage = (byte) 0x02;      // 2 messages
-      byte wLangIdL = (byte) 0x0c;
-      byte wLangIdH = (byte) 0x04;
-      byte bMsgIndex1 = (byte) 0x01;          // modification prompt
-      byte bMsgIndex2 = (byte) 0x02;          // confirmation prompt
-      byte bMsgIndex3 = (byte) 0x00;           
-
-      byte[] apdu = new byte[] {
-        (byte) 0x00, (byte) 0x24, (byte) 0x01, kid, (byte) 0x08,
-        (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff,
-        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff
-      };
-
-      int offset = 0;
-      byte[] pinModifyStructure = new byte[offset + 24 + apdu.length];
-      pinModifyStructure[offset++] = bTimeOut;
-      pinModifyStructure[offset++] = bTimeOut2;
-      pinModifyStructure[offset++] = bmFormatString;
-      pinModifyStructure[offset++] = bmPINBlockString;
-      pinModifyStructure[offset++] = bmPINLengthFormat;
-      pinModifyStructure[offset++] = bInsertionOffsetOld;
-      pinModifyStructure[offset++] = bInsertionOffsetNew;
-      pinModifyStructure[offset++] = wPINMaxExtraDigitL;
-      pinModifyStructure[offset++] = wPINMaxExtraDigitH;
-      pinModifyStructure[offset++] = bConfirmPIN;
-      pinModifyStructure[offset++] = bEntryValidationCondition;
-      pinModifyStructure[offset++] = bNumberMessage;
-      pinModifyStructure[offset++] = wLangIdL;
-      pinModifyStructure[offset++] = wLangIdH;
-      pinModifyStructure[offset++] = bMsgIndex1;
-      pinModifyStructure[offset++] = bMsgIndex2;
-      pinModifyStructure[offset++] = bMsgIndex3;
-
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-
-      pinModifyStructure[offset++] = (byte) apdu.length;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      pinModifyStructure[offset++] = 0x00;
-      System.arraycopy(apdu, 0, pinModifyStructure, offset, apdu.length);
-
-//      log.debug("PIN MODIFY " + SMCCHelper.toString(pinModifyStructure));
-      return pinModifyStructure;
+  
+  protected byte[] execSELECT_FID(CardChannel channel, byte[] fid)
+      throws SignatureCardException, CardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x02, 0x04, fid, 256));
+    
+    if (resp.getSW() == 0x6A82) {
+      String msg = "File or application not found FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new FileNotFoundException(msg);
+    } else if (resp.getSW() != 0x9000) {
+      String msg = "Failed to select application FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.error(msg);
+      throw new SignatureCardException(msg);
+    } else {
+      return resp.getBytes();
+    }
+    
   }
+  
+  protected void execMSE(CardChannel channel, int p1, int p2, byte[] data)
+      throws CardException, SignatureCardException {
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x22, p1, p2, data));
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("MSE:SET DST failed: SW="
+          + Integer.toHexString(resp.getSW()));
+    }
+  }
+  
+  protected void execPSO_HASH(CardChannel channel, byte[] hash) throws CardException, SignatureCardException {
+    byte[] data = new byte[hash.length + 2];
+    data[0] = (byte) 0x90; // tag
+    data[1] = (byte) (hash.length); // length
+    System.arraycopy(hash, 0, data, 2, hash.length);
 
-  @Override
-  public void reset() throws SignatureCardException {
-    try {
-      super.reset();
-      log.debug("select MF (e-card workaround)");
-      CardChannel channel = getCardChannel();
-      ResponseAPDU resp = transmit(channel, new CommandAPDU(0x00, 0xA4, 0x00, 0x0C));
-      if (resp.getSW() != 0x9000) {
-        throw new SignatureCardException("Failed to select MF after RESET: SW=" + Integer.toHexString(resp.getSW()) + ".");
-      }
-    } catch (CardException ex) {
-      log.error("Failed to select MF after RESET: " + ex.getMessage(), ex);
-      throw new SignatureCardException("Failed to select MF after RESET");
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x2A, 0x90, 0xA0, data));
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("PSO:HASH failed: SW="
+          + Integer.toHexString(resp.getSW()));
     }
   }
 
-  public String toString() {
-    return "e-card";
+  protected byte[] execPSO_COMPUTE_DIGITAL_SIGNATURE(CardChannel channel)
+      throws CardException, SignatureCardException {
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, 256));
+    if (resp.getSW() == 0x6982) {
+      throw new SecurityStatusNotSatisfiedException();
+    } else if (resp.getSW() == 0x6983) {
+      throw new LockedException();
+    } else if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException(
+          "PSO: COMPUTE DIGITAL SIGNATRE failed: SW="
+              + Integer.toHexString(resp.getSW()));
+    } else {
+      return resp.getData();
+    }
   }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index da084e0d..279362c0 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -14,10 +14,8 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.ccid.CCID;
 import java.io.ByteArrayOutputStream;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -37,20 +35,20 @@ import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
-import java.util.ArrayList;
 import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.List;
 import java.util.Locale;
 
-import java.util.Map;
 import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CardTerminal;
+import javax.smartcardio.ResponseAPDU;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
+import at.gv.egiz.smcc.ccid.CCID;
+
 /**
  *
  * @author mcentner
@@ -395,31 +393,6 @@ public class SWCard implements SignatureCard {
   public void reset() throws SignatureCardException {
   }
 
-  @Override
-  public List<PINSpec> getPINSpecs() {
-    return new ArrayList<PINSpec>();
-  }
-
-  @Override
-  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
-          throws LockedException, NotActivatedException, SignatureCardException {
-  }
-
-  @Override
-  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider) throws SignatureCardException {
-    throw new UnsupportedOperationException("Not supported yet.");
-  }
-
-  @Override
-  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider) throws CancelledException, SignatureCardException, InterruptedException {
-    throw new UnsupportedOperationException("Not supported yet.");
-  }
-
-  @Override
-  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider) throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException {
-    throw new UnsupportedOperationException("Not supported yet.");
-  }
-
   @Override
   public CCID getReader() {
     return new CCID() {
@@ -488,6 +461,32 @@ public class SWCard implements SignatureCard {
       public void setDisablePinpad(boolean disable) {
         throw new UnsupportedOperationException("Not supported yet.");
       }
+
+      @Override
+      public ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
+          PINSpec pinSpec, PINProvider provider, int retries)
+          throws CancelledException, InterruptedException, CardException,
+          SignatureCardException {
+        throw new UnsupportedOperationException("Not supported yet.");
+      }
+
+      @Override
+      public ResponseAPDU activate(CardChannel channel,
+          NewReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
+          PINProvider provider) throws CancelledException,
+          InterruptedException, CardException, SignatureCardException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+
+      @Override
+      public ResponseAPDU modify(CardChannel channel,
+          ChangeReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
+          ChangePINProvider provider, int retries) throws CancelledException,
+          InterruptedException, CardException, SignatureCardException {
+        // TODO Auto-generated method stub
+        return null;
+      }
     };
   }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index c06074f2..1a163783 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -1,35 +1,23 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
 package at.gv.egiz.smcc;
 
 import at.gv.egiz.smcc.ccid.CCID;
-import java.util.List;
 import java.util.Locale;
 
 import javax.smartcardio.Card;
@@ -76,6 +64,11 @@ public interface SignatureCard {
       return keyboxName_;
     }
 
+    @Override
+    public String toString() {
+      return keyboxName_;
+    }
+
   }
 
   public void init(Card card, CardTerminal cardTerminal);
@@ -118,24 +111,6 @@ public interface SignatureCard {
   public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
       PINProvider provider) throws SignatureCardException, InterruptedException;
 
-  /**
-   * Get the KIDs for all available PINs and the corresponding PINSpecs
-   * @return array of KIDs
-   */
-  public List<PINSpec> getPINSpecs();
-
-  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
-          throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException;
-
-  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
-          throws LockedException, NotActivatedException, CancelledException, PINFormatException, SignatureCardException, InterruptedException;
-
-  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
-          throws CancelledException, SignatureCardException, InterruptedException;
-
-  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
-          throws CancelledException, SignatureCardException, InterruptedException;
-
   public CCID getReader();
 
   /**
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardException.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardException.java
index f296f3a2..48b4646a 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardException.java
@@ -1,31 +1,20 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
 package at.gv.egiz.smcc;
 
 public class SignatureCardException extends Exception {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
index 5146c275..f46f8657 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
@@ -1,31 +1,20 @@
-//Copyright (C) 2002 IAIK
-//http://jce.iaik.at
-//
-//Copyright (C) 2003 Stiftung Secure Information and 
-//                 Communication Technologies SIC
-//http://www.sic.st
-//
-//All rights reserved.
-//
-//This source is provided for inspection purposes and recompilation only,
-//unless specified differently in a contract with IAIK. This source has to
-//be kept in strict confidence and must not be disclosed to any third party
-//under any circumstances. Redistribution in source and binary forms, with
-//or without modification, are <not> permitted in any case!
-//
-//THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-//ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-//IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-//ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-//FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-//DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-//OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-//HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-//LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-//OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-//SUCH DAMAGE.
-//
-//
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
 package at.gv.egiz.smcc;
 
 import java.util.ArrayList;
@@ -233,7 +222,11 @@ public class SignatureCardFactory {
         try {
           Class<?> scClass = cl.loadClass(supportedCard.getImplementationClassName());
           sc = (SignatureCard) scClass.newInstance();
+          
+          sc = ExclSignatureCardProxy.newInstance(sc);
+          
           sc.init(card, cardTerminal);
+
           return sc;
 
         } catch (ClassNotFoundException e) {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/VerifyAPDUSpec.java b/smcc/src/main/java/at/gv/egiz/smcc/VerifyAPDUSpec.java
new file mode 100644
index 00000000..23c1f0fd
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/VerifyAPDUSpec.java
@@ -0,0 +1,200 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class VerifyAPDUSpec {
+  
+  public static final int PIN_JUSTIFICATION_LEFT = 0;
+  
+  public static final int PIN_JUSTIFICATION_RIGHT = 1;
+  
+  public static final int PIN_FORMAT_BINARY = 0;
+  
+  public static final int PIN_FORMAT_BCD = 1;
+  
+  public static final int PIN_FORMAT_ASCII = 2; 
+  
+  /**
+   * The APDU template.
+   */
+  protected byte[] apdu;
+  
+  /**
+   * The PIN position in bytes.
+   */
+  protected int pinPosition;
+  
+  /**
+   * The PIN justification (either {@link #PIN_JUSTIFICATION_LEFT} or
+   * {@link #PIN_JUSTIFICATION_RIGHT}).
+   */
+  protected int pinJustification = PIN_JUSTIFICATION_LEFT;
+
+  /**
+   * The PIN encoding format (one of {@value #PIN_FORMAT_BCD},
+   * {@link #PIN_FORMAT_ASCII}).
+   */
+  protected int pinFormat;
+
+  /**
+   * The size of the PIN length in bits or 0 for no PIN length. (Default: 0)
+   */
+  protected int pinLengthSize = 0;
+  
+  /**
+   * The PIN length in the template in bytes.
+   */
+  protected int pinLength;
+  
+  /**
+   * The PIN length position in the template in bits or 0 for no PIN length.
+   * (Default: 0)
+   */
+  protected int pinLengthPos = 0;
+
+  /**
+   * @param apdu
+   * @param pinPosition
+   * @param pinFormat
+   * @param pinLength TODO
+   */
+  public VerifyAPDUSpec(byte[] apdu, int pinPosition, int pinFormat, int pinLength) {
+    super();
+    this.apdu = apdu;
+    this.pinPosition = pinPosition;
+    this.pinFormat = pinFormat;
+    this.pinLength = pinLength;
+  }
+
+  /**
+   * @param apdu
+   * @param pinPosition
+   * @param pinFormat
+   * @param pinLength
+   * @param pinLengthSize
+   * @param pinLengthPos
+   */
+  public VerifyAPDUSpec(byte[] apdu, int pinPosition, int pinFormat,
+      int pinLength, int pinLengthSize, int pinLengthPos) {
+    super();
+    this.apdu = apdu;
+    this.pinPosition = pinPosition;
+    this.pinFormat = pinFormat;
+    this.pinLength = pinLength;
+    this.pinLengthSize = pinLengthSize;
+    this.pinLengthPos = pinLengthPos;
+  }
+
+  /**
+   * @return the apdu
+   */
+  public byte[] getApdu() {
+    return apdu;
+  }
+
+  /**
+   * @param apdu the apdu to set
+   */
+  public void setApdu(byte[] apdu) {
+    this.apdu = apdu;
+  }
+
+  /**
+   * @return the pinPosition
+   */
+  public int getPinPosition() {
+    return pinPosition;
+  }
+
+  /**
+   * @param pinPosition the pinPosition to set
+   */
+  public void setPinPosition(int pinPosition) {
+    this.pinPosition = pinPosition;
+  }
+
+  /**
+   * @return the pinJustification
+   */
+  public int getPinJustification() {
+    return pinJustification;
+  }
+
+  /**
+   * @param pinJustification the pinJustification to set
+   */
+  public void setPinJustification(int pinJustification) {
+    this.pinJustification = pinJustification;
+  }
+
+  /**
+   * @return the pinFormat
+   */
+  public int getPinFormat() {
+    return pinFormat;
+  }
+
+  /**
+   * @param pinFormat the pinFormat to set
+   */
+  public void setPinFormat(int pinFormat) {
+    this.pinFormat = pinFormat;
+  }
+
+  /**
+   * @return the pinLengthSize
+   */
+  public int getPinLengthSize() {
+    return pinLengthSize;
+  }
+
+  /**
+   * @param pinLengthSize the pinLengthSize to set
+   */
+  public void setPinLengthSize(int pinLengthSize) {
+    this.pinLengthSize = pinLengthSize;
+  }
+
+  /**
+   * @return the pinLength
+   */
+  public int getPinLength() {
+    return pinLength;
+  }
+
+  /**
+   * @param pinLength the pinLength to set
+   */
+  public void setPinLength(int pinLength) {
+    this.pinLength = pinLength;
+  }
+
+  /**
+   * @return the pinLengthPos
+   */
+  public int getPinLengthPos() {
+    return pinLengthPos;
+  }
+
+  /**
+   * @param pinLengthPos the pinLengthPos to set
+   */
+  public void setPinLengthPos(int pinLengthPos) {
+    this.pinLengthPos = pinLengthPos;
+  }
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java b/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java
index 2972f3b8..d73ff0e9 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ccid/CCID.java
@@ -16,9 +16,20 @@
  */
 package at.gv.egiz.smcc.ccid;
 
-import at.gv.egiz.smcc.*;
 import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.ChangePINProvider;
+import at.gv.egiz.smcc.ChangeReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.NewReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.PINOperationAbortedException;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.VerifyAPDUSpec;
 
 /**
  *
@@ -66,6 +77,16 @@ public interface CCID {
   
   boolean hasFeature(Byte feature);
 
+  ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
+      PINSpec pinSpec, PINProvider provider, int retries)
+      throws CancelledException, InterruptedException, CardException,
+      SignatureCardException;
+
+  ResponseAPDU modify(CardChannel channel,
+      ChangeReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
+      ChangePINProvider provider, int retries) throws CancelledException,
+      InterruptedException, CardException, SignatureCardException;
+  
   /**
    * not supported by OMNIKEY CardMan 3621 with ACOS card
    * @param PIN_VERIFY
@@ -107,4 +128,9 @@ public interface CCID {
   byte getwPINMaxExtraDigitL();
   byte getwPINMaxExtraDigitH();
   byte getbEntryValidationCondition();
+
+  ResponseAPDU activate(CardChannel channel, NewReferenceDataAPDUSpec apduSpec,
+      PINSpec pinSpec, PINProvider provider)
+      throws CancelledException, InterruptedException, CardException,
+      SignatureCardException;
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java b/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java
index 580b9379..682390e3 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ccid/DefaultReader.java
@@ -16,16 +16,34 @@
  */
 package at.gv.egiz.smcc.ccid;
 
-import at.gv.egiz.smcc.*;
-import at.gv.egiz.smcc.util.SMCCHelper;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
+
 import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
 import javax.smartcardio.CardTerminal;
+import javax.smartcardio.ResponseAPDU;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.ChangePINProvider;
+import at.gv.egiz.smcc.ChangeReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.NewReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINOperationAbortedException;
+import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.TimeoutException;
+import at.gv.egiz.smcc.VerifyAPDUSpec;
+import at.gv.egiz.smcc.util.ISO7816Utils;
+import at.gv.egiz.smcc.util.SMCCHelper;
+
 /**
  *
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
@@ -415,4 +433,339 @@ public class DefaultReader implements CCID {
     }
     return resp;
   }
+  
+  
+  
+  protected byte[] createPINModifyStructure(NewReferenceDataAPDUSpec apduSpec, PINSpec pinSpec) {
+    
+    ByteArrayOutputStream s = new ByteArrayOutputStream();
+    // bTimeOut
+    s.write(getbTimeOut());
+    // bTimeOut2
+    s.write(getbTimeOut2());
+    // bmFormatString
+    s.write(1 << 7 // system unit = byte
+        | (0xF & apduSpec.getPinPosition()) << 3
+        | (0x1 & apduSpec.getPinJustification() << 2)
+        | (0x3 & apduSpec.getPinFormat()));
+    // bmPINBlockString
+    s.write((0xF & apduSpec.getPinLengthSize()) << 4
+        | (0xF & apduSpec.getPinLength()));
+    // bmPINLengthFormat
+    s.write(// system unit = bit
+        (0xF & apduSpec.getPinLengthPos()));
+    // bInsertionOffsetOld
+    s.write(0x00);
+    // bInsertionOffsetNew
+    s.write(apduSpec.getPinInsertionOffsetNew());
+    // wPINMaxExtraDigit
+    s.write(Math.min(pinSpec.getMaxLength(), getwPINMaxExtraDigitL()));
+    s.write(Math.max(pinSpec.getMinLength(), getwPINMaxExtraDigitH()));
+    // bConfirmPIN
+    s.write(0x01);
+    // bEntryValidationCondition
+    s.write(getbEntryValidationCondition());
+    // bNumberMessage
+    s.write(0x02);
+    // wLangId
+    s.write(0x0C);
+    s.write(0x04);
+    // bMsgIndex1
+    s.write(0x01);
+    // bMsgIndex2
+    s.write(0x02);
+    // bMsgIndex3
+    s.write(0x00);
+    
+    // bTeoPrologue
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // ulDataLength
+    s.write(apduSpec.getApdu().length);
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // abData
+    try {
+      s.write(apduSpec.getApdu());
+    } catch (IOException e) {
+      // As we are dealing with ByteArrayOutputStreams no exception is to be
+      // expected.
+      throw new RuntimeException(e);
+    }
+    
+    return s.toByteArray();
+
+  }
+  
+  protected byte[] createPINModifyStructure(ChangeReferenceDataAPDUSpec apduSpec, PINSpec pinSpec) {
+    
+    ByteArrayOutputStream s = new ByteArrayOutputStream();
+    // bTimeOut
+    s.write(getbTimeOut());
+    // bTimeOut2
+    s.write(getbTimeOut2());
+    // bmFormatString
+    s.write(1 << 7 // system unit = byte
+        | (0xF & apduSpec.getPinPosition()) << 3
+        | (0x1 & apduSpec.getPinJustification() << 2)
+        | (0x3 & apduSpec.getPinFormat()));
+    // bmPINBlockString
+    s.write((0xF & apduSpec.getPinLengthSize()) << 4
+        | (0xF & apduSpec.getPinLength()));
+    // bmPINLengthFormat
+    s.write(// system unit = bit
+        (0xF & apduSpec.getPinLengthPos()));
+    // bInsertionOffsetOld
+    s.write(apduSpec.getPinInsertionOffsetOld());
+    // bInsertionOffsetNew
+    s.write(apduSpec.getPinInsertionOffsetNew());
+    // wPINMaxExtraDigit
+    s.write(Math.min(pinSpec.getMaxLength(), getwPINMaxExtraDigitL()));
+    s.write(Math.max(pinSpec.getMinLength(), getwPINMaxExtraDigitH()));
+    // bConfirmPIN
+    s.write(0x03);
+    // bEntryValidationCondition
+    s.write(getbEntryValidationCondition());
+    // bNumberMessage
+    s.write(0x03);
+    // wLangId
+    s.write(0x0C);
+    s.write(0x04);
+    // bMsgIndex1
+    s.write(0x00);
+    // bMsgIndex2
+    s.write(0x01);
+    // bMsgIndex3
+    s.write(0x02);
+    
+    // bTeoPrologue
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // ulDataLength
+    s.write(apduSpec.getApdu().length);
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // abData
+    try {
+      s.write(apduSpec.getApdu());
+    } catch (IOException e) {
+      // As we are dealing with ByteArrayOutputStreams no exception is to be
+      // expected.
+      throw new RuntimeException(e);
+    }
+    
+    return s.toByteArray();
+
+  }
+  
+  protected byte[] createPINVerifyStructure(VerifyAPDUSpec apduSpec, PINSpec pinSpec) {
+    
+    ByteArrayOutputStream s = new ByteArrayOutputStream();
+    // bTimeOut
+    s.write(getbTimeOut());
+    // bTimeOut2
+    s.write(getbTimeOut2());
+    // bmFormatString
+    s.write(1 << 7 // system unit = byte
+        | (0xF & apduSpec.getPinPosition()) << 3
+        | (0x1 & apduSpec.getPinJustification() << 2)
+        | (0x3 & apduSpec.getPinFormat()));
+    // bmPINBlockString
+    s.write((0xF & apduSpec.getPinLengthSize()) << 4
+        | (0xF & apduSpec.getPinLength()));
+    // bmPINLengthFormat
+    s.write(// system unit = bit
+        (0xF & apduSpec.getPinLengthPos()));
+    // wPINMaxExtraDigit
+    s.write(Math.min(pinSpec.getMaxLength(), getwPINMaxExtraDigitL())); // max PIN length
+    s.write(Math.max(pinSpec.getMinLength(), getwPINMaxExtraDigitH())); // min PIN length
+    // bEntryValidationCondition
+    s.write(getbEntryValidationCondition());
+    // bNumberMessage
+    s.write(0xFF);
+    // wLangId
+    s.write(0x0C);
+    s.write(0x04);
+    // bMsgIndex
+    s.write(0x00);
+    // bTeoPrologue
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // ulDataLength
+    s.write(apduSpec.getApdu().length);
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // abData
+    try {
+      s.write(apduSpec.getApdu());
+    } catch (IOException e) {
+      // As we are dealing with ByteArrayOutputStreams no exception is to be
+      // expected.
+      throw new RuntimeException(e);
+    }
+    
+    return s.toByteArray();
+    
+  }
+  
+  @Override
+  public ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
+      PINSpec pinSpec, PINProvider provider, int retries)
+      throws CancelledException, InterruptedException, CardException,
+      SignatureCardException {
+    
+    char[] pin = provider.providePIN(pinSpec, retries);
+
+    ResponseAPDU resp = null;
+    if (!disablePinpad && hasFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+      log.debug("VERIFY using " + FEATURES[FEATURE_VERIFY_PIN_DIRECT] + ".");
+      byte[] s = createPINVerifyStructure(apduSpec, pinSpec);
+      resp = new ResponseAPDU(verifyPinDirect(s));
+    } else if (!disablePinpad && hasFeature(FEATURE_VERIFY_PIN_START)) {
+      log.debug("VERIFY using " + FEATURES[FEATURE_MODIFY_PIN_START] + ".");
+      byte[] s = createPINVerifyStructure(apduSpec, pinSpec);
+      resp = new ResponseAPDU(verifyPin(s));
+    }
+      
+    if (resp != null) {
+      
+      switch (resp.getSW()) {
+
+      case 0x6400:
+        log.debug("SPE operation timed out.");
+        throw new TimeoutException();
+      case 0x6401:
+        log.debug("SPE operation was cancelled by the 'Cancel' button.");
+        throw new CancelledException();
+      case 0x6103:
+        log.debug("User entered too short or too long PIN "
+            + "regarding MIN/MAX PIN length.");
+        throw new PINFormatException();
+      case 0x6480:
+        log.debug("SPE operation was aborted by the 'Cancel' operation "
+            + "at the host system.");
+      case 0x6b80:
+        log.info("Invalid parameter in passed structure.");
+
+      default:
+        return resp;
+      }
+      
+    } else {
+      log.debug("VERIFY using software pin entry.");
+      return channel.transmit(ISO7816Utils.createVerifyAPDU(apduSpec, pin));
+    }    
+    
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel,
+      ChangeReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
+      ChangePINProvider provider, int retries) throws CancelledException,
+      InterruptedException, CardException, SignatureCardException {
+    
+    char[] oldPin = provider.provideOldPIN(pinSpec, retries);
+    char[] newPin = provider.providePIN(pinSpec, retries);
+    
+    ResponseAPDU resp = null;
+    if (!disablePinpad && hasFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+      log.debug("MODIFY using " + FEATURES[FEATURE_MODIFY_PIN_DIRECT] + ".");
+      byte[] s = createPINModifyStructure(apduSpec, pinSpec);
+      resp = new ResponseAPDU(modifyPinDirect(s));
+    } else if (!disablePinpad && hasFeature(FEATURE_MODIFY_PIN_START)) {
+      log.debug("MODIFY using " + FEATURES[FEATURE_MODIFY_PIN_START] + ".");
+      byte[] s = createPINModifyStructure(apduSpec, pinSpec);
+      resp = new ResponseAPDU(modifyPin(s));
+    }
+    
+    if (resp != null) {
+      
+      switch (resp.getSW()) {
+
+      case 0x6400:
+        log.debug("SPE operation timed out.");
+        throw new TimeoutException();
+      case 0x6401:
+        log.debug("SPE operation was cancelled by the 'Cancel' button.");
+        throw new CancelledException();
+      case 0x6103:
+        log.debug("User entered too short or too long PIN "
+            + "regarding MIN/MAX PIN length.");
+        throw new PINFormatException();
+      case 0x6480:
+        log.debug("SPE operation was aborted by the 'Cancel' operation "
+            + "at the host system.");
+      case 0x6b80:
+        log.info("Invalid parameter in passed structure.");
+
+      default:
+        return resp;
+      }
+      
+    } else {
+      log.debug("MODIFY using software pin entry.");
+      return channel.transmit(ISO7816Utils.createChangeReferenceDataAPDU(apduSpec, oldPin, newPin));
+    }
+    
+  }
+  
+  @Override
+  public ResponseAPDU activate(CardChannel channel,
+      NewReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
+      PINProvider provider) throws CancelledException,
+      InterruptedException, CardException, SignatureCardException {
+    
+    char[] newPin = provider.providePIN(pinSpec, -1);
+    
+    ResponseAPDU resp = null;
+    if (!disablePinpad && hasFeature(FEATURE_MODIFY_PIN_DIRECT)) {
+      log.debug("MODIFY using " + FEATURES[FEATURE_MODIFY_PIN_DIRECT] + ".");
+      byte[] s = createPINModifyStructure(apduSpec, pinSpec);
+      resp = new ResponseAPDU(modifyPinDirect(s));
+    } else if (!disablePinpad && hasFeature(FEATURE_MODIFY_PIN_START)) {
+      log.debug("MODIFY using " + FEATURES[FEATURE_MODIFY_PIN_START] + ".");
+      byte[] s = createPINModifyStructure(apduSpec, pinSpec);
+      resp = new ResponseAPDU(modifyPin(s));
+    }
+    
+    if (resp != null) {
+      
+      switch (resp.getSW()) {
+
+      case 0x6400:
+        log.debug("SPE operation timed out.");
+        throw new TimeoutException();
+      case 0x6401:
+        log.debug("SPE operation was cancelled by the 'Cancel' button.");
+        throw new CancelledException();
+      case 0x6103:
+        log.debug("User entered too short or too long PIN "
+            + "regarding MIN/MAX PIN length.");
+        throw new PINFormatException();
+      case 0x6480:
+        log.debug("SPE operation was aborted by the 'Cancel' operation "
+            + "at the host system.");
+      case 0x6b80:
+        log.info("Invalid parameter in passed structure.");
+
+      default:
+        return resp;
+      }
+      
+    } else {
+      log.debug("MODIFY using software pin entry.");
+      return channel.transmit(ISO7816Utils.createNewReferenceDataAPDU(apduSpec, newPin));
+    }
+    
+  }
+  
+  
+
+  
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/conf/SMCCConfiguration.java b/smcc/src/main/java/at/gv/egiz/smcc/conf/SMCCConfiguration.java
index 8ea49ca6..696709bd 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/conf/SMCCConfiguration.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/conf/SMCCConfiguration.java
@@ -25,6 +25,8 @@ import java.util.Properties;
  */
 public class SMCCConfiguration extends Properties {
 
+  private static final long serialVersionUID = 1L;
+
   public static final String DISABLE_PINPAD_P = "disable.pinpad";
 
   public void setDisablePinpad(String value) {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java b/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java
new file mode 100644
index 00000000..c5c7cbc9
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java
@@ -0,0 +1,359 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.util;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.CharBuffer;
+import java.nio.charset.Charset;
+
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.ChangeReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.NewReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.SecurityStatusNotSatisfiedException;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.VerifyAPDUSpec;
+
+public class ISO7816Utils {
+  
+  public static TransparentFileInputStream openTransparentFileInputStream(
+      final CardChannel channel, int maxSize) {
+    
+    TransparentFileInputStream file = new TransparentFileInputStream(maxSize) {
+
+      @Override
+      protected byte[] readBinary(int offset, int len) throws IOException {
+
+        ResponseAPDU resp;
+        try {
+          resp = channel.transmit(new CommandAPDU(0x00, 0xB0,
+              0x7F & (offset >> 8), offset & 0xFF, len));
+        } catch (CardException e) {
+          throw new IOException(e);
+        }
+
+        Throwable cause;
+        if (resp.getSW() == 0x9000) {
+          return resp.getData();
+        } else if (resp.getSW() == 0x6982) {
+          cause = new SecurityStatusNotSatisfiedException();
+        } else {
+          cause = new SignatureCardException("Failed to read bytes (offset=" + offset + ",len="
+              + len + ") SW=" + Integer.toHexString(resp.getSW()) + ".");
+        }
+        throw new IOException(cause);
+
+      }
+      
+    };
+
+    return file;
+    
+  }
+
+  public static byte[] readTransparentFile(CardChannel channel, int maxSize)
+      throws CardException, SignatureCardException {
+    
+    TransparentFileInputStream is = openTransparentFileInputStream(channel, maxSize);
+    
+    try {
+
+      ByteArrayOutputStream os = new ByteArrayOutputStream();
+      
+      int len;
+      for (byte[] b = new byte[256]; (len = is.read(b)) != -1;) {
+        os.write(b, 0, len);
+      }
+      
+      return os.toByteArray();
+      
+    } catch (IOException e) {
+      Throwable cause = e.getCause();
+      if (cause instanceof CardException) {
+        throw (CardException) cause;
+      }
+      if (cause instanceof SignatureCardException) {
+        throw (SignatureCardException) cause;
+      }
+      throw new SignatureCardException(e);
+    }
+    
+  }
+  
+  public static byte[] readTransparentFileTLV(CardChannel channel, int maxSize,
+      byte expectedType) throws CardException, SignatureCardException {
+
+    TransparentFileInputStream is = openTransparentFileInputStream(channel,
+        maxSize);
+
+    try {
+
+      is.mark(256);
+
+      // check expected type
+      int b = is.read();
+      if (b == 0x00) {
+        return null;
+      }
+      if (b == -1 || expectedType != (0xFF & b)) {
+        throw new SignatureCardException("Unexpected TLV type. Expected "
+            + Integer.toHexString(expectedType) + " but was "
+            + Integer.toHexString(b) + ".");
+      }
+
+      // get actual length
+      int actualSize = 2;
+      b = is.read();
+      if (b == -1) {
+        return null;
+      } else if ((0x80 & b) > 0) {
+        int octets = (0x0F & b);
+        actualSize += octets;
+        for (int i = 1; i <= octets; i++) {
+          b = is.read();
+          if (b == -1) {
+            return null;
+          }
+          actualSize += (0xFF & b) << ((octets - i) * 8);
+        }
+      } else {
+        actualSize += 0xFF & b;
+      }
+
+      // set limit to actual size and read into buffer
+      is.reset();
+      is.setLimit(actualSize);
+      byte[] buf = new byte[actualSize];
+      if (is.read(buf) == actualSize) {
+        return buf;
+      } else {
+        return null;
+      }
+
+    } catch (IOException e) {
+      Throwable cause = e.getCause();
+      if (cause instanceof CardException) {
+        throw (CardException) cause;
+      }
+      if (cause instanceof SignatureCardException) {
+        throw (SignatureCardException) cause;
+      }
+      throw new SignatureCardException(e);
+    }
+
+  }
+  
+  public static int getLengthFromFCx(byte[] fcx) {
+    
+    int len = -1;
+    
+    if (fcx.length != 0 && (fcx[0] == (byte) 0x62 || fcx[0] == (byte) 0x6F)) {
+      int pos = 2;
+      while (pos < (fcx[1] - 2)) {
+        switch (fcx[pos]) {
+        
+        case (byte) 0x80: {
+          len = 0xFF & fcx[pos + 2];
+          for (int i = 1; i < fcx[pos + 1]; i++) {
+            len<<=8;
+            len+=0xFF & fcx[pos + i + 2];
+          }
+        }
+
+        default:
+          pos += 0xFF & fcx[pos + 1] + 2;
+        }
+      }
+    }
+    
+    return len;
+    
+  }
+  
+  public static byte[] readRecord(CardChannel channel, int record) throws CardException, SignatureCardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xB2, record, 0x04, 256));
+    if (resp.getSW() == 0x9000) {
+      return resp.getData();
+    } else {
+      throw new SignatureCardException("Failed to read records. SW="
+          + Integer.toHexString(resp.getSW()));
+    }
+    
+  }
+
+  public static void formatPIN(int pinFormat, int pinJustification, byte[] fpin, byte[] mask, char[] pin) {
+    
+    boolean left = (pinJustification == VerifyAPDUSpec.PIN_JUSTIFICATION_LEFT);
+    
+    int j = (left) ? 0 : fpin.length - 1;
+    int step = (left) ? 1 : - 1;
+    switch (pinFormat) {
+      case VerifyAPDUSpec.PIN_FORMAT_BINARY:
+        if (fpin.length < pin.length) {
+          throw new IllegalArgumentException();
+        }
+        for (int i = 0; i < pin.length; i++) {
+          fpin[j] = (byte) Character.digit(pin[i], 10);
+          mask[j] = (byte) 0xFF;
+          j += step;
+        }
+        break;
+      
+      case VerifyAPDUSpec.PIN_FORMAT_BCD:
+        if (fpin.length * 2 < pin.length) {
+          throw new IllegalArgumentException();
+        }
+        for (int i = 0; i < pin.length; i++) {
+          int digit = Character.digit(pin[i], 10);
+          boolean h = (i % 2 == 0) ^ left;
+          fpin[j] |= h ? digit : digit << 4 ;
+          mask[j] |= h ? (byte) 0x0F : (byte) 0xF0;
+          j += (i % 2) * step;
+        }
+        break;
+  
+      case VerifyAPDUSpec.PIN_FORMAT_ASCII:
+        if (fpin.length < pin.length) {
+          throw new IllegalArgumentException();
+        }
+        byte[] asciiPin = Charset.forName("ASCII").encode(CharBuffer.wrap(pin)).array();
+        for (int i = 0; i < pin.length; i++) {
+          fpin[j] = asciiPin[i];
+          mask[j] = (byte) 0xFF;
+          j += step;
+        }
+        break;
+      }
+  
+  }
+  
+  public static void insertPIN(byte[] apdu, int pos, byte[] fpin, byte[] mask) {
+    for (int i = 0; i < fpin.length; i++) {
+      apdu[pos + i] &= ~mask[i];
+      apdu[pos + i] |= fpin[i]; 
+    }
+  }
+  
+  public static void insertPINLength(byte[] apdu, int length, int lengthSize, int pos, int offset) {
+    
+    // use short (2 byte) to be able to shift the pin length
+    // by the number of bits given by the pin length position
+    short size = (short) (0x00FF & length);
+    short sMask = (short) ((1 << lengthSize) - 1);
+    // shift to the proper position 
+    int shift = 16 - lengthSize - (pos % 8);
+    offset += (pos / 8) + 5;
+    size <<= shift;
+    sMask <<= shift;
+    // insert upper byte
+    apdu[offset] &= (0xFF & (~sMask >> 8));
+    apdu[offset] |= (0xFF & (size >> 8));
+    // insert lower byte
+    apdu[offset + 1] &= (0xFF & ~sMask);
+    apdu[offset + 1] |= (0xFF & size);
+    
+  }
+
+  public static CommandAPDU createVerifyAPDU(VerifyAPDUSpec apduSpec, char[] pin) {
+
+    // format pin
+    byte[] fpin = new byte[apduSpec.getPinLength()];
+    byte[] mask = new byte[apduSpec.getPinLength()];
+    formatPIN(apduSpec.getPinFormat(), apduSpec.getPinJustification(), fpin, mask, pin);
+
+    byte[] apdu = apduSpec.getApdu();
+
+    // insert formated pin
+    insertPIN(apdu, apduSpec.getPinPosition() + 5, fpin, mask);
+
+    // insert pin length
+    if (apduSpec.getPinLengthSize() != 0) {
+      insertPINLength(apdu, pin.length, apduSpec.getPinLengthSize(), apduSpec.getPinLengthPos(), 0);
+    }
+
+    return new CommandAPDU(apdu);
+    
+  }
+
+  public static CommandAPDU createChangeReferenceDataAPDU(
+      ChangeReferenceDataAPDUSpec apduSpec, char[] oldPin, char[] newPin) {
+    
+    // format old pin
+    byte[] fpin = new byte[apduSpec.getPinLength()];
+    byte[] mask = new byte[apduSpec.getPinLength()];
+    formatPIN(apduSpec.getPinFormat(), apduSpec.getPinJustification(), fpin, mask, oldPin);
+
+    byte[] apdu = apduSpec.getApdu();
+    
+    // insert formated old pin
+    insertPIN(apdu, apduSpec.getPinPosition() + apduSpec.getPinInsertionOffsetOld() + 5, fpin, mask);
+
+    // insert pin length
+    if (apduSpec.getPinLengthSize() != 0) {
+      insertPINLength(apdu, oldPin.length, apduSpec.getPinLengthSize(),
+          apduSpec.getPinLengthPos(), apduSpec.getPinInsertionOffsetOld());
+    }
+
+    // format new pin
+    fpin = new byte[apduSpec.getPinLength()];
+    mask = new byte[apduSpec.getPinLength()];
+    formatPIN(apduSpec.getPinFormat(), apduSpec.getPinJustification(), fpin, mask, newPin);
+    
+    // insert formated new pin
+    insertPIN(apdu, apduSpec.getPinPosition() + apduSpec.getPinInsertionOffsetNew() + 5, fpin, mask);
+
+    // insert pin length
+    if (apduSpec.getPinLengthSize() != 0) {
+      insertPINLength(apdu, newPin.length, apduSpec.getPinLengthSize(),
+          apduSpec.getPinLengthPos(), apduSpec.getPinInsertionOffsetNew());
+    }
+
+    return new CommandAPDU(apdu);
+    
+  }
+
+  public static CommandAPDU createNewReferenceDataAPDU(
+      NewReferenceDataAPDUSpec apduSpec, char[] newPin) {
+    
+    // format old pin
+    byte[] fpin = new byte[apduSpec.getPinLength()];
+    byte[] mask = new byte[apduSpec.getPinLength()];
+    formatPIN(apduSpec.getPinFormat(), apduSpec.getPinJustification(), fpin, mask, newPin);
+
+    byte[] apdu = apduSpec.getApdu();
+    
+    // insert formated new pin
+    insertPIN(apdu, apduSpec.getPinPosition() + apduSpec.getPinInsertionOffsetNew() + 5, fpin, mask);
+
+    // insert pin length
+    if (apduSpec.getPinLengthSize() != 0) {
+      insertPINLength(apdu, newPin.length, apduSpec.getPinLengthSize(),
+          apduSpec.getPinLengthPos(), apduSpec.getPinInsertionOffsetNew());
+    }
+
+    return new CommandAPDU(apdu);
+    
+  }
+
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/util/TransparentFileInputStream.java b/smcc/src/main/java/at/gv/egiz/smcc/util/TransparentFileInputStream.java
new file mode 100644
index 00000000..781f9137
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/util/TransparentFileInputStream.java
@@ -0,0 +1,194 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+public abstract class TransparentFileInputStream extends InputStream {
+  
+  private final int chunkSize = 256;
+  
+  private byte[] buf = new byte[chunkSize];
+  private int start = 0;
+  private int end = 0;
+
+  private int offset = 0;
+  
+  private int length = -1;
+  
+  private int limit = -1;
+  
+  private int mark = -1;
+  
+  private int readlimit = -1; 
+  
+  public TransparentFileInputStream() {
+  }
+  
+  public TransparentFileInputStream(int length) {
+    this.length = length;
+  }
+
+  public void setLimit(int limit) {
+    this.limit = limit;
+  }
+
+  private int fill() throws IOException {
+    if (start == end && (limit < 0 || offset < limit)) {
+        int l;
+        if (limit > 0 && limit - offset < chunkSize) {
+          l = limit - offset;
+        } else if (length > 0) {
+          if (length - offset < chunkSize) {
+            l = length - offset;
+          } else {
+            l = chunkSize - 1;
+          }
+        } else {
+          l = chunkSize;
+        }
+        byte[] b = readBinary(offset, l);
+        offset += b.length;
+        if (mark < 0) {
+          start = 0;
+          end = b.length;
+          System.arraycopy(b, 0, buf, start, b.length);
+        } else {
+          if (end - mark + b.length > buf.length) {
+            // double buffer size
+            byte[] nbuf = new byte[buf.length * 2];
+            System.arraycopy(buf, mark, nbuf, 0, end - mark);
+            buf = nbuf;
+          } else {
+            System.arraycopy(buf, mark, buf, 0, end - mark);
+          }
+          start = start - mark;
+          end = end - mark + b.length;
+          mark = 0;
+          System.arraycopy(b, 0, buf, start, b.length);
+        }
+        if (l > b.length) {
+          // end of file reached
+          setLimit(offset);
+        }
+    }
+    return end - start;
+  }
+    
+  protected abstract byte[] readBinary(int offset, int len) throws IOException;
+  
+  @Override
+  public int read() throws IOException {
+    int b = (fill() > 0) ? 0xFF & buf[start++] : -1;
+    if (readlimit > 0 && start > readlimit) {
+      mark = -1;
+      readlimit = -1;
+    }
+    return b;
+  }
+  
+  @Override
+  public int read(byte[] b, int off, int len) throws IOException {
+    if (b == null) {
+      throw new NullPointerException();
+    } else if (off < 0 || len < 0 || len > b.length - off) {
+        throw new IndexOutOfBoundsException();
+    } else if (len == 0) {
+        return 0;
+    }
+
+    int count = 0;
+    int l;
+    while (count < len) {
+      if (fill() > 0) {
+        l = Math.min(end - start, len - count);
+        System.arraycopy(buf, start, b, off, l);
+        start += l;
+        off += l;
+        count += l;
+        if (readlimit > 0 && start > readlimit) {
+          mark = -1;
+          readlimit = -1;
+        }
+      } else {
+        return (count > 0) ? count : -1;
+      }
+    }
+
+    return count;
+
+  }
+
+  @Override
+  public synchronized void mark(int readlimit) {
+    this.readlimit = readlimit;
+    mark = start;
+  }
+
+  @Override
+  public boolean markSupported() {
+    return true;
+  }
+
+  @Override
+  public synchronized void reset() throws IOException {
+    if (mark < 0) {
+      throw new IOException();
+    } else {
+      start = mark;
+    }
+  }
+
+  @Override
+  public long skip(long n) throws IOException {
+
+    if (n <= 0) {
+      return 0;
+    }
+    
+    if (n <= end - start) {
+      start += n;
+      return n;
+    } else {
+      
+      mark = -1;
+      
+      long remaining = n - (end - start);
+      start = end;
+      
+      if (limit >= 0 && limit < offset + remaining) {
+        remaining -= limit - offset;
+        offset = limit;
+        return n - remaining;
+      }
+      
+      if (length >= 0 && length < offset + remaining) {
+        remaining -= length - offset;
+        offset = length;
+        return n - remaining; 
+      }
+      
+      offset += remaining;
+      
+      return n;
+      
+    }
+    
+  }
+  
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java
deleted file mode 100644
index 5839d14a..00000000
--- a/smcc/src/test/java/at/gv/egiz/smcc/ACOSCardTest.java
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- * To change this template, choose Tools | Templates
- * and open the template in the editor.
- */
-
-package at.gv.egiz.smcc;
-
-import at.gv.egiz.smcc.SignatureCard.KeyboxName;
-import at.gv.egiz.smcc.util.SMCCHelper;
-import java.util.List;
-import java.util.Locale;
-import javax.smartcardio.ResponseAPDU;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Ignore;
-import org.junit.Test;
-import static org.junit.Assert.*;
-
-/**
- *
- * @author clemens
- */
-@Ignore
-public class ACOSCardTest {
-
-  static ACOSCard card;
-  static PINSpec infPin, decPin, sigPin;
-
-    public ACOSCardTest() {
-    }
-
-  @BeforeClass
-  public static void setUpClass() throws Exception {
-    SMCCHelper smccHelper = new SMCCHelper();
-      switch (smccHelper.getResultCode()) {
-        case SMCCHelper.CARD_FOUND:
-          SignatureCard sigCard = smccHelper.getSignatureCard(Locale.GERMAN);
-          if (sigCard instanceof ACOSCard) {
-            System.out.println("ACOS card found");
-            card = (ACOSCard) sigCard;
-            List<PINSpec> pinSpecs = card.getPINSpecs();
-            infPin = pinSpecs.get(ACOSCard.PINSPEC_INF);
-            decPin = pinSpecs.get(ACOSCard.PINSPEC_DEC);
-            sigPin = pinSpecs.get(ACOSCard.PINSPEC_SIG);
-          } else {
-            throw new Exception("not STARCOS card: " + sigCard.toString());
-          }
-          break;
-        default:
-          throw new Exception("no card found");
-      }
-  }
-
-  @AfterClass
-  public static void tearDownClass() throws Exception {
-  }
-
-    @Before
-    public void setUp() {
-    }
-
-    @After
-    public void tearDown() {
-    }
-
-
-
-  /**
-   * Test of verifyPIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testVerifyPIN_pinpad() throws Exception {
-    System.out.println("verifyPIN (pinpad)");
-    assertNotNull(card);
-
-    card.verifyPIN(decPin, new PINProvider() {
-
-      @Override
-      public char[] providePIN(PINSpec spec, int retries) {
-        return null;
-      }
-    });
-  }
-
-  /**
-   * Test of verifyPIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testVerifyPIN_internal() throws Exception {
-    System.out.println("verifyPIN (internal)");
-    assertNotNull(card);
-
-    card.reset();
-
-    card.getCard().beginExclusive();
-
-    // 0x6700 without sending an APDU prior to send CtrlCmd
-    System.out.println("WARNING: this command will fail if no card " +
-            "communication took place prior to sending the CtrlCommand");
-    int retries = card.verifyPIN(decPin.getKID(), null); //"1397".toCharArray());
-
-    System.out.println("VERIFY PIN returned " + retries);
-    card.getCard().endExclusive();
-  }
-
-  /**
-   * Test of changePIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testChangePIN() throws Exception {
-    System.out.println("changePIN");
-    assertNotNull(card);
-
-    card.reset();
-    int retries = card.changePIN(decPin.getKID(), null, null);
-
-    System.out.println("CHANGE PIN returned " + retries);
-  }
-
-  /**
-   * Test of reset method, of class STARCOSCard.
-   */
-  @Test
-  public void testReset() throws Exception {
-    System.out.println("reset");
-    assertNotNull(card);
-    card.reset();
-  }
-
-}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java b/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java
new file mode 100644
index 00000000..137de509
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java
@@ -0,0 +1,56 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+
+public abstract class AbstractAppl implements CardAppl {
+  
+  public final HashMap<Integer, PIN> pins = new HashMap<Integer, PIN>();
+
+  protected List<File> files = new ArrayList<File>();
+
+  public void checkINS(CommandAPDU command, int ins) {
+    if (command.getINS() != ins) {
+      throw new IllegalArgumentException("INS has to be 0x" + Integer.toHexString(ins) + ".");
+    }
+  }
+
+  @Override
+  public abstract byte[] getAID();
+
+  @Override
+  public abstract byte[] getFCI();
+  
+  public void putFile(File file) {
+    files.add(file);
+  }
+
+  public List<File> getFiles() {
+    return files;
+  }
+
+  public abstract void setPin(int kid, char[] value);
+  
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardAppl.java b/smcc/src/test/java/at/gv/egiz/smcc/CardAppl.java
new file mode 100644
index 00000000..76a3e567
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardAppl.java
@@ -0,0 +1,43 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+
+@SuppressWarnings("restriction")
+public interface CardAppl {
+  
+  public byte[] getAID();
+  
+  public byte[] getFID();
+  
+  public byte[] getFCI();
+  
+  public void leaveApplContext();
+
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) throws CardException;
+
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel) throws CardException;
+
+  public ResponseAPDU cmdINTERNAL_AUTHENTICATE(CommandAPDU command, CardChannelEmul channel) throws CardException;
+
+  public void setPin(int kid, char[] value);
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/CardChannelEmul.java
new file mode 100644
index 00000000..bfe4e31c
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardChannelEmul.java
@@ -0,0 +1,52 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.nio.ByteBuffer;
+
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+
+@SuppressWarnings("restriction")
+public abstract class CardChannelEmul extends CardChannel {
+
+  protected AbstractAppl currentAppl = null;
+  protected File currentFile = null;
+
+  public CardChannelEmul() {
+    super();
+  }
+
+  @Override
+  public int getChannelNumber() {
+    return 0;
+  }
+
+  @Override
+  public void close() throws CardException {
+    throw new IllegalStateException("Basic logical channel cannot be closed.");
+  }
+
+  @Override
+  public int transmit(ByteBuffer command, ByteBuffer response) throws CardException {
+    byte[] responseBytes = transmit(new CommandAPDU(command)).getBytes();
+    response.put(responseBytes);
+    return responseBytes.length;
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java
new file mode 100644
index 00000000..6017bcce
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java
@@ -0,0 +1,106 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+
+
+@SuppressWarnings("restriction")
+public abstract class CardEmul extends Card {
+
+  protected Thread exclThread = null;
+  protected CardChannel channel = newCardChannel(this);
+  protected List<AbstractAppl> applications = new ArrayList<AbstractAppl>();
+
+  public CardEmul() {
+    super();
+  }
+
+  protected abstract CardChannelEmul newCardChannel(CardEmul cardEmul);
+
+  @Override
+  public void beginExclusive() throws CardException {
+    
+    if (exclThread == Thread.currentThread()) {
+      throw new CardException("Exclusive access already assigned to current thread.");
+    } else if (exclThread != null) {
+      throw new CardException("Exclusive access already assigned to another thread.");
+    }
+  
+    exclThread = Thread.currentThread();
+    
+  }
+
+  @Override
+  public void endExclusive() throws CardException {
+    
+    if (exclThread == Thread.currentThread()) {
+      exclThread = null;
+    } else if (exclThread == null) {
+      throw new CardException("Exclusive access has not been assigned.");
+    } else {
+      throw new CardException("Exclusive access has not been assigned to current thread.");
+    }
+  
+  }
+
+  @Override
+  public CardChannel getBasicChannel() {
+    return channel;
+  }
+
+  @Override
+  public void disconnect(boolean reset) throws CardException {
+    if (reset) {
+      channel = newCardChannel(this);
+    }
+  }
+
+  @Override
+  public CardChannel openLogicalChannel() throws CardException {
+    throw new CardException("Logical channels not supported.");
+  }
+
+  @Override
+  public String getProtocol() {
+    return "T1";
+  }
+
+  @Override
+  public byte[] transmitControlCommand(int arg0, byte[] arg1)
+      throws CardException {
+            throw new CardException("transmitControlCommand() not supported.");
+      }
+
+  public AbstractAppl getApplication(byte[] fid) {
+    
+    for(AbstractAppl appl : applications) {
+      if (Arrays.equals(appl.getAID(), fid) || Arrays.equals(appl.getFID(), fid)) {
+        return appl;
+      }
+    }
+    return null;
+    
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardTerminalEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/CardTerminalEmul.java
new file mode 100644
index 00000000..b13de62f
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardTerminalEmul.java
@@ -0,0 +1,64 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
+
+public class CardTerminalEmul extends CardTerminal {
+  
+  private Card card;
+  
+  public CardTerminalEmul(Card card) {
+    this.card = card;
+  }
+
+  @Override
+  public Card connect(String protocol) throws CardException {
+    if ("*".equals(protocol) || "T=1".equals(protocol)) {
+      return card;
+    } else {
+      throw new CardException("Protocol '" + protocol + "' not supported.");
+    }
+  }
+
+  @Override
+  public String getName() {
+    return "CardTerminal Emulation";
+  }
+
+  @Override
+  public boolean isCardPresent() throws CardException {
+    return true;
+  }
+
+  @Override
+  public boolean waitForCardAbsent(long timeout) throws CardException {
+    try {
+      Thread.sleep(timeout);
+    } catch (InterruptedException e) {
+    }
+    return false;
+  }
+
+  @Override
+  public boolean waitForCardPresent(long timeout) throws CardException {
+    return true;
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
new file mode 100644
index 00000000..298e26a5
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
@@ -0,0 +1,298 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import static org.junit.Assert.*;
+
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.smartcardio.Card;
+
+import org.junit.Test;
+
+import at.gv.egiz.smcc.SignatureCard.KeyboxName;
+import at.gv.egiz.smcc.acos.A04ApplDEC;
+
+@SuppressWarnings("restriction")
+public abstract class CardTest {
+
+  public class TestPINProvider implements PINProvider {
+    
+    int provided = 0;
+  
+    char[] pin;
+  
+    public TestPINProvider(char[] pin) {
+      super();
+      this.pin = pin;
+    }
+  
+    @Override
+    public char[] providePIN(PINSpec spec, int retries)
+        throws CancelledException, InterruptedException {
+      provided++;
+      return pin;
+    }
+
+    public int getProvided() {
+      return provided;
+    }
+  
+  }
+
+  public class TestChangePINProvider extends TestPINProvider implements
+      ChangePINProvider {
+  
+    char[] oldPin;
+  
+    public TestChangePINProvider(char[] oldPin, char[] pin) {
+      super(pin);
+      this.oldPin = oldPin;
+    }
+  
+    @Override
+    public char[] provideOldPIN(PINSpec spec, int retries)
+        throws CancelledException, InterruptedException {
+      return oldPin;
+    }
+  
+  }
+
+  public CardTest() {
+    super();
+  }
+
+  protected abstract SignatureCard createSignatureCard()
+      throws CardNotSupportedException;
+
+  @Test
+  public void testGetCard() throws CardNotSupportedException {
+    SignatureCard signatureCard = createSignatureCard();
+    Card card = signatureCard.getCard();
+    assertNotNull(card);
+  }
+
+  @Test
+  public void testGetInfoboxIdentityLink() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    final char[] pin = "0000".toCharArray();
+    
+    SignatureCard signatureCard = createSignatureCard();
+    
+    TestPINProvider pinProvider = new TestPINProvider(pin);
+
+    byte[] idlink = signatureCard.getInfobox("IdentityLink",
+        pinProvider, null);
+    assertNotNull(idlink);
+    assertTrue(Arrays.equals(idlink, A04ApplDEC.IDLINK));
+    assertEquals(1, pinProvider.provided);
+
+  }
+
+  @Test(expected = CancelledException.class)
+  public void testSignSIGCancel() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        SignatureCard signatureCard = createSignatureCard();
+      
+        MessageDigest md = MessageDigest.getInstance("SHA-1");
+        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+            throw new CancelledException();
+          }
+        };
+      
+        signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+            pinProvider);
+      
+      }
+
+  @Test(expected = CancelledException.class)
+  public void testSignDECCancel() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        SignatureCard signatureCard = createSignatureCard();
+      
+        MessageDigest md = MessageDigest.getInstance("SHA-1");
+        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+            throw new CancelledException();
+          }
+        };
+      
+        signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+            pinProvider);
+      
+      }
+
+  @Test(expected = InterruptedException.class)
+  public void testSignSIGInterrrupted() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        SignatureCard signatureCard = createSignatureCard();
+      
+        MessageDigest md = MessageDigest.getInstance("SHA-1");
+        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+            throw new InterruptedException();
+          }
+        };
+      
+        signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+            pinProvider);
+      
+      }
+
+  @Test(expected = InterruptedException.class)
+  public void testSignDECInterrrupted() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        SignatureCard signatureCard = createSignatureCard();
+      
+        MessageDigest md = MessageDigest.getInstance("SHA-1");
+        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+            throw new InterruptedException();
+          }
+        };
+      
+        signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+            pinProvider);
+      
+      }
+
+  @Test(expected = CancelledException.class)
+  public void testSignSIGConcurrent() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        final SignatureCard signatureCard = createSignatureCard();
+      
+        MessageDigest md = MessageDigest.getInstance("SHA-1");
+        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+      
+            try {
+              signatureCard.getCertificate(KeyboxName.SECURE_SIGNATURE_KEYPAIR);
+              assertTrue(false);
+              return null;
+            } catch (SignatureCardException e) {
+              // expected
+              throw new CancelledException();
+            }
+      
+          }
+        };
+      
+        signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+            pinProvider);
+      
+      }
+
+  @Test(expected = CancelledException.class)
+  public void testSignDECConcurrent() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        final SignatureCard signatureCard = createSignatureCard();
+      
+        MessageDigest md = MessageDigest.getInstance("SHA-1");
+        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+      
+            try {
+              signatureCard.getCertificate(KeyboxName.CERITIFIED_KEYPAIR);
+              assertTrue(false);
+              return null;
+            } catch (SignatureCardException e) {
+              // expected
+              throw new CancelledException();
+            }
+      
+          }
+        };
+      
+        signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+            pinProvider);
+      
+      }
+
+  @Test
+  public void testGetPinSpecs() throws CardNotSupportedException {
+  
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
+  
+    List<PINSpec> specs = signatureCard.getPINSpecs();
+    assertNotNull(specs);
+    assertTrue(specs.size() > 0);
+  
+  }
+
+  @Test(expected = SignatureCardException.class)
+  public void testActivatePin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+      
+        PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
+      
+        PINProvider pinProvider = new PINProvider() {
+          @Override
+          public char[] providePIN(PINSpec spec, int retries)
+              throws CancelledException, InterruptedException {
+            throw new CancelledException();
+          }
+        };
+      
+        List<PINSpec> specs = signatureCard.getPINSpecs();
+      
+        signatureCard.activatePIN(specs.get(0), pinProvider);
+      }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardTestSuite.java b/smcc/src/test/java/at/gv/egiz/smcc/CardTestSuite.java
new file mode 100644
index 00000000..3c275a8d
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardTestSuite.java
@@ -0,0 +1,29 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+import org.junit.runners.Suite.SuiteClasses;
+
+import at.gv.egiz.smcc.acos.ACOSCardTestSuite;
+
+@RunWith(Suite.class)
+@SuiteClasses( { ACOSCardTestSuite.class, at.gv.egiz.smcc.starcos.STARCOSCardTest.class })
+public class CardTestSuite {
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/File.java b/smcc/src/test/java/at/gv/egiz/smcc/File.java
new file mode 100644
index 00000000..e47c5f7d
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/File.java
@@ -0,0 +1,38 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class File {
+  public byte[] fid;
+  public byte[] file;
+  public byte[] fcx;
+  public int kid = -1;
+
+  public File(byte[] fid, byte[] file, byte[] fcx) {
+    this.fid = fid;
+    this.file = file;
+    this.fcx = fcx;
+  }
+
+  public File(byte[] fid, byte[] file, byte[] fcx, int kid) {
+    this.fid = fid;
+    this.file = file;
+    this.fcx = fcx;
+    this.kid = kid;
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/PIN.java b/smcc/src/test/java/at/gv/egiz/smcc/PIN.java
new file mode 100644
index 00000000..ae883727
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/PIN.java
@@ -0,0 +1,41 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class PIN {
+  
+  public static final int STATE_RESET = 0;
+  
+  public static final int STATE_PIN_VERIFIED = 1;
+  
+  public static final int STATE_PIN_BLOCKED = -1;
+  
+  public byte[] pin;
+  
+  public int kid;
+  
+  public int state = STATE_RESET;
+  
+  public int kfpc = 10;
+
+  public PIN(byte[] pin, int kid, int kfpc) {
+    this.pin = pin;
+    this.kid = kid;
+    this.kfpc = kfpc;
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java
deleted file mode 100644
index 9be8db00..00000000
--- a/smcc/src/test/java/at/gv/egiz/smcc/STARCOSCardTest.java
+++ /dev/null
@@ -1,267 +0,0 @@
-/*
- * To change this template, choose Tools | Templates
- * and open the template in the editor.
- */
-
-package at.gv.egiz.smcc;
-
-import at.gv.egiz.smcc.SignatureCard.KeyboxName;
-import at.gv.egiz.smcc.util.SMCCHelper;
-import java.util.List;
-import java.util.Locale;
-import javax.smartcardio.ResponseAPDU;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Ignore;
-import org.junit.Test;
-import static org.junit.Assert.*;
-
-/**
- *
- * @author clemens
- */
-@Ignore
-public class STARCOSCardTest {
-
-  static STARCOSCard card;
-  static PINSpec cardPin, ssPin;
-
-    public STARCOSCardTest() {
-    }
-
-  @BeforeClass
-  public static void setUpClass() throws Exception {
-    SMCCHelper smccHelper = new SMCCHelper();
-      switch (smccHelper.getResultCode()) {
-        case SMCCHelper.CARD_FOUND:
-          SignatureCard sigCard = smccHelper.getSignatureCard(Locale.GERMAN);
-          if (sigCard instanceof STARCOSCard) {
-            System.out.println("STARCOS card found");
-            card = (STARCOSCard) sigCard;
-            List<PINSpec> pinSpecs = card.getPINSpecs();
-            cardPin = pinSpecs.get(STARCOSCard.PINSPEC_CARD);
-            ssPin = pinSpecs.get(STARCOSCard.PINSPEC_SS);
-
-          } else {
-            throw new Exception("not STARCOS card: " + sigCard.toString());
-          }
-          break;
-        default:
-          throw new Exception("no card found");
-      }
-  }
-
-  @AfterClass
-  public static void tearDownClass() throws Exception {
-  }
-
-    @Before
-    public void setUp() {
-    }
-
-    @After
-    public void tearDown() {
-    }
-
-  /**
-   * Test of getCertificate method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testGetCertificate() throws Exception {
-    System.out.println("getCertificate");
-    KeyboxName keyboxName = null;
-    STARCOSCard instance = new STARCOSCard();
-    byte[] expResult = null;
-    byte[] result = instance.getCertificate(keyboxName);
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-  /**
-   * Test of getInfobox method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testGetInfobox() throws Exception {
-    System.out.println("getInfobox");
-    String infobox = "";
-    PINProvider provider = null;
-    String domainId = "";
-    STARCOSCard instance = new STARCOSCard();
-    byte[] expResult = null;
-    byte[] result = instance.getInfobox(infobox, provider, domainId);
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-  /**
-   * Test of createSignature method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testCreateSignature() throws Exception {
-    System.out.println("createSignature");
-    byte[] hash = null;
-    KeyboxName keyboxName = null;
-    PINProvider provider = null;
-    STARCOSCard instance = new STARCOSCard();
-    byte[] expResult = null;
-    byte[] result = instance.createSignature(hash, keyboxName, provider);
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-  /**
-   * Test of selectFileFID method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testSelectFileFID() throws Exception {
-    System.out.println("selectFileFID");
-    byte[] fid = null;
-    STARCOSCard instance = new STARCOSCard();
-    ResponseAPDU expResult = null;
-    ResponseAPDU result = instance.selectFileFID(fid);
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-  /**
-   * Test of verifyPIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testVerifyPIN_pinpad() throws Exception {
-    System.out.println("verifyPIN (pinpad)");
-    assertNotNull(card);
-
-    card.verifyPIN(cardPin, new PINProvider() {
-
-      @Override
-      public char[] providePIN(PINSpec spec, int retries) {
-        return null;
-      }
-    });
-  }
-
-  /**
-   * Test of verifyPIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testVerifyPIN_internal() throws Exception {
-    System.out.println("verifyPIN (internal)");
-    assertNotNull(card);
-
-    card.reset();
-
-    card.getCard().beginExclusive();
-
-    // 0x6700 without sending an APDU prior to send CtrlCmd
-    System.out.println("WARNING: this command will fail if no card " +
-            "communication took place prior to sending the CtrlCommand");
-    int retries = card.verifyPIN(cardPin.getKID(), null); //"1397".toCharArray());
-
-    System.out.println("VERIFY PIN returned " + retries);
-    card.getCard().endExclusive();
-  }
-
-  /**
-   * Test of verifyPIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testVerifyPIN_byte() throws Exception {
-    System.out.println("verifyPIN");
-    byte kid = 0;
-    STARCOSCard instance = new STARCOSCard();
-    int expResult = 0;
-    int result = instance.verifyPIN(kid);
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-  /**
-   * Test of changePIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testChangePIN() throws Exception {
-    System.out.println("changePIN");
-    assertNotNull(card);
-
-    card.reset();
-    int retries = card.changePIN(cardPin.getKID(), null, null);
-
-    System.out.println("CHANGE PIN returned " + retries);
-  }
-
-  /**
-   * Test of activatePIN method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testActivatePIN() throws Exception {
-    System.out.println("activatePIN");
-    assertNotNull(card);
-
-    card.reset();
-    card.activatePIN(cardPin, new PINProvider() {
-
-      @Override
-      public char[] providePIN(PINSpec spec, int retries) throws CancelledException, InterruptedException {
-        return null;
-      }
-    });
-  }
-
-  /**
-   * Test of encodePINBlock method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testEncodePINBlock() throws Exception {
-    System.out.println("encodePINBlock");
-    char[] pin = null;
-    STARCOSCard instance = new STARCOSCard();
-    byte[] expResult = null;
-    byte[] result = instance.encodePINBlock(pin);
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-  /**
-   * Test of reset method, of class STARCOSCard.
-   */
-  @Test
-  public void testReset() throws Exception {
-    System.out.println("reset");
-    assertNotNull(card);
-    card.reset();
-  }
-
-  /**
-   * Test of toString method, of class STARCOSCard.
-   */
-  @Test
-  @Ignore
-  public void testToString() {
-    System.out.println("toString");
-    STARCOSCard instance = new STARCOSCard();
-    String expResult = "";
-    String result = instance.toString();
-    assertEquals(expResult, result);
-    // TODO review the generated test code and remove the default call to fail.
-    fail("The test case is a prototype.");
-  }
-
-}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/TransparentFileInputStreamTest.java b/smcc/src/test/java/at/gv/egiz/smcc/TransparentFileInputStreamTest.java
new file mode 100644
index 00000000..4ae48335
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/TransparentFileInputStreamTest.java
@@ -0,0 +1,208 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+import java.io.IOException;
+
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import at.gv.egiz.smcc.util.TransparentFileInputStream;
+import static org.junit.Assert.*;
+
+public class TransparentFileInputStreamTest {
+  
+  public class TestTransparentFileInputStream extends TransparentFileInputStream {
+
+    private byte[] data;
+    
+    public TestTransparentFileInputStream(byte[] data) {
+      this.data = data;
+    }
+
+    @Override
+    protected byte[] readBinary(int offset, int len) throws IOException {
+      int l = Math.min(len, data.length - offset);
+      byte[] b = new byte[l];
+      System.arraycopy(data, offset, b, 0, l);
+      return b;
+    }
+    
+  }
+  
+  protected static byte[] file;
+  
+  protected static byte[] file_bs;
+  
+  @BeforeClass
+  public static void setUpClass() {
+    
+    byte b = 0x00;
+    file = new byte[1000];
+    for (int i = 0; i < file.length; i++) {
+      file[i] = b++;
+    }
+    
+    file_bs = new byte[256];
+    b = 0x00;
+    for (int i = 0; i < file_bs.length; i++) {
+      file_bs[i] = b++;
+    }
+    
+  }
+
+  @Test
+  public void testReadSeq() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 0;
+    int b; 
+    while ((b = is.read()) != -1) {
+      assertEquals(0xFF & i++, b);
+    }
+    assertEquals(file.length, i);
+    
+  }
+  
+  @Test
+  public void testReadBlock() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 0;
+    byte[] b = new byte[28];
+    int l;
+    while ((l = is.read(b)) != -1) {
+      for(int j = 0; j < l; j++) {
+        assertEquals(0xFF & i++, 0xFF & b[j]);
+      }
+    }
+    assertEquals(file.length, i);
+    
+  }
+
+  @Test
+  public void testReadBlockBS() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file_bs);
+    int i = 0;
+    byte[] b = new byte[28];
+    int l;
+    while ((l = is.read(b)) != -1) {
+      for(int j = 0; j < l; j++) {
+        assertEquals(0xFF & i++, 0xFF & b[j]);
+      }
+    }
+    assertEquals(file_bs.length, i);
+    
+  }
+  
+  @Test(expected = IOException.class)
+  public void testReset() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    is.read(new byte[128]);
+    is.reset();
+    
+  }
+  
+  @Test
+  public void testMark() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 0;
+    is.mark(12);
+    byte[] b = new byte[37];
+    int l;
+    while ((l = is.read(b)) != -1) {
+      for(int j = 0; j < l; j++) {
+        assertEquals(0xFF & i++, 0xFF & b[j]);
+      }
+    }
+    assertEquals(file.length, i);
+    
+  }
+  
+  @Test
+  public void testMarkReset() throws IOException {
+
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 128;
+    is.read(new byte[i]);
+    is.mark(512);
+    byte[] b = new byte[256];
+    is.read(b);
+    for(int j = 0; j < b.length; j++) {
+      assertEquals(0xFF & i + j, 0xFF & b[j]);
+    }
+    is.reset();
+    int l;
+    while ((l = is.read(b)) != -1) {
+      for(int j = 0; j < l; j++) {
+        assertEquals(0xFF & i++, 0xFF & b[j]);
+      }
+    }
+    assertEquals(file.length, i);
+    
+  }
+
+  
+  @Test(expected = IOException.class)
+  public void testMarkResetLimit() throws IOException {
+
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 128;
+    is.read(new byte[i]);
+    is.mark(128);
+    byte[] b = new byte[256];
+    is.read(b);
+    for(int j = 0; j < b.length; j++) {
+      assertEquals(0xFF & i + j, 0xFF & b[j]);
+    }
+    is.reset();
+    
+  }
+  
+  @Test
+  public void testSkipSmall() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 0;
+    i+= is.read(new byte[128]);
+    i+= is.skip(3);
+    byte[] b = new byte[256];
+    int l = is.read(b);
+    for (int j = 0; j < l; j++) {
+      assertEquals(0xFF & i + j, 0xFF & b[j]);
+    }
+    
+  }
+  @Test
+  public void testSkipBig() throws IOException {
+    
+    TransparentFileInputStream is = new TestTransparentFileInputStream(file);
+    int i = 0;
+    i+= is.read(new byte[128]);
+    i+= is.skip(300);
+    byte[] b = new byte[256];
+    int l = is.read(b);
+    for (int j = 0; j < l; j++) {
+      assertEquals(0xFF & i + j, 0xFF & b[j]);
+    }
+    
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java
new file mode 100644
index 00000000..9fd96d73
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java
@@ -0,0 +1,151 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+import java.util.Random;
+
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+
+@SuppressWarnings("restriction")
+public class A03ApplDEC extends ACOSApplDEC {
+  
+  public static final int KID_PIN_INF = 0x83;
+
+  public A03ApplDEC() {
+    super();
+
+    System.arraycopy(IDLINK, 0, EF_INFOBOX, 0, IDLINK.length);
+    putFile(new File(FID_EF_INFOBOX, EF_INFOBOX, FCI_EF_INFOBOX, KID_PIN_INF));
+
+    try {
+      pins.put(KID_PIN_INF, new PIN("0000\0\0\0\0".getBytes("ASCII"), KID_PIN_INF, 10));
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) {
+
+    checkINS(command, 0x22);
+
+    switch (command.getP2()) {
+    case 0xA4:
+      switch (command.getP1()) {
+      case 0x41: {
+        // INTERNAL AUTHENTICATE
+        byte[] dst = new byte[] { (byte) 0x84, (byte) 0x01, (byte) 0x88, (byte) 0x80, (byte) 0x01, (byte) 0x01 };
+        if (Arrays.equals(dst, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+      case 0x81:
+        // EXTERNAL AUTHENTICATE
+      }
+    case 0xB6:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO - COMPUTE DIGITAL SIGNATURE
+      case 0x81:
+        // PSO - VERIFY DGITAL SIGNATURE
+      }
+    case 0xB8:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO � DECIPHER
+      case 0x81:
+        // PSO � ENCIPHER
+      }
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+  }
+
+  @Override
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel) {
+    
+    checkINS(command, 0x2A);
+
+    return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    
+  }
+
+  @Override
+  public ResponseAPDU cmdINTERNAL_AUTHENTICATE(CommandAPDU command, CardChannelEmul channel) {
+    
+    checkINS(command, 0x88);
+    
+    if (command.getP1() == 0x10 && command.getP2() == 0x00) {
+      
+      byte[] data = command.getData();
+      
+      if (securityEnv == null) {
+        // Security Environment not set or wrong
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+      }
+
+      byte[] digestInfo = new byte[] {
+          (byte) 0x30, (byte) 0x21, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x05, (byte) 0x2B, (byte) 0x0E, 
+          (byte) 0x03, (byte) 0x02, (byte) 0x1A, (byte) 0x05, (byte) 0x00, (byte) 0x04, (byte) 0x14
+      };
+      
+      if (data.length != 35 || !Arrays.equals(digestInfo, Arrays.copyOf(data, 15))) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+        
+
+      if (pins.get(KID_PIN_DEC).state != PIN.STATE_PIN_VERIFIED) {
+        // Security Status not satisfied
+        return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+      }
+      
+      byte[] signature = new byte[48]; 
+      
+      // TODO replace by signature creation
+      Random random = new Random();
+      random.nextBytes(signature);
+      
+      byte[] response = new byte[signature.length + 2];
+      System.arraycopy(signature, 0, response, 0, signature.length);
+      response[signature.length] = (byte) 0x90;
+      response[signature.length + 1] = (byte) 0x00;
+      
+      hash = null;
+      pins.get(KID_PIN_DEC).state = PIN.STATE_RESET;
+
+      return new ResponseAPDU(response);
+        
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplSIG.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplSIG.java
new file mode 100644
index 00000000..d059ad57
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplSIG.java
@@ -0,0 +1,77 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.util.Arrays;
+
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+
+
+@SuppressWarnings("restriction")
+public class A03ApplSIG extends ACOSApplSIG {
+  
+  public A03ApplSIG() {
+    super();
+    System.arraycopy(C_CH_DS, 0, EF_C_CH_DS, 0, C_CH_DS.length);
+  }
+
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) {
+
+    checkINS(command, 0x22);
+
+    switch (command.getP2()) {
+    case 0xA4:
+      switch (command.getP1()) {
+      case 0x41:
+        // INTERNAL AUTHENTICATE
+      case 0x81:
+        // EXTERNAL AUTHENTICATE
+      }
+    case 0xB6:
+      switch (command.getP1()) {
+      case 0x41: {
+        // PSO - COMPUTE DIGITAL SIGNATURE
+        byte[] dst = new byte[] { (byte) 0x84, (byte) 0x01, (byte) 0x88, (byte) 0x80, (byte) 0x01, (byte) 0x14 };
+        if (Arrays.equals(dst, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+      case 0x81:
+        // PSO - VERIFY DGITAL SIGNATURE
+      }
+    case 0xB8:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO � DECIPHER
+      case 0x81:
+        // PSO � ENCIPHER
+      }
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+  }
+  
+  
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardChannelEmul.java
new file mode 100644
index 00000000..c8d5382c
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardChannelEmul.java
@@ -0,0 +1,98 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.PIN;
+
+
+@SuppressWarnings("restriction")
+public class A03CardChannelEmul extends ACOSCardChannelEmul {
+
+  public A03CardChannelEmul(CardEmul cardEmul) {
+    super(cardEmul);
+  }
+
+  @Override
+  public ResponseAPDU cmdREAD_BINARY(CommandAPDU command) throws CardException {
+
+    if (command.getINS() != 0xB0) {
+      throw new IllegalArgumentException("INS has to be 0xB0.");
+    }
+
+    if (currentFile == null) {
+      return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x86}); 
+    }
+    
+    if ((command.getP1() & 0x80) > 0) {
+      throw new CardException("Not implemented.");
+    }
+    
+    int offset = command.getP2() + (command.getP1() << 8);
+    if (offset > currentFile.file.length) {
+      // Wrong length
+      return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+    }
+    
+    if (command.getNe() == 0) {
+      throw new CardException("Not implemented.");
+    }
+    
+    if (currentFile.kid != -1) {
+      if ((currentFile.kid & 0x80) > 0) {
+        PIN pin;
+        if (currentAppl == null
+            || (pin = currentAppl.pins.get(currentFile.kid)) == null
+            || pin.state != PIN.STATE_PIN_VERIFIED) {
+          return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+        }
+      } else {
+        // Global PINs not implemented
+        throw new CardException("Not implemented.");
+      }
+    }
+
+    int len;
+    if (command.getNe() == 256) {
+      if (currentFile.file.length > 256) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      } else {
+        len = Math.min(command.getNe(), currentFile.file.length - offset);
+      }
+    } else {
+      if (command.getNe() >= currentFile.file.length - offset) {
+        return new ResponseAPDU(new byte[] {(byte) 0x62, (byte) 0x82});
+      } else {
+        len = command.getNe();
+      }
+    }
+    
+    byte[] response = new byte[len + 2];
+    System.arraycopy(currentFile.file, offset, response, 0, len);
+    response[len] = (byte) 0x90;
+    response[len + 1] = (byte) 0x00;
+    return new ResponseAPDU(response);
+    
+  }
+
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java
new file mode 100644
index 00000000..58216b6b
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java
@@ -0,0 +1,36 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.CardEmul;
+
+
+
+public class A03CardEmul extends ACOSCardEmul {
+
+  public A03CardEmul(A03ApplSIG applSIG, A03ApplDEC applDEC) {
+    applications.add(applSIG);
+    applications.add(applDEC);
+  }
+
+  @Override
+  protected CardChannelEmul newCardChannel(CardEmul cardEmul) {
+    return new A03CardChannelEmul(this);
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java
new file mode 100644
index 00000000..776c0370
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java
@@ -0,0 +1,91 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import static org.junit.Assert.assertTrue;
+
+import java.util.Arrays;
+
+import org.junit.Test;
+
+import at.gv.egiz.smcc.ACOSCard;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.CardNotSupportedException;
+import at.gv.egiz.smcc.CardTerminalEmul;
+import at.gv.egiz.smcc.LockedException;
+import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINMgmtSignatureCard;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.SignatureCardFactory;
+
+public class A03CardTest extends ACOSCardTest {
+
+  @Override
+  protected SignatureCard createSignatureCard()
+      throws CardNotSupportedException {
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    CardEmul card = new A03CardEmul(new A03ApplSIG(), new A03ApplDEC());
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+    assertTrue(signatureCard instanceof PINMgmtSignatureCard);
+    return signatureCard;
+  }
+
+  @Override
+  protected int getVersion() {
+    return 1;
+  }
+
+  @Test
+  public void testChangePin() throws CardNotSupportedException,
+      LockedException, NotActivatedException, CancelledException,
+      PINFormatException, SignatureCardException, InterruptedException {
+
+    char[] defaultPin = "123456".toCharArray();
+
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplSIG applSIG = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
+    applSIG.setPin(ACOSApplSIG.KID_PIN_SIG, defaultPin);
+    ACOSApplDEC applDEC = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    applDEC.setPin(ACOSApplDEC.KID_PIN_DEC, defaultPin);
+    applDEC.setPin(A03ApplDEC.KID_PIN_INF, defaultPin);
+
+    for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
+
+      char[] pin = defaultPin;
+
+      for (int i = pinSpec.getMinLength(); i <= pinSpec.getMaxLength(); i++) {
+        signatureCard.verifyPIN(pinSpec, new TestPINProvider(pin));
+        char[] newPin = new char[i];
+        Arrays.fill(newPin, '0');
+        signatureCard
+            .changePIN(pinSpec, new TestChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new TestPINProvider(newPin));
+        pin = newPin;
+      }
+
+    }
+
+  }
+
+  
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplDEC.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplDEC.java
new file mode 100644
index 00000000..e38a8e80
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplDEC.java
@@ -0,0 +1,296 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.io.UnsupportedEncodingException;
+import java.security.GeneralSecurityException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.Arrays;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.KeyGenerator;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.SecretKey;
+import javax.crypto.SecretKeyFactory;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+
+@SuppressWarnings("restriction")
+public class A04ApplDEC extends ACOSApplDEC {
+  
+  private static final byte[] SEC_ENV_INTERNAL_AUTHENTICATE = new byte[] { (byte) 0x84,
+      (byte) 0x01, (byte) 0x88, (byte) 0x80, (byte) 0x01, (byte) 0x01 };
+  
+  private static final byte[] SEC_ENV_DECIPHER = new byte[] { (byte) 0x84,
+      (byte) 0x01, (byte) 0x88, (byte) 0x80, (byte) 0x01, (byte) 0x02 };
+  
+  private static final RSAPrivateKey SK_CH_EKEY;
+  
+  private static final RSAPublicKey PK_CH_EKEY;
+  
+  static {
+    try {
+      KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
+      gen.initialize(1536);
+      KeyPair keyPair = gen.generateKeyPair();
+      SK_CH_EKEY = (RSAPrivateKey) keyPair.getPrivate();
+      PK_CH_EKEY = (RSAPublicKey) keyPair.getPublic();
+    } catch (NoSuchAlgorithmException e) {
+      throw new RuntimeException(e);
+    }
+  }
+  
+  public A04ApplDEC() {
+    this(false);
+  }
+
+  public A04ApplDEC(boolean encrypt) {
+    
+    int offset = 0;
+    
+    // HEADER 'AIK' + version
+    byte[] header;
+    try {
+      header = "AIK".getBytes("ASCII");
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
+    System.arraycopy(header, 0, EF_INFOBOX, offset, header.length);
+    offset += header.length;
+    EF_INFOBOX[offset++] = 1; 
+    
+    // HEADER identity link
+    EF_INFOBOX[offset++] = (byte) 0x01; // Personenbindung
+    if (encrypt) {
+      EF_INFOBOX[offset++] = (byte) 0x01; // Modifier
+
+      byte[] cipherText;
+      byte[] encKey;
+      try {
+        KeyGenerator keyGenerator = KeyGenerator.getInstance("DESede");
+        SecretKey secretKey = keyGenerator.generateKey();
+        
+        byte[] keyBytes = secretKey.getEncoded();
+        
+        Cipher cipher = Cipher.getInstance("DESede/CBC/PKCS5Padding");
+        byte[] iv = new byte[8];
+        Arrays.fill(iv, (byte) 0x00);
+        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
+        cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivParameterSpec);
+        cipherText = cipher.doFinal(IDLINK);
+        
+        cipher = Cipher.getInstance("RSA");
+        cipher.init(Cipher.ENCRYPT_MODE, PK_CH_EKEY);
+        encKey = cipher.doFinal(keyBytes);
+        
+      } catch (GeneralSecurityException e) {
+        throw new RuntimeException(e);
+      }
+      
+      int len = encKey.length + cipherText.length + 2;
+      
+      EF_INFOBOX[offset++] = (byte) (0xFF & len);
+      EF_INFOBOX[offset++] = (byte) (0xFF & len >> 8);
+      
+      EF_INFOBOX[offset++] = (byte) (0xFF & encKey.length);
+      EF_INFOBOX[offset++] = (byte) (0xFF & encKey.length >> 8);
+      
+      System.arraycopy(encKey, 0, EF_INFOBOX, offset, encKey.length);
+      offset += encKey.length;
+      
+      System.arraycopy(cipherText, 0, EF_INFOBOX, offset, cipherText.length);
+      
+    } else {
+      EF_INFOBOX[offset++] = (byte) 0x00; // Modifier
+      EF_INFOBOX[offset++] = (byte) (0xFF & IDLINK.length);
+      EF_INFOBOX[offset++] = (byte) (0xFF & IDLINK.length >> 8);
+      System.arraycopy(IDLINK, 0, EF_INFOBOX, offset, IDLINK.length);
+      offset += IDLINK.length;
+    }
+    
+    putFile(new File(FID_EF_INFOBOX, EF_INFOBOX, FCI_EF_INFOBOX));
+  }
+
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) {
+
+    checkINS(command, 0x22);
+
+    switch (command.getP2()) {
+    case 0xA4:
+      switch (command.getP1()) {
+      case 0x41: {
+        // INTERNAL AUTHENTICATE
+        if (Arrays.equals(SEC_ENV_INTERNAL_AUTHENTICATE, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x85});
+        }
+      }
+      case 0x81:
+        // EXTERNAL AUTHENTICATE
+      }
+    case 0xB6:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO - COMPUTE DIGITAL SIGNATURE
+      case 0x81:
+        // PSO - VERIFY DGITAL SIGNATURE
+      }
+    case 0xB8:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO � DECIPHER
+        if (Arrays.equals(SEC_ENV_DECIPHER, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x85});
+        }
+      case 0x81:
+        // PSO � ENCIPHER
+      }
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+  }
+
+  @Override
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel) throws CardException {
+    
+    checkINS(command, 0x2A);
+    
+    if (command.getP1() == 0x80 && command.getP2() == 0x86) {
+      
+      byte[] data = command.getData();
+      
+      if (!Arrays.equals(securityEnv, SEC_ENV_DECIPHER)) {
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+      }
+      
+      if (data.length != 193) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+      
+      if (pins.get(KID_PIN_DEC).state != PIN.STATE_PIN_VERIFIED) {
+        // Security Status not satisfied
+        return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+      }
+
+      byte[] cipherText = Arrays.copyOfRange(data, 1, data.length);
+      
+      byte[] plainText;
+      try {
+        Cipher cipher = Cipher.getInstance("RSA");
+        cipher.init(Cipher.DECRYPT_MODE, SK_CH_EKEY);
+        plainText = cipher.doFinal(cipherText);
+      } catch (GeneralSecurityException e) {
+        throw new CardException(e);
+      }
+      
+      byte[] response = new byte[plainText.length + 2];
+      System.arraycopy(plainText, 0, response, 0, plainText.length);
+      response[plainText.length] = (byte) 0x90;
+      response[plainText.length + 1] = (byte) 0x00;
+      
+      return new ResponseAPDU(response);
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    }
+    
+  }
+
+  @Override
+  public ResponseAPDU cmdINTERNAL_AUTHENTICATE(CommandAPDU command, CardChannelEmul channel) throws CardException {
+    
+    checkINS(command, 0x88);
+    
+    if (command.getP1() == 0x10 && command.getP2() == 0x00) {
+      
+      byte[] data = command.getData();
+      
+      if (!Arrays.equals(securityEnv, SEC_ENV_INTERNAL_AUTHENTICATE)) {
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+      }
+
+      byte[] digestInfo = new byte[] {
+          (byte) 0x30, (byte) 0x21, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x05, (byte) 0x2B, (byte) 0x0E, 
+          (byte) 0x03, (byte) 0x02, (byte) 0x1A, (byte) 0x05, (byte) 0x00, (byte) 0x04, (byte) 0x14
+      };
+      
+      if (data.length != 35 || !Arrays.equals(digestInfo, Arrays.copyOf(data, 15))) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+        
+
+      if (pins.get(KID_PIN_DEC).state != PIN.STATE_PIN_VERIFIED) {
+        // Security Status not satisfied
+        return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+      }
+      
+      byte[] digest = Arrays.copyOfRange(data, 15, 35);
+      
+      byte[] sig;
+      try {
+        Signature signature = Signature.getInstance("RSA");
+        signature.initSign(SK_CH_EKEY);
+        signature.update(digest);
+        sig = signature.sign();
+      } catch (GeneralSecurityException e) {
+        throw new CardException(e);
+      }
+      
+      byte[] response = new byte[sig.length + 2];
+      System.arraycopy(sig, 0, response, 0, sig.length);
+      response[sig.length] = (byte) 0x90;
+      response[sig.length + 1] = (byte) 0x00;
+      
+      hash = null;
+      pins.get(KID_PIN_DEC).state = PIN.STATE_RESET;
+
+      return new ResponseAPDU(response);
+        
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplSIG.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplSIG.java
new file mode 100644
index 00000000..aee6a7f7
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04ApplSIG.java
@@ -0,0 +1,87 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.util.Arrays;
+
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+
+
+@SuppressWarnings("restriction")
+public class A04ApplSIG extends ACOSApplSIG {
+  
+  private static byte[] FID_EF_INFO = new byte[] { (byte) 0xd0, (byte) 0x02 };
+
+  private static byte[] FCI_EF_INFO = new byte[] { (byte) 0x6f, (byte) 0x07,
+      (byte) 0x80, (byte) 0x02, (byte) 0x00, (byte) 0x08, (byte) 0x82,
+      (byte) 0x01, (byte) 0x01 };
+
+  private static byte[] EF_INFO = new byte[] { (byte) 0x02, (byte) 0x00,
+      (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+      (byte) 0x00, (byte) 0x90, (byte) 0x00 };
+
+  public A04ApplSIG() {
+    putFile(new File(FID_EF_INFO, EF_INFO, FCI_EF_INFO));
+  }
+
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) {
+
+    checkINS(command, 0x22);
+
+    switch (command.getP2()) {
+    case 0xA4:
+      switch (command.getP1()) {
+      case 0x41:
+        // INTERNAL AUTHENTICATE
+      case 0x81:
+        // EXTERNAL AUTHENTICATE
+      }
+    case 0xB6:
+      switch (command.getP1()) {
+      case 0x41: {
+        // PSO - COMPUTE DIGITAL SIGNATURE
+        byte[] dst = new byte[] { (byte) 0x84, (byte) 0x01, (byte) 0x88, (byte) 0x80, (byte) 0x01, (byte) 0x14 };
+        if (Arrays.equals(dst, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+      case 0x81:
+        // PSO - VERIFY DGITAL SIGNATURE
+      }
+    case 0xB8:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO � DECIPHER
+      case 0x81:
+        // PSO � ENCIPHER
+      }
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+  }
+  
+  
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardChannelEmul.java
new file mode 100644
index 00000000..3eaece91
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardChannelEmul.java
@@ -0,0 +1,75 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardEmul;
+
+
+@SuppressWarnings("restriction")
+public class A04CardChannelEmul extends ACOSCardChannelEmul {
+
+  public A04CardChannelEmul(CardEmul cardEmul) {
+    super(cardEmul);
+  }
+
+  @Override
+  public ResponseAPDU cmdREAD_BINARY(CommandAPDU command) throws CardException {
+
+    if (command.getINS() != 0xB0) {
+      throw new IllegalArgumentException("INS has to be 0xB0.");
+    }
+
+    if (currentFile == null) {
+      return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x86}); 
+    }
+    
+    if ((command.getP1() & 0x80) > 0) {
+      throw new CardException("Not implemented.");
+    }
+    
+    int offset = command.getP2() + (command.getP1() << 8);
+    if (offset > currentFile.file.length) {
+      // Wrong length
+      return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+    }
+    
+    if (command.getNe() == 0) {
+      throw new CardException("Not implemented.");
+    }
+    
+    if (command.getNe() == 256 || command.getNe() <= currentFile.file.length - offset) {
+      int len = Math.min(command.getNe(), currentFile.file.length - offset);
+      byte[] response = new byte[len + 2];
+      System.arraycopy(currentFile.file, offset, response, 0, len);
+      response[len] = (byte) 0x90;
+      response[len + 1] = (byte) 0x00;
+      return new ResponseAPDU(response);
+    } else if (command.getNe() >= currentFile.file.length - offset) {
+      return new ResponseAPDU(new byte[] {(byte) 0x62, (byte) 0x82});
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+    }
+    
+  }
+
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java
new file mode 100644
index 00000000..70925aa6
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java
@@ -0,0 +1,37 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.CardEmul;
+
+
+
+public class A04CardEmul extends ACOSCardEmul {
+
+  public A04CardEmul(A04ApplSIG applSIG, A04ApplDEC applDEC) {
+    applications.add(applSIG);
+    applications.add(applDEC);
+  }
+
+  @Override
+  protected CardChannelEmul newCardChannel(CardEmul cardEmul) {
+    return new A04CardChannelEmul(this);
+  }
+
+  
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java
new file mode 100644
index 00000000..d15e80d7
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java
@@ -0,0 +1,143 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import iaik.security.provider.IAIK;
+
+import java.security.Security;
+import java.util.Arrays;
+
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import at.gv.egiz.smcc.ACOSCard;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.CardNotSupportedException;
+import at.gv.egiz.smcc.CardTerminalEmul;
+import at.gv.egiz.smcc.LockedException;
+import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINMgmtSignatureCard;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.SignatureCardFactory;
+import at.gv.egiz.smcc.CardTest.TestPINProvider;
+
+public class A04CardTest extends ACOSCardTest {
+
+  @Override
+  protected SignatureCard createSignatureCard()
+      throws CardNotSupportedException {
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    CardEmul card = new A04CardEmul(new A04ApplSIG(), new A04ApplDEC());
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+    assertTrue(signatureCard instanceof PINMgmtSignatureCard);
+    return signatureCard;
+  }
+
+  @Override
+  protected int getVersion() {
+    return 2;
+  }
+
+  @BeforeClass
+  public static void setupClass() {
+    IAIK.addAsProvider();
+  }
+  
+  @Test
+  public void testChangePin() throws CardNotSupportedException,
+      LockedException, NotActivatedException, CancelledException,
+      PINFormatException, SignatureCardException, InterruptedException {
+
+    char[] defaultPin = "123456".toCharArray();
+
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplSIG applSIG = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
+    applSIG.setPin(ACOSApplSIG.KID_PIN_SIG, defaultPin);
+    ACOSApplDEC applDEC = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    applDEC.setPin(ACOSApplDEC.KID_PIN_DEC, defaultPin);
+
+    for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
+
+      char[] pin = defaultPin;
+
+      for (int i = pinSpec.getMinLength(); i <= pinSpec.getMaxLength(); i++) {
+        char[] newPin = new char[i];
+        Arrays.fill(newPin, '0');
+        signatureCard
+            .changePIN(pinSpec, new TestChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new TestPINProvider(newPin));
+        pin = newPin;
+      }
+
+    }
+
+  }
+  
+  @Test
+  public void testGetInfoboxIdentityLinkEncrypted()
+      throws CardNotSupportedException, SignatureCardException,
+      InterruptedException {
+    
+    char[] pin = "0000".toCharArray();
+
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    A04ApplDEC applDEC = new A04ApplDEC(true);
+    applDEC.setPin(A04ApplDEC.KID_PIN_DEC, pin);
+    CardEmul card = new A04CardEmul(new A04ApplSIG(), applDEC);
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+
+    TestPINProvider pinProvider = new TestPINProvider(pin);
+
+    byte[] idlink = signatureCard.getInfobox("IdentityLink",
+        pinProvider, null);
+    assertNotNull(idlink);
+    assertTrue(Arrays.equals(idlink, A04ApplDEC.IDLINK));
+    assertEquals(1, pinProvider.getProvided());
+
+  }
+  
+  @Test
+  public void testGetInfoboxIdentityLink() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    final char[] pin = "0000".toCharArray();
+    
+    SignatureCard signatureCard = createSignatureCard();
+    
+    TestPINProvider pinProvider = new TestPINProvider(pin);
+
+    byte[] idlink = signatureCard.getInfobox("IdentityLink",
+        pinProvider, null);
+    assertNotNull(idlink);
+    assertTrue(Arrays.equals(idlink, A04ApplDEC.IDLINK));
+    assertEquals(0, pinProvider.getProvided());
+
+  }
+
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSAppl.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSAppl.java
new file mode 100644
index 00000000..4c340d61
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSAppl.java
@@ -0,0 +1,79 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+import java.util.Iterator;
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.AbstractAppl;
+import at.gv.egiz.smcc.CardAppl;
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public abstract class ACOSAppl extends AbstractAppl implements CardAppl {
+
+  public static byte[] AID_SIG = new byte[] { (byte) 0xA0, (byte) 0x00,
+        (byte) 0x00, (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x43 };
+  
+  public static byte[] FID_SIG = new byte[] { (byte) 0xDF, (byte) 0x70 };
+  
+  public static byte[] AID_DEC = new byte[] { (byte) 0xA0, (byte) 0x00,
+        (byte) 0x00, (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x4E };
+
+  public static byte[] FID_DEC = new byte[] { (byte) 0xDF, (byte) 0x71 };
+
+  protected byte[] securityEnv;
+
+  protected byte[] hash;
+
+  @Override
+  public ResponseAPDU cmdINTERNAL_AUTHENTICATE(CommandAPDU command, CardChannelEmul channel) throws CardException {
+    return new ResponseAPDU(new byte[] {(byte) 0x6D, (byte) 0x00});
+  }
+
+  @Override
+  public void leaveApplContext() {
+    Iterator<PIN> pin = pins.values().iterator();
+    while (pin.hasNext()) {
+      pin.next().state = PIN.STATE_RESET;
+    }
+  }
+  
+  public void setPin(int kid, char[] value) {
+    try {
+      PIN pin = pins.get(kid);
+      if (pin != null) {
+        if (value == null) {
+          Arrays.fill(pin.pin, (byte) 0x00);
+          pin.state = PIN.STATE_PIN_BLOCKED;
+        } else {
+          int l = pin.pin.length;
+          pin.pin = Arrays.copyOf(new String(value).getBytes("ASCII"), l);
+        }
+      }
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java
new file mode 100644
index 00000000..08979536
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java
@@ -0,0 +1,334 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+public abstract class ACOSApplDEC extends ACOSAppl {
+
+  public static final byte[] IDLINK = new byte[] {
+      (byte) 0x30, (byte) 0x82, (byte) 0x02, (byte) 0x11, (byte) 0x02, (byte) 0x01, (byte) 0x01, (byte) 0x0c, 
+      (byte) 0x26, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, 
+      (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, 
+      (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x7a, 
+      (byte) 0x6d, (byte) 0x72, (byte) 0x2f, (byte) 0x70, (byte) 0x65, (byte) 0x72, (byte) 0x73, (byte) 0x62, 
+      (byte) 0x32, (byte) 0x30, (byte) 0x34, (byte) 0x2e, (byte) 0x78, (byte) 0x73, (byte) 0x6c, (byte) 0x0c, 
+      (byte) 0x29, (byte) 0x73, (byte) 0x7a, (byte) 0x72, (byte) 0x2e, (byte) 0x62, (byte) 0x6d, (byte) 0x69, 
+      (byte) 0x2e, (byte) 0x67, (byte) 0x76, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2d, (byte) 0x41, 
+      (byte) 0x73, (byte) 0x73, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x6f, (byte) 0x6e, 
+      (byte) 0x49, (byte) 0x44, (byte) 0x31, (byte) 0x32, (byte) 0x33, (byte) 0x36, (byte) 0x33, (byte) 0x35, 
+      (byte) 0x36, (byte) 0x33, (byte) 0x36, (byte) 0x36, (byte) 0x37, (byte) 0x39, (byte) 0x39, (byte) 0x39, 
+      (byte) 0x31, (byte) 0x39, (byte) 0x0c, (byte) 0x19, (byte) 0x32, (byte) 0x30, (byte) 0x30, (byte) 0x39, 
+      (byte) 0x2d, (byte) 0x30, (byte) 0x33, (byte) 0x2d, (byte) 0x30, (byte) 0x36, (byte) 0x54, (byte) 0x31, 
+      (byte) 0x36, (byte) 0x3a, (byte) 0x31, (byte) 0x39, (byte) 0x3a, (byte) 0x32, (byte) 0x36, (byte) 0x2b, 
+      (byte) 0x30, (byte) 0x31, (byte) 0x3a, (byte) 0x30, (byte) 0x30, (byte) 0xa0, (byte) 0x42, (byte) 0x30, 
+      (byte) 0x40, (byte) 0x0c, (byte) 0x18, (byte) 0x45, (byte) 0x68, (byte) 0x42, (byte) 0x53, (byte) 0x36, 
+      (byte) 0x54, (byte) 0x6f, (byte) 0x31, (byte) 0x49, (byte) 0x6c, (byte) 0x54, (byte) 0x4b, (byte) 0x4f, 
+      (byte) 0x4a, (byte) 0x45, (byte) 0x39, (byte) 0x75, (byte) 0x62, (byte) 0x74, (byte) 0x48, (byte) 0x69, 
+      (byte) 0x51, (byte) 0x3d, (byte) 0x3d, (byte) 0x0c, (byte) 0x0a, (byte) 0x58, (byte) 0x58, (byte) 0x58, 
+      (byte) 0xc5, (byte) 0x90, (byte) 0x7a, (byte) 0x67, (byte) 0xc3, (byte) 0xbc, (byte) 0x72, (byte) 0x0c, 
+      (byte) 0x0c, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x54, (byte) 0xc3, (byte) 0xbc, (byte) 0x7a, 
+      (byte) 0x65, (byte) 0x6b, (byte) 0xc3, (byte) 0xa7, (byte) 0x69, (byte) 0x0c, (byte) 0x0a, (byte) 0x31, 
+      (byte) 0x39, (byte) 0x37, (byte) 0x33, (byte) 0x2d, (byte) 0x30, (byte) 0x36, (byte) 0x2d, (byte) 0x30, 
+      (byte) 0x34, (byte) 0x30, (byte) 0x0a, (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x00, 
+      (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x01, (byte) 0x03, (byte) 0x82, (byte) 0x01, 
+      (byte) 0x01, (byte) 0x00, (byte) 0x9f, (byte) 0xa5, (byte) 0x68, (byte) 0xa9, (byte) 0x14, (byte) 0x4c, 
+      (byte) 0xa4, (byte) 0x5d, (byte) 0x9d, (byte) 0x09, (byte) 0x99, (byte) 0x2e, (byte) 0xe7, (byte) 0x45, 
+      (byte) 0x2e, (byte) 0x42, (byte) 0x49, (byte) 0x02, (byte) 0x16, (byte) 0xd9, (byte) 0xcb, (byte) 0x90, 
+      (byte) 0x43, (byte) 0x27, (byte) 0x03, (byte) 0x43, (byte) 0x6d, (byte) 0xb4, (byte) 0x8c, (byte) 0xdc, 
+      (byte) 0x1c, (byte) 0x77, (byte) 0xd4, (byte) 0x2e, (byte) 0xa1, (byte) 0x40, (byte) 0xe7, (byte) 0xe0, 
+      (byte) 0x03, (byte) 0x60, (byte) 0x15, (byte) 0xf7, (byte) 0xdb, (byte) 0x03, (byte) 0x5e, (byte) 0xca, 
+      (byte) 0xe4, (byte) 0x35, (byte) 0xba, (byte) 0x2b, (byte) 0xfd, (byte) 0xe6, (byte) 0xb8, (byte) 0xd8, 
+      (byte) 0xb7, (byte) 0x2a, (byte) 0x80, (byte) 0xdd, (byte) 0x38, (byte) 0xe0, (byte) 0x8a, (byte) 0x69, 
+      (byte) 0xad, (byte) 0x67, (byte) 0x60, (byte) 0x65, (byte) 0x42, (byte) 0xc9, (byte) 0x41, (byte) 0x60, 
+      (byte) 0x94, (byte) 0xde, (byte) 0x84, (byte) 0x54, (byte) 0xad, (byte) 0xb3, (byte) 0xf4, (byte) 0xf7, 
+      (byte) 0x44, (byte) 0xd5, (byte) 0xf3, (byte) 0xd3, (byte) 0xb6, (byte) 0x87, (byte) 0x8a, (byte) 0x22, 
+      (byte) 0x38, (byte) 0x00, (byte) 0xcb, (byte) 0xa4, (byte) 0x4f, (byte) 0x96, (byte) 0xc2, (byte) 0x28, 
+      (byte) 0xc2, (byte) 0x8d, (byte) 0x91, (byte) 0x95, (byte) 0xb4, (byte) 0xea, (byte) 0x00, (byte) 0x59, 
+      (byte) 0x2e, (byte) 0xec, (byte) 0x78, (byte) 0xd8, (byte) 0x0f, (byte) 0x26, (byte) 0x04, (byte) 0xee, 
+      (byte) 0xed, (byte) 0x13, (byte) 0xbf, (byte) 0x81, (byte) 0x68, (byte) 0x81, (byte) 0x43, (byte) 0xbe, 
+      (byte) 0x15, (byte) 0x0e, (byte) 0xba, (byte) 0xf9, (byte) 0x6a, (byte) 0x18, (byte) 0xeb, (byte) 0x95, 
+      (byte) 0xad, (byte) 0xb4, (byte) 0x0f, (byte) 0x3c, (byte) 0x94, (byte) 0x63, (byte) 0x32, (byte) 0x81, 
+      (byte) 0x90, (byte) 0xcf, (byte) 0x3f, (byte) 0x95, (byte) 0xff, (byte) 0x8d, (byte) 0x86, (byte) 0xed, 
+      (byte) 0xe4, (byte) 0x75, (byte) 0xd5, (byte) 0x09, (byte) 0x32, (byte) 0x17, (byte) 0x38, (byte) 0xb2, 
+      (byte) 0x68, (byte) 0x35, (byte) 0x49, (byte) 0x8c, (byte) 0xa6, (byte) 0xd0, (byte) 0x3e, (byte) 0xde, 
+      (byte) 0x6e, (byte) 0x47, (byte) 0x68, (byte) 0xbf, (byte) 0x98, (byte) 0x33, (byte) 0xae, (byte) 0x59, 
+      (byte) 0x9f, (byte) 0xe0, (byte) 0x19, (byte) 0x9b, (byte) 0x5b, (byte) 0x1b, (byte) 0x8f, (byte) 0x74, 
+      (byte) 0xd2, (byte) 0x9c, (byte) 0x01, (byte) 0x1a, (byte) 0xdf, (byte) 0xaf, (byte) 0xf8, (byte) 0x96, 
+      (byte) 0x91, (byte) 0xcb, (byte) 0xf8, (byte) 0xbf, (byte) 0x06, (byte) 0xc7, (byte) 0xd5, (byte) 0x17, 
+      (byte) 0x95, (byte) 0xef, (byte) 0xc5, (byte) 0x97, (byte) 0x37, (byte) 0x1b, (byte) 0xb0, (byte) 0xa1, 
+      (byte) 0x4f, (byte) 0x9f, (byte) 0x01, (byte) 0x82, (byte) 0x90, (byte) 0x4a, (byte) 0x6a, (byte) 0x04, 
+      (byte) 0xdb, (byte) 0x31, (byte) 0x1a, (byte) 0x58, (byte) 0xeb, (byte) 0xcd, (byte) 0x68, (byte) 0xe3, 
+      (byte) 0x68, (byte) 0x0b, (byte) 0xa0, (byte) 0x11, (byte) 0x44, (byte) 0x08, (byte) 0xa0, (byte) 0x5c, 
+      (byte) 0xfc, (byte) 0x61, (byte) 0x15, (byte) 0x1f, (byte) 0xbb, (byte) 0x22, (byte) 0x87, (byte) 0x18, 
+      (byte) 0xa3, (byte) 0x07, (byte) 0x9b, (byte) 0x0d, (byte) 0x13, (byte) 0x7c, (byte) 0xff, (byte) 0x30, 
+      (byte) 0xcf, (byte) 0xf3, (byte) 0xaf, (byte) 0xe4, (byte) 0x45, (byte) 0x05, (byte) 0xa0, (byte) 0x8e, 
+      (byte) 0x6b, (byte) 0xef, (byte) 0x70, (byte) 0xf5, (byte) 0x4b, (byte) 0x68, (byte) 0x8f, (byte) 0x61, 
+      (byte) 0xd6, (byte) 0xf5, (byte) 0xa0, (byte) 0x17, (byte) 0x03, (byte) 0x15, (byte) 0x00, (byte) 0x8e, 
+      (byte) 0xa8, (byte) 0xdf, (byte) 0xa9, (byte) 0x77, (byte) 0xfd, (byte) 0x9b, (byte) 0x4b, (byte) 0x91, 
+      (byte) 0x89, (byte) 0x34, (byte) 0x84, (byte) 0xf3, (byte) 0x24, (byte) 0xb2, (byte) 0x5a, (byte) 0x39, 
+      (byte) 0xa9, (byte) 0xf2, (byte) 0x17, (byte) 0xa1, (byte) 0x17, (byte) 0x03, (byte) 0x15, (byte) 0x00, 
+      (byte) 0xdb, (byte) 0xa2, (byte) 0xfd, (byte) 0xa4, (byte) 0xe7, (byte) 0x65, (byte) 0x2e, (byte) 0x7e, 
+      (byte) 0xb0, (byte) 0xc8, (byte) 0xfa, (byte) 0x4d, (byte) 0x13, (byte) 0x28, (byte) 0xdf, (byte) 0xb1, 
+      (byte) 0x58, (byte) 0x3b, (byte) 0x9e, (byte) 0x29, (byte) 0xa2, (byte) 0x17, (byte) 0x03, (byte) 0x15, 
+      (byte) 0x00, (byte) 0x68, (byte) 0xa0, (byte) 0x17, (byte) 0x18, (byte) 0xb7, (byte) 0xb3, (byte) 0xc3, 
+      (byte) 0x60, (byte) 0x77, (byte) 0x82, (byte) 0x8d, (byte) 0xf1, (byte) 0x5e, (byte) 0x10, (byte) 0xc3, 
+      (byte) 0x2d, (byte) 0x78, (byte) 0x2c, (byte) 0x11, (byte) 0x0b
+    };
+  private static byte[] FCI = new byte[] { (byte) 0x6f, (byte) 0x1a, (byte) 0x84,
+        (byte) 0x07, (byte) 0xa0, (byte) 0x00, (byte) 0x00, (byte) 0x01,
+        (byte) 0x18, (byte) 0x4e, (byte) 0x43, (byte) 0x85, (byte) 0x0f,
+        (byte) 0x50, (byte) 0x0d, (byte) 0x44, (byte) 0x49, (byte) 0x47,
+        (byte) 0x53, (byte) 0x49, (byte) 0x47, (byte) 0x20, (byte) 0x43,
+        (byte) 0x43, (byte) 0x20, (byte) 0x45, (byte) 0x4e, (byte) 0x43 };
+  protected static byte[] FID_EF_C_CH_EKEY = new byte[] { (byte) 0xc0, (byte) 0x01 };
+  protected static byte[] FCI_EF_C_CH_EKEY = new byte[] { (byte) 0x6f, (byte) 0x07,
+    (byte) 0x80, (byte) 0x02, (byte) 0x07, (byte) 0xd0, (byte) 0x82,
+    (byte) 0x01, (byte) 0x01};
+  protected static byte[] C_CH_EKEY = new byte[] {
+      (byte) 0x30, (byte) 0x82, (byte) 0x05, (byte) 0x7f, (byte) 0x30, (byte) 0x82, (byte) 0x04, (byte) 0x67, 
+      (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x02, (byte) 0x02, (byte) 0x03, (byte) 0x02, 
+      (byte) 0x05, (byte) 0x51, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, 
+      (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x00, (byte) 0x30, (byte) 0x81, (byte) 0xa1, (byte) 0x31, (byte) 0x0b, (byte) 0x30, (byte) 0x09, 
+      (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, (byte) 0x13, (byte) 0x02, (byte) 0x41, 
+      (byte) 0x54, (byte) 0x31, (byte) 0x48, (byte) 0x30, (byte) 0x46, (byte) 0x06, (byte) 0x03, (byte) 0x55, 
+      (byte) 0x04, (byte) 0x0a, (byte) 0x0c, (byte) 0x3f, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, 
+      (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x20, (byte) 0x47, (byte) 0x65, (byte) 0x73, (byte) 0x2e, 
+      (byte) 0x20, (byte) 0x66, (byte) 0x2e, (byte) 0x20, (byte) 0x53, (byte) 0x69, (byte) 0x63, (byte) 0x68, 
+      (byte) 0x65, (byte) 0x72, (byte) 0x68, (byte) 0x65, (byte) 0x69, (byte) 0x74, (byte) 0x73, (byte) 0x73, 
+      (byte) 0x79, (byte) 0x73, (byte) 0x74, (byte) 0x65, (byte) 0x6d, (byte) 0x65, (byte) 0x20, (byte) 0x69, 
+      (byte) 0x6d, (byte) 0x20, (byte) 0x65, (byte) 0x6c, (byte) 0x65, (byte) 0x6b, (byte) 0x74, (byte) 0x72, 
+      (byte) 0x2e, (byte) 0x20, (byte) 0x44, (byte) 0x61, (byte) 0x74, (byte) 0x65, (byte) 0x6e, (byte) 0x76, 
+      (byte) 0x65, (byte) 0x72, (byte) 0x6b, (byte) 0x65, (byte) 0x68, (byte) 0x72, (byte) 0x20, (byte) 0x47, 
+      (byte) 0x6d, (byte) 0x62, (byte) 0x48, (byte) 0x31, (byte) 0x23, (byte) 0x30, (byte) 0x21, (byte) 0x06, 
+      (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x0b, (byte) 0x0c, (byte) 0x1a, (byte) 0x61, (byte) 0x2d, 
+      (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, 
+      (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, 
+      (byte) 0x74, (byte) 0x2d, (byte) 0x45, (byte) 0x6e, (byte) 0x63, (byte) 0x2d, (byte) 0x30, (byte) 0x32, 
+      (byte) 0x31, (byte) 0x23, (byte) 0x30, (byte) 0x21, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, 
+      (byte) 0x03, (byte) 0x0c, (byte) 0x1a, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, 
+      (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, 
+      (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x45, 
+      (byte) 0x6e, (byte) 0x63, (byte) 0x2d, (byte) 0x30, (byte) 0x32, (byte) 0x30, (byte) 0x1e, (byte) 0x17, 
+      (byte) 0x0d, (byte) 0x30, (byte) 0x39, (byte) 0x30, (byte) 0x31, (byte) 0x31, (byte) 0x33, (byte) 0x30, 
+      (byte) 0x39, (byte) 0x34, (byte) 0x35, (byte) 0x31, (byte) 0x32, (byte) 0x5a, (byte) 0x17, (byte) 0x0d, 
+      (byte) 0x31, (byte) 0x32, (byte) 0x31, (byte) 0x32, (byte) 0x33, (byte) 0x31, (byte) 0x30, (byte) 0x39, 
+      (byte) 0x34, (byte) 0x35, (byte) 0x31, (byte) 0x32, (byte) 0x5a, (byte) 0x30, (byte) 0x70, (byte) 0x31, 
+      (byte) 0x0b, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, 
+      (byte) 0x13, (byte) 0x02, (byte) 0x41, (byte) 0x54, (byte) 0x31, (byte) 0x1f, (byte) 0x30, (byte) 0x1d, 
+      (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x03, (byte) 0x0c, (byte) 0x16, (byte) 0x58, 
+      (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x6f, (byte) 0x20, (byte) 0x58, 
+      (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x61, (byte) 0x6b, (byte) 0x72, 
+      (byte) 0x69, (byte) 0x6e, (byte) 0x67, (byte) 0x65, (byte) 0x72, (byte) 0x31, (byte) 0x17, (byte) 0x30, 
+      (byte) 0x15, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x04, (byte) 0x0c, (byte) 0x0e, 
+      (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x61, (byte) 0x6b, 
+      (byte) 0x72, (byte) 0x69, (byte) 0x6e, (byte) 0x67, (byte) 0x65, (byte) 0x72, (byte) 0x31, (byte) 0x10, 
+      (byte) 0x30, (byte) 0x0e, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x2a, (byte) 0x0c, 
+      (byte) 0x07, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x6f, 
+      (byte) 0x31, (byte) 0x15, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, 
+      (byte) 0x05, (byte) 0x13, (byte) 0x0c, (byte) 0x39, (byte) 0x37, (byte) 0x30, (byte) 0x30, (byte) 0x31, 
+      (byte) 0x36, (byte) 0x38, (byte) 0x36, (byte) 0x36, (byte) 0x31, (byte) 0x37, (byte) 0x34, (byte) 0x30, 
+      (byte) 0x81, (byte) 0xdf, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, 
+      (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x01, (byte) 0x05, 
+      (byte) 0x00, (byte) 0x03, (byte) 0x81, (byte) 0xcd, (byte) 0x00, (byte) 0x30, (byte) 0x81, (byte) 0xc9, 
+      (byte) 0x02, (byte) 0x81, (byte) 0xc1, (byte) 0x00, (byte) 0xae, (byte) 0xe6, (byte) 0x07, (byte) 0x1d, 
+      (byte) 0xb9, (byte) 0x56, (byte) 0x0a, (byte) 0x98, (byte) 0x1a, (byte) 0xde, (byte) 0x52, (byte) 0xf2, 
+      (byte) 0x77, (byte) 0xdc, (byte) 0x5e, (byte) 0x76, (byte) 0x7f, (byte) 0xe5, (byte) 0xc1, (byte) 0x79, 
+      (byte) 0xb9, (byte) 0x51, (byte) 0x97, (byte) 0x08, (byte) 0x20, (byte) 0x4e, (byte) 0xa6, (byte) 0xa3, 
+      (byte) 0xab, (byte) 0xdf, (byte) 0x49, (byte) 0x21, (byte) 0x2b, (byte) 0x65, (byte) 0x4f, (byte) 0x7c, 
+      (byte) 0x26, (byte) 0xe8, (byte) 0xb9, (byte) 0x47, (byte) 0xdf, (byte) 0x03, (byte) 0x0f, (byte) 0xf7, 
+      (byte) 0x4e, (byte) 0xf4, (byte) 0x47, (byte) 0x3d, (byte) 0x32, (byte) 0x61, (byte) 0x05, (byte) 0x33, 
+      (byte) 0x0f, (byte) 0xdc, (byte) 0x97, (byte) 0x3e, (byte) 0xbf, (byte) 0x9b, (byte) 0xf2, (byte) 0xf8, 
+      (byte) 0xb3, (byte) 0xe2, (byte) 0xc4, (byte) 0x4d, (byte) 0xe0, (byte) 0x48, (byte) 0x6a, (byte) 0x1b, 
+      (byte) 0xd2, (byte) 0xfe, (byte) 0xfa, (byte) 0xee, (byte) 0x24, (byte) 0x08, (byte) 0xdc, (byte) 0x60, 
+      (byte) 0x2a, (byte) 0x78, (byte) 0x6c, (byte) 0x1d, (byte) 0xd3, (byte) 0x74, (byte) 0x43, (byte) 0x1f, 
+      (byte) 0x1f, (byte) 0x4e, (byte) 0xd2, (byte) 0x0f, (byte) 0x89, (byte) 0x3c, (byte) 0xe3, (byte) 0x1e, 
+      (byte) 0xfa, (byte) 0x31, (byte) 0x5a, (byte) 0xc2, (byte) 0x04, (byte) 0x24, (byte) 0xd1, (byte) 0xe5, 
+      (byte) 0x51, (byte) 0xc4, (byte) 0x94, (byte) 0x26, (byte) 0xd1, (byte) 0x32, (byte) 0x1e, (byte) 0xdf, 
+      (byte) 0x64, (byte) 0xaa, (byte) 0xaf, (byte) 0x2c, (byte) 0x85, (byte) 0x25, (byte) 0x88, (byte) 0x8f, 
+      (byte) 0x80, (byte) 0xe4, (byte) 0x05, (byte) 0x74, (byte) 0xd5, (byte) 0xda, (byte) 0x69, (byte) 0x88, 
+      (byte) 0x4a, (byte) 0x0c, (byte) 0x6a, (byte) 0x85, (byte) 0x5f, (byte) 0x67, (byte) 0x51, (byte) 0x6c, 
+      (byte) 0x5c, (byte) 0x1c, (byte) 0x41, (byte) 0x88, (byte) 0x4c, (byte) 0xad, (byte) 0x83, (byte) 0xc9, 
+      (byte) 0x10, (byte) 0x97, (byte) 0x45, (byte) 0x00, (byte) 0x3f, (byte) 0xbd, (byte) 0x1d, (byte) 0x2f, 
+      (byte) 0x28, (byte) 0x2e, (byte) 0x78, (byte) 0x97, (byte) 0x05, (byte) 0xa5, (byte) 0x41, (byte) 0x42, 
+      (byte) 0x37, (byte) 0x08, (byte) 0x60, (byte) 0x0b, (byte) 0x66, (byte) 0xb1, (byte) 0xb8, (byte) 0xdd, 
+      (byte) 0x98, (byte) 0x03, (byte) 0x03, (byte) 0x33, (byte) 0xc9, (byte) 0x15, (byte) 0xf7, (byte) 0x5b, 
+      (byte) 0x35, (byte) 0xa5, (byte) 0xaa, (byte) 0x7a, (byte) 0x5e, (byte) 0xe9, (byte) 0xa7, (byte) 0x60, 
+      (byte) 0xba, (byte) 0xd8, (byte) 0x0d, (byte) 0x6d, (byte) 0xb3, (byte) 0x85, (byte) 0x70, (byte) 0x0e, 
+      (byte) 0x38, (byte) 0x6f, (byte) 0xf0, (byte) 0xfd, (byte) 0x02, (byte) 0x03, (byte) 0x01, (byte) 0x00, 
+      (byte) 0x01, (byte) 0xa3, (byte) 0x82, (byte) 0x02, (byte) 0x32, (byte) 0x30, (byte) 0x82, (byte) 0x02, 
+      (byte) 0x2e, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x23, 
+      (byte) 0x04, (byte) 0x0c, (byte) 0x30, (byte) 0x0a, (byte) 0x80, (byte) 0x08, (byte) 0x4b, (byte) 0x5d, 
+      (byte) 0x02, (byte) 0x5c, (byte) 0x6d, (byte) 0x58, (byte) 0x24, (byte) 0x67, (byte) 0x30, (byte) 0x81, 
+      (byte) 0x84, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x07, (byte) 0x01, (byte) 0x01, (byte) 0x04, (byte) 0x78, (byte) 0x30, (byte) 0x76, (byte) 0x30, 
+      (byte) 0x2c, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x07, (byte) 0x30, (byte) 0x01, (byte) 0x86, (byte) 0x20, (byte) 0x68, (byte) 0x74, (byte) 0x74, 
+      (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x70, 
+      (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, 
+      (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x2f, (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x70, (byte) 0x30, (byte) 0x46, (byte) 0x06, 
+      (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x30, 
+      (byte) 0x02, (byte) 0x86, (byte) 0x3a, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, 
+      (byte) 0x2f, (byte) 0x2f, (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, 
+      (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x2f, (byte) 0x63, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x73, (byte) 0x2f, (byte) 0x61, 
+      (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, 
+      (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, 
+      (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x45, (byte) 0x6e, (byte) 0x63, (byte) 0x2d, (byte) 0x30, 
+      (byte) 0x32, (byte) 0x2e, (byte) 0x63, (byte) 0x72, (byte) 0x74, (byte) 0x30, (byte) 0x81, (byte) 0x93, 
+      (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x20, (byte) 0x04, (byte) 0x81, (byte) 0x8b, 
+      (byte) 0x30, (byte) 0x81, (byte) 0x88, (byte) 0x30, (byte) 0x81, (byte) 0x85, (byte) 0x06, (byte) 0x06, 
+      (byte) 0x2a, (byte) 0x28, (byte) 0x00, (byte) 0x11, (byte) 0x01, (byte) 0x03, (byte) 0x30, (byte) 0x7b, 
+      (byte) 0x30, (byte) 0x3d, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, 
+      (byte) 0x05, (byte) 0x07, (byte) 0x02, (byte) 0x01, (byte) 0x16, (byte) 0x31, (byte) 0x68, (byte) 0x74, 
+      (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x77, (byte) 0x77, (byte) 0x77, 
+      (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, 
+      (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x64, (byte) 0x6f, (byte) 0x63, (byte) 0x73, 
+      (byte) 0x2f, (byte) 0x63, (byte) 0x70, (byte) 0x2f, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, 
+      (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x70, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, 
+      (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x30, 
+      (byte) 0x3a, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x07, (byte) 0x02, (byte) 0x02, (byte) 0x30, (byte) 0x2e, (byte) 0x1a, (byte) 0x2c, (byte) 0x44, 
+      (byte) 0x69, (byte) 0x65, (byte) 0x73, (byte) 0x65, (byte) 0x73, (byte) 0x20, (byte) 0x5a, (byte) 0x65, 
+      (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x6b, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x20, (byte) 0x64, (byte) 0x69, (byte) 0x65, (byte) 0x6e, (byte) 0x74, (byte) 0x20, (byte) 0x6e, 
+      (byte) 0x75, (byte) 0x72, (byte) 0x20, (byte) 0x7a, (byte) 0x75, (byte) 0x20, (byte) 0x54, (byte) 0x65, 
+      (byte) 0x73, (byte) 0x74, (byte) 0x7a, (byte) 0x77, (byte) 0x65, (byte) 0x63, (byte) 0x6b, (byte) 0x65, 
+      (byte) 0x6e, (byte) 0x20, (byte) 0x21, (byte) 0x30, (byte) 0x81, (byte) 0xa4, (byte) 0x06, (byte) 0x03, 
+      (byte) 0x55, (byte) 0x1d, (byte) 0x1f, (byte) 0x04, (byte) 0x81, (byte) 0x9c, (byte) 0x30, (byte) 0x81, 
+      (byte) 0x99, (byte) 0x30, (byte) 0x81, (byte) 0x96, (byte) 0xa0, (byte) 0x81, (byte) 0x93, (byte) 0xa0, 
+      (byte) 0x81, (byte) 0x90, (byte) 0x86, (byte) 0x81, (byte) 0x8d, (byte) 0x6c, (byte) 0x64, (byte) 0x61, 
+      (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x6c, (byte) 0x64, (byte) 0x61, (byte) 0x70, 
+      (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, 
+      (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x2f, (byte) 0x6f, (byte) 0x75, (byte) 0x3d, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, 
+      (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, 
+      (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, 
+      (byte) 0x45, (byte) 0x6e, (byte) 0x63, (byte) 0x2d, (byte) 0x30, (byte) 0x32, (byte) 0x2c, (byte) 0x6f, 
+      (byte) 0x3d, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, 
+      (byte) 0x2c, (byte) 0x63, (byte) 0x3d, (byte) 0x41, (byte) 0x54, (byte) 0x3f, (byte) 0x63, (byte) 0x65, 
+      (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x63, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x65, (byte) 0x72, (byte) 0x65, (byte) 0x76, (byte) 0x6f, (byte) 0x63, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x69, (byte) 0x6f, (byte) 0x6e, (byte) 0x6c, (byte) 0x69, (byte) 0x73, (byte) 0x74, (byte) 0x3f, 
+      (byte) 0x62, (byte) 0x61, (byte) 0x73, (byte) 0x65, (byte) 0x3f, (byte) 0x6f, (byte) 0x62, (byte) 0x6a, 
+      (byte) 0x65, (byte) 0x63, (byte) 0x74, (byte) 0x63, (byte) 0x6c, (byte) 0x61, (byte) 0x73, (byte) 0x73, 
+      (byte) 0x3d, (byte) 0x65, (byte) 0x69, (byte) 0x64, (byte) 0x43, (byte) 0x65, (byte) 0x72, (byte) 0x74, 
+      (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x63, (byte) 0x61, (byte) 0x74, (byte) 0x69, (byte) 0x6f, 
+      (byte) 0x6e, (byte) 0x41, (byte) 0x75, (byte) 0x74, (byte) 0x68, (byte) 0x6f, (byte) 0x72, (byte) 0x69, 
+      (byte) 0x74, (byte) 0x79, (byte) 0x30, (byte) 0x11, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, 
+      (byte) 0x0e, (byte) 0x04, (byte) 0x0a, (byte) 0x04, (byte) 0x08, (byte) 0x4a, (byte) 0x24, (byte) 0x43, 
+      (byte) 0xc0, (byte) 0x85, (byte) 0x2a, (byte) 0xb4, (byte) 0x51, (byte) 0x30, (byte) 0x0e, (byte) 0x06, 
+      (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x0f, (byte) 0x01, (byte) 0x01, (byte) 0xff, (byte) 0x04, 
+      (byte) 0x04, (byte) 0x03, (byte) 0x02, (byte) 0x04, (byte) 0xb0, (byte) 0x30, (byte) 0x25, (byte) 0x06, 
+      (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x11, (byte) 0x04, (byte) 0x1e, (byte) 0x30, (byte) 0x1c, 
+      (byte) 0x81, (byte) 0x1a, (byte) 0x74, (byte) 0x68, (byte) 0x6f, (byte) 0x6d, (byte) 0x61, (byte) 0x73, 
+      (byte) 0x2e, (byte) 0x72, (byte) 0x6f, (byte) 0x65, (byte) 0x73, (byte) 0x73, (byte) 0x6c, (byte) 0x65, 
+      (byte) 0x72, (byte) 0x40, (byte) 0x65, (byte) 0x67, (byte) 0x69, (byte) 0x7a, (byte) 0x2e, (byte) 0x67, 
+      (byte) 0x76, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x03, 
+      (byte) 0x55, (byte) 0x1d, (byte) 0x13, (byte) 0x04, (byte) 0x02, (byte) 0x30, (byte) 0x00, (byte) 0x30, 
+      (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, (byte) 0x48, (byte) 0x86, (byte) 0xf7, 
+      (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x00, (byte) 0x03, (byte) 0x82, 
+      (byte) 0x01, (byte) 0x01, (byte) 0x00, (byte) 0x4a, (byte) 0x36, (byte) 0x02, (byte) 0xb3, (byte) 0xab, 
+      (byte) 0x02, (byte) 0xe9, (byte) 0xe1, (byte) 0xaf, (byte) 0x3f, (byte) 0xd5, (byte) 0xcd, (byte) 0x3d, 
+      (byte) 0x51, (byte) 0x08, (byte) 0xb8, (byte) 0x73, (byte) 0x23, (byte) 0x68, (byte) 0x0c, (byte) 0x22, 
+      (byte) 0x32, (byte) 0xcd, (byte) 0xbe, (byte) 0xc8, (byte) 0x77, (byte) 0xbc, (byte) 0x47, (byte) 0x37, 
+      (byte) 0xdd, (byte) 0x89, (byte) 0x7c, (byte) 0x22, (byte) 0x24, (byte) 0x2f, (byte) 0x23, (byte) 0xea, 
+      (byte) 0x3e, (byte) 0xc2, (byte) 0xf4, (byte) 0x59, (byte) 0x78, (byte) 0xa6, (byte) 0xbe, (byte) 0xcd, 
+      (byte) 0x71, (byte) 0xaa, (byte) 0xb5, (byte) 0xbc, (byte) 0xe3, (byte) 0xbc, (byte) 0x3f, (byte) 0xf1, 
+      (byte) 0xfa, (byte) 0x1a, (byte) 0x43, (byte) 0x2b, (byte) 0x91, (byte) 0x35, (byte) 0x67, (byte) 0xa5, 
+      (byte) 0x62, (byte) 0x9d, (byte) 0x55, (byte) 0x85, (byte) 0xe0, (byte) 0x3f, (byte) 0xed, (byte) 0x00, 
+      (byte) 0x67, (byte) 0x80, (byte) 0x6a, (byte) 0xfb, (byte) 0x46, (byte) 0x8a, (byte) 0xed, (byte) 0x48, 
+      (byte) 0x03, (byte) 0xe7, (byte) 0x9d, (byte) 0x5c, (byte) 0xac, (byte) 0xdf, (byte) 0xec, (byte) 0x2d, 
+      (byte) 0x53, (byte) 0x8b, (byte) 0x01, (byte) 0xdb, (byte) 0x14, (byte) 0x91, (byte) 0x21, (byte) 0xaf, 
+      (byte) 0xa7, (byte) 0x91, (byte) 0x69, (byte) 0x7e, (byte) 0x97, (byte) 0x68, (byte) 0xcc, (byte) 0x2a, 
+      (byte) 0x06, (byte) 0x1a, (byte) 0xbc, (byte) 0x53, (byte) 0x35, (byte) 0xde, (byte) 0xd7, (byte) 0x62, 
+      (byte) 0x12, (byte) 0xbd, (byte) 0x54, (byte) 0xb5, (byte) 0x4c, (byte) 0x3c, (byte) 0xaf, (byte) 0x55, 
+      (byte) 0xa4, (byte) 0x5b, (byte) 0x28, (byte) 0x61, (byte) 0x68, (byte) 0x03, (byte) 0xc6, (byte) 0x72, 
+      (byte) 0xc0, (byte) 0xa2, (byte) 0x3f, (byte) 0x84, (byte) 0x02, (byte) 0xf8, (byte) 0x3d, (byte) 0x70, 
+      (byte) 0x3f, (byte) 0xde, (byte) 0x9d, (byte) 0x6a, (byte) 0x71, (byte) 0x16, (byte) 0x87, (byte) 0x9d, 
+      (byte) 0x93, (byte) 0x3d, (byte) 0x46, (byte) 0x41, (byte) 0xa9, (byte) 0x6a, (byte) 0xca, (byte) 0x87, 
+      (byte) 0xd4, (byte) 0xd1, (byte) 0x3f, (byte) 0x1d, (byte) 0x6e, (byte) 0x6a, (byte) 0xbf, (byte) 0x02, 
+      (byte) 0x9b, (byte) 0xfb, (byte) 0x4a, (byte) 0x47, (byte) 0xe0, (byte) 0x20, (byte) 0x4a, (byte) 0x2d, 
+      (byte) 0x5a, (byte) 0x0c, (byte) 0x6b, (byte) 0x25, (byte) 0xd6, (byte) 0x2d, (byte) 0xd4, (byte) 0x53, 
+      (byte) 0x08, (byte) 0x41, (byte) 0xa9, (byte) 0x16, (byte) 0xa2, (byte) 0xa0, (byte) 0xef, (byte) 0x13, 
+      (byte) 0xa8, (byte) 0xec, (byte) 0x7e, (byte) 0x99, (byte) 0x15, (byte) 0xf9, (byte) 0x1a, (byte) 0x18, 
+      (byte) 0x5e, (byte) 0x75, (byte) 0xc7, (byte) 0x5d, (byte) 0x40, (byte) 0xd4, (byte) 0x84, (byte) 0x4a, 
+      (byte) 0xd2, (byte) 0xf7, (byte) 0x7c, (byte) 0x65, (byte) 0x12, (byte) 0xc7, (byte) 0xae, (byte) 0xbc, 
+      (byte) 0x9d, (byte) 0x3e, (byte) 0xce, (byte) 0x42, (byte) 0xfe, (byte) 0xe4, (byte) 0x98, (byte) 0x10, 
+      (byte) 0x63, (byte) 0x0d, (byte) 0xaa, (byte) 0x2d, (byte) 0x73, (byte) 0x7d, (byte) 0x46, (byte) 0x19, 
+      (byte) 0xca, (byte) 0x78, (byte) 0x94, (byte) 0xe5, (byte) 0x11, (byte) 0x83, (byte) 0x87, (byte) 0xb2, 
+      (byte) 0xf7, (byte) 0x59, (byte) 0x90, (byte) 0x47, (byte) 0x86, (byte) 0x57, (byte) 0xcf, (byte) 0xc7, 
+      (byte) 0x7b, (byte) 0x8f, (byte) 0xac, (byte) 0x20, (byte) 0xbd, (byte) 0x46, (byte) 0xea, (byte) 0xa2, 
+      (byte) 0x10, (byte) 0xe1, (byte) 0x72, (byte) 0x3e, (byte) 0xe3, (byte) 0x72, (byte) 0x20, (byte) 0x24, 
+      (byte) 0xa5, (byte) 0x2f, (byte) 0xc5
+    };
+  protected static final int KID_PIN_DEC = 0x81;
+
+  protected static byte[] FID_EF_INFOBOX = new byte[] { (byte) 0xc0, (byte) 0x02 };
+  protected static byte[] FCI_EF_INFOBOX = new byte[] { (byte) 0x6f, (byte) 0x07,
+    (byte) 0x80, (byte) 0x02, (byte) 0x05, (byte) 0xdc, (byte) 0x82,
+    (byte) 0x01, (byte) 0x01};
+  
+  protected byte[] EF_INFOBOX = new byte[1500];
+
+  protected byte[] EF_C_CH_EKEY = new byte[2000];
+  
+  public ACOSApplDEC() {
+    System.arraycopy(C_CH_EKEY, 0, EF_C_CH_EKEY, 0, C_CH_EKEY.length);
+    putFile(new File(FID_EF_C_CH_EKEY, EF_C_CH_EKEY, FCI_EF_C_CH_EKEY));
+    try {
+      pins.put(KID_PIN_DEC, new PIN("1234\0\0\0\0".getBytes("ASCII"), KID_PIN_DEC, 10));
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  @Override
+  public byte[] getAID() {
+    return AID_DEC;
+  }
+
+  @Override
+  public byte[] getFID() {
+    return FID_DEC;
+  }
+
+  @Override
+  public byte[] getFCI() {
+    return FCI;
+  }
+
+  public void clearInfobox() {
+    Arrays.fill(EF_INFOBOX, (byte) 0x00);
+  }
+  
+  public void setInfoboxHeader(byte b) {
+    EF_INFOBOX[0] = b;
+  }
+  
+  public void clearCert() {
+    Arrays.fill(EF_C_CH_EKEY, (byte) 0x00);
+  }
+
+  
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java
new file mode 100644
index 00000000..e476b434
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java
@@ -0,0 +1,302 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+import java.util.Random;
+
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public abstract class ACOSApplSIG extends ACOSAppl {
+
+  private static byte[] FCI = new byte[] { (byte) 0x6f, (byte) 0x1a,
+        (byte) 0x84, (byte) 0x07, (byte) 0xa0, (byte) 0x00, (byte) 0x00,
+        (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x43, (byte) 0x85,
+        (byte) 0x0f, (byte) 0x50, (byte) 0x0d, (byte) 0x44, (byte) 0x49,
+        (byte) 0x47, (byte) 0x53, (byte) 0x49, (byte) 0x47, (byte) 0x20,
+        (byte) 0x43, (byte) 0x43, (byte) 0x20, (byte) 0x45, (byte) 0x43,
+        (byte) 0x43 };
+  protected static byte[] FID_EF_C_CH_DS = new byte[] { (byte) 0xc0, (byte) 0x02 };
+  protected static byte[] FCI_EF_C_CH_DS = new byte[] { (byte) 0x6f, (byte) 0x07,
+        (byte) 0x80, (byte) 0x02, (byte) 0x07, (byte) 0xd0, (byte) 0x82,
+        (byte) 0x01, (byte) 0x01 };
+  protected static byte[] C_CH_DS = new byte[] {
+      (byte) 0x30, (byte) 0x82, (byte) 0x05, (byte) 0x2b, (byte) 0x30, (byte) 0x82, (byte) 0x04, (byte) 0x13, 
+      (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x02, (byte) 0x02, (byte) 0x03, (byte) 0x02, 
+      (byte) 0x05, (byte) 0x52, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, 
+      (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x00, (byte) 0x30, (byte) 0x81, (byte) 0xa1, (byte) 0x31, (byte) 0x0b, (byte) 0x30, (byte) 0x09, 
+      (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, (byte) 0x13, (byte) 0x02, (byte) 0x41, 
+      (byte) 0x54, (byte) 0x31, (byte) 0x48, (byte) 0x30, (byte) 0x46, (byte) 0x06, (byte) 0x03, (byte) 0x55, 
+      (byte) 0x04, (byte) 0x0a, (byte) 0x0c, (byte) 0x3f, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, 
+      (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x20, (byte) 0x47, (byte) 0x65, (byte) 0x73, (byte) 0x2e, 
+      (byte) 0x20, (byte) 0x66, (byte) 0x2e, (byte) 0x20, (byte) 0x53, (byte) 0x69, (byte) 0x63, (byte) 0x68, 
+      (byte) 0x65, (byte) 0x72, (byte) 0x68, (byte) 0x65, (byte) 0x69, (byte) 0x74, (byte) 0x73, (byte) 0x73, 
+      (byte) 0x79, (byte) 0x73, (byte) 0x74, (byte) 0x65, (byte) 0x6d, (byte) 0x65, (byte) 0x20, (byte) 0x69, 
+      (byte) 0x6d, (byte) 0x20, (byte) 0x65, (byte) 0x6c, (byte) 0x65, (byte) 0x6b, (byte) 0x74, (byte) 0x72, 
+      (byte) 0x2e, (byte) 0x20, (byte) 0x44, (byte) 0x61, (byte) 0x74, (byte) 0x65, (byte) 0x6e, (byte) 0x76, 
+      (byte) 0x65, (byte) 0x72, (byte) 0x6b, (byte) 0x65, (byte) 0x68, (byte) 0x72, (byte) 0x20, (byte) 0x47, 
+      (byte) 0x6d, (byte) 0x62, (byte) 0x48, (byte) 0x31, (byte) 0x23, (byte) 0x30, (byte) 0x21, (byte) 0x06, 
+      (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x0b, (byte) 0x0c, (byte) 0x1a, (byte) 0x61, (byte) 0x2d, 
+      (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, 
+      (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, 
+      (byte) 0x74, (byte) 0x2d, (byte) 0x53, (byte) 0x69, (byte) 0x67, (byte) 0x2d, (byte) 0x30, (byte) 0x32, 
+      (byte) 0x31, (byte) 0x23, (byte) 0x30, (byte) 0x21, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, 
+      (byte) 0x03, (byte) 0x0c, (byte) 0x1a, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, 
+      (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, 
+      (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x53, 
+      (byte) 0x69, (byte) 0x67, (byte) 0x2d, (byte) 0x30, (byte) 0x32, (byte) 0x30, (byte) 0x1e, (byte) 0x17, 
+      (byte) 0x0d, (byte) 0x30, (byte) 0x39, (byte) 0x30, (byte) 0x31, (byte) 0x31, (byte) 0x33, (byte) 0x30, 
+      (byte) 0x39, (byte) 0x34, (byte) 0x35, (byte) 0x31, (byte) 0x32, (byte) 0x5a, (byte) 0x17, (byte) 0x0d, 
+      (byte) 0x31, (byte) 0x32, (byte) 0x31, (byte) 0x32, (byte) 0x33, (byte) 0x31, (byte) 0x30, (byte) 0x39, 
+      (byte) 0x34, (byte) 0x35, (byte) 0x31, (byte) 0x32, (byte) 0x5a, (byte) 0x30, (byte) 0x70, (byte) 0x31, 
+      (byte) 0x0b, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, 
+      (byte) 0x13, (byte) 0x02, (byte) 0x41, (byte) 0x54, (byte) 0x31, (byte) 0x1f, (byte) 0x30, (byte) 0x1d, 
+      (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x03, (byte) 0x0c, (byte) 0x16, (byte) 0x58, 
+      (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x6f, (byte) 0x20, (byte) 0x58, 
+      (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x61, (byte) 0x6b, (byte) 0x72, 
+      (byte) 0x69, (byte) 0x6e, (byte) 0x67, (byte) 0x65, (byte) 0x72, (byte) 0x31, (byte) 0x17, (byte) 0x30, 
+      (byte) 0x15, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x04, (byte) 0x0c, (byte) 0x0e, 
+      (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x61, (byte) 0x6b, 
+      (byte) 0x72, (byte) 0x69, (byte) 0x6e, (byte) 0x67, (byte) 0x65, (byte) 0x72, (byte) 0x31, (byte) 0x10, 
+      (byte) 0x30, (byte) 0x0e, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x2a, (byte) 0x0c, 
+      (byte) 0x07, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x4f, (byte) 0x74, (byte) 0x74, (byte) 0x6f, 
+      (byte) 0x31, (byte) 0x15, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, 
+      (byte) 0x05, (byte) 0x13, (byte) 0x0c, (byte) 0x39, (byte) 0x37, (byte) 0x30, (byte) 0x30, (byte) 0x31, 
+      (byte) 0x36, (byte) 0x38, (byte) 0x36, (byte) 0x36, (byte) 0x31, (byte) 0x37, (byte) 0x34, (byte) 0x30, 
+      (byte) 0x59, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x07, (byte) 0x2a, (byte) 0x86, (byte) 0x48, 
+      (byte) 0xce, (byte) 0x3d, (byte) 0x02, (byte) 0x01, (byte) 0x06, (byte) 0x08, (byte) 0x2a, (byte) 0x86, 
+      (byte) 0x48, (byte) 0xce, (byte) 0x3d, (byte) 0x03, (byte) 0x01, (byte) 0x01, (byte) 0x03, (byte) 0x42, 
+      (byte) 0x00, (byte) 0x04, (byte) 0x6b, (byte) 0xde, (byte) 0x5f, (byte) 0x5e, (byte) 0xd5, (byte) 0x2b, 
+      (byte) 0xbe, (byte) 0x1e, (byte) 0xb9, (byte) 0x82, (byte) 0x19, (byte) 0x75, (byte) 0xf4, (byte) 0x3b, 
+      (byte) 0xc1, (byte) 0x34, (byte) 0xe9, (byte) 0xdb, (byte) 0x0b, (byte) 0x25, (byte) 0x31, (byte) 0x33, 
+      (byte) 0xfa, (byte) 0x8b, (byte) 0x72, (byte) 0xd4, (byte) 0x9f, (byte) 0x21, (byte) 0xf5, (byte) 0x62, 
+      (byte) 0xb9, (byte) 0xf6, (byte) 0x50, (byte) 0xdb, (byte) 0xcc, (byte) 0xbf, (byte) 0x43, (byte) 0xb9, 
+      (byte) 0x5e, (byte) 0x75, (byte) 0x2a, (byte) 0x37, (byte) 0xbe, (byte) 0x32, (byte) 0xa6, (byte) 0x83, 
+      (byte) 0xb1, (byte) 0x5c, (byte) 0xc3, (byte) 0x9d, (byte) 0xf0, (byte) 0xab, (byte) 0xe6, (byte) 0x8f, 
+      (byte) 0xe4, (byte) 0x97, (byte) 0x83, (byte) 0x57, (byte) 0x89, (byte) 0xe0, (byte) 0x13, (byte) 0xe3, 
+      (byte) 0x13, (byte) 0xa8, (byte) 0xa3, (byte) 0x82, (byte) 0x02, (byte) 0x65, (byte) 0x30, (byte) 0x82, 
+      (byte) 0x02, (byte) 0x61, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, 
+      (byte) 0x23, (byte) 0x04, (byte) 0x0c, (byte) 0x30, (byte) 0x0a, (byte) 0x80, (byte) 0x08, (byte) 0x46, 
+      (byte) 0x06, (byte) 0x9f, (byte) 0x8e, (byte) 0x41, (byte) 0x8e, (byte) 0x15, (byte) 0xbd, (byte) 0x30, 
+      (byte) 0x27, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x07, (byte) 0x01, (byte) 0x03, (byte) 0x01, (byte) 0x01, (byte) 0xff, (byte) 0x04, (byte) 0x18, 
+      (byte) 0x30, (byte) 0x16, (byte) 0x30, (byte) 0x08, (byte) 0x06, (byte) 0x06, (byte) 0x04, (byte) 0x00, 
+      (byte) 0x8e, (byte) 0x46, (byte) 0x01, (byte) 0x01, (byte) 0x30, (byte) 0x0a, (byte) 0x06, (byte) 0x08, 
+      (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x0b, (byte) 0x01, 
+      (byte) 0x30, (byte) 0x81, (byte) 0x84, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, 
+      (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x01, (byte) 0x01, (byte) 0x04, (byte) 0x78, (byte) 0x30, 
+      (byte) 0x76, (byte) 0x30, (byte) 0x2c, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, 
+      (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x30, (byte) 0x01, (byte) 0x86, (byte) 0x20, (byte) 0x68, 
+      (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x6f, (byte) 0x63, 
+      (byte) 0x73, (byte) 0x70, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2e, 
+      (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, 
+      (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x70, (byte) 0x30, 
+      (byte) 0x46, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+      (byte) 0x07, (byte) 0x30, (byte) 0x02, (byte) 0x86, (byte) 0x3a, (byte) 0x68, (byte) 0x74, (byte) 0x74, 
+      (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, 
+      (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, 
+      (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x63, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x73, 
+      (byte) 0x2f, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, 
+      (byte) 0x50, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, 
+      (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x53, (byte) 0x69, (byte) 0x67, 
+      (byte) 0x2d, (byte) 0x30, (byte) 0x32, (byte) 0x2e, (byte) 0x63, (byte) 0x72, (byte) 0x74, (byte) 0x30, 
+      (byte) 0x81, (byte) 0x9d, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x20, (byte) 0x04, 
+      (byte) 0x81, (byte) 0x95, (byte) 0x30, (byte) 0x81, (byte) 0x92, (byte) 0x30, (byte) 0x81, (byte) 0x85, 
+      (byte) 0x06, (byte) 0x06, (byte) 0x2a, (byte) 0x28, (byte) 0x00, (byte) 0x11, (byte) 0x01, (byte) 0x03, 
+      (byte) 0x30, (byte) 0x7b, (byte) 0x30, (byte) 0x3d, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, 
+      (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x02, (byte) 0x01, (byte) 0x16, (byte) 0x31, 
+      (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x77, 
+      (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, 
+      (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x64, (byte) 0x6f, 
+      (byte) 0x63, (byte) 0x73, (byte) 0x2f, (byte) 0x63, (byte) 0x70, (byte) 0x2f, (byte) 0x61, (byte) 0x2d, 
+      (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x70, (byte) 0x72, (byte) 0x65, 
+      (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, 
+      (byte) 0x74, (byte) 0x30, (byte) 0x3a, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, 
+      (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x02, (byte) 0x02, (byte) 0x30, (byte) 0x2e, (byte) 0x1a, 
+      (byte) 0x2c, (byte) 0x44, (byte) 0x69, (byte) 0x65, (byte) 0x73, (byte) 0x65, (byte) 0x73, (byte) 0x20, 
+      (byte) 0x5a, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x6b, 
+      (byte) 0x61, (byte) 0x74, (byte) 0x20, (byte) 0x64, (byte) 0x69, (byte) 0x65, (byte) 0x6e, (byte) 0x74, 
+      (byte) 0x20, (byte) 0x6e, (byte) 0x75, (byte) 0x72, (byte) 0x20, (byte) 0x7a, (byte) 0x75, (byte) 0x20, 
+      (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x7a, (byte) 0x77, (byte) 0x65, (byte) 0x63, 
+      (byte) 0x6b, (byte) 0x65, (byte) 0x6e, (byte) 0x20, (byte) 0x21, (byte) 0x30, (byte) 0x08, (byte) 0x06, 
+      (byte) 0x06, (byte) 0x04, (byte) 0x00, (byte) 0x8b, (byte) 0x30, (byte) 0x01, (byte) 0x01, (byte) 0x30, 
+      (byte) 0x81, (byte) 0xa4, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x1f, (byte) 0x04, 
+      (byte) 0x81, (byte) 0x9c, (byte) 0x30, (byte) 0x81, (byte) 0x99, (byte) 0x30, (byte) 0x81, (byte) 0x96, 
+      (byte) 0xa0, (byte) 0x81, (byte) 0x93, (byte) 0xa0, (byte) 0x81, (byte) 0x90, (byte) 0x86, (byte) 0x81, 
+      (byte) 0x8d, (byte) 0x6c, (byte) 0x64, (byte) 0x61, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, 
+      (byte) 0x6c, (byte) 0x64, (byte) 0x61, (byte) 0x70, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, 
+      (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, 
+      (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x6f, (byte) 0x75, (byte) 0x3d, 
+      (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, 
+      (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, 
+      (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x53, (byte) 0x69, (byte) 0x67, (byte) 0x2d, 
+      (byte) 0x30, (byte) 0x32, (byte) 0x2c, (byte) 0x6f, (byte) 0x3d, (byte) 0x41, (byte) 0x2d, (byte) 0x54, 
+      (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2c, (byte) 0x63, (byte) 0x3d, (byte) 0x41, 
+      (byte) 0x54, (byte) 0x3f, (byte) 0x63, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, 
+      (byte) 0x69, (byte) 0x63, (byte) 0x61, (byte) 0x74, (byte) 0x65, (byte) 0x72, (byte) 0x65, (byte) 0x76, 
+      (byte) 0x6f, (byte) 0x63, (byte) 0x61, (byte) 0x74, (byte) 0x69, (byte) 0x6f, (byte) 0x6e, (byte) 0x6c, 
+      (byte) 0x69, (byte) 0x73, (byte) 0x74, (byte) 0x3f, (byte) 0x62, (byte) 0x61, (byte) 0x73, (byte) 0x65, 
+      (byte) 0x3f, (byte) 0x6f, (byte) 0x62, (byte) 0x6a, (byte) 0x65, (byte) 0x63, (byte) 0x74, (byte) 0x63, 
+      (byte) 0x6c, (byte) 0x61, (byte) 0x73, (byte) 0x73, (byte) 0x3d, (byte) 0x65, (byte) 0x69, (byte) 0x64, 
+      (byte) 0x43, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x63, 
+      (byte) 0x61, (byte) 0x74, (byte) 0x69, (byte) 0x6f, (byte) 0x6e, (byte) 0x41, (byte) 0x75, (byte) 0x74, 
+      (byte) 0x68, (byte) 0x6f, (byte) 0x72, (byte) 0x69, (byte) 0x74, (byte) 0x79, (byte) 0x30, (byte) 0x11, 
+      (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x0e, (byte) 0x04, (byte) 0x0a, (byte) 0x04, 
+      (byte) 0x08, (byte) 0x46, (byte) 0x08, (byte) 0xda, (byte) 0x9e, (byte) 0x68, (byte) 0xf8, (byte) 0xe5, 
+      (byte) 0x81, (byte) 0x30, (byte) 0x0e, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x0f, 
+      (byte) 0x01, (byte) 0x01, (byte) 0xff, (byte) 0x04, (byte) 0x04, (byte) 0x03, (byte) 0x02, (byte) 0x06, 
+      (byte) 0xc0, (byte) 0x30, (byte) 0x25, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x11, 
+      (byte) 0x04, (byte) 0x1e, (byte) 0x30, (byte) 0x1c, (byte) 0x81, (byte) 0x1a, (byte) 0x74, (byte) 0x68, 
+      (byte) 0x6f, (byte) 0x6d, (byte) 0x61, (byte) 0x73, (byte) 0x2e, (byte) 0x72, (byte) 0x6f, (byte) 0x65, 
+      (byte) 0x73, (byte) 0x73, (byte) 0x6c, (byte) 0x65, (byte) 0x72, (byte) 0x40, (byte) 0x65, (byte) 0x67, 
+      (byte) 0x69, (byte) 0x7a, (byte) 0x2e, (byte) 0x67, (byte) 0x76, (byte) 0x2e, (byte) 0x61, (byte) 0x74, 
+      (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x13, (byte) 0x04, 
+      (byte) 0x02, (byte) 0x30, (byte) 0x00, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, 
+      (byte) 0x86, (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, 
+      (byte) 0x05, (byte) 0x00, (byte) 0x03, (byte) 0x82, (byte) 0x01, (byte) 0x01, (byte) 0x00, (byte) 0xd8, 
+      (byte) 0xec, (byte) 0xe5, (byte) 0x5c, (byte) 0x17, (byte) 0x42, (byte) 0xe8, (byte) 0x2f, (byte) 0x04, 
+      (byte) 0x1f, (byte) 0xe2, (byte) 0x04, (byte) 0x57, (byte) 0x07, (byte) 0x30, (byte) 0xdc, (byte) 0x4f, 
+      (byte) 0x61, (byte) 0x7d, (byte) 0xd8, (byte) 0x89, (byte) 0x36, (byte) 0x31, (byte) 0x26, (byte) 0x45, 
+      (byte) 0x55, (byte) 0x64, (byte) 0xd3, (byte) 0x55, (byte) 0x1b, (byte) 0x83, (byte) 0x51, (byte) 0xa0, 
+      (byte) 0x39, (byte) 0x1b, (byte) 0x6a, (byte) 0x7e, (byte) 0xfa, (byte) 0x7e, (byte) 0x2c, (byte) 0xd0, 
+      (byte) 0xd3, (byte) 0x86, (byte) 0x7b, (byte) 0x8d, (byte) 0x29, (byte) 0x8f, (byte) 0xa3, (byte) 0x83, 
+      (byte) 0xd2, (byte) 0x72, (byte) 0xce, (byte) 0x43, (byte) 0xcf, (byte) 0xc1, (byte) 0x27, (byte) 0xf1, 
+      (byte) 0x4d, (byte) 0x11, (byte) 0xe2, (byte) 0x67, (byte) 0xbe, (byte) 0x6e, (byte) 0x34, (byte) 0x7d, 
+      (byte) 0x04, (byte) 0x1f, (byte) 0xba, (byte) 0x55, (byte) 0x34, (byte) 0xea, (byte) 0xc2, (byte) 0xcf, 
+      (byte) 0x0f, (byte) 0x64, (byte) 0x7b, (byte) 0x84, (byte) 0xe0, (byte) 0x55, (byte) 0x05, (byte) 0x82, 
+      (byte) 0xdd, (byte) 0x9d, (byte) 0xd7, (byte) 0xeb, (byte) 0x91, (byte) 0x78, (byte) 0x69, (byte) 0x49, 
+      (byte) 0x58, (byte) 0x70, (byte) 0xff, (byte) 0x83, (byte) 0x70, (byte) 0xa0, (byte) 0xb3, (byte) 0xb7, 
+      (byte) 0x3d, (byte) 0x0f, (byte) 0x8e, (byte) 0xe9, (byte) 0x1b, (byte) 0x21, (byte) 0xef, (byte) 0x31, 
+      (byte) 0x0b, (byte) 0xe3, (byte) 0xac, (byte) 0xc6, (byte) 0x0f, (byte) 0x57, (byte) 0x4f, (byte) 0xd8, 
+      (byte) 0xd6, (byte) 0xb2, (byte) 0xd0, (byte) 0xca, (byte) 0xd9, (byte) 0x6f, (byte) 0x3f, (byte) 0x6e, 
+      (byte) 0x83, (byte) 0x8c, (byte) 0xff, (byte) 0x47, (byte) 0xca, (byte) 0xbc, (byte) 0x81, (byte) 0x60, 
+      (byte) 0x5f, (byte) 0xe2, (byte) 0xdd, (byte) 0xbd, (byte) 0x89, (byte) 0xb2, (byte) 0x52, (byte) 0xac, 
+      (byte) 0xc3, (byte) 0x8b, (byte) 0x44, (byte) 0x99, (byte) 0x70, (byte) 0xe7, (byte) 0x2c, (byte) 0x52, 
+      (byte) 0x21, (byte) 0xaa, (byte) 0xa2, (byte) 0x0f, (byte) 0x38, (byte) 0xc6, (byte) 0x98, (byte) 0x4d, 
+      (byte) 0x48, (byte) 0xda, (byte) 0x65, (byte) 0x41, (byte) 0xa4, (byte) 0xad, (byte) 0x41, (byte) 0x7c, 
+      (byte) 0x99, (byte) 0x14, (byte) 0xe5, (byte) 0xcb, (byte) 0x51, (byte) 0xd7, (byte) 0xab, (byte) 0x76, 
+      (byte) 0xb1, (byte) 0x20, (byte) 0xce, (byte) 0x32, (byte) 0x1b, (byte) 0x11, (byte) 0x5c, (byte) 0xef, 
+      (byte) 0x8b, (byte) 0x4f, (byte) 0xf3, (byte) 0x46, (byte) 0x5b, (byte) 0x11, (byte) 0xd7, (byte) 0x91, 
+      (byte) 0xb6, (byte) 0x41, (byte) 0xd3, (byte) 0x23, (byte) 0xb6, (byte) 0x03, (byte) 0xa8, (byte) 0x98, 
+      (byte) 0x40, (byte) 0x76, (byte) 0x13, (byte) 0x5d, (byte) 0x4c, (byte) 0xb2, (byte) 0xe9, (byte) 0xfe, 
+      (byte) 0x90, (byte) 0x27, (byte) 0x04, (byte) 0xfc, (byte) 0x10, (byte) 0x45, (byte) 0x8b, (byte) 0x10, 
+      (byte) 0xc3, (byte) 0xb2, (byte) 0x4b, (byte) 0x3c, (byte) 0xd2, (byte) 0x5b, (byte) 0x0f, (byte) 0xe8, 
+      (byte) 0xfb, (byte) 0xb9, (byte) 0x45, (byte) 0xaf, (byte) 0x05, (byte) 0xc4, (byte) 0xba, (byte) 0xc7, 
+      (byte) 0xfc, (byte) 0xa5, (byte) 0x7d, (byte) 0xdb, (byte) 0x4f, (byte) 0xa9, (byte) 0x76, (byte) 0xe2, 
+      (byte) 0xfa, (byte) 0xc7, (byte) 0xe0, (byte) 0xad, (byte) 0x70, (byte) 0xaa, (byte) 0x40, (byte) 0x15, 
+      (byte) 0x64, (byte) 0x01, (byte) 0xba, (byte) 0xc6, (byte) 0xc3, (byte) 0x83, (byte) 0x65, (byte) 0x95, 
+      (byte) 0x3c, (byte) 0x05, (byte) 0x53, (byte) 0x88, (byte) 0xe7, (byte) 0x19, (byte) 0x98
+    };
+  
+  protected static final int KID_PIN_SIG = 0x81;
+
+  protected byte[] EF_C_CH_DS = new byte[2000];
+  
+  public ACOSApplSIG() {
+    // Files
+    System.arraycopy(C_CH_DS, 0, EF_C_CH_DS, 0, C_CH_DS.length);
+    putFile(new File(FID_EF_C_CH_DS, EF_C_CH_DS, FCI_EF_C_CH_DS));
+    
+    // PINs
+    try {
+      pins.put(KID_PIN_SIG, new PIN(Arrays.copyOf("123456".getBytes("ASCII"), 8), KID_PIN_SIG, 3));
+    } catch (UnsupportedEncodingException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  @Override
+  public byte[] getAID() {
+    return AID_SIG;
+  }
+
+  @Override
+  public byte[] getFID() {
+    return FID_SIG;
+  }
+
+  @Override
+  public byte[] getFCI() {
+    return FCI;
+  }
+
+  @Override
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel) {
+    
+    checkINS(command, 0x2A);
+  
+    if (command.getP1() == 0x90 && command.getP2() == 0x81) {
+      
+      // PUT HASH
+      hash = command.getData();
+      return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+      
+    } else if (command.getP1() == 0x9E && command.getP2() == 0x9A) {
+      
+      // COMPUTE DIGITAL SIGNATURE
+      if (securityEnv == null) {
+        // No security environment
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+      }
+      if (hash == null) {
+        // Command sequence not correct
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x03});
+      }
+      if (hash.length != 20) {
+        // Invalid hash length
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80});
+      }
+      if (pins.get(KID_PIN_SIG).state != PIN.STATE_PIN_VERIFIED) {
+        // Security Status not satisfied
+        return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+      }
+      
+      byte[] signature = new byte[48]; 
+      
+      // TODO replace by signature creation
+      Random random = new Random();
+      random.nextBytes(signature);
+      
+      byte[] response = new byte[signature.length + 2];
+      System.arraycopy(signature, 0, response, 0, signature.length);
+      response[signature.length] = (byte) 0x90;
+      response[signature.length + 1] = (byte) 0x00;
+      
+      hash = null;
+      pins.get(KID_PIN_SIG).state = PIN.STATE_RESET;
+      
+      return new ResponseAPDU(response);
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    }
+    
+  }
+  
+  public void clearCert() {
+    Arrays.fill(EF_C_CH_DS, (byte) 0x00);
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardChannelEmul.java
new file mode 100644
index 00000000..25923686
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardChannelEmul.java
@@ -0,0 +1,261 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import java.util.Arrays;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.AbstractAppl;
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public abstract class ACOSCardChannelEmul extends CardChannelEmul {
+
+  /**
+   * 
+   */
+  protected CardEmul cardEmul;
+
+  public ACOSCardChannelEmul(CardEmul cardEmul) {
+    this.cardEmul = cardEmul;
+  }
+
+  @Override
+  public Card getCard() {
+    return cardEmul;
+  }
+
+  protected ResponseAPDU cmdSELECT(CommandAPDU command) throws CardException {
+  
+    byte[] fid = command.getData();
+    
+    AbstractAppl appl = cardEmul.getApplication(fid);
+    if (appl != null) {
+      if (currentAppl != null && currentAppl != appl) {
+        currentAppl.leaveApplContext();
+        currentFile = null;
+      }
+      currentAppl = appl;
+
+      byte[] fci = currentAppl.getFCI();
+      byte[] response = new byte[fci.length + 2];
+      System.arraycopy(fci, 0, response, 0, fci.length);
+      response[fci.length] = (byte) 0x90;
+      response[fci.length + 1] = (byte) 0x00;
+      return new ResponseAPDU(response);
+    }
+    
+    if (command.getP1() == 0x00) {
+      // SELECT with FID
+      if (currentAppl instanceof AbstractAppl) {
+        
+        for (File file : ((AbstractAppl) currentAppl).getFiles()) {
+          
+          if (Arrays.equals(fid, file.fid)) {
+            currentFile = file;
+            byte[] response = new byte[file.fcx.length + 2];
+            System.arraycopy(file.fcx, 0, response, 0, file.fcx.length);
+            response[file.fcx.length] = (byte) 0x90;
+            response[file.fcx.length + 1] = (byte) 0x00;
+            return new ResponseAPDU(response);
+          }
+          
+        }
+        
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x82});
+        
+      } else {
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x82});
+      }
+    }
+    
+    // Not found
+    return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x82});
+    
+  }
+  
+  public abstract ResponseAPDU cmdREAD_BINARY(CommandAPDU command) throws CardException;
+
+
+  @Override
+  public ResponseAPDU transmit(CommandAPDU command) throws CardException {
+  
+    if (command.getCLA() == 0x00) {
+  
+      switch (command.getINS()) {
+  
+      // SELECT
+      case 0xA4:
+        return cmdSELECT(command);
+      
+      // READ BINARY
+      case 0xB0:
+        return cmdREAD_BINARY(command);
+      
+      // VERIFY
+      case 0x20:
+        if ((command.getP2() & 0x80) > 0) {
+          return cmdVERIFY(command);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81}); 
+        }
+      
+      // MANAGE SECURITY ENVIRONMENT
+      case 0x22: {
+        if (currentAppl != null) {
+          return currentAppl.cmdMANAGE_SECURITY_ENVIRONMENT(command, this);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05}); 
+        }
+      }
+      
+      // CHANGE REFERENCE DATA
+      case 0x24: {
+        return cmdCHANGE_REFERENCE_DATA(command);
+      }
+      
+      // PERFORM SECURITY OPERATION
+      case 0x2A: {
+        if (currentAppl != null) {
+          return currentAppl.cmdPERFORM_SECURITY_OPERATION(command, this);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+  
+      // INTERNAL AUTHENTICATE
+      case 0x88: {
+        if (currentAppl != null) {
+          return currentAppl.cmdINTERNAL_AUTHENTICATE(command, this);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+      
+      default:
+        return new ResponseAPDU(new byte[] { (byte) 0x6D, (byte) 0x00});
+      }
+  
+    } else {
+      return new ResponseAPDU(new byte[] { (byte) 0x6E, (byte) 0x00}); 
+    }
+  
+  }
+
+  protected ResponseAPDU verifyPin(int kid, byte[] reference) {
+    
+    PIN pin;
+    if (currentAppl != null) {
+      pin = currentAppl.pins.get(kid);
+    } else {
+      pin = null;
+    }
+    
+    if (pin != null) {
+  
+      if (reference.length != 8) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+      
+      if (Arrays.equals(reference, pin.pin)) {
+        switch (pin.state) {
+        case PIN.STATE_PIN_BLOCKED:
+          return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x83 });
+  
+        case PIN.STATE_RESET:
+          pin.state = PIN.STATE_PIN_VERIFIED;
+          
+        default:
+          pin.kfpc = 10;
+          return new ResponseAPDU(new byte[] { (byte) 0x90, (byte) 0x00 });
+        }
+      } else {
+        switch (pin.state) {
+        case PIN.STATE_PIN_BLOCKED:
+          return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x83 });
+        
+        default:
+          if (--pin.kfpc > 0) {
+            return new ResponseAPDU(new byte[] { (byte) 0x63, (byte) (pin.kfpc | 0xC0)});
+          } else {
+            pin.state = PIN.STATE_PIN_BLOCKED;
+            return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x83 });
+          }
+        }
+        
+      }
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    }
+    
+  }
+
+  public ResponseAPDU cmdVERIFY(CommandAPDU command) throws CardException {
+    
+    if (command.getINS() != 0x20) {
+      throw new IllegalArgumentException("INS has to be 0x20.");
+    }
+    
+    if (command.getP1() != 00) {
+      return new ResponseAPDU(new byte[] {(byte) 0x6B, (byte) 0x00});
+    }
+    
+    return verifyPin(command.getP2(), command.getData());
+  
+  }
+
+  public ResponseAPDU cmdCHANGE_REFERENCE_DATA(CommandAPDU command) {
+    
+    if (command.getINS() != 0x24) {
+      throw new IllegalArgumentException("INS has to be 0x24.");
+    }
+    
+    if (command.getP1() == 0x00) {
+      
+      byte[] data = command.getData();
+      if (data.length != 16) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+  
+      ResponseAPDU response = verifyPin(command.getP2(), Arrays.copyOf(data, 8));
+      if (response.getSW() == 0x9000) {
+        PIN pin;
+        if (currentAppl != null) {
+          pin = currentAppl.pins.get(command.getP2());
+        } else {
+          pin = null;
+        }
+        pin.pin = Arrays.copyOfRange(data, 8, 16);
+      }
+      
+      return response;
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+    
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardEmul.java
new file mode 100644
index 00000000..b9f70a5d
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardEmul.java
@@ -0,0 +1,38 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+
+import javax.smartcardio.ATR;
+
+import at.gv.egiz.smcc.CardEmul;
+
+@SuppressWarnings("restriction")
+public abstract class ACOSCardEmul extends CardEmul {
+
+  protected static ATR ATR = new ATR(new byte[] {
+        (byte) 0x3b, (byte) 0xbf, (byte) 0x11, (byte) 0x00, (byte) 0x81, (byte) 0x31, (byte) 0xfe, (byte) 0x45, 
+        (byte) 0x45, (byte) 0x50, (byte) 0x41, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0xf1
+  });
+  
+  @Override
+  public ATR getATR() {
+    return ATR;
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
new file mode 100644
index 00000000..90bb039e
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
@@ -0,0 +1,243 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+
+import org.junit.Test;
+
+import at.gv.egiz.smcc.ACOSCard;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.CardNotSupportedException;
+import at.gv.egiz.smcc.CardTest;
+import at.gv.egiz.smcc.LockedException;
+import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.SignatureCard.KeyboxName;
+
+public abstract class ACOSCardTest extends CardTest {
+
+  public ACOSCardTest() {
+    super();
+  }
+
+  protected abstract int getVersion();
+
+  @Test
+  public void testGetInfoboxIdentityLinkEmpty() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    char[] pin = "0000".toCharArray();
+    
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    appl.clearInfobox();
+
+    byte[] idlink = signatureCard.getInfobox("IdentityLink",
+        new TestPINProvider(pin), null);
+    assertNull(idlink);
+
+  }
+  
+  @Test(expected = SignatureCardException.class)
+  public void testGetInfoboxIdentityInvalid() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    char[] pin = "0000".toCharArray();
+    
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    appl.setInfoboxHeader((byte) 0xFF);
+
+    signatureCard.getInfobox("IdentityLink", new TestPINProvider(pin), null);
+
+  }
+
+  @Test
+  public void testGetCerts() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    SignatureCard signatureCard = createSignatureCard();
+
+    byte[] cert;
+
+    cert = signatureCard.getCertificate(KeyboxName.SECURE_SIGNATURE_KEYPAIR);
+    assertNotNull(cert);
+    assertTrue(Arrays.equals(cert, A04ApplSIG.C_CH_DS));
+
+    cert = signatureCard.getCertificate(KeyboxName.CERITIFIED_KEYPAIR);
+    assertNotNull(cert);
+    assertTrue(Arrays.equals(cert, A04ApplDEC.C_CH_EKEY));
+
+  }
+
+  @Test(expected = NotActivatedException.class)
+  public void testGetSIGCertEmpty() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplSIG appl = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
+    appl.clearCert();
+
+    signatureCard.getCertificate(KeyboxName.SECURE_SIGNATURE_KEYPAIR);
+
+  }
+
+  @Test(expected = NotActivatedException.class)
+  public void testGetDECCertEmpty() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    appl.clearCert();
+
+    signatureCard.getCertificate(KeyboxName.CERITIFIED_KEYPAIR);
+
+  }
+
+  @Test
+  public void testSignSIG() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    char[] pin = "123456".toCharArray();
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplSIG appl = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
+    appl.setPin(ACOSApplSIG.KID_PIN_SIG, pin);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    byte[] signature = signatureCard.createSignature(hash,
+        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin));
+
+    assertNotNull(signature);
+
+  }
+
+  @Test
+  public void testSignDEC() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    char[] pin = "1234".toCharArray();
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    appl.setPin(ACOSApplDEC.KID_PIN_DEC, pin);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    byte[] signature = signatureCard.createSignature(hash,
+        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin));
+
+    assertNotNull(signature);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignSIGInvalidPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignDECInvalidPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignSIGBlockedPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplSIG appl = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
+    appl.setPin(ACOSApplSIG.KID_PIN_SIG, null);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignDECBlockedPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
+    appl.setPin(ACOSApplDEC.KID_PIN_DEC, null);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider);
+
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTestSuite.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTestSuite.java
new file mode 100644
index 00000000..101f7edc
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTestSuite.java
@@ -0,0 +1,27 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.acos;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+import org.junit.runners.Suite.SuiteClasses;
+
+@RunWith(Suite.class)
+@SuiteClasses( { A03CardTest.class, A04CardTest.class })
+public class ACOSCardTestSuite {
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java
new file mode 100644
index 00000000..2ca63eea
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java
@@ -0,0 +1,95 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import java.io.UnsupportedEncodingException;
+import java.math.BigInteger;
+import java.util.Arrays;
+import java.util.Iterator;
+
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.AbstractAppl;
+import at.gv.egiz.smcc.CardAppl;
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public abstract class STARCOSAppl extends AbstractAppl implements CardAppl {
+
+  public static byte[] AID_SichereSignatur = new byte[] { (byte) 0xD0, (byte) 0x40,
+        (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01 };
+  
+  public static byte[] FID_SichereSignatur = new byte[] { (byte) 0x3F, (byte) 0x04 };
+  
+  public static byte[] AID_Infobox = new byte[] { (byte) 0xD0, (byte) 0x40,
+    (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x18, (byte) 0x01 };
+
+  public static byte[] FID_Infobox = new byte[] { (byte) 0x3F, (byte) 0x06 };
+
+  public static byte[] AID_GewoehnlicheSignatur = new byte[] { (byte) 0xD0, (byte) 0x40,
+    (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x13, (byte) 0x01 };
+
+  public static byte[] FID_GewoehnlicheSignatur = new byte[] { (byte) 0x3F, (byte) 0x05 };
+  
+  protected STARCOSCardChannelEmul channel;
+  
+  protected byte[] securityEnv;
+
+  protected byte[] hash;
+
+  public STARCOSAppl(STARCOSCardChannelEmul channel) {
+    this.channel = channel;
+  }
+
+  @Override
+  public ResponseAPDU cmdINTERNAL_AUTHENTICATE(CommandAPDU command, CardChannelEmul channel) {
+    return new ResponseAPDU(new byte[] {(byte) 0x6D, (byte) 0x00});
+  }
+
+  @Override
+  public void leaveApplContext() {
+    Iterator<PIN> pin = pins.values().iterator();
+    while (pin.hasNext()) {
+      pin.next().state = PIN.STATE_RESET;
+    }
+  }
+  
+  public void setPin(int kid, char[] value) {
+    PIN pin = pins.get(kid);
+    if (pin != null) {
+      if (value == null) {
+        pin.pin = null;
+      } else {
+        byte[] b = new byte[8];
+        b[0] = (byte) (0x20 | value.length);
+        for(int i = 1, j = 0; i < b.length; i++) {
+          int h = ((j < value.length) 
+                  ? Character.digit(value[j++], 10) 
+                  : 0x0F);
+          int l = ((j < value.length) 
+                  ? Character.digit(value[j++], 10) 
+                  : 0x0F);
+          b[i] = (byte) ((h << 4) | l);
+        }
+        pin.pin = b;
+      }
+    }
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java
new file mode 100644
index 00000000..cec305da
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java
@@ -0,0 +1,332 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+import java.util.Random;
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public class STARCOSApplGewoehnlicheSignatur extends STARCOSAppl {
+
+  private static byte[] FCI = new byte[] { (byte) 0x6f, (byte) 0x14,
+      (byte) 0x84, (byte) 0x08, (byte) 0xd0, (byte) 0x40, (byte) 0x00,
+      (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x13, (byte) 0x01,
+      (byte) 0xa5, (byte) 0x08, (byte) 0x53, (byte) 0x02, (byte) 0x01,
+      (byte) 0x10, (byte) 0x54, (byte) 0x02, (byte) 0x01, (byte) 0x00 };
+  
+  protected static byte[] FID_EF_C_X509_CH_AUT = new byte[] { (byte) 0x2f,
+      (byte) 0x01 };
+  
+  protected static byte[] FCI_EF_C_X509_CH_AUT = new byte[] { (byte) 0x62,
+      (byte) 0x16, (byte) 0x80, (byte) 0x02, (byte) 0x04, (byte) 0x9c,
+      (byte) 0x82, (byte) 0x01, (byte) 0x01, (byte) 0x83, (byte) 0x02,
+      (byte) 0x2f, (byte) 0x01, (byte) 0x88, (byte) 0x01, (byte) 0x08,
+      (byte) 0x8a, (byte) 0x01, (byte) 0x05, (byte) 0xa1, (byte) 0x03,
+      (byte) 0x8b, (byte) 0x01, (byte) 0x08 };
+  
+  protected static byte[] C_X509_CH_AUT = new byte[] {
+    (byte) 0x30, (byte) 0x82, (byte) 0x04, (byte) 0x98, (byte) 0x30, (byte) 0x82, (byte) 0x03, (byte) 0x80, 
+    (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x02, (byte) 0x02, (byte) 0x03, (byte) 0x02, 
+    (byte) 0x06, (byte) 0x5f, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, 
+    (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+    (byte) 0x00, (byte) 0x30, (byte) 0x81, (byte) 0x95, (byte) 0x31, (byte) 0x0b, (byte) 0x30, (byte) 0x09, 
+    (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, (byte) 0x13, (byte) 0x02, (byte) 0x41, 
+    (byte) 0x54, (byte) 0x31, (byte) 0x48, (byte) 0x30, (byte) 0x46, (byte) 0x06, (byte) 0x03, (byte) 0x55, 
+    (byte) 0x04, (byte) 0x0a, (byte) 0x0c, (byte) 0x3f, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x20, (byte) 0x47, (byte) 0x65, (byte) 0x73, (byte) 0x2e, 
+    (byte) 0x20, (byte) 0x66, (byte) 0x2e, (byte) 0x20, (byte) 0x53, (byte) 0x69, (byte) 0x63, (byte) 0x68, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x68, (byte) 0x65, (byte) 0x69, (byte) 0x74, (byte) 0x73, (byte) 0x73, 
+    (byte) 0x79, (byte) 0x73, (byte) 0x74, (byte) 0x65, (byte) 0x6d, (byte) 0x65, (byte) 0x20, (byte) 0x69, 
+    (byte) 0x6d, (byte) 0x20, (byte) 0x65, (byte) 0x6c, (byte) 0x65, (byte) 0x6b, (byte) 0x74, (byte) 0x72, 
+    (byte) 0x2e, (byte) 0x20, (byte) 0x44, (byte) 0x61, (byte) 0x74, (byte) 0x65, (byte) 0x6e, (byte) 0x76, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x6b, (byte) 0x65, (byte) 0x68, (byte) 0x72, (byte) 0x20, (byte) 0x47, 
+    (byte) 0x6d, (byte) 0x62, (byte) 0x48, (byte) 0x31, (byte) 0x1d, (byte) 0x30, (byte) 0x1b, (byte) 0x06, 
+    (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x0b, (byte) 0x0c, (byte) 0x14, (byte) 0x61, (byte) 0x2d, 
+    (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x74, (byte) 0x6f, (byte) 0x6b, 
+    (byte) 0x65, (byte) 0x6e, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, 
+    (byte) 0x30, (byte) 0x33, (byte) 0x31, (byte) 0x1d, (byte) 0x30, (byte) 0x1b, (byte) 0x06, (byte) 0x03, 
+    (byte) 0x55, (byte) 0x04, (byte) 0x03, (byte) 0x0c, (byte) 0x14, (byte) 0x61, (byte) 0x2d, (byte) 0x73, 
+    (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x74, (byte) 0x6f, (byte) 0x6b, (byte) 0x65, 
+    (byte) 0x6e, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x30, 
+    (byte) 0x33, (byte) 0x30, (byte) 0x1e, (byte) 0x17, (byte) 0x0d, (byte) 0x30, (byte) 0x39, (byte) 0x30, 
+    (byte) 0x33, (byte) 0x30, (byte) 0x36, (byte) 0x31, (byte) 0x35, (byte) 0x32, (byte) 0x32, (byte) 0x33, 
+    (byte) 0x38, (byte) 0x5a, (byte) 0x17, (byte) 0x0d, (byte) 0x31, (byte) 0x32, (byte) 0x30, (byte) 0x33, 
+    (byte) 0x30, (byte) 0x36, (byte) 0x31, (byte) 0x35, (byte) 0x32, (byte) 0x32, (byte) 0x33, (byte) 0x38, 
+    (byte) 0x5a, (byte) 0x30, (byte) 0x72, (byte) 0x31, (byte) 0x0b, (byte) 0x30, (byte) 0x09, (byte) 0x06, 
+    (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, (byte) 0x13, (byte) 0x02, (byte) 0x41, (byte) 0x54, 
+    (byte) 0x31, (byte) 0x20, (byte) 0x30, (byte) 0x1e, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, 
+    (byte) 0x03, (byte) 0x0c, (byte) 0x17, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0xc5, (byte) 0x90, 
+    (byte) 0x7a, (byte) 0x67, (byte) 0xc3, (byte) 0xbc, (byte) 0x72, (byte) 0x20, (byte) 0x58, (byte) 0x58, 
+    (byte) 0x58, (byte) 0x54, (byte) 0xc3, (byte) 0xbc, (byte) 0x7a, (byte) 0x65, (byte) 0x6b, (byte) 0xc3, 
+    (byte) 0xa7, (byte) 0x69, (byte) 0x31, (byte) 0x15, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, 
+    (byte) 0x55, (byte) 0x04, (byte) 0x04, (byte) 0x0c, (byte) 0x0c, (byte) 0x58, (byte) 0x58, (byte) 0x58, 
+    (byte) 0x54, (byte) 0xc3, (byte) 0xbc, (byte) 0x7a, (byte) 0x65, (byte) 0x6b, (byte) 0xc3, (byte) 0xa7, 
+    (byte) 0x69, (byte) 0x31, (byte) 0x13, (byte) 0x30, (byte) 0x11, (byte) 0x06, (byte) 0x03, (byte) 0x55, 
+    (byte) 0x04, (byte) 0x2a, (byte) 0x0c, (byte) 0x0a, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0xc5, 
+    (byte) 0x90, (byte) 0x7a, (byte) 0x67, (byte) 0xc3, (byte) 0xbc, (byte) 0x72, (byte) 0x31, (byte) 0x15, 
+    (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x05, (byte) 0x13, 
+    (byte) 0x0c, (byte) 0x37, (byte) 0x30, (byte) 0x34, (byte) 0x38, (byte) 0x37, (byte) 0x31, (byte) 0x30, 
+    (byte) 0x35, (byte) 0x30, (byte) 0x30, (byte) 0x30, (byte) 0x38, (byte) 0x30, (byte) 0x49, (byte) 0x30, 
+    (byte) 0x13, (byte) 0x06, (byte) 0x07, (byte) 0x2a, (byte) 0x86, (byte) 0x48, (byte) 0xce, (byte) 0x3d, 
+    (byte) 0x02, (byte) 0x01, (byte) 0x06, (byte) 0x08, (byte) 0x2a, (byte) 0x86, (byte) 0x48, (byte) 0xce, 
+    (byte) 0x3d, (byte) 0x03, (byte) 0x01, (byte) 0x01, (byte) 0x03, (byte) 0x32, (byte) 0x00, (byte) 0x04, 
+    (byte) 0x02, (byte) 0x55, (byte) 0x51, (byte) 0xf9, (byte) 0x2a, (byte) 0xea, (byte) 0x6f, (byte) 0xd3, 
+    (byte) 0xf5, (byte) 0xda, (byte) 0xa9, (byte) 0x7a, (byte) 0x22, (byte) 0xfc, (byte) 0xb4, (byte) 0x38, 
+    (byte) 0xe9, (byte) 0x5c, (byte) 0xdc, (byte) 0x6b, (byte) 0x86, (byte) 0xa6, (byte) 0x77, (byte) 0xa7, 
+    (byte) 0x90, (byte) 0xf3, (byte) 0x36, (byte) 0xe0, (byte) 0xc4, (byte) 0xde, (byte) 0x72, (byte) 0xf2, 
+    (byte) 0x1a, (byte) 0x07, (byte) 0xfa, (byte) 0xd0, (byte) 0xc8, (byte) 0x1c, (byte) 0xa0, (byte) 0xc8, 
+    (byte) 0x8b, (byte) 0x5d, (byte) 0xde, (byte) 0x9e, (byte) 0xf8, (byte) 0x3b, (byte) 0x7c, (byte) 0x8c, 
+    (byte) 0xa3, (byte) 0x82, (byte) 0x01, (byte) 0xec, (byte) 0x30, (byte) 0x82, (byte) 0x01, (byte) 0xe8, 
+    (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x23, (byte) 0x04, 
+    (byte) 0x0c, (byte) 0x30, (byte) 0x0a, (byte) 0x80, (byte) 0x08, (byte) 0x47, (byte) 0x7e, (byte) 0x5b, 
+    (byte) 0xdb, (byte) 0x37, (byte) 0x33, (byte) 0xb1, (byte) 0xfa, (byte) 0x30, (byte) 0x7e, (byte) 0x06, 
+    (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x01, 
+    (byte) 0x01, (byte) 0x04, (byte) 0x72, (byte) 0x30, (byte) 0x70, (byte) 0x30, (byte) 0x2c, (byte) 0x06, 
+    (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x30, 
+    (byte) 0x01, (byte) 0x86, (byte) 0x20, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, 
+    (byte) 0x2f, (byte) 0x2f, (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x70, (byte) 0x2d, (byte) 0x74, 
+    (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x6f, 
+    (byte) 0x63, (byte) 0x73, (byte) 0x70, (byte) 0x30, (byte) 0x40, (byte) 0x06, (byte) 0x08, (byte) 0x2b, 
+    (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x30, (byte) 0x02, (byte) 0x86, 
+    (byte) 0x34, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, 
+    (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x63, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x73, (byte) 0x2f, (byte) 0x61, (byte) 0x2d, (byte) 0x73, 
+    (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x74, (byte) 0x6f, (byte) 0x6b, (byte) 0x65, 
+    (byte) 0x6e, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x30, 
+    (byte) 0x33, (byte) 0x2e, (byte) 0x63, (byte) 0x72, (byte) 0x74, (byte) 0x30, (byte) 0x81, (byte) 0x86, 
+    (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x20, (byte) 0x04, (byte) 0x7f, (byte) 0x30, 
+    (byte) 0x7d, (byte) 0x30, (byte) 0x7b, (byte) 0x06, (byte) 0x06, (byte) 0x2a, (byte) 0x28, (byte) 0x00, 
+    (byte) 0x11, (byte) 0x01, (byte) 0x03, (byte) 0x30, (byte) 0x71, (byte) 0x30, (byte) 0x35, (byte) 0x06, 
+    (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x02, 
+    (byte) 0x01, (byte) 0x16, (byte) 0x29, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, 
+    (byte) 0x2f, (byte) 0x2f, (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, 
+    (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, 
+    (byte) 0x2f, (byte) 0x64, (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x2f, (byte) 0x63, (byte) 0x70, 
+    (byte) 0x2f, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, 
+    (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x30, (byte) 0x38, (byte) 0x06, (byte) 0x08, 
+    (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x02, (byte) 0x02, 
+    (byte) 0x30, (byte) 0x2c, (byte) 0x1a, (byte) 0x2a, (byte) 0x44, (byte) 0x69, (byte) 0x65, (byte) 0x73, 
+    (byte) 0x65, (byte) 0x73, (byte) 0x20, (byte) 0x5a, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, 
+    (byte) 0x66, (byte) 0x69, (byte) 0x6b, (byte) 0x61, (byte) 0x74, (byte) 0x20, (byte) 0x64, (byte) 0x69, 
+    (byte) 0x65, (byte) 0x6e, (byte) 0x74, (byte) 0x20, (byte) 0x6e, (byte) 0x75, (byte) 0x72, (byte) 0x20, 
+    (byte) 0x7a, (byte) 0x75, (byte) 0x20, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x7a, 
+    (byte) 0x77, (byte) 0x65, (byte) 0x63, (byte) 0x6b, (byte) 0x65, (byte) 0x6e, (byte) 0x30, (byte) 0x81, 
+    (byte) 0x99, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x1f, (byte) 0x04, (byte) 0x81, 
+    (byte) 0x91, (byte) 0x30, (byte) 0x81, (byte) 0x8e, (byte) 0x30, (byte) 0x81, (byte) 0x8b, (byte) 0xa0, 
+    (byte) 0x81, (byte) 0x88, (byte) 0xa0, (byte) 0x81, (byte) 0x85, (byte) 0x86, (byte) 0x81, (byte) 0x82, 
+    (byte) 0x6c, (byte) 0x64, (byte) 0x61, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x6c, 
+    (byte) 0x64, (byte) 0x61, (byte) 0x70, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, 
+    (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, 
+    (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x6f, (byte) 0x75, (byte) 0x3d, (byte) 0x61, 
+    (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x74, (byte) 0x6f, 
+    (byte) 0x6b, (byte) 0x65, (byte) 0x6e, (byte) 0x2d, (byte) 0x30, (byte) 0x33, (byte) 0x2c, (byte) 0x6f, 
+    (byte) 0x3d, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, 
+    (byte) 0x2c, (byte) 0x63, (byte) 0x3d, (byte) 0x41, (byte) 0x54, (byte) 0x3f, (byte) 0x63, (byte) 0x65, 
+    (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x63, (byte) 0x61, (byte) 0x74, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x65, (byte) 0x76, (byte) 0x6f, (byte) 0x63, (byte) 0x61, (byte) 0x74, 
+    (byte) 0x69, (byte) 0x6f, (byte) 0x6e, (byte) 0x6c, (byte) 0x69, (byte) 0x73, (byte) 0x74, (byte) 0x3f, 
+    (byte) 0x62, (byte) 0x61, (byte) 0x73, (byte) 0x65, (byte) 0x3f, (byte) 0x6f, (byte) 0x62, (byte) 0x6a, 
+    (byte) 0x65, (byte) 0x63, (byte) 0x74, (byte) 0x63, (byte) 0x6c, (byte) 0x61, (byte) 0x73, (byte) 0x73, 
+    (byte) 0x3d, (byte) 0x65, (byte) 0x69, (byte) 0x64, (byte) 0x43, (byte) 0x65, (byte) 0x72, (byte) 0x74, 
+    (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x63, (byte) 0x61, (byte) 0x74, (byte) 0x69, (byte) 0x6f, 
+    (byte) 0x6e, (byte) 0x41, (byte) 0x75, (byte) 0x74, (byte) 0x68, (byte) 0x6f, (byte) 0x72, (byte) 0x69, 
+    (byte) 0x74, (byte) 0x79, (byte) 0x30, (byte) 0x11, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, 
+    (byte) 0x0e, (byte) 0x04, (byte) 0x0a, (byte) 0x04, (byte) 0x08, (byte) 0x4a, (byte) 0x43, (byte) 0x51, 
+    (byte) 0x30, (byte) 0x45, (byte) 0xfc, (byte) 0x2a, (byte) 0x00, (byte) 0x30, (byte) 0x0e, (byte) 0x06, 
+    (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x0f, (byte) 0x01, (byte) 0x01, (byte) 0xff, (byte) 0x04, 
+    (byte) 0x04, (byte) 0x03, (byte) 0x02, (byte) 0x04, (byte) 0xb0, (byte) 0x30, (byte) 0x09, (byte) 0x06, 
+    (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x13, (byte) 0x04, (byte) 0x02, (byte) 0x30, (byte) 0x00, 
+    (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, (byte) 0x48, (byte) 0x86, 
+    (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x00, (byte) 0x03, 
+    (byte) 0x82, (byte) 0x01, (byte) 0x01, (byte) 0x00, (byte) 0x31, (byte) 0xdc, (byte) 0xf3, (byte) 0x43, 
+    (byte) 0x79, (byte) 0xdd, (byte) 0xa9, (byte) 0x2a, (byte) 0xdc, (byte) 0x21, (byte) 0xf9, (byte) 0xd9, 
+    (byte) 0x8f, (byte) 0x9a, (byte) 0x4e, (byte) 0x01, (byte) 0x40, (byte) 0x9a, (byte) 0xf1, (byte) 0x14, 
+    (byte) 0x8d, (byte) 0x3a, (byte) 0x5e, (byte) 0x88, (byte) 0x36, (byte) 0x45, (byte) 0x1f, (byte) 0x16, 
+    (byte) 0x3e, (byte) 0xeb, (byte) 0xa2, (byte) 0xef, (byte) 0xbf, (byte) 0x55, (byte) 0xbd, (byte) 0x5e, 
+    (byte) 0x0e, (byte) 0x19, (byte) 0xc7, (byte) 0x0c, (byte) 0xbd, (byte) 0xed, (byte) 0xdf, (byte) 0xb8, 
+    (byte) 0x75, (byte) 0x4e, (byte) 0x6a, (byte) 0x3a, (byte) 0x9a, (byte) 0x10, (byte) 0xfa, (byte) 0x49, 
+    (byte) 0xc1, (byte) 0xd2, (byte) 0x35, (byte) 0xc5, (byte) 0x9a, (byte) 0xd7, (byte) 0xf4, (byte) 0xf0, 
+    (byte) 0xcd, (byte) 0x13, (byte) 0xd1, (byte) 0x24, (byte) 0x06, (byte) 0xf8, (byte) 0x1f, (byte) 0xea, 
+    (byte) 0xd6, (byte) 0x7a, (byte) 0xcb, (byte) 0x4f, (byte) 0xb5, (byte) 0x3e, (byte) 0x6c, (byte) 0xb2, 
+    (byte) 0xfc, (byte) 0xe3, (byte) 0xaa, (byte) 0x2b, (byte) 0x20, (byte) 0x91, (byte) 0xf5, (byte) 0x5b, 
+    (byte) 0xf1, (byte) 0x94, (byte) 0x0e, (byte) 0x06, (byte) 0x0a, (byte) 0xfd, (byte) 0x25, (byte) 0x71, 
+    (byte) 0x11, (byte) 0xfc, (byte) 0x84, (byte) 0x46, (byte) 0xef, (byte) 0x5b, (byte) 0x0b, (byte) 0xa4, 
+    (byte) 0x4a, (byte) 0x5d, (byte) 0x42, (byte) 0x99, (byte) 0xc8, (byte) 0x4e, (byte) 0x51, (byte) 0xd8, 
+    (byte) 0x63, (byte) 0xd1, (byte) 0xbd, (byte) 0x00, (byte) 0xa3, (byte) 0xdd, (byte) 0x8f, (byte) 0x12, 
+    (byte) 0x42, (byte) 0xbe, (byte) 0xca, (byte) 0x15, (byte) 0x37, (byte) 0x4c, (byte) 0xd2, (byte) 0xc9, 
+    (byte) 0xa7, (byte) 0x37, (byte) 0xb2, (byte) 0x76, (byte) 0xb7, (byte) 0x34, (byte) 0x92, (byte) 0x98, 
+    (byte) 0x60, (byte) 0xe7, (byte) 0x3d, (byte) 0x55, (byte) 0xa2, (byte) 0x6c, (byte) 0xb6, (byte) 0x66, 
+    (byte) 0x67, (byte) 0xe1, (byte) 0xe4, (byte) 0x8f, (byte) 0xe3, (byte) 0xa5, (byte) 0xb8, (byte) 0xb5, 
+    (byte) 0xc8, (byte) 0x8f, (byte) 0x9e, (byte) 0xe3, (byte) 0xf1, (byte) 0xaa, (byte) 0x8e, (byte) 0xe6, 
+    (byte) 0xe2, (byte) 0x47, (byte) 0x49, (byte) 0x3d, (byte) 0xbe, (byte) 0x8c, (byte) 0xdd, (byte) 0xce, 
+    (byte) 0x8d, (byte) 0x52, (byte) 0xac, (byte) 0xb9, (byte) 0x83, (byte) 0xe9, (byte) 0x9d, (byte) 0x98, 
+    (byte) 0x7b, (byte) 0xda, (byte) 0x2b, (byte) 0xbc, (byte) 0x83, (byte) 0xcb, (byte) 0x74, (byte) 0x64, 
+    (byte) 0x17, (byte) 0x4c, (byte) 0x33, (byte) 0xbb, (byte) 0x88, (byte) 0xc2, (byte) 0xdd, (byte) 0x08, 
+    (byte) 0x69, (byte) 0xd8, (byte) 0xa2, (byte) 0xac, (byte) 0x95, (byte) 0x71, (byte) 0xd3, (byte) 0xf8, 
+    (byte) 0xc9, (byte) 0xd1, (byte) 0xd6, (byte) 0x0e, (byte) 0xc3, (byte) 0x67, (byte) 0xa1, (byte) 0xdb, 
+    (byte) 0xca, (byte) 0x58, (byte) 0xaa, (byte) 0x4b, (byte) 0xec, (byte) 0x37, (byte) 0x46, (byte) 0x73, 
+    (byte) 0xc3, (byte) 0xa3, (byte) 0x7b, (byte) 0x1e, (byte) 0xdd, (byte) 0xf9, (byte) 0xb3, (byte) 0xbb, 
+    (byte) 0xe0, (byte) 0x16, (byte) 0x39, (byte) 0xaf, (byte) 0xa0, (byte) 0x19, (byte) 0x9e, (byte) 0x89, 
+    (byte) 0x37, (byte) 0x1e, (byte) 0x6e, (byte) 0x41, (byte) 0x59, (byte) 0xe1, (byte) 0x86, (byte) 0xea, 
+    (byte) 0x0b, (byte) 0x39, (byte) 0x03, (byte) 0x89, (byte) 0xd2, (byte) 0xba, (byte) 0xd5, (byte) 0x0c, 
+    (byte) 0x84, (byte) 0x09, (byte) 0xdd, (byte) 0xc7, (byte) 0x00, (byte) 0x2c, (byte) 0x2e, (byte) 0x1a, 
+    (byte) 0x69, (byte) 0xeb, (byte) 0xdf, (byte) 0xb1
+  };
+  
+
+  protected byte[] EF_C_X509_CH_AUT = new byte[2000];
+  
+  public STARCOSApplGewoehnlicheSignatur(STARCOSCardChannelEmul channel) {
+    super(channel);
+    // Files
+    System.arraycopy(C_X509_CH_AUT, 0, EF_C_X509_CH_AUT, 0, C_X509_CH_AUT.length);
+    putFile(new File(FID_EF_C_X509_CH_AUT, EF_C_X509_CH_AUT, FCI_EF_C_X509_CH_AUT));
+  }
+
+  @Override
+  public byte[] getAID() {
+    return AID_GewoehnlicheSignatur;
+  }
+
+  @Override
+  public byte[] getFID() {
+    return FID_GewoehnlicheSignatur;
+  }
+
+  @Override
+  public byte[] getFCI() {
+    return FCI;
+  }
+
+  public void clearCert() {
+    Arrays.fill(EF_C_X509_CH_AUT, (byte) 0x00);
+  }
+
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) throws CardException {
+
+    checkINS(command, 0x22);
+
+    switch (command.getP2()) {
+    case 0xA4:
+      switch (command.getP1()) {
+      case 0x41:
+        // INTERNAL AUTHENTICATE
+      case 0x81:
+        // EXTERNAL AUTHENTICATE
+      }
+    case 0xB6:
+      switch (command.getP1()) {
+      case 0x41: {
+        // PSO - COMPUTE DIGITAL SIGNATURE
+        byte[] dst = new byte[] { (byte) 0x84, (byte) 0x03, (byte) 0x80,
+            (byte) 0x02, (byte) 0x00, (byte) 0x89, (byte) 0x03, (byte) 0x13, (byte) 0x35, (byte) 0x10};
+        if (Arrays.equals(dst, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80});
+        }
+      }
+      case 0x81:
+        // PSO - VERIFY DGITAL SIGNATURE
+      }
+    case 0xB8:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO � DECIPHER
+      case 0x81:
+        // PSO � ENCIPHER
+      }
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+
+    
+  }
+
+  @Override
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel) throws CardException {
+    
+    checkINS(command, 0x2A);
+  
+    if (command.getP1() == 0x90 && command.getP2() == 0xA0) {
+      
+      // HASH
+      byte[] data = command.getData();
+      if (data[0] == (byte) 0x90 && data[1] == (byte) 0x14) {
+        hash = Arrays.copyOfRange(data, 2, data.length);
+        return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+      } else {
+        throw new CardException("HASH command only supports complete hash.");
+      }
+      
+    } else if (command.getP1() == 0x9E && command.getP2() == 0x9A) {
+      
+      // COMPUTE DIGITAL SIGNATURE
+      if (securityEnv == null) {
+        // No security environment
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+      }
+      if (hash == null) {
+        // Command sequence not correct
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x03});
+      }
+      if (hash.length != 20) {
+        // Invalid hash length
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80});
+      }
+      STARCOSCardChannelEmul c = (STARCOSCardChannelEmul) channel;
+      if (c.globalPins.get(STARCOSCardChannelEmul.KID_PIN_Glob).state != PIN.STATE_PIN_VERIFIED) {
+        // Security Status not satisfied
+        return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+      }
+      
+      byte[] signature = new byte[48]; 
+      
+      // TODO replace by signature creation
+      Random random = new Random();
+      random.nextBytes(signature);
+      
+      byte[] response = new byte[signature.length + 2];
+      System.arraycopy(signature, 0, response, 0, signature.length);
+      response[signature.length] = (byte) 0x90;
+      response[signature.length + 1] = (byte) 0x00;
+      
+      hash = null;
+      
+      return new ResponseAPDU(response);
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    }
+    
+  }
+
+  
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java
new file mode 100644
index 00000000..b7835a43
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java
@@ -0,0 +1,160 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import java.util.Arrays;
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+
+@SuppressWarnings("restriction")
+public class STARCOSApplInfobox extends STARCOSAppl {
+
+  public static final byte[] IDLINK = new byte[] {
+    (byte) 0x30, (byte) 0x82, (byte) 0x02, (byte) 0x11, (byte) 0x02, (byte) 0x01, (byte) 0x01, (byte) 0x0c, 
+    (byte) 0x26, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, 
+    (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x7a, 
+    (byte) 0x6d, (byte) 0x72, (byte) 0x2f, (byte) 0x70, (byte) 0x65, (byte) 0x72, (byte) 0x73, (byte) 0x62, 
+    (byte) 0x32, (byte) 0x30, (byte) 0x34, (byte) 0x2e, (byte) 0x78, (byte) 0x73, (byte) 0x6c, (byte) 0x0c, 
+    (byte) 0x29, (byte) 0x73, (byte) 0x7a, (byte) 0x72, (byte) 0x2e, (byte) 0x62, (byte) 0x6d, (byte) 0x69, 
+    (byte) 0x2e, (byte) 0x67, (byte) 0x76, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2d, (byte) 0x41, 
+    (byte) 0x73, (byte) 0x73, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x6f, (byte) 0x6e, 
+    (byte) 0x49, (byte) 0x44, (byte) 0x31, (byte) 0x32, (byte) 0x33, (byte) 0x36, (byte) 0x33, (byte) 0x35, 
+    (byte) 0x36, (byte) 0x33, (byte) 0x36, (byte) 0x36, (byte) 0x37, (byte) 0x39, (byte) 0x39, (byte) 0x39, 
+    (byte) 0x31, (byte) 0x39, (byte) 0x0c, (byte) 0x19, (byte) 0x32, (byte) 0x30, (byte) 0x30, (byte) 0x39, 
+    (byte) 0x2d, (byte) 0x30, (byte) 0x33, (byte) 0x2d, (byte) 0x30, (byte) 0x36, (byte) 0x54, (byte) 0x31, 
+    (byte) 0x36, (byte) 0x3a, (byte) 0x31, (byte) 0x39, (byte) 0x3a, (byte) 0x32, (byte) 0x36, (byte) 0x2b, 
+    (byte) 0x30, (byte) 0x31, (byte) 0x3a, (byte) 0x30, (byte) 0x30, (byte) 0xa0, (byte) 0x42, (byte) 0x30, 
+    (byte) 0x40, (byte) 0x0c, (byte) 0x18, (byte) 0x45, (byte) 0x68, (byte) 0x42, (byte) 0x53, (byte) 0x36, 
+    (byte) 0x54, (byte) 0x6f, (byte) 0x31, (byte) 0x49, (byte) 0x6c, (byte) 0x54, (byte) 0x4b, (byte) 0x4f, 
+    (byte) 0x4a, (byte) 0x45, (byte) 0x39, (byte) 0x75, (byte) 0x62, (byte) 0x74, (byte) 0x48, (byte) 0x69, 
+    (byte) 0x51, (byte) 0x3d, (byte) 0x3d, (byte) 0x0c, (byte) 0x0a, (byte) 0x58, (byte) 0x58, (byte) 0x58, 
+    (byte) 0xc5, (byte) 0x90, (byte) 0x7a, (byte) 0x67, (byte) 0xc3, (byte) 0xbc, (byte) 0x72, (byte) 0x0c, 
+    (byte) 0x0c, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x54, (byte) 0xc3, (byte) 0xbc, (byte) 0x7a, 
+    (byte) 0x65, (byte) 0x6b, (byte) 0xc3, (byte) 0xa7, (byte) 0x69, (byte) 0x0c, (byte) 0x0a, (byte) 0x31, 
+    (byte) 0x39, (byte) 0x37, (byte) 0x33, (byte) 0x2d, (byte) 0x30, (byte) 0x36, (byte) 0x2d, (byte) 0x30, 
+    (byte) 0x34, (byte) 0x30, (byte) 0x0a, (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x00, 
+    (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x01, (byte) 0x03, (byte) 0x82, (byte) 0x01, 
+    (byte) 0x01, (byte) 0x00, (byte) 0x9f, (byte) 0xa5, (byte) 0x68, (byte) 0xa9, (byte) 0x14, (byte) 0x4c, 
+    (byte) 0xa4, (byte) 0x5d, (byte) 0x9d, (byte) 0x09, (byte) 0x99, (byte) 0x2e, (byte) 0xe7, (byte) 0x45, 
+    (byte) 0x2e, (byte) 0x42, (byte) 0x49, (byte) 0x02, (byte) 0x16, (byte) 0xd9, (byte) 0xcb, (byte) 0x90, 
+    (byte) 0x43, (byte) 0x27, (byte) 0x03, (byte) 0x43, (byte) 0x6d, (byte) 0xb4, (byte) 0x8c, (byte) 0xdc, 
+    (byte) 0x1c, (byte) 0x77, (byte) 0xd4, (byte) 0x2e, (byte) 0xa1, (byte) 0x40, (byte) 0xe7, (byte) 0xe0, 
+    (byte) 0x03, (byte) 0x60, (byte) 0x15, (byte) 0xf7, (byte) 0xdb, (byte) 0x03, (byte) 0x5e, (byte) 0xca, 
+    (byte) 0xe4, (byte) 0x35, (byte) 0xba, (byte) 0x2b, (byte) 0xfd, (byte) 0xe6, (byte) 0xb8, (byte) 0xd8, 
+    (byte) 0xb7, (byte) 0x2a, (byte) 0x80, (byte) 0xdd, (byte) 0x38, (byte) 0xe0, (byte) 0x8a, (byte) 0x69, 
+    (byte) 0xad, (byte) 0x67, (byte) 0x60, (byte) 0x65, (byte) 0x42, (byte) 0xc9, (byte) 0x41, (byte) 0x60, 
+    (byte) 0x94, (byte) 0xde, (byte) 0x84, (byte) 0x54, (byte) 0xad, (byte) 0xb3, (byte) 0xf4, (byte) 0xf7, 
+    (byte) 0x44, (byte) 0xd5, (byte) 0xf3, (byte) 0xd3, (byte) 0xb6, (byte) 0x87, (byte) 0x8a, (byte) 0x22, 
+    (byte) 0x38, (byte) 0x00, (byte) 0xcb, (byte) 0xa4, (byte) 0x4f, (byte) 0x96, (byte) 0xc2, (byte) 0x28, 
+    (byte) 0xc2, (byte) 0x8d, (byte) 0x91, (byte) 0x95, (byte) 0xb4, (byte) 0xea, (byte) 0x00, (byte) 0x59, 
+    (byte) 0x2e, (byte) 0xec, (byte) 0x78, (byte) 0xd8, (byte) 0x0f, (byte) 0x26, (byte) 0x04, (byte) 0xee, 
+    (byte) 0xed, (byte) 0x13, (byte) 0xbf, (byte) 0x81, (byte) 0x68, (byte) 0x81, (byte) 0x43, (byte) 0xbe, 
+    (byte) 0x15, (byte) 0x0e, (byte) 0xba, (byte) 0xf9, (byte) 0x6a, (byte) 0x18, (byte) 0xeb, (byte) 0x95, 
+    (byte) 0xad, (byte) 0xb4, (byte) 0x0f, (byte) 0x3c, (byte) 0x94, (byte) 0x63, (byte) 0x32, (byte) 0x81, 
+    (byte) 0x90, (byte) 0xcf, (byte) 0x3f, (byte) 0x95, (byte) 0xff, (byte) 0x8d, (byte) 0x86, (byte) 0xed, 
+    (byte) 0xe4, (byte) 0x75, (byte) 0xd5, (byte) 0x09, (byte) 0x32, (byte) 0x17, (byte) 0x38, (byte) 0xb2, 
+    (byte) 0x68, (byte) 0x35, (byte) 0x49, (byte) 0x8c, (byte) 0xa6, (byte) 0xd0, (byte) 0x3e, (byte) 0xde, 
+    (byte) 0x6e, (byte) 0x47, (byte) 0x68, (byte) 0xbf, (byte) 0x98, (byte) 0x33, (byte) 0xae, (byte) 0x59, 
+    (byte) 0x9f, (byte) 0xe0, (byte) 0x19, (byte) 0x9b, (byte) 0x5b, (byte) 0x1b, (byte) 0x8f, (byte) 0x74, 
+    (byte) 0xd2, (byte) 0x9c, (byte) 0x01, (byte) 0x1a, (byte) 0xdf, (byte) 0xaf, (byte) 0xf8, (byte) 0x96, 
+    (byte) 0x91, (byte) 0xcb, (byte) 0xf8, (byte) 0xbf, (byte) 0x06, (byte) 0xc7, (byte) 0xd5, (byte) 0x17, 
+    (byte) 0x95, (byte) 0xef, (byte) 0xc5, (byte) 0x97, (byte) 0x37, (byte) 0x1b, (byte) 0xb0, (byte) 0xa1, 
+    (byte) 0x4f, (byte) 0x9f, (byte) 0x01, (byte) 0x82, (byte) 0x90, (byte) 0x4a, (byte) 0x6a, (byte) 0x04, 
+    (byte) 0xdb, (byte) 0x31, (byte) 0x1a, (byte) 0x58, (byte) 0xeb, (byte) 0xcd, (byte) 0x68, (byte) 0xe3, 
+    (byte) 0x68, (byte) 0x0b, (byte) 0xa0, (byte) 0x11, (byte) 0x44, (byte) 0x08, (byte) 0xa0, (byte) 0x5c, 
+    (byte) 0xfc, (byte) 0x61, (byte) 0x15, (byte) 0x1f, (byte) 0xbb, (byte) 0x22, (byte) 0x87, (byte) 0x18, 
+    (byte) 0xa3, (byte) 0x07, (byte) 0x9b, (byte) 0x0d, (byte) 0x13, (byte) 0x7c, (byte) 0xff, (byte) 0x30, 
+    (byte) 0xcf, (byte) 0xf3, (byte) 0xaf, (byte) 0xe4, (byte) 0x45, (byte) 0x05, (byte) 0xa0, (byte) 0x8e, 
+    (byte) 0x6b, (byte) 0xef, (byte) 0x70, (byte) 0xf5, (byte) 0x4b, (byte) 0x68, (byte) 0x8f, (byte) 0x61, 
+    (byte) 0xd6, (byte) 0xf5, (byte) 0xa0, (byte) 0x17, (byte) 0x03, (byte) 0x15, (byte) 0x00, (byte) 0x8e, 
+    (byte) 0xa8, (byte) 0xdf, (byte) 0xa9, (byte) 0x77, (byte) 0xfd, (byte) 0x9b, (byte) 0x4b, (byte) 0x91, 
+    (byte) 0x89, (byte) 0x34, (byte) 0x84, (byte) 0xf3, (byte) 0x24, (byte) 0xb2, (byte) 0x5a, (byte) 0x39, 
+    (byte) 0xa9, (byte) 0xf2, (byte) 0x17, (byte) 0xa1, (byte) 0x17, (byte) 0x03, (byte) 0x15, (byte) 0x00, 
+    (byte) 0xdb, (byte) 0xa2, (byte) 0xfd, (byte) 0xa4, (byte) 0xe7, (byte) 0x65, (byte) 0x2e, (byte) 0x7e, 
+    (byte) 0xb0, (byte) 0xc8, (byte) 0xfa, (byte) 0x4d, (byte) 0x13, (byte) 0x28, (byte) 0xdf, (byte) 0xb1, 
+    (byte) 0x58, (byte) 0x3b, (byte) 0x9e, (byte) 0x29, (byte) 0xa2, (byte) 0x17, (byte) 0x03, (byte) 0x15, 
+    (byte) 0x00, (byte) 0x68, (byte) 0xa0, (byte) 0x17, (byte) 0x18, (byte) 0xb7, (byte) 0xb3, (byte) 0xc3, 
+    (byte) 0x60, (byte) 0x77, (byte) 0x82, (byte) 0x8d, (byte) 0xf1, (byte) 0x5e, (byte) 0x10, (byte) 0xc3, 
+    (byte) 0x2d, (byte) 0x78, (byte) 0x2c, (byte) 0x11, (byte) 0x0b
+  };
+  
+  private static byte[] FCP = new byte[] { (byte) 0x6f, (byte) 0x14,
+      (byte) 0x84, (byte) 0x08, (byte) 0xd0, (byte) 0x40, (byte) 0x00,
+      (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x18, (byte) 0x01,
+      (byte) 0xa5, (byte) 0x08, (byte) 0x53, (byte) 0x02, (byte) 0x01,
+      (byte) 0x11, (byte) 0x54, (byte) 0x02, (byte) 0x01, (byte) 0x00 };
+  
+  protected static byte[] FID_EF_IdentityLink = new byte[] { (byte) 0xef, (byte) 0x01 };
+  
+  protected static byte[] FCP_EF_IdentityLink = new byte[] { (byte) 0x62,
+      (byte) 0x16, (byte) 0x80, (byte) 0x02, (byte) 0x04, (byte) 0x00,
+      (byte) 0x82, (byte) 0x01, (byte) 0x01, (byte) 0x83, (byte) 0x02,
+      (byte) 0xef, (byte) 0x01, (byte) 0x88, (byte) 0x01, (byte) 0x08,
+      (byte) 0x8a, (byte) 0x01, (byte) 0x05, (byte) 0xa1, (byte) 0x03,
+      (byte) 0x8b, (byte) 0x01, (byte) 0x02 };
+  
+  protected static byte[] EF_IdentityLink = new byte[1500];
+
+  public STARCOSApplInfobox(STARCOSCardChannelEmul channel) {
+    super(channel);
+    System.arraycopy(IDLINK, 0, EF_IdentityLink, 0, IDLINK.length);
+    putFile(new File(FID_EF_IdentityLink, EF_IdentityLink, FCP_EF_IdentityLink, 0x01));
+  }
+
+  @Override
+  public byte[] getAID() {
+    return AID_Infobox;
+  }
+
+  @Override
+  public byte[] getFID() {
+    return FID_Infobox;
+  }
+
+  @Override
+  public byte[] getFCI() {
+    return FCP;
+  }
+
+  public void clearInfobox() {
+    Arrays.fill(EF_IdentityLink, (byte) 0x00);
+  }
+  
+  public void setInfoboxHeader(byte b) {
+    EF_IdentityLink[0] = b;
+  }
+  
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel)
+      throws CardException {
+    throw new CardException("Not supported.");
+  }
+
+  @Override
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel)
+      throws CardException {
+    throw new CardException("Not supported.");
+  }
+
+  
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java
new file mode 100644
index 00000000..9fb5ad37
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java
@@ -0,0 +1,347 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+import java.util.Random;
+
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public class STARCOSApplSichereSignatur extends STARCOSAppl {
+
+  private static byte[] FCI = new byte[] { (byte) 0x6f, (byte) 0x16,
+      (byte) 0x84, (byte) 0x08, (byte) 0xd0, (byte) 0x40, (byte) 0x00,
+      (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01,
+      (byte) 0xa5, (byte) 0x0a, (byte) 0x53, (byte) 0x02, (byte) 0x01,
+      (byte) 0x10, (byte) 0x54, (byte) 0x04, (byte) 0x01, (byte) 0x00,
+      (byte) 0x03, (byte) 0x00 };
+  
+  protected static byte[] FID_EF_C_X509_CH_DS = new byte[] { (byte) 0xc0,
+      (byte) 0x00 };
+  
+  protected static byte[] FCI_EF_C_X509_CH_DS = new byte[] { (byte) 0x62,
+      (byte) 0x16, (byte) 0x80, (byte) 0x02, (byte) 0x04, (byte) 0xef,
+      (byte) 0x82, (byte) 0x01, (byte) 0x01, (byte) 0x83, (byte) 0x02,
+      (byte) 0xc0, (byte) 0x00, (byte) 0x88, (byte) 0x01, (byte) 0x08,
+      (byte) 0x8a, (byte) 0x01, (byte) 0x05, (byte) 0xa1, (byte) 0x03,
+      (byte) 0x8b, (byte) 0x01, (byte) 0x0e };
+  
+  protected static byte[] C_X509_CH_DS = new byte[] {
+    (byte) 0x30, (byte) 0x82, (byte) 0x04, (byte) 0xeb, (byte) 0x30, (byte) 0x82, (byte) 0x03, (byte) 0xd3, 
+    (byte) 0xa0, (byte) 0x03, (byte) 0x02, (byte) 0x01, (byte) 0x02, (byte) 0x02, (byte) 0x03, (byte) 0x02, 
+    (byte) 0x06, (byte) 0x5e, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, (byte) 0x86, 
+    (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, (byte) 0x05, 
+    (byte) 0x00, (byte) 0x30, (byte) 0x81, (byte) 0xa1, (byte) 0x31, (byte) 0x0b, (byte) 0x30, (byte) 0x09, 
+    (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, (byte) 0x13, (byte) 0x02, (byte) 0x41, 
+    (byte) 0x54, (byte) 0x31, (byte) 0x48, (byte) 0x30, (byte) 0x46, (byte) 0x06, (byte) 0x03, (byte) 0x55, 
+    (byte) 0x04, (byte) 0x0a, (byte) 0x0c, (byte) 0x3f, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x20, (byte) 0x47, (byte) 0x65, (byte) 0x73, (byte) 0x2e, 
+    (byte) 0x20, (byte) 0x66, (byte) 0x2e, (byte) 0x20, (byte) 0x53, (byte) 0x69, (byte) 0x63, (byte) 0x68, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x68, (byte) 0x65, (byte) 0x69, (byte) 0x74, (byte) 0x73, (byte) 0x73, 
+    (byte) 0x79, (byte) 0x73, (byte) 0x74, (byte) 0x65, (byte) 0x6d, (byte) 0x65, (byte) 0x20, (byte) 0x69, 
+    (byte) 0x6d, (byte) 0x20, (byte) 0x65, (byte) 0x6c, (byte) 0x65, (byte) 0x6b, (byte) 0x74, (byte) 0x72, 
+    (byte) 0x2e, (byte) 0x20, (byte) 0x44, (byte) 0x61, (byte) 0x74, (byte) 0x65, (byte) 0x6e, (byte) 0x76, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x6b, (byte) 0x65, (byte) 0x68, (byte) 0x72, (byte) 0x20, (byte) 0x47, 
+    (byte) 0x6d, (byte) 0x62, (byte) 0x48, (byte) 0x31, (byte) 0x23, (byte) 0x30, (byte) 0x21, (byte) 0x06, 
+    (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x0b, (byte) 0x0c, (byte) 0x1a, (byte) 0x61, (byte) 0x2d, 
+    (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, 
+    (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, 
+    (byte) 0x74, (byte) 0x2d, (byte) 0x53, (byte) 0x69, (byte) 0x67, (byte) 0x2d, (byte) 0x30, (byte) 0x32, 
+    (byte) 0x31, (byte) 0x23, (byte) 0x30, (byte) 0x21, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, 
+    (byte) 0x03, (byte) 0x0c, (byte) 0x1a, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, 
+    (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, 
+    (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x53, 
+    (byte) 0x69, (byte) 0x67, (byte) 0x2d, (byte) 0x30, (byte) 0x32, (byte) 0x30, (byte) 0x1e, (byte) 0x17, 
+    (byte) 0x0d, (byte) 0x30, (byte) 0x39, (byte) 0x30, (byte) 0x33, (byte) 0x30, (byte) 0x36, (byte) 0x31, 
+    (byte) 0x35, (byte) 0x32, (byte) 0x32, (byte) 0x33, (byte) 0x37, (byte) 0x5a, (byte) 0x17, (byte) 0x0d, 
+    (byte) 0x31, (byte) 0x32, (byte) 0x30, (byte) 0x33, (byte) 0x30, (byte) 0x36, (byte) 0x31, (byte) 0x35, 
+    (byte) 0x32, (byte) 0x32, (byte) 0x33, (byte) 0x37, (byte) 0x5a, (byte) 0x30, (byte) 0x72, (byte) 0x31, 
+    (byte) 0x0b, (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x06, 
+    (byte) 0x13, (byte) 0x02, (byte) 0x41, (byte) 0x54, (byte) 0x31, (byte) 0x20, (byte) 0x30, (byte) 0x1e, 
+    (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x03, (byte) 0x0c, (byte) 0x17, (byte) 0x58, 
+    (byte) 0x58, (byte) 0x58, (byte) 0xc5, (byte) 0x90, (byte) 0x7a, (byte) 0x67, (byte) 0xc3, (byte) 0xbc, 
+    (byte) 0x72, (byte) 0x20, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x54, (byte) 0xc3, (byte) 0xbc, 
+    (byte) 0x7a, (byte) 0x65, (byte) 0x6b, (byte) 0xc3, (byte) 0xa7, (byte) 0x69, (byte) 0x31, (byte) 0x15, 
+    (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x04, (byte) 0x0c, 
+    (byte) 0x0c, (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0x54, (byte) 0xc3, (byte) 0xbc, (byte) 0x7a, 
+    (byte) 0x65, (byte) 0x6b, (byte) 0xc3, (byte) 0xa7, (byte) 0x69, (byte) 0x31, (byte) 0x13, (byte) 0x30, 
+    (byte) 0x11, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x04, (byte) 0x2a, (byte) 0x0c, (byte) 0x0a, 
+    (byte) 0x58, (byte) 0x58, (byte) 0x58, (byte) 0xc5, (byte) 0x90, (byte) 0x7a, (byte) 0x67, (byte) 0xc3, 
+    (byte) 0xbc, (byte) 0x72, (byte) 0x31, (byte) 0x15, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, 
+    (byte) 0x55, (byte) 0x04, (byte) 0x05, (byte) 0x13, (byte) 0x0c, (byte) 0x37, (byte) 0x30, (byte) 0x34, 
+    (byte) 0x38, (byte) 0x37, (byte) 0x31, (byte) 0x30, (byte) 0x35, (byte) 0x30, (byte) 0x30, (byte) 0x30, 
+    (byte) 0x38, (byte) 0x30, (byte) 0x49, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x07, (byte) 0x2a, 
+    (byte) 0x86, (byte) 0x48, (byte) 0xce, (byte) 0x3d, (byte) 0x02, (byte) 0x01, (byte) 0x06, (byte) 0x08, 
+    (byte) 0x2a, (byte) 0x86, (byte) 0x48, (byte) 0xce, (byte) 0x3d, (byte) 0x03, (byte) 0x01, (byte) 0x01, 
+    (byte) 0x03, (byte) 0x32, (byte) 0x00, (byte) 0x04, (byte) 0xde, (byte) 0x75, (byte) 0x22, (byte) 0x4c, 
+    (byte) 0xc4, (byte) 0xd4, (byte) 0x14, (byte) 0x16, (byte) 0x48, (byte) 0x4a, (byte) 0x65, (byte) 0x9d, 
+    (byte) 0x5a, (byte) 0x39, (byte) 0x71, (byte) 0x11, (byte) 0x1c, (byte) 0x33, (byte) 0x7e, (byte) 0x7f, 
+    (byte) 0xb4, (byte) 0x06, (byte) 0x33, (byte) 0x74, (byte) 0xe6, (byte) 0xf3, (byte) 0xc2, (byte) 0x56, 
+    (byte) 0x46, (byte) 0x18, (byte) 0x39, (byte) 0xb9, (byte) 0xc4, (byte) 0x47, (byte) 0x84, (byte) 0xf5, 
+    (byte) 0x46, (byte) 0x41, (byte) 0x60, (byte) 0x78, (byte) 0x81, (byte) 0x45, (byte) 0x4a, (byte) 0x0f, 
+    (byte) 0x67, (byte) 0x77, (byte) 0x77, (byte) 0xb2, (byte) 0xa3, (byte) 0x82, (byte) 0x02, (byte) 0x33, 
+    (byte) 0x30, (byte) 0x82, (byte) 0x02, (byte) 0x2f, (byte) 0x30, (byte) 0x13, (byte) 0x06, (byte) 0x03, 
+    (byte) 0x55, (byte) 0x1d, (byte) 0x23, (byte) 0x04, (byte) 0x0c, (byte) 0x30, (byte) 0x0a, (byte) 0x80, 
+    (byte) 0x08, (byte) 0x46, (byte) 0x06, (byte) 0x9f, (byte) 0x8e, (byte) 0x41, (byte) 0x8e, (byte) 0x15, 
+    (byte) 0xbd, (byte) 0x30, (byte) 0x27, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, 
+    (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x01, (byte) 0x03, (byte) 0x01, (byte) 0x01, (byte) 0xff, 
+    (byte) 0x04, (byte) 0x18, (byte) 0x30, (byte) 0x16, (byte) 0x30, (byte) 0x08, (byte) 0x06, (byte) 0x06, 
+    (byte) 0x04, (byte) 0x00, (byte) 0x8e, (byte) 0x46, (byte) 0x01, (byte) 0x01, (byte) 0x30, (byte) 0x0a, 
+    (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, 
+    (byte) 0x0b, (byte) 0x01, (byte) 0x30, (byte) 0x81, (byte) 0x84, (byte) 0x06, (byte) 0x08, (byte) 0x2b, 
+    (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x01, (byte) 0x01, (byte) 0x04, 
+    (byte) 0x78, (byte) 0x30, (byte) 0x76, (byte) 0x30, (byte) 0x2c, (byte) 0x06, (byte) 0x08, (byte) 0x2b, 
+    (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x30, (byte) 0x01, (byte) 0x86, 
+    (byte) 0x20, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, 
+    (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x70, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, 
+    (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, 
+    (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x6f, (byte) 0x63, (byte) 0x73, 
+    (byte) 0x70, (byte) 0x30, (byte) 0x46, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, (byte) 0x01, 
+    (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x30, (byte) 0x02, (byte) 0x86, (byte) 0x3a, (byte) 0x68, 
+    (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x77, (byte) 0x77, 
+    (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, 
+    (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x63, (byte) 0x65, (byte) 0x72, 
+    (byte) 0x74, (byte) 0x73, (byte) 0x2f, (byte) 0x61, (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, 
+    (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, 
+    (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x53, 
+    (byte) 0x69, (byte) 0x67, (byte) 0x2d, (byte) 0x30, (byte) 0x32, (byte) 0x2e, (byte) 0x63, (byte) 0x72, 
+    (byte) 0x74, (byte) 0x30, (byte) 0x81, (byte) 0x92, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, 
+    (byte) 0x20, (byte) 0x04, (byte) 0x81, (byte) 0x8a, (byte) 0x30, (byte) 0x81, (byte) 0x87, (byte) 0x30, 
+    (byte) 0x7b, (byte) 0x06, (byte) 0x06, (byte) 0x2a, (byte) 0x28, (byte) 0x00, (byte) 0x11, (byte) 0x01, 
+    (byte) 0x03, (byte) 0x30, (byte) 0x71, (byte) 0x30, (byte) 0x35, (byte) 0x06, (byte) 0x08, (byte) 0x2b, 
+    (byte) 0x06, (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x02, (byte) 0x01, (byte) 0x16, 
+    (byte) 0x29, (byte) 0x68, (byte) 0x74, (byte) 0x74, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, 
+    (byte) 0x77, (byte) 0x77, (byte) 0x77, (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x64, 
+    (byte) 0x6f, (byte) 0x63, (byte) 0x73, (byte) 0x2f, (byte) 0x63, (byte) 0x70, (byte) 0x2f, (byte) 0x61, 
+    (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x74, (byte) 0x65, 
+    (byte) 0x73, (byte) 0x74, (byte) 0x30, (byte) 0x38, (byte) 0x06, (byte) 0x08, (byte) 0x2b, (byte) 0x06, 
+    (byte) 0x01, (byte) 0x05, (byte) 0x05, (byte) 0x07, (byte) 0x02, (byte) 0x02, (byte) 0x30, (byte) 0x2c, 
+    (byte) 0x1a, (byte) 0x2a, (byte) 0x44, (byte) 0x69, (byte) 0x65, (byte) 0x73, (byte) 0x65, (byte) 0x73, 
+    (byte) 0x20, (byte) 0x5a, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, 
+    (byte) 0x6b, (byte) 0x61, (byte) 0x74, (byte) 0x20, (byte) 0x64, (byte) 0x69, (byte) 0x65, (byte) 0x6e, 
+    (byte) 0x74, (byte) 0x20, (byte) 0x6e, (byte) 0x75, (byte) 0x72, (byte) 0x20, (byte) 0x7a, (byte) 0x75, 
+    (byte) 0x20, (byte) 0x54, (byte) 0x65, (byte) 0x73, (byte) 0x74, (byte) 0x7a, (byte) 0x77, (byte) 0x65, 
+    (byte) 0x63, (byte) 0x6b, (byte) 0x65, (byte) 0x6e, (byte) 0x30, (byte) 0x08, (byte) 0x06, (byte) 0x06, 
+    (byte) 0x04, (byte) 0x00, (byte) 0x8b, (byte) 0x30, (byte) 0x01, (byte) 0x01, (byte) 0x30, (byte) 0x81, 
+    (byte) 0xa4, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x1f, (byte) 0x04, (byte) 0x81, 
+    (byte) 0x9c, (byte) 0x30, (byte) 0x81, (byte) 0x99, (byte) 0x30, (byte) 0x81, (byte) 0x96, (byte) 0xa0, 
+    (byte) 0x81, (byte) 0x93, (byte) 0xa0, (byte) 0x81, (byte) 0x90, (byte) 0x86, (byte) 0x81, (byte) 0x8d, 
+    (byte) 0x6c, (byte) 0x64, (byte) 0x61, (byte) 0x70, (byte) 0x3a, (byte) 0x2f, (byte) 0x2f, (byte) 0x6c, 
+    (byte) 0x64, (byte) 0x61, (byte) 0x70, (byte) 0x2d, (byte) 0x74, (byte) 0x65, (byte) 0x73, (byte) 0x74, 
+    (byte) 0x2e, (byte) 0x61, (byte) 0x2d, (byte) 0x74, (byte) 0x72, (byte) 0x75, (byte) 0x73, (byte) 0x74, 
+    (byte) 0x2e, (byte) 0x61, (byte) 0x74, (byte) 0x2f, (byte) 0x6f, (byte) 0x75, (byte) 0x3d, (byte) 0x61, 
+    (byte) 0x2d, (byte) 0x73, (byte) 0x69, (byte) 0x67, (byte) 0x6e, (byte) 0x2d, (byte) 0x50, (byte) 0x72, 
+    (byte) 0x65, (byte) 0x6d, (byte) 0x69, (byte) 0x75, (byte) 0x6d, (byte) 0x2d, (byte) 0x54, (byte) 0x65, 
+    (byte) 0x73, (byte) 0x74, (byte) 0x2d, (byte) 0x53, (byte) 0x69, (byte) 0x67, (byte) 0x2d, (byte) 0x30, 
+    (byte) 0x32, (byte) 0x2c, (byte) 0x6f, (byte) 0x3d, (byte) 0x41, (byte) 0x2d, (byte) 0x54, (byte) 0x72, 
+    (byte) 0x75, (byte) 0x73, (byte) 0x74, (byte) 0x2c, (byte) 0x63, (byte) 0x3d, (byte) 0x41, (byte) 0x54, 
+    (byte) 0x3f, (byte) 0x63, (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, 
+    (byte) 0x63, (byte) 0x61, (byte) 0x74, (byte) 0x65, (byte) 0x72, (byte) 0x65, (byte) 0x76, (byte) 0x6f, 
+    (byte) 0x63, (byte) 0x61, (byte) 0x74, (byte) 0x69, (byte) 0x6f, (byte) 0x6e, (byte) 0x6c, (byte) 0x69, 
+    (byte) 0x73, (byte) 0x74, (byte) 0x3f, (byte) 0x62, (byte) 0x61, (byte) 0x73, (byte) 0x65, (byte) 0x3f, 
+    (byte) 0x6f, (byte) 0x62, (byte) 0x6a, (byte) 0x65, (byte) 0x63, (byte) 0x74, (byte) 0x63, (byte) 0x6c, 
+    (byte) 0x61, (byte) 0x73, (byte) 0x73, (byte) 0x3d, (byte) 0x65, (byte) 0x69, (byte) 0x64, (byte) 0x43, 
+    (byte) 0x65, (byte) 0x72, (byte) 0x74, (byte) 0x69, (byte) 0x66, (byte) 0x69, (byte) 0x63, (byte) 0x61, 
+    (byte) 0x74, (byte) 0x69, (byte) 0x6f, (byte) 0x6e, (byte) 0x41, (byte) 0x75, (byte) 0x74, (byte) 0x68, 
+    (byte) 0x6f, (byte) 0x72, (byte) 0x69, (byte) 0x74, (byte) 0x79, (byte) 0x30, (byte) 0x11, (byte) 0x06, 
+    (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x0e, (byte) 0x04, (byte) 0x0a, (byte) 0x04, (byte) 0x08, 
+    (byte) 0x47, (byte) 0x64, (byte) 0x6e, (byte) 0xbb, (byte) 0x92, (byte) 0xa0, (byte) 0xf6, (byte) 0xf4, 
+    (byte) 0x30, (byte) 0x0e, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x0f, (byte) 0x01, 
+    (byte) 0x01, (byte) 0xff, (byte) 0x04, (byte) 0x04, (byte) 0x03, (byte) 0x02, (byte) 0x06, (byte) 0xc0, 
+    (byte) 0x30, (byte) 0x09, (byte) 0x06, (byte) 0x03, (byte) 0x55, (byte) 0x1d, (byte) 0x13, (byte) 0x04, 
+    (byte) 0x02, (byte) 0x30, (byte) 0x00, (byte) 0x30, (byte) 0x0d, (byte) 0x06, (byte) 0x09, (byte) 0x2a, 
+    (byte) 0x86, (byte) 0x48, (byte) 0x86, (byte) 0xf7, (byte) 0x0d, (byte) 0x01, (byte) 0x01, (byte) 0x05, 
+    (byte) 0x05, (byte) 0x00, (byte) 0x03, (byte) 0x82, (byte) 0x01, (byte) 0x01, (byte) 0x00, (byte) 0x06, 
+    (byte) 0x63, (byte) 0x76, (byte) 0x0a, (byte) 0xd5, (byte) 0x54, (byte) 0xfa, (byte) 0x51, (byte) 0x2a, 
+    (byte) 0xb0, (byte) 0x41, (byte) 0xdc, (byte) 0xa4, (byte) 0x9b, (byte) 0x52, (byte) 0x1c, (byte) 0x0e, 
+    (byte) 0x1d, (byte) 0x65, (byte) 0x46, (byte) 0x2b, (byte) 0xa3, (byte) 0xcd, (byte) 0xd4, (byte) 0x46, 
+    (byte) 0x36, (byte) 0x40, (byte) 0xc3, (byte) 0x49, (byte) 0xe8, (byte) 0xa4, (byte) 0xdc, (byte) 0x01, 
+    (byte) 0xde, (byte) 0x70, (byte) 0x97, (byte) 0x31, (byte) 0xb0, (byte) 0xcd, (byte) 0xdf, (byte) 0x69, 
+    (byte) 0xf8, (byte) 0xc3, (byte) 0x83, (byte) 0xee, (byte) 0xc6, (byte) 0xed, (byte) 0xe3, (byte) 0x18, 
+    (byte) 0x1a, (byte) 0x80, (byte) 0xc1, (byte) 0x30, (byte) 0xa9, (byte) 0xd6, (byte) 0xb1, (byte) 0xb8, 
+    (byte) 0xa8, (byte) 0xe0, (byte) 0x3d, (byte) 0xb1, (byte) 0x8e, (byte) 0x2c, (byte) 0xc9, (byte) 0xa6, 
+    (byte) 0x05, (byte) 0x6e, (byte) 0x4a, (byte) 0xd2, (byte) 0xb2, (byte) 0x03, (byte) 0xa4, (byte) 0x2b, 
+    (byte) 0xa2, (byte) 0xad, (byte) 0xad, (byte) 0xe5, (byte) 0xba, (byte) 0x0d, (byte) 0x54, (byte) 0x8d, 
+    (byte) 0x92, (byte) 0x51, (byte) 0xda, (byte) 0x58, (byte) 0xed, (byte) 0xd3, (byte) 0x8d, (byte) 0x61, 
+    (byte) 0xa1, (byte) 0xfc, (byte) 0x49, (byte) 0xf6, (byte) 0x80, (byte) 0xdb, (byte) 0x65, (byte) 0x92, 
+    (byte) 0xe0, (byte) 0xd5, (byte) 0x23, (byte) 0x69, (byte) 0x0f, (byte) 0x38, (byte) 0x11, (byte) 0x61, 
+    (byte) 0x1e, (byte) 0xcd, (byte) 0xa2, (byte) 0x8e, (byte) 0x68, (byte) 0xec, (byte) 0x70, (byte) 0xfb, 
+    (byte) 0x55, (byte) 0x95, (byte) 0xcb, (byte) 0xb4, (byte) 0x18, (byte) 0x6b, (byte) 0x3a, (byte) 0x25, 
+    (byte) 0x4a, (byte) 0x3e, (byte) 0x07, (byte) 0xb0, (byte) 0x18, (byte) 0x26, (byte) 0x51, (byte) 0x39, 
+    (byte) 0x46, (byte) 0xfa, (byte) 0xe2, (byte) 0xae, (byte) 0xe6, (byte) 0x1c, (byte) 0xd2, (byte) 0xcb, 
+    (byte) 0x28, (byte) 0xa1, (byte) 0x8b, (byte) 0x56, (byte) 0xbb, (byte) 0xe9, (byte) 0x6c, (byte) 0xf7, 
+    (byte) 0x0b, (byte) 0x84, (byte) 0xdd, (byte) 0x7f, (byte) 0x64, (byte) 0x8b, (byte) 0x43, (byte) 0x93, 
+    (byte) 0x62, (byte) 0x39, (byte) 0xfb, (byte) 0x91, (byte) 0xfa, (byte) 0x3a, (byte) 0x57, (byte) 0x56, 
+    (byte) 0x4a, (byte) 0xaa, (byte) 0x99, (byte) 0x1e, (byte) 0x9b, (byte) 0xcc, (byte) 0xa4, (byte) 0xc0, 
+    (byte) 0x18, (byte) 0x46, (byte) 0xae, (byte) 0x15, (byte) 0x24, (byte) 0xf5, (byte) 0xf3, (byte) 0xe6, 
+    (byte) 0x36, (byte) 0x55, (byte) 0x29, (byte) 0xa8, (byte) 0xa9, (byte) 0xaf, (byte) 0x7b, (byte) 0x44, 
+    (byte) 0x19, (byte) 0xda, (byte) 0x66, (byte) 0x4d, (byte) 0x11, (byte) 0x89, (byte) 0x28, (byte) 0x34, 
+    (byte) 0x01, (byte) 0x15, (byte) 0x24, (byte) 0x93, (byte) 0x43, (byte) 0x6a, (byte) 0x8f, (byte) 0xe4, 
+    (byte) 0x54, (byte) 0x3a, (byte) 0x3d, (byte) 0x9b, (byte) 0x2f, (byte) 0xc3, (byte) 0xdb, (byte) 0x7e, 
+    (byte) 0x5e, (byte) 0x12, (byte) 0x00, (byte) 0xaa, (byte) 0xe7, (byte) 0xc1, (byte) 0x82, (byte) 0x1c, 
+    (byte) 0x1d, (byte) 0x1d, (byte) 0x23, (byte) 0x1d, (byte) 0xa3, (byte) 0xcc, (byte) 0x59, (byte) 0xe4, 
+    (byte) 0x7a, (byte) 0xf0, (byte) 0x14, (byte) 0x17, (byte) 0xfb, (byte) 0x96, (byte) 0x90, (byte) 0xc1, 
+    (byte) 0xc0, (byte) 0xde, (byte) 0xdb, (byte) 0x91, (byte) 0xfb, (byte) 0x49, (byte) 0x39, (byte) 0x70, 
+    (byte) 0x76, (byte) 0x2f, (byte) 0x7b, (byte) 0x22, (byte) 0xcd, (byte) 0x35, (byte) 0xcb, (byte) 0xed, 
+    (byte) 0x8f, (byte) 0xb3, (byte) 0x66, (byte) 0xae, (byte) 0x95, (byte) 0x49, (byte) 0x75
+  };
+  
+  protected static final int KID_PIN_SS = 0x81;
+
+  protected byte[] EF_C_X509_CH_DS = new byte[2000];
+  
+  public STARCOSApplSichereSignatur(STARCOSCardChannelEmul channel) {
+    super(channel);
+    // Files
+    System.arraycopy(C_X509_CH_DS, 0, EF_C_X509_CH_DS, 0, C_X509_CH_DS.length);
+    putFile(new File(FID_EF_C_X509_CH_DS, EF_C_X509_CH_DS, FCI_EF_C_X509_CH_DS));
+    
+    // PINs
+    pins.put(KID_PIN_SS, new PIN(new byte[] { (byte) 0x24, (byte) 0x12,
+        (byte) 0x34, (byte) 0x56, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF,
+        (byte) 0xFF }, KID_PIN_SS, 3));
+  }
+
+  @Override
+  public byte[] getAID() {
+    return AID_SichereSignatur;
+  }
+
+  @Override
+  public byte[] getFID() {
+    return FID_SichereSignatur;
+  }
+
+  @Override
+  public byte[] getFCI() {
+    return FCI;
+  }
+
+  @Override
+  public ResponseAPDU cmdPERFORM_SECURITY_OPERATION(CommandAPDU command, CardChannelEmul channel) throws CardException {
+    
+    checkINS(command, 0x2A);
+  
+    if (command.getP1() == 0x90 && command.getP2() == 0xA0) {
+      
+      // HASH
+      byte[] data = command.getData();
+      if (data[0] == (byte) 0x90 && data[1] == (byte) 0x14) {
+        hash = Arrays.copyOfRange(data, 2, data.length);
+        return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+      } else {
+        throw new CardException("HASH command only supports complete hash.");
+      }
+      
+    } else if (command.getP1() == 0x9E && command.getP2() == 0x9A) {
+      
+      // COMPUTE DIGITAL SIGNATURE
+      if (securityEnv == null) {
+        // No security environment
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+      }
+      if (hash == null) {
+        // Command sequence not correct
+        return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x03});
+      }
+      if (hash.length != 20) {
+        // Invalid hash length
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80});
+      }
+      if (pins.get(KID_PIN_SS).state != PIN.STATE_PIN_VERIFIED) {
+        // Security Status not satisfied
+        return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+      }
+      
+      byte[] signature = new byte[48]; 
+      
+      // TODO replace by signature creation
+      Random random = new Random();
+      random.nextBytes(signature);
+      
+      byte[] response = new byte[signature.length + 2];
+      System.arraycopy(signature, 0, response, 0, signature.length);
+      response[signature.length] = (byte) 0x90;
+      response[signature.length + 1] = (byte) 0x00;
+      
+      hash = null;
+      pins.get(KID_PIN_SS).state = PIN.STATE_RESET;
+      
+      return new ResponseAPDU(response);
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    }
+    
+  }
+  
+  public void clearCert() {
+    Arrays.fill(EF_C_X509_CH_DS, (byte) 0x00);
+  }
+
+  @Override
+  public ResponseAPDU cmdMANAGE_SECURITY_ENVIRONMENT(CommandAPDU command, CardChannelEmul channel) throws CardException {
+
+    checkINS(command, 0x22);
+
+    switch (command.getP2()) {
+    case 0xA4:
+      switch (command.getP1()) {
+      case 0x41:
+        // INTERNAL AUTHENTICATE
+      case 0x81:
+        // EXTERNAL AUTHENTICATE
+      }
+    case 0xB6:
+      switch (command.getP1()) {
+      case 0x41: {
+        // PSO - COMPUTE DIGITAL SIGNATURE
+        byte[] dst = new byte[] { (byte) 0x84, (byte) 0x03, (byte) 0x80,
+            (byte) 0x02, (byte) 0x00, (byte) 0x89, (byte) 0x03, (byte) 0x13, (byte) 0x35, (byte) 0x10};
+        if (Arrays.equals(dst, command.getData())) {
+          securityEnv = command.getData();
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80});
+        }
+      }
+      case 0x81:
+        // PSO - VERIFY DGITAL SIGNATURE
+      }
+    case 0xB8:
+      switch (command.getP1()) {
+      case 0x41:
+        // PSO � DECIPHER
+      case 0x81:
+        // PSO � ENCIPHER
+      }
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x81});
+    }
+  
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java
new file mode 100644
index 00000000..89030894
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java
@@ -0,0 +1,375 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Arrays;
+import java.util.HashMap;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.AbstractAppl;
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public class STARCOSCardChannelEmul extends CardChannelEmul {
+
+  public static final int KID_PIN_Glob = 0x01;
+  
+  /**
+   * 
+   */
+  protected CardEmul cardEmul;
+  
+  public final HashMap<Integer, PIN> globalPins = new HashMap<Integer, PIN>();
+
+  public STARCOSCardChannelEmul(CardEmul cardEmul) {
+    this.cardEmul = cardEmul;
+    globalPins.put(KID_PIN_Glob, new PIN(new byte[] { (byte) 0x24, (byte) 0x00,
+        (byte) 0x00, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF,
+        (byte) 0xFF }, KID_PIN_Glob, 10));
+ }
+
+  @Override
+  public Card getCard() {
+    return cardEmul;
+  }
+
+  protected ResponseAPDU cmdSELECT(CommandAPDU command) throws CardException {
+  
+    byte[] fid = command.getData();
+    
+    switch (command.getP1()) {
+    case 0x00: // MF
+      if (fid.length !=0) {
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80}); 
+      } else {
+        currentFile = null;
+        currentAppl = null;
+        return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+      }
+
+    case 0x01: // Lower-level DF
+      throw new CardException("Not supported.");
+      
+    case 0x02: // EF in current DF
+      if (currentAppl != null) {
+        if (command.getP2() != 0x04) {
+          throw new CardException("Not supported.");
+        }
+        for (File file : currentAppl.getFiles()) {
+          if (Arrays.equals(fid, file.fid)) {
+            currentFile = file;
+            byte[] response = new byte[file.fcx.length + 2];
+            System.arraycopy(file.fcx, 0, response, 0, file.fcx.length);
+            response[file.fcx.length] = (byte) 0x90;
+            response[file.fcx.length + 1] = (byte) 0x00;
+            return new ResponseAPDU(response);
+          }
+        }
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x82});
+      } else {
+        throw new CardException("Not supported.");
+      }
+      
+    case 0x03: // Higher-level DF
+      throw new CardException("Not supported.");
+      
+    case 0x04: // Selection by DF name
+      AbstractAppl appl = cardEmul.getApplication(fid);
+      if (appl != null) {
+        if (command.getP2() != 0x00) {
+          throw new CardException("Not supported.");
+        }
+        if (currentAppl != null && currentAppl != appl) {
+          currentAppl.leaveApplContext();
+          currentFile = null;
+        }
+        currentAppl = appl;
+
+        byte[] fci = currentAppl.getFCI();
+        byte[] response = new byte[fci.length + 2];
+        System.arraycopy(fci, 0, response, 0, fci.length);
+        response[fci.length] = (byte) 0x90;
+        response[fci.length + 1] = (byte) 0x00;
+        return new ResponseAPDU(response);
+      }
+      
+    default:
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x86});
+    }
+    
+  }
+  
+  protected ResponseAPDU cmdREAD_BINARY(CommandAPDU command) throws CardException {
+
+    if (command.getINS() != 0xB0) {
+      throw new IllegalArgumentException("INS has to be 0xB0.");
+    }
+
+    if (currentFile == null) {
+      return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x86}); 
+    }
+    
+    if ((command.getP1() & 0x80) > 0) {
+      throw new CardException("Not implemented.");
+    }
+    
+    int offset = command.getP2() + (command.getP1() << 8);
+    if (offset > currentFile.file.length) {
+      // Wrong length
+      return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+    }
+    
+    if (command.getNe() == 0) {
+      throw new CardException("Not implemented.");
+    }
+    
+    if (currentFile.kid != -1) {
+      PIN pin;
+      if ((currentFile.kid & 0x80) > 0) {
+        if (currentAppl == null
+            || (pin = currentAppl.pins.get(currentFile.kid)) == null
+            || pin.state != PIN.STATE_PIN_VERIFIED) {
+          return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+        }
+      } else {
+        if ((pin = globalPins.get(currentFile.kid)) == null
+          || pin.state != PIN.STATE_PIN_VERIFIED) {
+          return new ResponseAPDU(new byte[] {(byte) 0x69, (byte) 0x82});
+        }
+      }
+    }
+    
+    if (command.getNe() == 256 || command.getNe() <= currentFile.file.length - offset) {
+      int len = Math.min(command.getNe(), currentFile.file.length - offset);
+      byte[] response = new byte[len + 2];
+      System.arraycopy(currentFile.file, offset, response, 0, len);
+      response[len] = (byte) 0x90;
+      response[len + 1] = (byte) 0x00;
+      return new ResponseAPDU(response);
+    } else if (command.getNe() >= currentFile.file.length - offset) {
+      return new ResponseAPDU(new byte[] {(byte) 0x62, (byte) 0x82});
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+    }
+    
+  }
+
+  
+  @Override
+  public ResponseAPDU transmit(CommandAPDU command) throws CardException {
+  
+    if (command.getCLA() == 0x00) {
+  
+      switch (command.getINS()) {
+  
+      // SELECT
+      case 0xA4:
+        return cmdSELECT(command);
+      
+      // READ BINARY
+      case 0xB0:
+        return cmdREAD_BINARY(command);
+      
+      // VERIFY
+      case 0x20:
+        return cmdVERIFY(command);
+      
+      // MANAGE SECURITY ENVIRONMENT
+      case 0x22: {
+        if (currentAppl != null) {
+          return currentAppl.cmdMANAGE_SECURITY_ENVIRONMENT(command, this);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05}); 
+        }
+      }
+      
+      // CHANGE REFERENCE DATA
+      case 0x24: {
+        return cmdCHANGE_REFERENCE_DATA(command);
+      }
+      
+      // PERFORM SECURITY OPERATION
+      case 0x2A: {
+        if (currentAppl != null) {
+          return currentAppl.cmdPERFORM_SECURITY_OPERATION(command, this);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+  
+      // INTERNAL AUTHENTICATE
+      case 0x88: {
+        if (currentAppl != null) {
+          return currentAppl.cmdINTERNAL_AUTHENTICATE(command, this);
+        } else {
+          return new ResponseAPDU(new byte[] {(byte) 0x6F, (byte) 0x05});
+        }
+      }
+      
+      default:
+        return new ResponseAPDU(new byte[] { (byte) 0x6D, (byte) 0x00});
+      }
+  
+    } else {
+      return new ResponseAPDU(new byte[] { (byte) 0x6E, (byte) 0x00}); 
+    }
+  
+  }
+
+  protected ResponseAPDU verifyPin(int kid, byte[] reference) {
+    
+    PIN pin;
+    if ((kid & 0x80) > 0 && currentAppl != null) {
+      pin = currentAppl.pins.get(kid);
+    } else {
+      pin = globalPins.get(kid);
+    }
+    
+    if (pin != null) {
+  
+      if (reference.length == 0) {
+        return new ResponseAPDU(new byte[] { (byte) 0x63, (byte) (pin.kfpc | 0xC0)});
+      }
+      
+      if (reference.length != 8) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+      
+      if (Arrays.equals(reference, pin.pin)) {
+        switch (pin.state) {
+        case PIN.STATE_PIN_BLOCKED:
+          return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x83 });
+  
+        case PIN.STATE_RESET:
+          pin.state = PIN.STATE_PIN_VERIFIED;
+          
+        default:
+          pin.kfpc = 10;
+          return new ResponseAPDU(new byte[] { (byte) 0x90, (byte) 0x00 });
+        }
+      } else {
+        switch (pin.state) {
+        case PIN.STATE_PIN_BLOCKED:
+          return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x83 });
+        
+        default:
+          if (--pin.kfpc > 0) {
+            return new ResponseAPDU(new byte[] { (byte) 0x63, (byte) (pin.kfpc | 0xC0)});
+          } else {
+            pin.state = PIN.STATE_PIN_BLOCKED;
+            return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x83 });
+          }
+        }
+        
+      }
+      
+    } else {
+      return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x00});
+    }
+    
+  }
+
+  protected ResponseAPDU cmdVERIFY(CommandAPDU command) throws CardException {
+    
+    if (command.getINS() != 0x20) {
+      throw new IllegalArgumentException("INS has to be 0x20.");
+    }
+    
+    if (command.getP1() != 00) {
+      return new ResponseAPDU(new byte[] {(byte) 0x6B, (byte) 0x00});
+    }
+    
+    return verifyPin(command.getP2(), command.getData());
+  
+  }
+
+  protected ResponseAPDU cmdCHANGE_REFERENCE_DATA(CommandAPDU command) {
+    
+    if (command.getINS() != 0x24) {
+      throw new IllegalArgumentException("INS has to be 0x24.");
+    }
+
+    byte[] data = command.getData();
+
+    ResponseAPDU response;
+    
+    if (command.getP1() == 0x01) {
+    
+      if (data.length != 8) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+      
+      response = verifyPin(0xFF & command.getP2(), data);
+
+    } else if (command.getP1() == 0x00) {
+      
+      if (data.length != 16) {
+        return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
+      }
+  
+      response = verifyPin(0xFF & command.getP2(), Arrays.copyOf(data, 8));
+    
+    } else {
+      return new ResponseAPDU(new byte[] { (byte) 0x6A, (byte) 0x81 });
+    }
+     
+    if (response.getSW() == 0x9000) {
+      PIN pin;
+      if (currentAppl != null) {
+        pin = currentAppl.pins.get(command.getP2());
+      } else {
+        pin = globalPins.get(command.getP2());
+      }
+      pin.pin = Arrays.copyOfRange(data, 8, 16);
+    }
+
+    return response;
+    
+  }
+  
+  public void setPin(int kid, char[] value) {
+    PIN pin = globalPins.get(kid);
+    if (pin != null) {
+      if (value == null) {
+        pin.pin = null;
+      } else {
+        byte[] b = new byte[8];
+        b[0] = (byte) (0x20 | value.length);
+        for(int i = 1, j = 0; i < b.length; i++) {
+          int h = ((j < value.length) 
+                  ? Character.digit(value[j++], 10) 
+                  : 0x0F);
+          int l = ((j < value.length) 
+                  ? Character.digit(value[j++], 10) 
+                  : 0x0F);
+          b[i] = (byte) ((h << 4) | l);
+        }
+        pin.pin = b;
+      }
+    }
+  }
+
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java
new file mode 100644
index 00000000..7b2f3fbe
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java
@@ -0,0 +1,50 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+
+import javax.smartcardio.ATR;
+
+import at.gv.egiz.smcc.CardChannelEmul;
+import at.gv.egiz.smcc.CardEmul;
+
+@SuppressWarnings("restriction")
+public class STARCOSCardEmul extends CardEmul {
+  
+  protected static ATR ATR = new ATR(new byte[] {
+      (byte) 0x3b, (byte) 0xbd, (byte) 0x18, (byte) 0x00, (byte) 0x81, (byte) 0x31, (byte) 0xfe, (byte) 0x45, 
+      (byte) 0x80, (byte) 0x51, (byte) 0x02, (byte) 0x67, (byte) 0x05, (byte) 0x18, (byte) 0xb1, (byte) 0x02, 
+      (byte) 0x02, (byte) 0x02, (byte) 0x01, (byte) 0x81, (byte) 0x05, (byte) 0x31
+  });
+  
+  public STARCOSCardEmul() {
+    applications.add(new STARCOSApplSichereSignatur((STARCOSCardChannelEmul) channel));
+    applications.add(new STARCOSApplInfobox((STARCOSCardChannelEmul) channel));
+    applications.add(new STARCOSApplGewoehnlicheSignatur((STARCOSCardChannelEmul) channel));
+  }
+
+  @Override
+  public ATR getATR() {
+    return ATR;
+  }
+
+  @Override
+  protected CardChannelEmul newCardChannel(CardEmul cardEmul) {
+    return new STARCOSCardChannelEmul(this);
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
new file mode 100644
index 00000000..0fb4f62d
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
@@ -0,0 +1,297 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+
+import javax.smartcardio.CardChannel;
+
+import org.junit.Test;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.CardNotSupportedException;
+import at.gv.egiz.smcc.CardTerminalEmul;
+import at.gv.egiz.smcc.CardTest;
+import at.gv.egiz.smcc.LockedException;
+import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINMgmtSignatureCard;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.STARCOSCard;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.SignatureCardFactory;
+import at.gv.egiz.smcc.CardTest.TestChangePINProvider;
+import at.gv.egiz.smcc.CardTest.TestPINProvider;
+import at.gv.egiz.smcc.SignatureCard.KeyboxName;
+import at.gv.egiz.smcc.acos.A03ApplDEC;
+import at.gv.egiz.smcc.acos.A04ApplDEC;
+import at.gv.egiz.smcc.acos.A04ApplSIG;
+import at.gv.egiz.smcc.acos.ACOSAppl;
+import at.gv.egiz.smcc.acos.ACOSApplDEC;
+import at.gv.egiz.smcc.acos.ACOSApplSIG;
+
+public class STARCOSCardTest extends CardTest {
+
+  @Override
+  protected SignatureCard createSignatureCard()
+      throws CardNotSupportedException {
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    STARCOSCardEmul card = new STARCOSCardEmul();
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+    assertTrue(signatureCard instanceof PINMgmtSignatureCard);
+    return signatureCard;
+  }
+  
+  @Test
+  public void testGetInfoboxIdentityLinkEmpty() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    char[] pin = "0000".toCharArray();
+    
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSApplInfobox appl = (STARCOSApplInfobox) card.getApplication(STARCOSAppl.AID_Infobox);
+    appl.clearInfobox();
+
+    byte[] idlink = signatureCard.getInfobox("IdentityLink",
+        new TestPINProvider(pin), null);
+    assertNull(idlink);
+
+  }
+
+  @Test(expected = SignatureCardException.class)
+  public void testGetInfoboxIdentityInvalid() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    char[] pin = "0000".toCharArray();
+    
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSApplInfobox appl = (STARCOSApplInfobox) card.getApplication(STARCOSAppl.AID_Infobox);
+    appl.setInfoboxHeader((byte) 0xFF);
+
+    signatureCard.getInfobox("IdentityLink", new TestPINProvider(pin), null);
+
+  }
+ 
+  @Test
+  public void testGetCerts() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    SignatureCard signatureCard = createSignatureCard();
+
+    byte[] cert;
+
+    cert = signatureCard.getCertificate(KeyboxName.SECURE_SIGNATURE_KEYPAIR);
+    assertNotNull(cert);
+    assertTrue(Arrays.equals(cert, STARCOSApplSichereSignatur.C_X509_CH_DS));
+
+    cert = signatureCard.getCertificate(KeyboxName.CERITIFIED_KEYPAIR);
+    assertNotNull(cert);
+    assertTrue(Arrays.equals(cert, STARCOSApplGewoehnlicheSignatur.C_X509_CH_AUT));
+
+  }
+
+  @Test(expected = NotActivatedException.class)
+  public void testGetDSCertEmpty() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
+    appl.clearCert();
+
+    signatureCard.getCertificate(KeyboxName.SECURE_SIGNATURE_KEYPAIR);
+
+  }
+
+  @Test(expected = NotActivatedException.class)
+  public void testGetAUTCertEmpty() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSApplGewoehnlicheSignatur appl = (STARCOSApplGewoehnlicheSignatur) card.getApplication(STARCOSApplGewoehnlicheSignatur.AID_GewoehnlicheSignatur);
+    appl.clearCert();
+
+    signatureCard.getCertificate(KeyboxName.CERITIFIED_KEYPAIR);
+
+  }
+  
+  @Test
+  public void testSignSichereSignatur() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    char[] pin = "123456".toCharArray();
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
+    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, pin);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    byte[] signature = signatureCard.createSignature(hash,
+        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin));
+
+    assertNotNull(signature);
+
+  }
+
+  @Test
+  public void testSignGewoehnlicheSignatur() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    char[] pin = "1234".toCharArray();
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
+    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, pin);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    byte[] signature = signatureCard.createSignature(hash,
+        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin));
+
+    assertNotNull(signature);
+
+  }
+  
+  @Test(expected = LockedException.class)
+  public void testSignSichereSignaturInvalidPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignGewoehnlicheSignaturInvalidPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("1234".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignSichereSignaturBlockedPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
+    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, null);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+    assertTrue(pinProvider.getProvided() <= 0);
+
+    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider);
+
+  }
+
+  @Test(expected = LockedException.class)
+  public void testSignGewoehnlicheSignaturBlockedPin() throws SignatureCardException,
+      InterruptedException, CardNotSupportedException,
+      NoSuchAlgorithmException, UnsupportedEncodingException {
+
+    SignatureCard signatureCard = createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
+    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, null);
+
+    MessageDigest md = MessageDigest.getInstance("SHA-1");
+    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
+
+    TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
+
+    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider);
+
+  }
+  
+  @Test
+  public void testChangePin() throws CardNotSupportedException,
+      LockedException, NotActivatedException, CancelledException,
+      PINFormatException, SignatureCardException, InterruptedException {
+
+    char[] defaultPin = "123456".toCharArray();
+
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
+    CardEmul card = (CardEmul) signatureCard.getCard();
+    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
+    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, defaultPin);
+    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
+    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, defaultPin);
+    
+    for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
+
+      char[] pin = defaultPin;
+
+      for (int i = pinSpec.getMinLength(); i <= pinSpec.getMaxLength(); i++) {
+        signatureCard.verifyPIN(pinSpec, new TestPINProvider(pin));
+        char[] newPin = new char[i];
+        Arrays.fill(newPin, '0');
+        signatureCard
+            .changePIN(pinSpec, new TestChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new TestPINProvider(newPin));
+        pin = newPin;
+      }
+
+    }
+
+  }
+
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/util/ISO7816UtilsTest.java b/smcc/src/test/java/at/gv/egiz/smcc/util/ISO7816UtilsTest.java
new file mode 100644
index 00000000..679f2c02
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/util/ISO7816UtilsTest.java
@@ -0,0 +1,175 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.util;
+
+import java.util.Arrays;
+
+import javax.smartcardio.CommandAPDU;
+
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+import org.junit.Test;
+
+import at.gv.egiz.smcc.VerifyAPDUSpec;
+import at.gv.egiz.smcc.util.ISO7816Utils;
+import static org.junit.Assert.*;
+
+public class ISO7816UtilsTest {
+  
+  @Test
+  public void testFormatPIN() {
+    
+    formatPIN(VerifyAPDUSpec.PIN_FORMAT_BINARY,
+        VerifyAPDUSpec.PIN_JUSTIFICATION_LEFT, 7, "1234",
+        new byte[] {
+        (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0x04, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        },
+        new byte[] {
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        }
+    );
+
+    formatPIN(VerifyAPDUSpec.PIN_FORMAT_BINARY,
+        VerifyAPDUSpec.PIN_JUSTIFICATION_RIGHT, 7, "12345",
+        new byte[] {
+        (byte) 0x00, (byte) 0x00, (byte) 0x05, (byte) 0x04, (byte) 0x03, (byte) 0x02, (byte) 0x01
+        },
+        new byte[] {
+        (byte) 0x00, (byte) 0x00, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff
+        }
+    );
+
+    formatPIN(VerifyAPDUSpec.PIN_FORMAT_BCD,
+        VerifyAPDUSpec.PIN_JUSTIFICATION_LEFT, 7, "12345",
+        new byte[] {
+        (byte) 0x12, (byte) 0x34, (byte) 0x50, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        },
+        new byte[] {
+        (byte) 0xff, (byte) 0xff, (byte) 0xf0, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        }
+    );
+
+    formatPIN(VerifyAPDUSpec.PIN_FORMAT_BCD,
+        VerifyAPDUSpec.PIN_JUSTIFICATION_RIGHT, 7, "1234567",
+        new byte[] {
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x07, (byte) 0x65, (byte) 0x43, (byte) 0x21
+        },
+        new byte[] {
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x0f, (byte) 0xff, (byte) 0xff, (byte) 0xff
+        }
+    );
+
+    formatPIN(VerifyAPDUSpec.PIN_FORMAT_ASCII,
+        VerifyAPDUSpec.PIN_JUSTIFICATION_LEFT, 7, "1234",
+        new byte[] {
+        (byte) 0x31, (byte) 0x32, (byte) 0x33, (byte) 0x34, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        },
+        new byte[] {
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        }
+    );
+
+    formatPIN(VerifyAPDUSpec.PIN_FORMAT_ASCII,
+        VerifyAPDUSpec.PIN_JUSTIFICATION_RIGHT, 7, "12345",
+        new byte[] {
+        (byte) 0x00, (byte) 0x00, (byte) 0x35, (byte) 0x34, (byte) 0x33, (byte) 0x32, (byte) 0x31
+        },
+        new byte[] {
+        (byte) 0x00, (byte) 0x00, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff
+        }
+    );
+
+    
+  }
+  
+  private void formatPIN(int pinFormat, int pinJusitification, int pinLength, String pin, byte[] rfpin, byte[] rmask) {
+
+    byte[] fpin = new byte[pinLength];
+    byte[] mask = new byte[pinLength];
+    
+    ISO7816Utils.formatPIN(pinFormat, pinJusitification, fpin, mask, pin.toCharArray());
+    
+//    System.out.println(toString(fpin));
+//    System.out.println(toString(mask));
+    
+    assertTrue(Arrays.equals(fpin, rfpin));
+    assertTrue(Arrays.equals(mask, rmask));
+    
+  }
+  
+  @Test
+  public void testCreateVerifyAPDU() {
+    
+    VerifyAPDUSpec verifyAPDUSpec;
+    CommandAPDU apdu;
+    byte[] ref;
+    
+    verifyAPDUSpec = new VerifyAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x00, (byte) 0x80, (byte) 0x08,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
+    
+    apdu = ISO7816Utils.createVerifyAPDU(verifyAPDUSpec, "1234".toCharArray());
+    
+//    System.out.println(toString(apdu.getBytes()));
+    
+    ref = new byte[] { (byte) 0x00, (byte) 0x20, (byte) 0x00, (byte) 0x80,
+        (byte) 0x08, (byte) 0x24, (byte) 0x12, (byte) 0x34, (byte) 0xff,
+        (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff };
+    
+    assertTrue(Arrays.equals(apdu.getBytes(), ref));
+    
+    ref = new byte[] { (byte) 0x00, (byte) 0x20, (byte) 0x00, (byte) 0x80,
+        (byte) 0x08, (byte) 0x31, (byte) 0x32, (byte) 0x33, (byte) 0x34,
+        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00 };
+    
+    verifyAPDUSpec = new VerifyAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x00, (byte) 0x80, (byte) 0x08,
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00 }, 
+        0, VerifyAPDUSpec.PIN_FORMAT_ASCII, 8);
+
+    apdu = ISO7816Utils.createVerifyAPDU(verifyAPDUSpec, "1234".toCharArray());
+
+//    System.out.println(toString(apdu.getBytes()));
+    
+    assertTrue(Arrays.equals(apdu.getBytes(), ref));
+
+  }
+  
+  private String toString(byte[] b) {
+    StringBuffer sb = new StringBuffer();
+    if (b != null && b.length > 0) {
+      sb.append(Integer.toHexString((b[0] & 240) >> 4));
+      sb.append(Integer.toHexString(b[0] & 15));
+    }
+    for (int i = 1; i < b.length; i++) {
+      sb.append(':');
+      sb.append(Integer.toHexString((b[i] & 240) >> 4));
+      sb.append(Integer.toHexString(b[i] & 15));
+    }
+    return sb.toString();
+  }
+
+
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
index eeb97290..32e990c5 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
@@ -53,8 +53,8 @@ public class InfoBoxReadRequestHandler extends AbstractRequestHandler {
                   .getCardPINProvider(),
                   infoBox.getDomainIdentifier());
           if (resp == null) {
-            log.info("Got null as result->user cancelled");
-            return new ErrorResponse(6001);
+            log.info("Infobox doesn't contain any data. Assume card is not activated.");
+            throw new NotActivatedException();
           } else {
             try {
               resp = DomainIdConverter.convertDomainId(resp, infoBox
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index 1c1cb833..36880e68 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -1,6 +1,5 @@
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.ccid.CCID;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -10,17 +9,18 @@ import javax.smartcardio.CardTerminal;
 
 import org.junit.Assert;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Test;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.smccstal.AbstractSMCCSTAL;
 import at.gv.egiz.bku.smccstal.SMCCSTALRequestHandler;
+import at.gv.egiz.smcc.ccid.CCID;
 import at.gv.egiz.stal.ErrorResponse;
 import at.gv.egiz.stal.InfoboxReadRequest;
 import at.gv.egiz.stal.InfoboxReadResponse;
 import at.gv.egiz.stal.STALRequest;
 import at.gv.egiz.stal.STALResponse;
-import org.junit.Ignore;
 
 public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
     SMCCSTALRequestHandler {
@@ -87,32 +87,11 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       
     }
 
-
-      @Override
-      public List<PINSpec> getPINSpecs() {
-        return new ArrayList<PINSpec>();
-      }
-
-      @Override
-      public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider) {
-      }
-
-      @Override
-      public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider) {
-      }
-
-      @Override
-      public void activatePIN(PINSpec pinSpec, PINProvider pinProvider) {
-      }
-
-      @Override
-      public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider) {
-      }
-
-      @Override
-      public CCID getReader() {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
+    @Override
+    public CCID getReader() {
+      // TODO Auto-generated method stub
+      return null;
+    }
 
    };
     return false;
-- 
cgit v1.2.3


From 68941b57df2caeead67a5bede2ef5a635d07db32 Mon Sep 17 00:00:00 2001
From: mcentner <mcentner@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Wed, 11 Nov 2009 15:51:08 +0000
Subject: Added support for SHA-256 and partial support for e-card G3, BELPIC
 and Italian cards.

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@540 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../at/gv/egiz/stal/util/JCEAlgorithmNames.java    |  51 ----
 .../java/at/gv/egiz/bku/conf/Configurator.java     |  71 +++--
 .../at/gv/egiz/bku/slcommands/impl/STALHelper.java |  26 +-
 .../impl/xsect/AlgorithmMethodFactoryImpl.java     |  86 ++++--
 .../bku/slcommands/impl/xsect/STALProvider.java    |   6 +-
 .../egiz/bku/slcommands/impl/xsect/Signature.java  |  23 +-
 .../slexceptions/SLExceptionMessages.properties    |   2 +-
 .../slexceptions/SLExceptionMessages_en.properties |   2 +-
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   |  55 +++-
 smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java | 283 ++++++++++++++++++++
 smcc/src/main/java/at/gv/egiz/smcc/ITCard.java     | 297 +++++++++++++++++++++
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java | 192 +++++++++----
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     |   8 +-
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |  11 +-
 .../java/at/gv/egiz/smcc/SignatureCardFactory.java |  96 +++++--
 .../java/at/gv/egiz/smcc/util/ISO7816Utils.java    |  11 +-
 .../at/gv/egiz/smcc/BELPICCard.properties          |   3 +
 .../resources/at/gv/egiz/smcc/ITCard.properties    |   3 +
 smcc/src/test/java/at/gv/egiz/smcc/CardTest.java   |  62 ++---
 .../java/at/gv/egiz/smcc/acos/ACOSCardTest.java    |  62 ++---
 .../at/gv/egiz/smcc/starcos/STARCOSCardTest.java   |  62 ++---
 .../gv/egiz/bku/smccstal/SignRequestHandler.java   |  21 +-
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |   5 +-
 .../gv/egiz/xades/QualifyingPropertiesFactory.java |  15 +-
 24 files changed, 1145 insertions(+), 308 deletions(-)
 delete mode 100644 STAL/src/main/java/at/gv/egiz/stal/util/JCEAlgorithmNames.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ITCard.java
 create mode 100644 smcc/src/main/resources/at/gv/egiz/smcc/BELPICCard.properties
 create mode 100644 smcc/src/main/resources/at/gv/egiz/smcc/ITCard.properties

(limited to 'smccSTAL/src/test/java/at')

diff --git a/STAL/src/main/java/at/gv/egiz/stal/util/JCEAlgorithmNames.java b/STAL/src/main/java/at/gv/egiz/stal/util/JCEAlgorithmNames.java
deleted file mode 100644
index c162eed4..00000000
--- a/STAL/src/main/java/at/gv/egiz/stal/util/JCEAlgorithmNames.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
-* Copyright 2008 Federal Chancellery Austria and
-* Graz University of Technology
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
-package at.gv.egiz.stal.util;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * Maps XML Algorithms to JCE Hash names.
- * 
- */
-public class JCEAlgorithmNames {
-
-  private Map<String, String> hashNameMap = new HashMap<String, String>();
-
-  public static String[] JCE_HASH_NAMES = { "SHA-1" };
-  
-  public static String[] SHA_1_ALGORITMS = {
-      "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1",
-      "http://www.w3.org/2000/09/xmldsig#rsa-sha1" };
-
-  private static JCEAlgorithmNames instance = new JCEAlgorithmNames();
-
-  private JCEAlgorithmNames() {
-    for (String alg : SHA_1_ALGORITMS) {
-      registerHash(alg, JCE_HASH_NAMES[0]);
-    }
-  }
-
-  public static String getJCEHashName(String xmlAlgorithmURI) {
-     return instance.hashNameMap.get(xmlAlgorithmURI);
-  }
-
-  public void registerHash(String xmlAlgorithmURI, String jceName) {
-    hashNameMap.put(xmlAlgorithmURI, jceName);
-  }
-}
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java b/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java
index 41c2512f..50f5d2b4 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java
@@ -166,31 +166,62 @@ public abstract class Configurator {
 
   protected void configureProviders() {
     log.debug("Registering security providers");
-    Security.insertProviderAt(new IAIK(), 1);
-    Security.insertProviderAt(new ECCProvider(false), 2);
+    
+    IAIK iaikProvider = new IAIK();
+    if (Security.getProvider(iaikProvider.getName()) == null) {
+      // register IAIK provider at first position
+      Security.insertProviderAt(iaikProvider, 1);
+    } else {
+      // IAIK provider already registered
+      log.info("Provider " + iaikProvider.getName() + " already registered.");
+    }
+
+    ECCProvider eccProvider = new ECCProvider(false);
+    if (Security.getProvider(eccProvider.getName()) == null) {
+      // register ECC Provider at second position
+      Security.insertProviderAt(eccProvider, 2);
+    } else {
+      // ECC Provider already registered
+      log.info("Provider " + eccProvider.getName() + " already registered."); 
+    }
 
     // registering STALProvider as delegation provider for XSECT
     STALProvider stalProvider = new STALProvider();
-    Set<Service> services = stalProvider.getServices();
-    StringBuilder sb = new StringBuilder();
-    for (Service service : services) {
-      String algorithm = service.getType() + "." + service.getAlgorithm();
-      XSecProvider.setDelegationProvider(algorithm, stalProvider.getName());
-      sb.append("\n" + algorithm);
+    if (Security.getProvider(stalProvider.getName()) == null) {
+      // register STAL provider
+      Set<Service> services = stalProvider.getServices();
+      StringBuilder sb = new StringBuilder();
+      for (Service service : services) {
+        String algorithm = service.getType() + "." + service.getAlgorithm();
+        XSecProvider.setDelegationProvider(algorithm, stalProvider.getName());
+        sb.append("\n" + algorithm);
+      }
+      log
+          .debug("Registered STALProvider as XSecProvider delegation provider for the following services : "
+              + sb.toString());
+
+      Security.addProvider(stalProvider);
+    } else {
+      // STAL Provider already registered
+      log.info("Provider " + stalProvider.getName() + " already registered."); 
     }
-    log
-        .debug("Registered STALProvider as XSecProvider delegation provider for the following services : "
-            + sb.toString());
-
-    Security.addProvider(stalProvider);
-    XSecProvider.addAsProvider(false);
-    sb = new StringBuilder();
-    sb.append("Registered providers: ");
-    int i = 1;
-    for (Provider prov : Security.getProviders()) {
-      sb.append((i++) + ". : " + prov);
+    
+    if (Security.getProvider(XSecProvider.NAME) == null) {
+      // register XML Security provider
+      XSecProvider.addAsProvider(false);
+    } else {
+      log.info("Provider " + XSecProvider.NAME + " already registered.");
+    }
+    
+    if (log.isDebugEnabled()) {
+      StringBuilder sb = new StringBuilder();
+      sb.append("Registered providers: ");
+      int i = 1;
+      for (Provider prov : Security.getProviders()) {
+        sb.append((i++) + ". : " + prov);
+      }
+      log.debug(sb.toString());
     }
-    log.debug(sb.toString());
   }
 
   protected void configViewer() {
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java
index 0c7ce3f5..e903c608 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/STALHelper.java
@@ -18,8 +18,15 @@ package at.gv.egiz.bku.slcommands.impl;
 
 import iaik.asn1.CodingException;
 import iaik.asn1.DerCoder;
+import iaik.utils.Base64OutputStream;
 
 import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.OutputStreamWriter;
+import java.io.StringWriter;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
@@ -174,7 +181,24 @@ public class STALHelper {
       try {
         certificates.add((X509Certificate) certFactory.generateCertificate(new ByteArrayInputStream(cert)));
       } catch (CertificateException e) {
-        log.info("Failed to decode certificate.", e);
+        if (log.isDebugEnabled()) {
+          ByteArrayOutputStream certDump = new ByteArrayOutputStream();
+          OutputStreamWriter writer = new OutputStreamWriter(certDump);
+          try {
+            writer.write("-----BEGIN CERTIFICATE-----\n");
+            writer.flush();
+            Base64OutputStream b64os = new Base64OutputStream(certDump);
+            b64os.write(cert);
+            b64os.flush();
+            writer.write("\n-----END CERTIFICATE-----");
+            writer.flush();
+          } catch (IOException e1) {
+            log.info("Failed to decode certificate.", e);
+          }
+          log.debug("Failed to decode certificate.\n" + certDump.toString(), e);
+        } else {
+          log.info("Failed to decode certificate.", e);
+        }
         throw new SLCommandException(4000,
             SLExceptionMessages.EC4000_UNCLASSIFIED_INFOBOX_INVALID,
             new Object[] { "Certificates" });
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/AlgorithmMethodFactoryImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/AlgorithmMethodFactoryImpl.java
index 6b963465..061fe707 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/AlgorithmMethodFactoryImpl.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/AlgorithmMethodFactoryImpl.java
@@ -16,18 +16,23 @@
 */
 package at.gv.egiz.bku.slcommands.impl.xsect;
 
-import iaik.xml.crypto.XmldsigMore;
-
-import java.security.InvalidAlgorithmParameterException;
-import java.security.NoSuchAlgorithmException;
-import java.security.cert.X509Certificate;
-
-import javax.xml.crypto.dsig.CanonicalizationMethod;
-import javax.xml.crypto.dsig.DigestMethod;
-import javax.xml.crypto.dsig.SignatureMethod;
-import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
-import javax.xml.crypto.dsig.spec.DigestMethodParameterSpec;
-import javax.xml.crypto.dsig.spec.SignatureMethodParameterSpec;
+import iaik.security.ecc.interfaces.ECDSAParams;
+import iaik.xml.crypto.XmldsigMore;
+
+import java.security.InvalidAlgorithmParameterException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPublicKey;
+import java.security.spec.ECParameterSpec;
+
+import javax.xml.crypto.dsig.CanonicalizationMethod;
+import javax.xml.crypto.dsig.DigestMethod;
+import javax.xml.crypto.dsig.SignatureMethod;
+import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
+import javax.xml.crypto.dsig.spec.DigestMethodParameterSpec;
+import javax.xml.crypto.dsig.spec.SignatureMethodParameterSpec;
 
 /**
  * An implementation of the AlgorithmMethod factory that uses the signing
@@ -40,7 +45,12 @@ public class AlgorithmMethodFactoryImpl implements AlgorithmMethodFactory {
   /**
    * The signature algorithm URI.
    */
-  private String signatureAlgorithmURI;
+  private String signatureAlgorithmURI;
+  
+  /**
+   * the digest algorithm URI.
+   */
+  private String digestAlgorithmURI = DigestMethod.SHA1;
 
   /**
    * The algorithm parameters for the signature algorithm.
@@ -51,23 +61,55 @@ public class AlgorithmMethodFactoryImpl implements AlgorithmMethodFactory {
    * Creates a new AlgrithmMethodFactory with the given
    * <code>signingCertificate</code>.
    * 
-   * @param siginingCertificate
+   * @param signingCertificate
    * 
    * @throws NoSuchAlgorithmException
    *           if the public key algorithm of the given
    *           <code>signingCertificate</code> is not supported
    */
-  public AlgorithmMethodFactoryImpl(X509Certificate siginingCertificate)
+  public AlgorithmMethodFactoryImpl(X509Certificate signingCertificate)
       throws NoSuchAlgorithmException {
-
-    String algorithm = siginingCertificate.getPublicKey().getAlgorithm();
+
+    PublicKey publicKey = signingCertificate.getPublicKey();
+    String algorithm = publicKey.getAlgorithm();
 
     if ("DSA".equals(algorithm)) {
       signatureAlgorithmURI = SignatureMethod.DSA_SHA1;
-    } else if ("RSA".equals(algorithm)) {
-      signatureAlgorithmURI = SignatureMethod.RSA_SHA1;
-    } else if (("EC".equals(algorithm)) || ("ECDSA".equals(algorithm))) {
-      signatureAlgorithmURI = XmldsigMore.SIGNATURE_ECDSA_SHA1;
+    } else if ("RSA".equals(algorithm)) {
+      
+      int keyLength = 0;
+      if (publicKey instanceof RSAPublicKey) {
+        keyLength = ((RSAPublicKey) publicKey).getModulus().bitLength();
+      }
+      
+      if (keyLength >= 2048) {
+        signatureAlgorithmURI = XmldsigMore.SIGNATURE_RSA_SHA256;
+        digestAlgorithmURI = DigestMethod.SHA256;
+      } else {
+        signatureAlgorithmURI = SignatureMethod.RSA_SHA1;
+      }
+      
+    } else if (("EC".equals(algorithm)) || ("ECDSA".equals(algorithm))) {
+      
+      int fieldSize = 0;
+      if (publicKey instanceof iaik.security.ecc.ecdsa.ECPublicKey) {
+        ECDSAParams params = ((iaik.security.ecc.ecdsa.ECPublicKey) publicKey).getParameter();
+        fieldSize = params.getG().getCurve().getField().getSize().bitLength();
+      } else if (publicKey instanceof ECPublicKey) {
+        ECParameterSpec params = ((ECPublicKey) publicKey).getParams();
+        fieldSize = params.getCurve().getField().getFieldSize();
+      }
+      
+      if (fieldSize < 256) {
+        signatureAlgorithmURI = XmldsigMore.SIGNATURE_ECDSA_SHA1;
+      } else if (fieldSize < 512) {
+        signatureAlgorithmURI = XmldsigMore.SIGNATURE_ECDSA_SHA256;
+        digestAlgorithmURI = DigestMethod.SHA256;
+      } else {
+        signatureAlgorithmURI = XmldsigMore.SIGNATURE_ECDSA_SHA512;
+        digestAlgorithmURI = DigestMethod.SHA512;
+      }
+      
     } else {
       throw new NoSuchAlgorithmException("Public key algorithm '" + algorithm
           + "' not supported.");
@@ -104,7 +146,7 @@ public class AlgorithmMethodFactoryImpl implements AlgorithmMethodFactory {
       throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
 
     return signatureContext.getSignatureFactory().newDigestMethod(
-        DigestMethod.SHA1, (DigestMethodParameterSpec) null);
+        digestAlgorithmURI, (DigestMethodParameterSpec) null);
   }
 
   /*
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/STALProvider.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/STALProvider.java
index 0ab30530..42c6a4c5 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/STALProvider.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/STALProvider.java
@@ -49,7 +49,11 @@ public class STALProvider extends Provider {
     map.put("Signature." + SignatureMethod.RSA_SHA1,
         IMPL_PACKAGE_NAME + ".STALSignature");
     map.put("Signature." + XmldsigMore.SIGNATURE_ECDSA_SHA1, 
-        IMPL_PACKAGE_NAME + ".STALSignature");
+        IMPL_PACKAGE_NAME + ".STALSignature");
+    map.put("Signature." + XmldsigMore.SIGNATURE_RSA_SHA256, 
+        IMPL_PACKAGE_NAME + ".STALSignature");
+    map.put("Signature." + XmldsigMore.SIGNATURE_ECDSA_SHA256, 
+        IMPL_PACKAGE_NAME + ".STALSignature");
 
     AccessController.doPrivileged(new PrivilegedAction<Void>() {
       @Override
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
index 26ddb153..3cebb6a3 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
@@ -628,9 +628,20 @@ public class Signature {
     
     String target = "#" + signatureId;
     
+    DigestMethod dm;
+    try {
+      dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get DigestMethod algorithm.", e);
+      throw new SLCommandException(4006);
+    } catch (InvalidAlgorithmParameterException e) {
+      log.error("Failed to get DigestMethod algorithm.", e);
+      throw new SLCommandException(4006);
+    }
+    
     JAXBElement<QualifyingPropertiesType> qualifyingProperties;
     try {
-      qualifyingProperties = factory.createQualifyingProperties111(target, date, signingCertificates, idValue, dataObjectFormats);
+      qualifyingProperties = factory.createQualifyingProperties111(target, date, signingCertificates, idValue, dataObjectFormats, dm);
     } catch (QualifyingPropertiesException e) {
       log.error("Failed to create QualifyingProperties.", e);
       throw new SLCommandException(4000);
@@ -665,7 +676,10 @@ public class Signature {
     String referenceURI = "#xmlns(xades=http://uri.etsi.org/01903/v1.1.1%23)%20xpointer(id('"
         + objectIdValue
         + "')/child::xades:QualifyingProperties/child::xades:SignedProperties)";
-    DigestMethod dm;
+    
+    String referenceIdValue = ctx.getIdValueFactory().createIdValue("Reference");
+    String referenceType = QualifyingPropertiesFactory.SIGNED_PROPERTIES_REFERENCE_TYPE_V1_1_1;
+    
     try {
       dm = ctx.getAlgorithmMethodFactory().createDigestMethod(ctx);
     } catch (NoSuchAlgorithmException e) {
@@ -675,10 +689,7 @@ public class Signature {
       log.error("Failed to get DigestMethod algorithm.", e);
       throw new SLCommandException(4006);
     }
-    
-    String referenceIdValue = ctx.getIdValueFactory().createIdValue("Reference");
-    String referenceType = QualifyingPropertiesFactory.SIGNED_PROPERTIES_REFERENCE_TYPE_V1_1_1;
-    
+
     Reference reference = ctx.getSignatureFactory().newReference(referenceURI, dm, null, referenceType, referenceIdValue);
     
     references.add(reference);
diff --git a/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages.properties b/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages.properties
index db56184e..c5bfce18 100644
--- a/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages.properties
+++ b/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages.properties
@@ -91,7 +91,7 @@ ec3002.invalid=XML-Struktur der Befehlsanfrage entspricht nicht dem Schema des S
 # 4xxx
 #
 
-ec4000.infobox.invalid=Die Infobox '{0}' enthält ungültige Daten.
+ec4000.infobox.invalid=Die Infobox {0} enthält ungültige Daten.
 ec4000.idlink.transfomation.failed=Die komprimierte Personenbindung konnte mit dem Stylesheet {0} nicht transformiert werden.
 ec4002.infobox.unknown=Unbekannter Infoboxbezeichner {0}.
 ec4003.not.resolved=Zu signierendes Datum kann nicht aufgelöst werden (URI={0}).
diff --git a/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages_en.properties b/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages_en.properties
index 6c67ba87..a8bffdc6 100644
--- a/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages_en.properties
+++ b/bkucommon/src/main/resources/at/gv/egiz/bku/slexceptions/SLExceptionMessages_en.properties
@@ -91,7 +91,7 @@ ec3002.invalid=XML structure of the command request does not comply with the Sec
 # 4xxx
 #
 
-ec4000.infobox.invalid=The infobox '{0}' contains invalid content.
+ec4000.infobox.invalid=The infobox {0} contains invalid content.
 ec4000.idlink.transfomation.failed=Failed to transform CompressedIdentityLink with Stylesheet {0}.
 ec4002.infobox.unknown=Unknown info box identifier {0}.
 ec4003.not.resolved=Data to be signed cannot be resolved from URI={0}.
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index 414d4678..a63d4076 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -16,9 +16,13 @@
 */
 package at.gv.egiz.smcc;
 
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.security.AlgorithmParameters;
 import java.security.GeneralSecurityException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 import java.util.List;
 
@@ -375,12 +379,46 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   
   @Override
   @Exclusive
-  public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
-      PINProvider provider) throws SignatureCardException, InterruptedException {
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName,
+      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
   
-    if (hash.length != 20) {
-      throw new IllegalArgumentException("Hash value must be of length 20.");
+    ByteArrayOutputStream dst = new ByteArrayOutputStream();
+    // key ID
+    dst.write(new byte[]{(byte) 0x84, (byte) 0x01, (byte) 0x88});
+    // algorithm ID
+    dst.write(new byte[]{(byte) 0x80, (byte) 0x01});
+    
+    MessageDigest md;
+    try {
+      if ("http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1".equals(alg)) {
+        dst.write((byte) 0x14); // SHA-1/ECC
+        md = MessageDigest.getInstance("SHA-1");
+      } else if ("http://www.w3.org/2000/09/xmldsig#rsa-sha1".equals(alg)) {
+        dst.write((byte) 0x12); // SHA-1 with padding according to PKCS#1 block type 01
+        md = MessageDigest.getInstance("SHA-1");
+      } else if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)
+          && appVersion >= 2
+          && "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256".equals(alg)) {
+        dst.write((byte) 0x44); // SHA-256/ECC
+        md = MessageDigest.getInstance("SHA256");
+      } else if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)
+          && appVersion >= 2
+          && "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256".equals(alg)) {
+        dst.write((byte) 0x41); // SHA-256 with padding according to PKCS#1
+        md = MessageDigest.getInstance("SHA256");
+      } else {
+        throw new SignatureCardException("Card does not support signature algorithm " + alg + ".");
+      }
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get MessageDigest.", e);
+      throw new SignatureCardException(e);
     }
+    
+    byte[] digest = new byte[md.getDigestLength()];
+    for (int l; (l = input.read(digest)) != -1;) {
+      md.update(digest, 0, l);
+    }
+    digest = md.digest();
   
     try {
       
@@ -393,11 +431,11 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
         // SELECT application
         execSELECT_AID(channel, AID_SIG);
         // MANAGE SECURITY ENVIRONMENT : SET DST
-        execMSE(channel, 0x41, 0xb6, DST_SIG);
+        execMSE(channel, 0x41, 0xb6, dst.toByteArray());
         // VERIFY
         verifyPINLoop(channel, spec, provider);
         // PERFORM SECURITY OPERATION : HASH
-        execPSO_HASH(channel, hash);
+        execPSO_HASH(channel, digest);
         // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATRE
         return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel);
     
@@ -413,7 +451,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
         while (true) {
           try {
             // INTERNAL AUTHENTICATE
-            return execINTERNAL_AUTHENTICATE(channel, hash);
+            return execINTERNAL_AUTHENTICATE(channel, digest);
           } catch (SecurityStatusNotSatisfiedException e) {
             verifyPINLoop(channel, spec, provider);
           }
@@ -711,6 +749,9 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
 
     ResponseAPDU resp = channel.transmit(
         new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, 256));
+    if (resp.getSW() == 0x6982) {
+      throw new SecurityStatusNotSatisfiedException();
+    }
     if (resp.getSW() != 0x9000) {
       throw new SignatureCardException(
           "PSO - COMPUTE DIGITAL SIGNATRE failed: SW="
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java b/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java
new file mode 100644
index 00000000..15b47fb0
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java
@@ -0,0 +1,283 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
+
+package at.gv.egiz.smcc;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.gv.egiz.smcc.util.ISO7816Utils;
+import at.gv.egiz.smcc.util.SMCCHelper;
+
+public class BELPICCard extends AbstractSignatureCard implements SignatureCard {
+  
+    /**
+     * Logging facility.
+     */
+    private static Log log = LogFactory.getLog(BELPICCard.class);
+
+    public static final byte[] MF = new byte[] { (byte) 0x3F, (byte) 0x00 };
+
+    public static final byte[] DF_BELPIC = new byte[] { (byte) 0xDF,
+            (byte) 0x00 };
+
+    public static final byte[] DF_ID = new byte[] { (byte) 0xDF, (byte) 0x01 };
+
+    public static final byte[] SIGN_CERT = new byte[] { (byte) 0x50,
+            (byte) 0x39 };
+
+//    public static final byte MSE_SET_ALGO_REF = (byte) 0x02;
+
+//    public static final byte MSE_SET_PRIV_KEY_REF = (byte) 0x83;
+
+    public static final int SIGNATURE_LENGTH = (int) 0x80;
+
+    public static final byte KID = (byte) 0x01;
+
+    public static final int READ_BUFFER_LENGTH = 256;
+
+    public static final int PINSPEC_SS = 0;
+    
+  private static final PINSpec SS_PIN_SPEC = 
+    new PINSpec(4, 12, "[0-9]",
+      "at/gv/egiz/smcc/BelpicCard", "sig.pin", KID, DF_BELPIC);
+    
+  /**
+   * Creates a new instance.
+   */
+  public BELPICCard() {
+    super("at/gv/egiz/smcc/BelpicCard");
+    pinSpecs.add(SS_PIN_SPEC);
+  }
+
+  @Override
+  @Exclusive
+  public byte[] getCertificate(KeyboxName keyboxName)
+      throws SignatureCardException {
+
+    if (keyboxName != KeyboxName.SECURE_SIGNATURE_KEYPAIR) {
+      throw new IllegalArgumentException("Keybox " + keyboxName
+          + " not supported");
+    }
+
+    try {
+      CardChannel channel = getCardChannel();
+      // SELECT MF
+      execSELECT_FID(channel, MF);
+      // SELECT application
+      execSELECT_FID(channel, DF_BELPIC);
+      // SELECT file
+      execSELECT_FID(channel, SIGN_CERT);
+      // READ BINARY
+      byte[] certificate = ISO7816Utils.readTransparentFileTLV(channel, -1, (byte) 0x30);
+      if (certificate == null) {
+        throw new NotActivatedException();
+      }
+      return certificate;
+    } catch (FileNotFoundException e) {
+      throw new NotActivatedException();
+    } catch (CardException e) {
+      log.info("Failed to get certificate.", e);
+      throw new SignatureCardException(e);
+    }
+
+  }
+
+  @Override
+  @Exclusive
+  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+      throws SignatureCardException, InterruptedException {
+      
+    throw new IllegalArgumentException("Infobox '" + infobox
+        + "' not supported.");
+  }
+
+  @Override
+  @Exclusive
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName,
+      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
+    
+    if (KeyboxName.SECURE_SIGNATURE_KEYPAIR != keyboxName) {
+      throw new SignatureCardException("Card does not support key " + keyboxName + ".");
+    }
+    if (!"http://www.w3.org/2000/09/xmldsig#rsa-sha1".equals(alg)) {
+      throw new SignatureCardException("Card does not support algorithm " + alg + ".");
+    }
+    
+    byte[] dst = new byte[] { (byte) 0x04, // number of following
+        // bytes
+        (byte) 0x80, // tag for algorithm reference
+        (byte) 0x02, // algorithm reference
+        (byte) 0x84, // tag for private key reference
+        (byte) 0x83 // private key reference
+    };
+    
+    MessageDigest md;
+    try {
+      md = MessageDigest.getInstance("SHA-1");
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get MessageDigest.", e);
+      throw new SignatureCardException(e);
+    }
+    // calculate message digest
+    byte[] digest = new byte[md.getDigestLength()];
+    for (int l; (l = input.read(digest)) != -1;) {
+      md.update(digest, 0, l);
+    }
+    digest = md.digest();
+
+    try {
+      
+      CardChannel channel = getCardChannel();
+
+      // SELECT MF
+      execSELECT_FID(channel, MF);
+      // VERIFY
+      execMSE(channel, 0x41, 0xb6, dst);
+      // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
+      verifyPINLoop(channel, SS_PIN_SPEC, provider);
+      // MANAGE SECURITY ENVIRONMENT : SET DST
+      return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel, digest);
+
+    } catch (CardException e) {
+      log.warn(e);
+      throw new SignatureCardException("Failed to access card.", e);
+    }
+
+  }
+
+  public String toString() {
+    return "Belpic Card";
+  }
+  
+  protected void verifyPINLoop(CardChannel channel, PINSpec spec,
+      PINProvider provider) throws LockedException, NotActivatedException,
+      SignatureCardException, InterruptedException, CardException {
+    
+    int retries = -1; //verifyPIN(channel, spec, null, -1);
+    do {
+      retries = verifyPIN(channel, spec, provider, retries);
+    } while (retries > 0);
+  }
+
+  protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
+      PINProvider provider, int retries) throws SignatureCardException,
+      LockedException, NotActivatedException, InterruptedException,
+      CardException {
+    
+    VerifyAPDUSpec apduSpec = new VerifyAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x00, pinSpec.getKID(), (byte) 0x08,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
+    
+    ResponseAPDU resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    
+    if (resp.getSW() == 0x9000) {
+      return -1;
+    }
+    if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    }
+    
+    switch (resp.getSW()) {
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
+    case 0x6984:
+      // reference data not usable
+      throw new NotActivatedException();
+    case 0x6985:
+      // conditions of use not satisfied
+      throw new NotActivatedException();
+  
+    default:
+      String msg = "VERIFY failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+    
+  }
+  
+  protected byte[] execSELECT_FID(CardChannel channel, byte[] fid)
+      throws SignatureCardException, CardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x02, 0x0C, fid, 256));
+    
+    if (resp.getSW() == 0x6A82) {
+      String msg = "File or application not found FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new FileNotFoundException(msg);
+    } else if (resp.getSW() != 0x9000) {
+      String msg = "Failed to select application FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.error(msg);
+      throw new SignatureCardException(msg);
+    } else {
+      return resp.getBytes();
+    }
+    
+  }
+  
+  protected void execMSE(CardChannel channel, int p1, int p2, byte[] data)
+      throws CardException, SignatureCardException {
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0x22, p1, p2, data, 256));
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("MSE:SET failed: SW="
+          + Integer.toHexString(resp.getSW()));
+    }
+  }
+
+  protected byte[] execPSO_COMPUTE_DIGITAL_SIGNATURE(CardChannel channel, byte[] hash)
+      throws CardException, SignatureCardException {
+    ResponseAPDU resp;
+    resp = channel.transmit(
+        new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, hash, 256));
+    if (resp.getSW() == 0x6982) {
+      throw new SecurityStatusNotSatisfiedException();
+    } else if (resp.getSW() == 0x6983) {
+      throw new LockedException();
+    } else if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException(
+          "PSO: COMPUTE DIGITAL SIGNATRE failed: SW="
+              + Integer.toHexString(resp.getSW()));
+    } else {
+      return resp.getData();
+    }
+  }
+
+
+
+    
+}
\ No newline at end of file
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java
new file mode 100644
index 00000000..831a1f9b
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java
@@ -0,0 +1,297 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+
+package at.gv.egiz.smcc;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CommandAPDU;
+import javax.smartcardio.ResponseAPDU;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.gv.egiz.smcc.util.ISO7816Utils;
+import at.gv.egiz.smcc.util.SMCCHelper;
+
+public class ITCard extends AbstractSignatureCard {
+  
+  /**
+   * Logging facility.
+   */
+  private static Log log = LogFactory.getLog(STARCOSCard.class);
+  
+  public static final byte[] MF = new byte[] { (byte) 0x3F, (byte) 0x00 };
+  
+  public static final byte[] DF1 = new byte[] { (byte) 0x11, (byte) 0x00 };
+  
+  public static final byte[] EF_C_Carta = new byte[] { (byte) 0x11, (byte) 0x01 };
+  
+  private static final PINSpec SS_PIN_SPEC = 
+    new PINSpec(5, 8, "[0-9]", 
+        "at/gv/egiz/smcc/ITCard", "sig.pin", (byte) 0x10, 
+        new byte[] { (byte) 0x11, (byte) 0x00 });
+
+  /**
+   * Creates a new instance.
+   */
+  public ITCard() {
+    super("at/gv/egiz/smcc/ITCard");
+    pinSpecs.add(SS_PIN_SPEC);
+  }
+
+  @Override
+  @Exclusive
+  public byte[] getCertificate(KeyboxName keyboxName)
+      throws SignatureCardException, InterruptedException {
+
+    if (keyboxName != KeyboxName.SECURE_SIGNATURE_KEYPAIR) {
+      throw new IllegalArgumentException("Keybox " + keyboxName
+          + " not supported");
+    }
+
+    try {
+      CardChannel channel = getCardChannel();
+      // SELECT MF
+      execSELECT_FID(channel, MF);
+      // SELECT application
+      execSELECT_FID(channel, DF1);
+      // SELECT EF_C_Carta
+      byte[] fcx = execSELECT_FID(channel, EF_C_Carta);
+      int maxsize = ISO7816Utils.getLengthFromFCx(fcx);
+      // READ BINARY
+      byte[] certificate = ISO7816Utils.readTransparentFileTLV(channel, maxsize, (byte) 0x30);
+      if (certificate == null) {
+        throw new NotActivatedException();
+      }
+      return certificate;
+    } catch (FileNotFoundException e) {
+      throw new NotActivatedException();
+    } catch (CardException e) {
+      log.info("Failed to get certificate.", e);
+      throw new SignatureCardException(e);
+    }
+    
+  }
+
+  @Override
+  @Exclusive
+  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+      throws SignatureCardException, InterruptedException {
+      
+    throw new IllegalArgumentException("Infobox '" + infobox
+        + "' not supported.");
+  }
+
+  @Override
+  @Exclusive
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName,
+      PINProvider provider, String alg) throws SignatureCardException,
+      InterruptedException, IOException {
+
+    if (KeyboxName.SECURE_SIGNATURE_KEYPAIR != keyboxName) {
+      throw new SignatureCardException("Card does not support key " + keyboxName + ".");
+    }
+    if (!"http://www.w3.org/2000/09/xmldsig#rsa-sha1".equals(alg)) {
+      throw new SignatureCardException("Card does not support algorithm " + alg + ".");
+    }
+
+    byte[] dst = new byte[] {
+        (byte) 0x83, // tag for algorithm reference
+        (byte) 0x01, // algorithm reference
+        (byte) 0x01  // private key reference
+    };
+    
+    MessageDigest md;
+    try {
+      md = MessageDigest.getInstance("SHA-1");
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get MessageDigest.", e);
+      throw new SignatureCardException(e);
+    }
+    // calculate message digest
+    byte[] digest = new byte[md.getDigestLength()];
+    for (int l; (l = input.read(digest)) != -1;) {
+      md.update(digest, 0, l);
+    }
+    digest = md.digest();
+
+    try {
+      
+      CardChannel channel = getCardChannel();
+
+      // SELECT MF
+      execSELECT_FID(channel, MF);
+      // VERIFY
+      verifyPINLoop(channel, SS_PIN_SPEC, provider);
+      // MANAGE SECURITY ENVIRONMENT : RESTORE SE
+      execMSE(channel, 0xF3, 0x03, null);
+      // MANAGE SECURITY ENVIRONMENT : SET DST
+      execMSE(channel, 0xF1, 0xB8, dst);
+      // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
+      return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel, digest);
+
+    } catch (CardException e) {
+      log.warn(e);
+      throw new SignatureCardException("Failed to access card.", e);
+    }
+
+  }
+
+  protected void verifyPINLoop(CardChannel channel, PINSpec spec,
+      PINProvider provider) throws LockedException, NotActivatedException,
+      SignatureCardException, InterruptedException, CardException {
+    
+    int retries = -1;
+    do {
+      retries = verifyPIN(channel, spec, provider, retries);
+    } while (retries >= -1);
+  }
+
+  protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
+      PINProvider provider, int retries) throws SignatureCardException,
+      LockedException, NotActivatedException, InterruptedException,
+      CardException {
+    
+    VerifyAPDUSpec apduSpec = new VerifyAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x20, (byte) 0x00, pinSpec.getKID(), (byte) 0x08,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+        0, VerifyAPDUSpec.PIN_FORMAT_ASCII, 8);
+    
+    ResponseAPDU resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    
+    if (resp.getSW() == 0x9000) {
+      return -2;
+    }
+    if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    }
+    
+    switch (resp.getSW()) {
+    case 0x6300:
+      // incorrect PIN, number of retries not provided
+      return -1;
+    case 0x6983:
+      // authentication method blocked
+      throw new LockedException();
+    case 0x6984:
+      // reference data not usable
+      throw new NotActivatedException();
+    case 0x6985:
+      // conditions of use not satisfied
+      throw new NotActivatedException();
+  
+    default:
+      String msg = "VERIFY failed. SW=" + Integer.toHexString(resp.getSW()); 
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+    
+  }
+
+  protected byte[] execSELECT_FID(CardChannel channel, byte[] fid)
+      throws SignatureCardException, CardException {
+    
+    ResponseAPDU resp = channel.transmit(
+        new CommandAPDU(0x00, 0xA4, 0x00, 0x00, fid, 256));
+    
+    if (resp.getSW() == 0x6A82) {
+      String msg = "File or application not found FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.info(msg);
+      throw new FileNotFoundException(msg);
+    } else if (resp.getSW() != 0x9000) {
+      String msg = "Failed to select application FID="
+          + SMCCHelper.toString(fid) + " SW="
+          + Integer.toHexString(resp.getSW()) + ".";
+      log.error(msg);
+      throw new SignatureCardException(msg);
+    } else {
+      return resp.getBytes();
+    }
+    
+  }
+  
+  protected void execMSE(CardChannel channel, int p1, int p2, byte[] data)
+      throws CardException, SignatureCardException {
+    
+    ResponseAPDU resp;
+    if (data == null) {
+      resp = channel.transmit(new CommandAPDU(0x00, 0x22, p1, p2));
+    } else {
+      resp = channel.transmit(new CommandAPDU(0x00, 0x22, p1, p2, data));
+    }
+    
+    if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException("MSE:SET failed: SW="
+          + Integer.toHexString(resp.getSW()));
+    }
+  }
+
+  protected byte[] execPSO_COMPUTE_DIGITAL_SIGNATURE(CardChannel channel,
+      byte[] hash) throws CardException, SignatureCardException {
+    
+    byte[] oid = new byte[] { (byte) 0x30, (byte) 0x21, (byte) 0x30,
+        (byte) 0x09, (byte) 0x06, (byte) 0x05, (byte) 0x2b,
+        (byte) 0x0e, (byte) 0x03, (byte) 0x02, (byte) 0x1a,
+        (byte) 0x05, (byte) 0x00, (byte) 0x04, (byte) 0x14 };
+    
+    ByteArrayOutputStream data = new ByteArrayOutputStream();
+    
+    try {
+      // header
+      data.write(new byte[] { (byte) 0x00, (byte) 0x00, (byte) 0x01 });
+      // padding
+      for (int i = 0, len = 125 - hash.length - oid.length; i < len; i++) {
+        data.write((byte) 0xFF);
+      }
+      data.write((byte) 0x00);
+      // oid
+      data.write(oid);
+      // hash
+      data.write(hash);
+    } catch (IOException e) {
+      throw new SignatureCardException(e);
+    }
+    
+    ResponseAPDU resp = channel
+          .transmit(new CommandAPDU(0x00, 0x2A, 0x80, 0x86, data.toByteArray(), 0x81));
+
+    
+    if (resp.getSW() == 0x6982) {
+      throw new SecurityStatusNotSatisfiedException();
+    } else if (resp.getSW() == 0x6983) {
+      throw new LockedException();
+    } else if (resp.getSW() != 0x9000) {
+      throw new SignatureCardException(
+          "PSO: COMPUTE DIGITAL SIGNATRE failed: SW="
+              + Integer.toHexString(resp.getSW()));
+    } else {
+      return resp.getData();
+    }
+}
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index a0c2391d..01de8a77 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -19,11 +19,16 @@ package at.gv.egiz.smcc;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.InputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 import java.util.List;
 
+import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
 import javax.smartcardio.CommandAPDU;
 import javax.smartcardio.ResponseAPDU;
 
@@ -41,6 +46,8 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   private static Log log = LogFactory.getLog(STARCOSCard.class);
 
   public static final byte[] MF = new byte[] { (byte) 0x3F, (byte) 0x00 };
+  
+  public static final byte[] EF_VERSION = new byte[] { (byte) 0x00, (byte) 0x32 };
 
   /**
    * Application ID <em>SV-Personendaten</em>.
@@ -106,19 +113,6 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   public static final byte[] EF_C_X509_CA_CS_DS = new byte[] { (byte) 0xc6,
       (byte) 0x08 };
 
-  public static final byte[] DST_SS = new byte[] { (byte) 0x84, (byte) 0x03, // tag
-      // ,
-      // length
-      // (
-      // key
-      // desc
-      // .
-      // )
-      (byte) 0x80, (byte) 0x02, (byte) 0x00, // local, key ID, key version
-      (byte) 0x89, (byte) 0x03, // tag, length (algorithm ID)
-      (byte) 0x13, (byte) 0x35, (byte) 0x10 // ECDSA
-  };
-
   public static final byte KID_PIN_SS = (byte) 0x81;
 
   // Gewöhnliche Signatur (GS)
@@ -133,19 +127,6 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   public static final byte[] EF_C_X509_CA_CS = new byte[] { (byte) 0x2f,
       (byte) 0x02 };
 
-  public static final byte[] DST_GS = new byte[] { (byte) 0x84, (byte) 0x03, // tag
-      // ,
-      // length
-      // (
-      // key
-      // desc
-      // .
-      // )
-      (byte) 0x80, (byte) 0x02, (byte) 0x00, // local, key ID, key version
-      (byte) 0x89, (byte) 0x03, // tag, length (algorithm ID)
-      (byte) 0x13, (byte) 0x35, (byte) 0x10 // ECDSA
-  };
-
   public static final byte KID_PIN_CARD = (byte) 0x01;
 
   private static final PINSpec CARD_PIN_SPEC =
@@ -155,9 +136,11 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   private static final PINSpec SS_PIN_SPEC =
     new PINSpec(6, 12, "[0-9]", 
         "at/gv/egiz/smcc/STARCOSCard", "sig.pin", KID_PIN_SS, AID_DF_SS);
+  
+  protected double version = 1.1;
 
   /**
-   * Creates an new instance.
+   * Creates a new instance.
    */
   public STARCOSCard() {
     super("at/gv/egiz/smcc/STARCOSCard");
@@ -165,6 +148,35 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
     pinSpecs.add(SS_PIN_SPEC);
   }
  
+  /* (non-Javadoc)
+   * @see at.gv.egiz.smcc.AbstractSignatureCard#init(javax.smartcardio.Card, javax.smartcardio.CardTerminal)
+   */
+  @Override
+  public void init(Card card, CardTerminal cardTerminal) {
+    super.init(card, cardTerminal);
+    
+    // determine application version
+    CardChannel channel = getCardChannel();
+    try {
+      // SELECT MF
+      execSELECT_MF(channel);
+      // SELECT EF_VERSION
+      execSELECT_FID(channel, EF_VERSION);
+      // READ BINARY
+      byte[] ver = ISO7816Utils.readRecord(channel, 1);
+      if (ver[0] == (byte) 0xa5 && ver[2] == (byte) 0x53) {
+        version = (0x0F & ver[4]) + (0xF0 & ver[5])/160.0 + (0x0F & ver[5])/100.0;
+        String generation = (version < 1.2) ? "<= G2" : "G3";
+        log.info("e-card version=" + version + " (" + generation + ")");
+      }
+    } catch (CardException e) {
+      log.warn(e);
+    } catch (SignatureCardException e) {
+      log.warn(e);
+    }
+    
+  }
+
   @Override
   @Exclusive
   public byte[] getCertificate(KeyboxName keyboxName)
@@ -281,19 +293,57 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
 
   @Override
   @Exclusive
-  public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
-      PINProvider provider) throws SignatureCardException, InterruptedException {
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName,
+      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
   
-    if (hash.length != 20) {
-      throw new IllegalArgumentException("Hash value must be of length 20.");
+    ByteArrayOutputStream dst = new ByteArrayOutputStream();
+    byte[] ht = null;
+    
+    MessageDigest md = null;
+    try {
+      if (version < 1.2 && "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1".equals(alg)) {
+        // local key ID '02' version '00'
+        dst.write(new byte[] {(byte) 0x84, (byte) 0x03, (byte) 0x80, (byte) 0x02, (byte) 0x00});
+        // algorithm ID ECDSA with SHA-1
+        dst.write(new byte[] {(byte) 0x89, (byte) 0x03, (byte) 0x13, (byte) 0x35, (byte) 0x10});
+        md = MessageDigest.getInstance("SHA-1");
+      } else if (version >= 1.2 && "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256".equals(alg)) {
+        // local key ID '02' version '00'
+        dst.write(new byte[] {(byte) 0x84, (byte) 0x03, (byte) 0x80, (byte) 0x02, (byte) 0x00});
+        // portable algorithm reference
+        dst.write(new byte[] {(byte) 0x80, (byte) 0x01, (byte) 0x04});
+        // hash template
+        ht = new byte[] {(byte) 0x80, (byte) 0x01, (byte) 0x40};
+        md = MessageDigest.getInstance("SHA256");
+      } else if (version >= 1.2 && "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256".equals(alg)) {
+        // local key ID '03' version '00'
+        dst.write(new byte[] {(byte) 0x84, (byte) 0x03, (byte) 0x80, (byte) 0x03, (byte) 0x00});
+        // portable algorithm reference
+        dst.write(new byte[] {(byte) 0x80, (byte) 0x01, (byte) 0x02});
+        // hash template
+        ht = new byte[] {(byte) 0x80, (byte) 0x01, (byte) 0x40};
+        md = MessageDigest.getInstance("SHA256");
+      } else {
+        throw new SignatureCardException("e-card versio " + version + " does not support signature algorithm " + alg + ".");
+      }
+    } catch (NoSuchAlgorithmException e) {
+      log.error("Failed to get MessageDigest.", e);
+      throw new SignatureCardException(e);
     }
-  
+    
+    // calculate message digest
+    byte[] digest = new byte[md.getDigestLength()];
+    for (int l; (l = input.read(digest)) != -1;) {
+      md.update(digest, 0, l);
+    }
+    digest = md.digest();
+
     try {
       
       CardChannel channel = getCardChannel();
       
       if (KeyboxName.SECURE_SIGNATURE_KEYPAIR.equals(keyboxName)) {
-
+        
         PINSpec spec = SS_PIN_SPEC;
         
         // SELECT MF
@@ -303,11 +353,21 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
         // VERIFY
         verifyPINLoop(channel, spec, provider);
         // MANAGE SECURITY ENVIRONMENT : SET DST
-        execMSE(channel, 0x41, 0xb6, DST_SS);
-        // PERFORM SECURITY OPERATION : HASH
-        execPSO_HASH(channel, hash);
-        // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
-        return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel);
+        execMSE(channel, 0x41, 0xb6, dst.toByteArray());
+        if (ht != null) {
+          // PERFORM SECURITY OPERATION : SET HT
+          execMSE(channel, 0x41, 0xaa, ht);
+        }
+        if (version < 1.2) {
+          // PERFORM SECURITY OPERATION : HASH
+          execPSO_HASH(channel, digest);
+          // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
+          return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel, null);
+        } else {
+          // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
+          return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel, digest);
+        }
+        
         
       } else if (KeyboxName.CERITIFIED_KEYPAIR.equals(keyboxName)) {
 
@@ -316,14 +376,17 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
         // SELECT application
         execSELECT_AID(channel, AID_DF_GS);
         // MANAGE SECURITY ENVIRONMENT : SET DST
-        execMSE(channel, 0x41, 0xb6, DST_GS);
+        execMSE(channel, 0x41, 0xb6, dst.toByteArray());
+        if (ht != null) {
+          // PERFORM SECURITY OPERATION : SET HT
+          execMSE(channel, 0x41, 0xaa, ht);
+        }
         // PERFORM SECURITY OPERATION : HASH
-        execPSO_HASH(channel, hash);
-        
+        execPSO_HASH(channel, digest);
         while (true) {
           try {
             // PERFORM SECURITY OPERATION : COMPUTE DIGITAL SIGNATURE
-            return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel);
+            return execPSO_COMPUTE_DIGITAL_SIGNATURE(channel, null);
           } catch (SecurityStatusNotSatisfiedException e) {
             verifyPINLoop(channel, spec, provider);
           }
@@ -682,7 +745,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
     ResponseAPDU resp = channel.transmit(
         new CommandAPDU(0x00, 0x22, p1, p2, data));
     if (resp.getSW() != 0x9000) {
-      throw new SignatureCardException("MSE:SET DST failed: SW="
+      throw new SignatureCardException("MSE:SET failed: SW="
           + Integer.toHexString(resp.getSW()));
     }
   }
@@ -701,10 +764,47 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
     }
   }
 
-  protected byte[] execPSO_COMPUTE_DIGITAL_SIGNATURE(CardChannel channel)
+  protected void execPSO_HASH(CardChannel channel, InputStream input)
+      throws SignatureCardException, CardException {
+    ResponseAPDU resp;
+    int blockSize = 64;
+    byte[] b = new byte[blockSize];
+    try {
+      ByteArrayOutputStream data = new ByteArrayOutputStream();
+      // initialize
+      data.write((byte) 0x90);
+      data.write((byte) 0x00);
+      resp = channel.transmit(
+          new CommandAPDU(0x10, 0x2A, 0x90, 0xA0, data.toByteArray()));
+      data.reset();
+      for (int l; (l = input.read(b)) != -1;) {
+        data.write((byte) 0x80);
+        data.write(l);
+        data.write(b, 0, l);
+        resp = channel.transmit(
+            new CommandAPDU((l == blockSize) ? 0x10 : 0x00, 0x2A, 0x90, 0xA0, data.toByteArray()));
+        if (resp.getSW() != 0x9000) {
+          throw new SignatureCardException("PSO:HASH failed: SW="
+              + Integer.toHexString(resp.getSW()));
+        }
+        data.reset();
+      }
+    } catch (IOException e) {
+      throw new SignatureCardException(e);
+    }
+    
+  }
+
+  protected byte[] execPSO_COMPUTE_DIGITAL_SIGNATURE(CardChannel channel, byte[] hash)
       throws CardException, SignatureCardException {
-    ResponseAPDU resp = channel.transmit(
-        new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, 256));
+    ResponseAPDU resp;
+    if (hash != null) {
+      resp = channel.transmit(
+          new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, hash, 256));
+    } else {
+      resp = channel.transmit(
+          new CommandAPDU(0x00, 0x2A, 0x9E, 0x9A, 256));
+    }
     if (resp.getSW() == 0x6982) {
       throw new SecurityStatusNotSatisfiedException();
     } else if (resp.getSW() == 0x6983) {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index 279362c0..670704d5 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -20,6 +20,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.nio.charset.Charset;
 import java.security.InvalidKeyException;
@@ -308,7 +309,7 @@ public class SWCard implements SignatureCard {
   }
 
   @Override
-  public byte[] createSignature(byte[] hash, KeyboxName keyboxName, PINProvider provider) throws SignatureCardException, InterruptedException {
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName, PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
 
     // KeyStore password
     char[] password = getPassword(keyboxName);
@@ -363,7 +364,10 @@ public class SWCard implements SignatureCard {
     try {
       Signature signature = Signature.getInstance(algorithm);
       signature.initSign(privateKey);
-      signature.update(hash);
+      int l;
+      for (byte[] b = new byte[20]; (l = input.read(b)) != -1;) {
+        signature.update(b, 0, l);
+      }
       return signature.sign();
     } catch (NoSuchAlgorithmException e) {
       String msg = "Algorithm + '" + algorithm + "' not supported for signing.";
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index 1a163783..3d56f97b 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -18,6 +18,9 @@
 package at.gv.egiz.smcc;
 
 import at.gv.egiz.smcc.ccid.CCID;
+
+import java.io.IOException;
+import java.io.InputStream;
 import java.util.Locale;
 
 import javax.smartcardio.Card;
@@ -101,15 +104,17 @@ public interface SignatureCard {
 
   /**
    * 
-   * @param hash
+   * @param input
    * @param keyboxName
    * @param provider
+   * @param alg TODO
    * @return
    * @throws at.gv.egiz.smcc.SignatureCardException
    * @throws java.lang.InterruptedException if applet is destroyed while in pin dialog
+   * @throws IOException 
    */
-  public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
-      PINProvider provider) throws SignatureCardException, InterruptedException;
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName,
+      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException;
 
   public CCID getReader();
 
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
index 26844473..47053f98 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCardFactory.java
@@ -170,21 +170,21 @@ public class SignatureCardFactory {
         },
         "at.gv.egiz.smcc.STARCOSCard"));
     
-//    // e-card G3
-//    supportedCards.add(new SupportedCard(
-//        // ATR  (3b:dd:96:ff:81:b1:fe:45:1f:03:80:31:b0:52:02:03:64:04:1b:b4:22:81:05:18)
-//        new byte[] {
-//            (byte) 0x3b, (byte) 0xdd, (byte) 0x96, (byte) 0xff, (byte) 0x81, (byte) 0xb1, (byte) 0xfe, (byte) 0x45, 
-//            (byte) 0x1f, (byte) 0x03, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
-//            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00
-//        },
-//        // mask (
-//        new byte[] {
-//            (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, 
-//            (byte) 0xff, (byte) 0xff, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
-//            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00 
-//        },
-//        "at.gv.egiz.smcc.STARCOSCard"));
+    // e-card G3
+    supportedCards.add(new SupportedCard(
+        // ATR  (3b:dd:96:ff:81:b1:fe:45:1f:03:80:31:b0:52:02:03:64:04:1b:b4:22:81:05:18)
+        new byte[] {
+            (byte) 0x3b, (byte) 0xdd, (byte) 0x96, (byte) 0xff, (byte) 0x81, (byte) 0xb1, (byte) 0xfe, (byte) 0x45, 
+            (byte) 0x1f, (byte) 0x03, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00
+        },
+        // mask (
+        new byte[] {
+            (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, 
+            (byte) 0xff, (byte) 0xff, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
+            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00 
+        },
+        "at.gv.egiz.smcc.STARCOSCard"));
 
     // a-sign premium
     supportedCards.add(new SupportedCard(
@@ -202,6 +202,72 @@ public class SignatureCardFactory {
         },
         "at.gv.egiz.smcc.ACOSCard"));
 
+    // BELPIC
+    supportedCards.add(new SupportedCard(
+            // ATR (3b:98:13:40:0A:A5:03:01:01:01:AD:13:11)
+            new byte[] { (byte) 0x3b, (byte) 0x98, (byte) 0x13,
+                    (byte) 0x40, (byte) 0x0a, (byte) 0xa5, (byte) 0x03,
+                    (byte) 0x01, (byte) 0x01, (byte) 0x01, (byte) 0xad,
+                    (byte) 0x13, (byte) 0x11 },
+            // mask (ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff)
+            new byte[] { (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                    (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                    (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                    (byte) 0xff, (byte) 0xff },
+            "at.gv.egiz.smcc.BELPICCard"));
+    
+    // ITCards
+    supportedCards.add(new SupportedCard(
+    // ATR =
+    // [3b:ff:18:00:ff:81:31:fe:55:00:6b:02:09:02:00:01:11:01:43:4e:53:11:31:80:8e]
+            new byte[] { (byte) 0x3b, (byte) 0xff, (byte) 0x18,
+                    (byte) 0x00, (byte) 0xff, (byte) 0x81, (byte) 0x31,
+                    (byte) 0xfe, (byte) 0x55, (byte) 0x00, (byte) 0x6b,
+                    (byte) 0x02, (byte) 0x09 /*
+                                             * , (byte) 0x02, (byte) 0x00,
+                                             * (byte) 0x01, (byte) 0x11,
+                                             * (byte) 0x01, (byte) 0x43,
+                                             * (byte) 0x4e, (byte) 0x53,
+                                             * (byte) 0x11, (byte) 0x31,
+                                             * (byte) 0x80, (byte) 0x8e
+                                             */
+            },
+            // mask (ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff)
+            new byte[] { (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                    (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                    (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                    (byte) 0xff, (byte) 0xff /*
+                                             * , (byte) 0xff, (byte) 0xff,
+                                             * (byte) 0xff, (byte) 0xff,
+                                             * (byte) 0xff, (byte) 0xff,
+                                             * (byte) 0xff, (byte) 0xff,
+                                             * (byte) 0xff, (byte) 0xff,
+                                             * (byte) 0xff, (byte) 0xff
+                                             */
+            }, "at.gv.egiz.smcc.ITCard"));
+    supportedCards.add(new SupportedCard(
+        // ATR
+        // (3B:FF:18:00:FF:C1:0A:31:FE:55:00:6B:05:08:C8:05:01:01:01:43:4E:53:10:31:80:1C)
+        new byte[] { (byte) 0x3b, (byte) 0xff, (byte) 0x18,
+                (byte) 0x00, (byte) 0xFF, (byte) 0xC1, (byte) 0x0a,
+                (byte) 0x31, (byte) 0xfe, (byte) 0x55, (byte) 0x00,
+                (byte) 0x6B, (byte) 0x05, (byte) 0x08, (byte) 0xC8,
+                (byte) 0x05, (byte) 0x01, (byte) 0x01, (byte) 0x01,
+                (byte) 0x43, (byte) 0x4E, (byte) 0x53, (byte) 0x10,
+                (byte) 0x31, (byte) 0x80, (byte) 0x1C },
+        // mask
+        // (ff:ff:ff:00:00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:00:00:00:00)
+        new byte[] { (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff },
+        "at.gv.egiz.smcc.ITCard"));
+
+    
+    
   }
 
   /**
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java b/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java
index c5c7cbc9..fcd0b876 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/util/ISO7816Utils.java
@@ -103,6 +103,14 @@ public class ISO7816Utils {
 
     TransparentFileInputStream is = openTransparentFileInputStream(channel,
         maxSize);
+    
+    return readTransparentFileTLV(is, maxSize, expectedType);
+
+  }
+  
+  public static byte[] readTransparentFileTLV(TransparentFileInputStream is, int maxSize,
+      byte expectedType) throws CardException, SignatureCardException {
+
 
     try {
 
@@ -170,7 +178,8 @@ public class ISO7816Utils {
       while (pos < (fcx[1] - 2)) {
         switch (fcx[pos]) {
         
-        case (byte) 0x80: {
+        case (byte) 0x80: 
+        case (byte) 0x81: {
           len = 0xFF & fcx[pos + 2];
           for (int i = 1; i < fcx[pos + 1]; i++) {
             len<<=8;
diff --git a/smcc/src/main/resources/at/gv/egiz/smcc/BELPICCard.properties b/smcc/src/main/resources/at/gv/egiz/smcc/BELPICCard.properties
new file mode 100644
index 00000000..71267394
--- /dev/null
+++ b/smcc/src/main/resources/at/gv/egiz/smcc/BELPICCard.properties
@@ -0,0 +1,3 @@
+#pin.name=PIN
+sig.pin.name=PIN
+sig.pin.length=4-12
\ No newline at end of file
diff --git a/smcc/src/main/resources/at/gv/egiz/smcc/ITCard.properties b/smcc/src/main/resources/at/gv/egiz/smcc/ITCard.properties
new file mode 100644
index 00000000..e0222a70
--- /dev/null
+++ b/smcc/src/main/resources/at/gv/egiz/smcc/ITCard.properties
@@ -0,0 +1,3 @@
+#pin.name=PIN
+sig.pin.name=PIN
+sig.pin.length=5-8
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
index 2a55357d..b3bd07ab 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
@@ -18,6 +18,8 @@ package at.gv.egiz.smcc;
 
 import static org.junit.Assert.*;
 
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -178,13 +180,10 @@ public abstract class CardTest {
   @Test(expected = CancelledException.class)
   public void testSignSIGCancel() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        MessageDigest md = MessageDigest.getInstance("SHA-1");
-        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-      
         PINProvider pinProvider = new PINProvider() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
@@ -193,21 +192,19 @@ public abstract class CardTest {
           }
         };
       
-        signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-            pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR, pinProvider,
+        null);
       
       }
 
   @Test(expected = CancelledException.class)
   public void testSignDECCancel() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        MessageDigest md = MessageDigest.getInstance("SHA-1");
-        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-      
         PINProvider pinProvider = new PINProvider() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
@@ -216,21 +213,19 @@ public abstract class CardTest {
           }
         };
       
-        signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-            pinProvider);
+        signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+            .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+            pinProvider, null);
       
       }
 
   @Test(expected = InterruptedException.class)
   public void testSignSIGInterrrupted() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        MessageDigest md = MessageDigest.getInstance("SHA-1");
-        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-      
         PINProvider pinProvider = new PINProvider() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
@@ -239,21 +234,19 @@ public abstract class CardTest {
           }
         };
       
-        signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-            pinProvider);
+        signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+            .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+            pinProvider, null);
       
       }
 
   @Test(expected = InterruptedException.class)
   public void testSignDECInterrrupted() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        MessageDigest md = MessageDigest.getInstance("SHA-1");
-        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-      
         PINProvider pinProvider = new PINProvider() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
@@ -262,21 +255,19 @@ public abstract class CardTest {
           }
         };
       
-        signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-            pinProvider);
+        signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+            .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+            pinProvider, null);
       
       }
 
   @Test(expected = CancelledException.class)
   public void testSignSIGConcurrent() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
       
         final SignatureCard signatureCard = createSignatureCard();
       
-        MessageDigest md = MessageDigest.getInstance("SHA-1");
-        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-      
         PINProvider pinProvider = new PINProvider() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
@@ -294,21 +285,19 @@ public abstract class CardTest {
           }
         };
       
-        signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-            pinProvider);
+        signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+            .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+            pinProvider, null);
       
       }
 
   @Test(expected = CancelledException.class)
   public void testSignDECConcurrent() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
       
         final SignatureCard signatureCard = createSignatureCard();
       
-        MessageDigest md = MessageDigest.getInstance("SHA-1");
-        byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-      
         PINProvider pinProvider = new PINProvider() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
@@ -326,8 +315,9 @@ public abstract class CardTest {
           }
         };
       
-        signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-            pinProvider);
+        signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+            .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+            pinProvider, null);
       
       }
 
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
index 90bb039e..56d1e4b2 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
@@ -21,6 +21,8 @@ import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -125,7 +127,7 @@ public abstract class ACOSCardTest extends CardTest {
   @Test
   public void testSignSIG() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     char[] pin = "123456".toCharArray();
 
@@ -134,11 +136,9 @@ public abstract class ACOSCardTest extends CardTest {
     ACOSApplSIG appl = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
     appl.setPin(ACOSApplSIG.KID_PIN_SIG, pin);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
-    byte[] signature = signatureCard.createSignature(hash,
-        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin));
+    byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")),
+        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -147,7 +147,7 @@ public abstract class ACOSCardTest extends CardTest {
   @Test
   public void testSignDEC() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     char[] pin = "1234".toCharArray();
 
@@ -156,11 +156,9 @@ public abstract class ACOSCardTest extends CardTest {
     ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
     appl.setPin(ACOSApplDEC.KID_PIN_DEC, pin);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
-    byte[] signature = signatureCard.createSignature(hash,
-        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin));
+    byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")),
+        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -169,74 +167,66 @@ public abstract class ACOSCardTest extends CardTest {
   @Test(expected = LockedException.class)
   public void testSignSIGInvalidPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider, null);
 
   }
 
   @Test(expected = LockedException.class)
   public void testSignDECInvalidPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider, null);
 
   }
 
   @Test(expected = LockedException.class)
   public void testSignSIGBlockedPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
     CardEmul card = (CardEmul) signatureCard.getCard();
     ACOSApplSIG appl = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
     appl.setPin(ACOSApplSIG.KID_PIN_SIG, null);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider, null);
 
   }
 
   @Test(expected = LockedException.class)
   public void testSignDECBlockedPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
     CardEmul card = (CardEmul) signatureCard.getCard();
     ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
     appl.setPin(ACOSApplDEC.KID_PIN_DEC, null);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider, null);
 
   }
 
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
index 89e2ca65..b7dc9a0c 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
@@ -20,6 +20,8 @@ import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -147,7 +149,7 @@ public class STARCOSCardTest extends CardTest {
   @Test
   public void testSignSichereSignatur() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     char[] pin = "123456".toCharArray();
 
@@ -156,11 +158,9 @@ public class STARCOSCardTest extends CardTest {
     STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
     appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, pin);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
-    byte[] signature = signatureCard.createSignature(hash,
-        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin));
+    byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")),
+        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -169,7 +169,7 @@ public class STARCOSCardTest extends CardTest {
   @Test
   public void testSignGewoehnlicheSignatur() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     char[] pin = "1234".toCharArray();
 
@@ -178,11 +178,9 @@ public class STARCOSCardTest extends CardTest {
     STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
     channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, pin);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
-    byte[] signature = signatureCard.createSignature(hash,
-        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin));
+    byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")),
+        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -191,75 +189,67 @@ public class STARCOSCardTest extends CardTest {
   @Test(expected = LockedException.class)
   public void testSignSichereSignaturInvalidPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider, null);
 
   }
 
   @Test(expected = LockedException.class)
   public void testSignGewoehnlicheSignaturInvalidPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("1234".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider, null);
 
   }
 
   @Test(expected = LockedException.class)
   public void testSignSichereSignaturBlockedPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
     CardEmul card = (CardEmul) signatureCard.getCard();
     STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
     appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, null);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
     assertTrue(pinProvider.getProvided() <= 0);
 
-    signatureCard.createSignature(hash, KeyboxName.SECURE_SIGNATURE_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
+        pinProvider, null);
 
   }
 
   @Test(expected = LockedException.class)
   public void testSignGewoehnlicheSignaturBlockedPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
-      NoSuchAlgorithmException, UnsupportedEncodingException {
+      NoSuchAlgorithmException, IOException {
 
     SignatureCard signatureCard = createSignatureCard();
     CardEmul card = (CardEmul) signatureCard.getCard();
     STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
     channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, null);
 
-    MessageDigest md = MessageDigest.getInstance("SHA-1");
-    byte[] hash = md.digest("MOCCA".getBytes("ASCII"));
-
     TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
 
-    signatureCard.createSignature(hash, KeyboxName.CERITIFIED_KEYPAIR,
-        pinProvider);
+    signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
+        .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
+        pinProvider, null);
 
   }
   
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
index 560f1373..58d7b305 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
@@ -18,9 +18,8 @@ package at.gv.egiz.bku.smccstal;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.InputStream;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
 
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBElement;
@@ -44,7 +43,6 @@ import at.gv.egiz.stal.SignRequest;
 import at.gv.egiz.stal.SignResponse;
 import at.gv.egiz.stal.signedinfo.ObjectFactory;
 import at.gv.egiz.stal.signedinfo.SignedInfoType;
-import at.gv.egiz.stal.util.JCEAlgorithmNames;
 
 public class SignRequestHandler extends AbstractRequestHandler {
 
@@ -77,18 +75,11 @@ public class SignRequestHandler extends AbstractRequestHandler {
                 JAXBElement<SignedInfoType> si = (JAXBElement<SignedInfoType>) unmarshaller.unmarshal(is);
                 String signatureMethod = si.getValue().getSignatureMethod().getAlgorithm();
                 log.debug("Found signature method: " + signatureMethod);
-                String jceName = JCEAlgorithmNames.getJCEHashName(signatureMethod);
-                if (jceName == null) {
-                    log.error("Hash algorithm not supported:");
-                    return new ErrorResponse(4006);
-                }
-                MessageDigest md = MessageDigest.getInstance(jceName);
-                md.update(signReq.getSignedInfo());
                 KeyboxName kb = SignatureCard.KeyboxName.getKeyboxName(signReq.getKeyIdentifier());
 
-                byte[] resp = card.createSignature(md.digest(), kb,
+                byte[] resp = card.createSignature(new ByteArrayInputStream(signReq.getSignedInfo()), kb,
                         new PINProviderFactory(card.getReader(), gui)
-                        .getSignaturePINProvider(secureViewer, si.getValue()));
+                        .getSignaturePINProvider(secureViewer, si.getValue()), signatureMethod);
                 if (resp == null) {
                     return new ErrorResponse(6001);
                 }
@@ -127,9 +118,9 @@ public class SignRequestHandler extends AbstractRequestHandler {
             } catch (JAXBException e) {
                 log.error("Cannot unmarshall signed info", e);
                 return new ErrorResponse(1000);
-            } catch (NoSuchAlgorithmException e) {
-                log.error(e);
-                return new ErrorResponse(1000);
+            } catch (IOException e) {
+              log.error("Error while creating signature: " + e);
+              return new ErrorResponse(4000);
             } 
         } else {
             log.fatal("Got unexpected STAL request: " + request);
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index 36880e68..16d3efa9 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -1,5 +1,6 @@
 package at.gv.egiz.smcc;
 
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -37,8 +38,8 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
    signatureCard = new SignatureCard() {
 
     @Override
-    public byte[] createSignature(byte[] hash, KeyboxName keyboxName,
-        PINProvider provider) throws SignatureCardException {
+    public byte[] createSignature(InputStream input, KeyboxName keyboxName,
+        PINProvider provider, String alg) throws SignatureCardException {
       // TODO Auto-generated method stub
       return null;
     }
diff --git a/utils/src/main/java/at/gv/egiz/xades/QualifyingPropertiesFactory.java b/utils/src/main/java/at/gv/egiz/xades/QualifyingPropertiesFactory.java
index 82cba624..6f694b91 100644
--- a/utils/src/main/java/at/gv/egiz/xades/QualifyingPropertiesFactory.java
+++ b/utils/src/main/java/at/gv/egiz/xades/QualifyingPropertiesFactory.java
@@ -104,14 +104,14 @@ public class QualifyingPropertiesFactory {
 
   }
   
-  public DigestAlgAndValueType createDigestAlgAndValueType(X509Certificate certificate) throws QualifyingPropertiesException {
+  public DigestAlgAndValueType createDigestAlgAndValueType(X509Certificate certificate, DigestMethod dm) throws QualifyingPropertiesException {
     
     DigestMethodType digestMethodType = dsFactory.createDigestMethodType();
-    digestMethodType.setAlgorithm(DigestMethod.SHA1);
-
+    digestMethodType.setAlgorithm(dm.getAlgorithm());
+    
     byte[] digest;
     try {
-      MessageDigest messageDigest = MessageDigest.getInstance("SHA-1");
+      MessageDigest messageDigest = MessageDigest.getInstance(dm.getAlgorithm());
       digest = messageDigest.digest(certificate.getEncoded());
     } catch (CertificateEncodingException e) {
       throw new QualifyingPropertiesException(e);
@@ -155,7 +155,10 @@ public class QualifyingPropertiesFactory {
     return dataObjectFormatType;
   }
   
-  public JAXBElement<QualifyingPropertiesType> createQualifyingProperties111(String target, Date signingTime, List<X509Certificate> certificates, String idValue, List<DataObjectFormatType> dataObjectFormats) throws QualifyingPropertiesException {
+  public JAXBElement<QualifyingPropertiesType> createQualifyingProperties111(
+      String target, Date signingTime, List<X509Certificate> certificates,
+      String idValue, List<DataObjectFormatType> dataObjectFormats,
+      DigestMethod digestMethod) throws QualifyingPropertiesException {
 
     GregorianCalendar gregorianCalendar = new GregorianCalendar();
     gregorianCalendar.setTimeZone(TimeZone.getTimeZone("UTC"));
@@ -175,7 +178,7 @@ public class QualifyingPropertiesFactory {
     for (X509Certificate certificate : certificates) {
       
       CertIDType certIDType = qpFactory.createCertIDType();
-      certIDType.setCertDigest(createDigestAlgAndValueType(certificate));
+      certIDType.setCertDigest(createDigestAlgAndValueType(certificate, digestMethod));
       certIDType.setIssuerSerial(createX509IssuerSerialType(certificate));
       
       certIDs.add(certIDType);
-- 
cgit v1.2.3


From 3da4655d011dfc2f04f9e4ac28b38aee42d01bc0 Mon Sep 17 00:00:00 2001
From: clemenso <clemenso@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Tue, 5 Jan 2010 10:06:47 +0000
Subject: Features [#437] Handle pinpad [64:03] response apdu correctly [#445]
 pin entry feedback for VERIFY_PIN_START/FINISH [#471] Provide SecureViewer
 Link before Pinpad PinEntry timeout starts

Bugs
[#479] PIN Managment Applet allows unmatching new pin and pin confirmation
[#480] PIN Management displays blocked PINs as ACTIVE
[#486] Not possible to select 3 times in series the same item from signedReferencesList for display in secureViewer
[#506] change pin dialog (gui) issues
[#508] e-card G3 PIN activation (with TransportPIN) not supported
[#509] closing secure viewer window (WINDOW_CLOSING) leaves "signature data is displayed in viewer" dialog in applet


git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@565 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java |  28 +-
 .../main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java   | 765 +++++++++------------
 .../main/java/at/gv/egiz/bku/gui/PinDocument.java  | 125 +---
 .../at/gv/egiz/bku/gui/SecureViewerDialog.java     | 118 ++--
 .../at/gv/egiz/bku/gui/Messages.properties         |   9 +-
 .../at/gv/egiz/bku/gui/Messages_en.properties      |   9 +-
 .../test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java |  13 +-
 .../at/gv/egiz/bku/gui/ComparePinDocument.java     | 102 +++
 .../at/gv/egiz/bku/gui/ExtendedPinDocument.java    | 108 +++
 .../java/at/gv/egiz/bku/gui/PINManagementGUI.java  | 163 +++--
 .../at/gv/egiz/bku/gui/PINManagementGUIFacade.java |  66 +-
 .../gv/egiz/bku/gui/ActivationMessages.properties  |  36 +-
 .../egiz/bku/gui/ActivationMessages_en.properties  |  34 +-
 BKUOnline/src/main/resources/log4j.properties      |   2 +-
 BKUOnline/src/main/webapp/META-INF/context.xml     |   2 +-
 smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java   |  44 +-
 .../at/gv/egiz/smcc/AbstractSignatureCard.java     |  14 +-
 smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java |  11 +-
 .../java/at/gv/egiz/smcc/ChangePINProvider.java    |  36 -
 smcc/src/main/java/at/gv/egiz/smcc/ITCard.java     |  11 +-
 .../at/gv/egiz/smcc/PINConfirmationException.java  |  19 -
 .../java/at/gv/egiz/smcc/PINFormatException.java   |  19 -
 .../java/at/gv/egiz/smcc/PINMgmtSignatureCard.java |  11 +-
 .../src/main/java/at/gv/egiz/smcc/PINProvider.java |  45 --
 .../at/gv/egiz/smcc/ResetRetryCounterAPDUSpec.java |  38 +
 .../src/main/java/at/gv/egiz/smcc/STARCOSCard.java | 208 +++---
 smcc/src/main/java/at/gv/egiz/smcc/SWCard.java     | 106 +--
 .../main/java/at/gv/egiz/smcc/SignatureCard.java   |   9 +-
 .../java/at/gv/egiz/smcc/pin/gui/ModifyPINGUI.java |  36 +
 .../at/gv/egiz/smcc/pin/gui/ModifyPINProvider.java |  48 ++
 .../main/java/at/gv/egiz/smcc/pin/gui/PINGUI.java  |  42 ++
 .../java/at/gv/egiz/smcc/pin/gui/PINProvider.java  |  49 ++
 .../java/at/gv/egiz/smcc/reader/CardReader.java    |  92 +++
 .../at/gv/egiz/smcc/reader/DefaultCardReader.java  | 106 +++
 .../at/gv/egiz/smcc/reader/PinpadCardReader.java   | 703 +++++++++++++++++++
 .../java/at/gv/egiz/smcc/reader/ReaderFactory.java | 128 ++++
 .../test/java/at/gv/egiz/smcc/AbstractAppl.java    |   1 +
 smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java   |  14 +-
 smcc/src/test/java/at/gv/egiz/smcc/CardTest.java   | 171 +----
 smcc/src/test/java/at/gv/egiz/smcc/PIN.java        |  10 +-
 .../test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java |   2 +-
 .../java/at/gv/egiz/smcc/acos/A03CardEmul.java     |   7 +-
 .../java/at/gv/egiz/smcc/acos/A03CardTest.java     |   9 +-
 .../java/at/gv/egiz/smcc/acos/A04CardEmul.java     |   7 +-
 .../java/at/gv/egiz/smcc/acos/A04CardTest.java     |  12 +-
 .../java/at/gv/egiz/smcc/acos/ACOSApplDEC.java     |   2 +-
 .../java/at/gv/egiz/smcc/acos/ACOSApplSIG.java     |   2 +-
 .../java/at/gv/egiz/smcc/acos/ACOSCardTest.java    |  21 +-
 .../egiz/smcc/pin/gui/CancelChangePINProvider.java |  39 ++
 .../at/gv/egiz/smcc/pin/gui/CancelPINProvider.java |  29 +
 .../at/gv/egiz/smcc/pin/gui/ChangePINProvider.java |  49 ++
 .../at/gv/egiz/smcc/pin/gui/DummyChangePINGUI.java |  68 ++
 .../java/at/gv/egiz/smcc/pin/gui/DummyPINGUI.java  |  48 ++
 .../gv/egiz/smcc/pin/gui/InterruptPINProvider.java |  34 +
 .../smcc/pin/gui/InvalidChangePINProvider.java     |  56 ++
 .../gv/egiz/smcc/pin/gui/InvalidPINProvider.java   |  48 ++
 .../gv/egiz/smcc/pin/gui/SMCCTestPINProvider.java  |  43 ++
 .../java/at/gv/egiz/smcc/starcos/STARCOSAppl.java  |  23 -
 .../starcos/STARCOSApplGewoehnlicheSignatur.java   |  27 +-
 .../gv/egiz/smcc/starcos/STARCOSApplInfobox.java   |   5 +
 .../smcc/starcos/STARCOSApplSichereSignatur.java   |  36 +-
 .../egiz/smcc/starcos/STARCOSCardChannelEmul.java  | 105 ++-
 .../at/gv/egiz/smcc/starcos/STARCOSCardEmul.java   |  24 +-
 .../at/gv/egiz/smcc/starcos/STARCOSCardTest.java   | 132 ++--
 .../smcc/starcos/STARCOSG3CardChannelEmul.java     |  46 ++
 .../at/gv/egiz/smcc/starcos/STARCOSG3CardEmul.java |  57 ++
 .../at/gv/egiz/smcc/starcos/STARCOSG3CardTest.java | 119 ++++
 smccSTAL/src/main/java/META-INF/MANIFEST.MF        |   3 -
 .../gv/egiz/bku/pin/gui/AbstractPINProvider.java   |  60 ++
 .../java/at/gv/egiz/bku/pin/gui/SignPINGUI.java    | 136 ++++
 .../at/gv/egiz/bku/pin/gui/SignPINProvider.java    | 105 +++
 .../java/at/gv/egiz/bku/pin/gui/VerifyPINGUI.java  |  76 ++
 .../at/gv/egiz/bku/pin/gui/VerifyPINProvider.java  |  72 ++
 .../gv/egiz/bku/smccstal/AbstractPINProvider.java  |  67 --
 .../bku/smccstal/InfoBoxReadRequestHandler.java    |   9 +-
 .../gv/egiz/bku/smccstal/PINProviderFactory.java   | 327 ---------
 .../gv/egiz/bku/smccstal/SignRequestHandler.java   |   4 +-
 .../java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java |  13 +-
 .../at/gv/egiz/bku/pin/gui/ManagementPINGUI.java   |  88 +++
 .../gv/egiz/bku/pin/gui/ManagementPINProvider.java |  89 +++
 .../bku/smccstal/ManagementPINProviderFactory.java | 246 -------
 .../bku/smccstal/PINManagementRequestHandler.java  | 210 ++++--
 82 files changed, 4011 insertions(+), 2095 deletions(-)
 create mode 100644 BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ComparePinDocument.java
 create mode 100644 BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ExtendedPinDocument.java
 delete mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
 delete mode 100644 smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/ResetRetryCounterAPDUSpec.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINGUI.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINProvider.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINGUI.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINProvider.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/reader/CardReader.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/reader/DefaultCardReader.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/reader/PinpadCardReader.java
 create mode 100644 smcc/src/main/java/at/gv/egiz/smcc/reader/ReaderFactory.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelChangePINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelPINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/ChangePINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyChangePINGUI.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyPINGUI.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InterruptPINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidChangePINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidPINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/pin/gui/SMCCTestPINProvider.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardChannelEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardEmul.java
 create mode 100644 smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardTest.java
 delete mode 100644 smccSTAL/src/main/java/META-INF/MANIFEST.MF
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/AbstractPINProvider.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINGUI.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINProvider.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINGUI.java
 create mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINProvider.java
 delete mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
 delete mode 100644 smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
 create mode 100644 smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINGUI.java
 create mode 100644 smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINProvider.java
 delete mode 100644 smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/ManagementPINProviderFactory.java

(limited to 'smccSTAL/src/test/java/at')

diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
index 91c91dcb..1e23c64c 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIFacade.java
@@ -16,7 +16,7 @@
  */
 package at.gv.egiz.bku.gui;
 
-import at.gv.egiz.stal.HashDataInput;
+  import at.gv.egiz.stal.HashDataInput;
 import at.gv.egiz.smcc.PINSpec;
 import java.awt.Color;
 import java.awt.event.ActionListener;
@@ -53,14 +53,15 @@ public interface BKUGUIFacade {
   public static final String TITLE_WELCOME = "title.welcome";
   public static final String TITLE_INSERTCARD = "title.insertcard";
   public static final String TITLE_CARD_NOT_SUPPORTED = "title.cardnotsupported";
-  public static final String TITLE_CARDPIN = "title.cardpin";
+  public static final String TITLE_VERIFY_PIN = "title.verify.pin";
   public static final String TITLE_SIGN = "title.sign";
+  public static final String TITLE_VERIFY_PINPAD = "title.verify.pinpad";
   public static final String TITLE_ERROR = "title.error";
   public static final String TITLE_WARNING = "title.warning";
   public static final String TITLE_ENTRY_TIMEOUT = "title.entry.timeout";
   public static final String TITLE_RETRY = "title.retry";
   public static final String TITLE_WAIT = "title.wait";
-  public static final String TITLE_HASHDATA = "title.hashdata";
+  public static final String TITLE_SIGNATURE_DATA = "title.signature.data";
   public static final String WINDOWTITLE_SAVE = "windowtitle.save";
   public static final String WINDOWTITLE_ERROR = "windowtitle.error";
   public static final String WINDOWTITLE_SAVEDIR = "windowtitle.savedir";
@@ -75,6 +76,7 @@ public interface BKUGUIFacade {
   public static final String MESSAGE_CARD_NOT_SUPPORTED = "cardnotsupported";
   public static final String MESSAGE_ENTERPIN = "enterpin";
   public static final String MESSAGE_ENTERPIN_PINPAD = "enterpin.pinpad";
+  public static final String MESSAGE_ENTERPIN_PINPAD_DIRECT = "enterpin.pinpad.direct";
   public static final String MESSAGE_HASHDATALINK = "hashdatalink";
   public static final String MESSAGE_HASHDATALINK_TINY = "hashdatalink.tiny";
   public static final String MESSAGE_HASHDATALINK_FOCUS = "hashdatalink.focus";
@@ -96,8 +98,9 @@ public interface BKUGUIFacade {
   public static final String HELP_WAIT = "help.wait";
   public static final String HELP_CARDNOTSUPPORTED = "help.cardnotsupported";
   public static final String HELP_INSERTCARD = "help.insertcard";
-  public static final String HELP_CARDPIN = "help.cardpin";
+  public static final String HELP_VERIFY_PIN = "help.cardpin";
   public static final String HELP_SIGNPIN = "help.signpin";
+  public static final String HELP_PINPAD = "help.pinpad";
   public static final String HELP_RETRY = "help.retry";
   public static final String HELP_HASHDATA = "help.hashdata";
   public static final String HELP_HASHDATALIST = "help.hashdatalist";
@@ -111,6 +114,18 @@ public interface BKUGUIFacade {
   public static final String SAVE_HASHDATAINPUT_PREFIX = "save.hashdatainput.prefix";
   public static final String ALT_HELP = "alt.help";
 
+  public void showEnterPINDirect(PINSpec spec, int retries);
+
+  public void showEnterPIN(PINSpec spec, int retries);
+
+  public void showSignatureDataDialog(PINSpec spec, ActionListener listener, String string, ActionListener aThis0, String string0, ActionListener aThis1, String string1);
+
+  public void correctionButtonPressed();
+
+  public void allKeysCleared();
+
+  public void validKeyPressed();
+
   public enum Style { tiny, simple, advanced };
     
   /**
@@ -119,7 +134,7 @@ public interface BKUGUIFacade {
    */
   public Locale getLocale();
 
-  public void showCardPINDialog(PINSpec pinSpec, int numRetries,
+  public void showVerifyPINDialog(PINSpec pinSpec, int numRetries,
           ActionListener okListener, String okCommand,
           ActionListener cancelListener, String cancelCommand);
 
@@ -128,9 +143,6 @@ public interface BKUGUIFacade {
           ActionListener cancelListener, String cancelCommand,
           ActionListener viewerListener, String viewerCommand);
 
-  public void showPinpadSignaturePINDialog(PINSpec pinSpec, int numRetries, 
-          ActionListener viewerListener, String viewerCommand);
-
   public char[] getPin();
 
   /**
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
index baffb3fd..3fc631c3 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/BKUGUIImpl.java
@@ -93,6 +93,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
     protected JLabel switchFocusDummyLabel; 
     /** remember the pinfield to return to worker */
     protected JPasswordField pinField;
+    protected JPasswordField pinpadPINField;
 
     protected int buttonSize;
     
@@ -360,221 +361,27 @@ public class BKUGUIImpl implements BKUGUIFacade {
       return messages.containsKey(key);
     }
 
-//    @Override
-//    public void showWelcomeDialog() {
-//
-//      log.debug("scheduling welcome dialog");
-//
-//        SwingUtilities.invokeLater(new Runnable() {
-//
-//            @Override
-//            public void run() {
-//
-//              log.debug("show welcome dialog");
-//
-//                mainPanel.removeAll();
-//                buttonPanel.removeAll();
-//
-//                helpListener.setHelpTopic(HELP_WELCOME);
-//
-//                JLabel welcomeMsgLabel = new JLabel();
-//                welcomeMsgLabel.setFont(welcomeMsgLabel.getFont().deriveFont(welcomeMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-//
-//                if (renderHeaderPanel) {
-//                  titleLabel.setText(getMessage(TITLE_WELCOME));
-//                  welcomeMsgLabel.setText(getMessage(MESSAGE_WAIT));
-//                } else {
-//                  welcomeMsgLabel.setText(getMessage(TITLE_WELCOME));
-//                }
-//
-//                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-//                mainPanel.setLayout(mainPanelLayout);
-//
-//                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-//                        .addComponent(welcomeMsgLabel);
-//                GroupLayout.Group messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-//                        .addComponent(welcomeMsgLabel);
-//                if (!renderHeaderPanel) {
-//                  messageHorizontal
-//                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-//                          .addComponent(helpLabel);
-//                  messageVertical
-//                          .addComponent(helpLabel);
-//                }
-//
-//                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-//                mainPanelLayout.setVerticalGroup(messageVertical);
-//
-//                contentPanel.validate();
-//
-//            }
-//        });
-//    }
-
-//    @Override
-//    public void showInsertCardDialog(
-//            final ActionListener cancelListener, final String cancelCommand) {
-//
-//      log.debug("scheduling insert card dialog");
-//
-//      SwingUtilities.invokeLater(new Runnable() {
-//
-//            @Override
-//            public void run() {
-//
-//              log.debug("show insert card dialog");
-//
-//                mainPanel.removeAll();
-//                buttonPanel.removeAll();
-//
-//                if (renderHeaderPanel) {
-//                  titleLabel.setText(getMessage(TITLE_INSERTCARD));
-//                }
-//
-//                helpListener.setHelpTopic(HELP_INSERTCARD);
-//
-//                JLabel insertCardMsgLabel = new JLabel();
-//                insertCardMsgLabel.setFont(insertCardMsgLabel.getFont().deriveFont(insertCardMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-//                insertCardMsgLabel.setText(getMessage(MESSAGE_INSERTCARD));
-//
-//                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-//                mainPanel.setLayout(mainPanelLayout);
-//
-//                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-//                        .addComponent(insertCardMsgLabel);
-//                GroupLayout.ParallelGroup messageVertical = mainPanelLayout.createParallelGroup()
-//                        .addComponent(insertCardMsgLabel);
-//
-//                if (!renderHeaderPanel) {
-//                  messageHorizontal
-//                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-//                          .addComponent(helpLabel);
-//                  messageVertical
-//                          .addComponent(helpLabel);
-//                }
-//
-//                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-//                mainPanelLayout.setVerticalGroup(messageVertical);
-//
-//                if (renderCancelButton) {
-//                  JButton cancelButton = new JButton();
-//                  cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-//                  cancelButton.setText(getMessage(BUTTON_CANCEL));
-//                  cancelButton.addActionListener(cancelListener);
-//                  cancelButton.setActionCommand(cancelCommand);
-//
-//                  GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-//                  buttonPanel.setLayout(buttonPanelLayout);
-//
-//                  buttonPanelLayout.setHorizontalGroup(
-//                    buttonPanelLayout.createSequentialGroup()
-//                          .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-//                          .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-//                  buttonPanelLayout.setVerticalGroup(
-//                    buttonPanelLayout.createSequentialGroup()
-//                      .addComponent(cancelButton));
-//                }
-//
-//                contentPanel.validate();
-//            }
-//        });
-//    }
-
-    /**
-     * only difference to showInsertCard: title text: card not supported
-     * @param cancelListener
-     * @param cancelCommand
-     */
-//    @Override
-//    public void showCardNotSupportedDialog(final ActionListener cancelListener, final String cancelCommand) {
-//
-//      log.debug("scheduling card not supported dialog");
-//
-//      SwingUtilities.invokeLater(new Runnable() {
-//
-//            @Override
-//            public void run() {
-//
-//              log.debug("show card not supported dialog");
-//
-//              mainPanel.removeAll();
-//              buttonPanel.removeAll();
-//
-//              JLabel insertCardMsgLabel = new JLabel();
-//              insertCardMsgLabel.setFont(insertCardMsgLabel.getFont().deriveFont(insertCardMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-//
-//              if (renderHeaderPanel) {
-//                titleLabel.setText(getMessage(TITLE_CARD_NOT_SUPPORTED));
-//                insertCardMsgLabel.setText(getMessage(MESSAGE_INSERTCARD));
-//              } else {
-//                insertCardMsgLabel.setText(getMessage(TITLE_CARD_NOT_SUPPORTED));
-//              }
-//
-//              helpListener.setHelpTopic(HELP_CARDNOTSUPPORTED);
-//
-//              GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-//              mainPanel.setLayout(mainPanelLayout);
-//
-//              GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-//                      .addComponent(insertCardMsgLabel);
-//              GroupLayout.Group messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-//                      .addComponent(insertCardMsgLabel);
-//              if (!renderHeaderPanel) {
-//                messageHorizontal
-//                        .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-//                        .addComponent(helpLabel);
-//                messageVertical
-//                        .addComponent(helpLabel);
-//              }
-//
-//              mainPanelLayout.setHorizontalGroup(messageHorizontal);
-//              mainPanelLayout.setVerticalGroup(messageVertical);
-//
-//              if (renderCancelButton) {
-//                JButton cancelButton = new JButton();
-//                cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-//                cancelButton.setText(getMessage(BUTTON_CANCEL));
-//                cancelButton.addActionListener(cancelListener);
-//                cancelButton.setActionCommand(cancelCommand);
-//
-//                GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-//                buttonPanel.setLayout(buttonPanelLayout);
-//
-//                buttonPanelLayout.setHorizontalGroup(
-//                  buttonPanelLayout.createSequentialGroup()
-//                        .addContainerGap(GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
-//                        .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE));
-//                buttonPanelLayout.setVerticalGroup(
-//                  buttonPanelLayout.createSequentialGroup()
-//                    .addComponent(cancelButton));
-//              }
-//
-//              contentPanel.validate();
-//            }
-//        });
-//    }
-
   @Override
-  public void showCardPINDialog(final PINSpec pinSpec, final int numRetries,
+  public void showVerifyPINDialog(final PINSpec pinSpec, final int numRetries,
           final ActionListener okListener, final String okCommand,
           final ActionListener cancelListener, final String cancelCommand) {
         
-      log.debug("scheduling card-pin dialog");
+      log.debug("scheduling verify pin dialog");
       
       SwingUtilities.invokeLater(new Runnable() {
 
             @Override
             public void run() {
 
-              log.debug("[" + Thread.currentThread().getName() + "] show card-pin dialog");
+              log.debug("[" + Thread.currentThread().getName() + "] show verify pin dialog");
       
                 mainPanel.removeAll();
                 buttonPanel.removeAll();
 
                 if (renderHeaderPanel) {
                   if (numRetries < 0) {
-                      String cardpinTitle = getMessage(TITLE_CARDPIN);
-                      titleLabel.setText(MessageFormat.format(cardpinTitle, new Object[]{pinSpec.getLocalizedName()}));
+                      String verifyTitle = getMessage(TITLE_VERIFY_PIN);
+                      titleLabel.setText(MessageFormat.format(verifyTitle, new Object[]{pinSpec.getLocalizedName()}));
                   } else {
                       titleLabel.setText(getMessage(TITLE_RETRY));
                   }
@@ -615,8 +422,8 @@ public class BKUGUIImpl implements BKUGUIFacade {
                   } else {
                     infoLabel.setText(MessageFormat.format(infoPattern, new Object[] {pinSpec.getLocalizedName()}));
                   }
-                  helpMouseListener.setHelpTopic(HELP_CARDPIN);
-                  helpKeyListener.setHelpTopic(HELP_CARDPIN);
+                  helpMouseListener.setHelpTopic(HELP_VERIFY_PIN);
+                  helpKeyListener.setHelpTopic(HELP_VERIFY_PIN);
                 } else {
                   String retryPattern;
                   if (numRetries < 2) {
@@ -732,194 +539,346 @@ public class BKUGUIImpl implements BKUGUIFacade {
         });
     }
 
-//    @Override
-//    public void showCardPINDialog(PINSpec pinSpec, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand) {
-//        showCardPINDialog(pinSpec, -1, okListener, okCommand, cancelListener, cancelCommand);
-//    }
-//
-//    @Override
-//    public void showCardPINRetryDialog(PINSpec pinSpec, int numRetries, ActionListener okListener, String okCommand, ActionListener cancelListener, String cancelCommand) {
-//        showCardPINDialog(pinSpec, numRetries, okListener, okCommand, cancelListener, cancelCommand);
-//    }
+  @Override
+  public void showEnterPINDirect(PINSpec pinSpec, int retries) {
+    if (retries < 0) {
+      showMessageDialog(TITLE_VERIFY_PINPAD, MESSAGE_ENTERPIN_PINPAD_DIRECT, new Object[] {
+                  pinSpec.getLocalizedName(), pinSpec.getLocalizedLength() });
+    } else {
+      showMessageDialog(TITLE_RETRY, MESSAGE_RETRIES, new Object[]{String.valueOf(retries) });
+    }
+  }
 
-//    @Override
-//    public void showSignaturePINDialog(PINSpec pinSpec, ActionListener signListener, String signCommand, ActionListener cancelListener, String cancelCommand, ActionListener hashdataListener, String hashdataCommand) {
-//        showSignaturePINDialog(pinSpec, -1, signListener, signCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
-//    }
+  @Override
+  public void showEnterPIN(final PINSpec pinSpec, final int retries) {
+    showEnterPIN(pinSpec, retries, TITLE_VERIFY_PINPAD, MESSAGE_ENTERPIN_PINPAD, null);
+  }
 
-    @Override
-    public void showPinpadSignaturePINDialog(final PINSpec pinSpec, final int numRetries,
-//            final ActionListener cancelListener, final String cancelCommand,
-            final ActionListener hashdataListener, final String hashdataCommand) {
+  protected void showEnterPIN(final PINSpec pinSpec, final int retries, final String titleKey, final String messageKey, final Object[] messageParams) {
+    log.debug("scheduling pinpad dialog");
 
-        log.debug("scheduling pinpad signature-pin dialog");
+    SwingUtilities.invokeLater(new Runnable() {
 
-        SwingUtilities.invokeLater(new Runnable() {
+      @Override
+      public void run() {
 
-            @Override
-            public void run() {
+        log.debug("[" + Thread.currentThread().getName() + "] show pinpad dialog");
 
-              log.debug("[" + Thread.currentThread().getName() + "] show pinpad signature-pin dialog");
+        mainPanel.removeAll();
+        buttonPanel.removeAll();
 
-                mainPanel.removeAll();
-                buttonPanel.removeAll();
+        if (renderHeaderPanel) {
+          if (retries < 0) {
+              titleLabel.setText(getMessage(titleKey));
+          } else {
+              titleLabel.setText(getMessage(TITLE_RETRY));
+          }
+        }
 
-                if (renderHeaderPanel) {
-                  if (numRetries < 0) {
-                      titleLabel.setText(getMessage(TITLE_SIGN));
-                  } else {
-                      titleLabel.setText(getMessage(TITLE_RETRY));
-                  }
-                }
+        final JLabel infoLabel = new JLabel();
+        if (retries < 0) {
+          infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+          infoLabel.setText(MessageFormat.format(getMessage(messageKey), messageParams));
+          helpMouseListener.setHelpTopic(HELP_PINPAD);
+          helpKeyListener.setHelpTopic(HELP_PINPAD);
+        } else {
+          String retryPattern;
+          if (retries == 1) {
+            retryPattern = getMessage(MESSAGE_LAST_RETRY);
+          } else {
+            retryPattern = getMessage(MESSAGE_RETRIES);
+          }
+          infoLabel.setText(MessageFormat.format(retryPattern, new Object[]{String.valueOf(retries)}));
+          infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() | java.awt.Font.BOLD));
+          infoLabel.setForeground(ERROR_COLOR);
+          helpMouseListener.setHelpTopic(HELP_RETRY);
+          helpKeyListener.setHelpTopic(HELP_RETRY);
+        }
+
+        JLabel pinLabel = new JLabel();
+        pinLabel.setFont(pinLabel.getFont().deriveFont(pinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+        String pinName = getMessage(LABEL_PIN);
+        pinLabel.setText(MessageFormat.format(pinName, new Object[]{pinSpec.getLocalizedName()}));
+
+        pinpadPINField = new JPasswordField();
+        pinpadPINField.setText("");
+        pinpadPINField.setEnabled(false);
+
+        JLabel pinsizeLabel = new JLabel();
+        pinsizeLabel.setFont(pinsizeLabel.getFont().deriveFont(pinsizeLabel.getFont().getStyle() & ~java.awt.Font.BOLD, pinsizeLabel.getFont().getSize()-2));
+        pinsizeLabel.setText(MessageFormat.format(getMessage(LABEL_PINSIZE), pinSpec.getLocalizedLength()));
+
+        GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+        mainPanel.setLayout(mainPanelLayout);
+
+        GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
+                .addComponent(infoLabel);
+        GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                .addComponent(infoLabel);
+
+        if (!renderHeaderPanel) {
+          infoHorizontal
+                  .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                  .addComponent(switchFocusDummyLabel)
+                  .addComponent(helpLabel)
+                  ;
+          infoVertical
+                  .addComponent(switchFocusDummyLabel)
+                  .addComponent(helpLabel)
+                  ;
+        }
+
+        // align pinfield and pinsize to the right
+        GroupLayout.Group pinHorizontal = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.TRAILING);
+        GroupLayout.SequentialGroup pinVertical = mainPanelLayout.createSequentialGroup();
+
+        if (pinLabelPos == PinLabelPosition.ABOVE) {
+          pinHorizontal
+                  .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                    .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                    .addComponent(pinpadPINField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
+                  .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE);
+          pinVertical
+                  .addComponent(pinLabel)
+                  .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                  .addComponent(pinpadPINField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                  .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                  .addComponent(pinsizeLabel);
+        } else { // PinLabelPosition.LEFT
+          pinHorizontal
+                  .addGroup(mainPanelLayout.createSequentialGroup()
+                    .addComponent(pinLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE)
+                    .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                    .addComponent(pinpadPINField, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
+                  .addComponent(pinsizeLabel, GroupLayout.PREFERRED_SIZE, GroupLayout.DEFAULT_SIZE, GroupLayout.PREFERRED_SIZE);
+          pinVertical
+                  .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                    .addComponent(pinLabel)
+                    .addComponent(pinpadPINField))
+                  .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+                  .addComponent(pinsizeLabel);
+        }
+
+        mainPanelLayout.setHorizontalGroup(
+          mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+            .addGroup(infoHorizontal)
+            .addGroup(pinHorizontal));
+
+        mainPanelLayout.setVerticalGroup(
+          mainPanelLayout.createSequentialGroup()
+            .addGroup(infoVertical)
+            .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+            .addGroup(pinVertical));
+
+        contentPanel.validate();
+      }
+    });
+  }
+
+  @Override
+  public void showSignatureDataDialog(PINSpec spec,
+          final ActionListener enterPINListener, final String enterPINCommand,
+          final ActionListener cancelListener, final String cancelCommand,
+          final ActionListener hashdataListener, final String hashdataCommand) {
+
+    log.debug("scheduling signature-data dialog");
+
+    SwingUtilities.invokeLater(new Runnable() {
+
+        @Override
+        public void run() {
+
+          log.debug("[" + Thread.currentThread().getName() + "] show signature-data dialog");
+
+          mainPanel.removeAll();
+          buttonPanel.removeAll();
+
+          if (renderHeaderPanel) {
+            titleLabel.setText(getMessage(TITLE_SIGNATURE_DATA));
+          }
+
+          final JLabel infoLabel = new JLabel();
+          infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
+          if (shortText) {
+            infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
+          } else {
+            infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
+          }
+          infoLabel.setFocusable(true);
+          infoLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
+          infoLabel.setForeground(HYPERLINK_COLOR);
+          infoLabel.addMouseListener(new MouseAdapter() {
+
+              @Override
+              public void mouseClicked(MouseEvent me) {
+                  ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
+                  hashdataListener.actionPerformed(e);
+              }
+          });
+
+          infoLabel.addKeyListener(new KeyAdapter() {
+
+             @Override
+             public void keyPressed(KeyEvent e) {
+
+                 if(e.getKeyCode() == KeyEvent.VK_ENTER) {
+                     ActionEvent e1 = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
+                      hashdataListener.actionPerformed(e1);
+                 }
+             }
+
+           });
+
+          infoLabel.addFocusListener(new FocusAdapter() {
+
+              @Override
+              public void focusGained(FocusEvent e) {
 
-                final JLabel infoLabel = new JLabel();
-                if (numRetries < 0) {
-                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
                   if (shortText) {
-                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
-                  } else {
-                    infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
-                  }
-                  infoLabel.setFocusable(true);
-                  infoLabel.setCursor(Cursor.getPredefinedCursor(Cursor.HAND_CURSOR));
-                  infoLabel.setForeground(HYPERLINK_COLOR);
-                  infoLabel.addMouseListener(new MouseAdapter() {
+                      infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY_FOCUS));
+                    } else {
+                      infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_FOCUS));
+                    }
+              }
 
-                      @Override
-                      public void mouseClicked(MouseEvent me) {
-                          ActionEvent e = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
-                          hashdataListener.actionPerformed(e);
-                      }
-                  });
-                  
-                  infoLabel.addKeyListener(new KeyAdapter() {
-                	  
-                 	 @Override
-                 	 public void keyPressed(KeyEvent e) {
-                 		 
-                 		 if(e.getKeyCode() == KeyEvent.VK_ENTER) {                			 
-                 			 ActionEvent e1 = new ActionEvent(this, ActionEvent.ACTION_PERFORMED, hashdataCommand);
-                              hashdataListener.actionPerformed(e1);
-                 		 }
-                 	 }
-                 	  
-                   });  
-                  
-                  infoLabel.addFocusListener(new FocusAdapter() {
-                	  
-                	  @Override
-                	  public void focusGained(FocusEvent e) {
-                		  
-                          if (shortText) {
-                              infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY_FOCUS));
-                            } else {
-                              infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_FOCUS));
-                            }
-                	  }
-                	  
-                	  @Override
-                	  public void focusLost(FocusEvent e) {
-                		  
-                          if (shortText) {
-                              infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
-                            } else {
-                              infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
-                            }
-                		  
-                	  }                	  
-                	  
-                  });                  
-                  
-                  helpMouseListener.setHelpTopic(HELP_SIGNPIN);
-                  helpKeyListener.setHelpTopic(HELP_SIGNPIN);
-                } else {
-                  String retryPattern;
-                  if (numRetries < 2) {
-                    retryPattern = getMessage(MESSAGE_LAST_RETRY);
-                  } else {
-                    retryPattern = getMessage(MESSAGE_RETRIES);
-                  }
-                  infoLabel.setFocusable(true);
-                  infoLabel.setText(MessageFormat.format(retryPattern, new Object[]{String.valueOf(numRetries)}));
-                  infoLabel.setFont(infoLabel.getFont().deriveFont(infoLabel.getFont().getStyle() | java.awt.Font.BOLD));
-                  infoLabel.setForeground(ERROR_COLOR);
-                  helpMouseListener.setHelpTopic(HELP_RETRY);
-                  helpKeyListener.setHelpTopic(HELP_RETRY);
-                }
+              @Override
+              public void focusLost(FocusEvent e) {
 
-                String msgPattern = getMessage(MESSAGE_ENTERPIN_PINPAD);
-                String msg = MessageFormat.format(msgPattern, new Object[] {
-                  pinSpec.getLocalizedName(), pinSpec.getLocalizedLength() });
+                  if (shortText) {
+                      infoLabel.setText(getMessage(MESSAGE_HASHDATALINK_TINY));
+                    } else {
+                      infoLabel.setText(getMessage(MESSAGE_HASHDATALINK));
+                    }
 
-                JLabel msgLabel = new JLabel();
-                msgLabel.setFont(msgLabel.getFont().deriveFont(msgLabel.getFont().getStyle() & ~Font.BOLD));
-                msgLabel.setText(msg);
+              }
 
-                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-                mainPanel.setLayout(mainPanelLayout);
+          });
 
-                GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
-                        .addComponent(infoLabel);
-                GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                        .addComponent(infoLabel);
+          helpMouseListener.setHelpTopic(HELP_SIGNPIN);
+          helpKeyListener.setHelpTopic(HELP_SIGNPIN);
 
-                if (!renderHeaderPanel) {
-                  infoHorizontal
-                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-                          .addComponent(switchFocusDummyLabel)
-                          .addComponent(helpLabel)
-                          ;
-                  infoVertical
-                          .addComponent(switchFocusDummyLabel)
-                          .addComponent(helpLabel)
-                          ;
-                }
+          //TODO message panel
 
-                mainPanelLayout.setHorizontalGroup(
-                  mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-                    .addGroup(infoHorizontal)
-                    .addComponent(msgLabel));
+//              String msgPattern = getMessage(MESSAGE_ENTERPIN_PINPAD);
+//              String msg = MessageFormat.format(msgPattern, new Object[] {
+//                pinSpec.getLocalizedName(), pinSpec.getLocalizedLength() });
+//
+//              JLabel msgLabel = new JLabel();
+//              msgLabel.setFont(msgLabel.getFont().deriveFont(msgLabel.getFont().getStyle() & ~Font.BOLD));
+//              msgLabel.setText(msg);
 
-                mainPanelLayout.setVerticalGroup(
-                  mainPanelLayout.createSequentialGroup()
-                    .addGroup(infoVertical)
+          GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
+          mainPanel.setLayout(mainPanelLayout);
+
+          GroupLayout.SequentialGroup infoHorizontal = mainPanelLayout.createSequentialGroup()
+                  .addComponent(infoLabel);
+          GroupLayout.ParallelGroup infoVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+                  .addComponent(infoLabel);
+
+          if (!renderHeaderPanel) {
+            infoHorizontal
+                    .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
+                    .addComponent(switchFocusDummyLabel)
+                    .addComponent(helpLabel)
+                    ;
+            infoVertical
+                    .addComponent(switchFocusDummyLabel)
+                    .addComponent(helpLabel)
+                    ;
+          }
+
+          mainPanelLayout.setHorizontalGroup(
+                  infoHorizontal);
+//              mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
+//                .addGroup(infoHorizontal)
+//                .addComponent(msgLabel));
+
+          mainPanelLayout.setVerticalGroup(
+                  infoVertical);
+//              mainPanelLayout.createSequentialGroup()
+//                .addGroup(infoVertical)
+//                .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
+//                .addComponent(msgLabel));
+
+
+          GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
+          buttonPanel.setLayout(buttonPanelLayout);
+
+          GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup();
+          GroupLayout.Group buttonVertical;
+
+          JButton enterPINButton = new JButton();
+          enterPINButton.setFont(enterPINButton.getFont().deriveFont(enterPINButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+          enterPINButton.setText(getMessage(BUTTON_SIGN));
+          enterPINButton.setActionCommand(enterPINCommand);
+          enterPINButton.addActionListener(enterPINListener);
+
+          if (renderCancelButton) {
+            JButton cancelButton = new JButton();
+            cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
+            cancelButton.setText(getMessage(BUTTON_CANCEL));
+            cancelButton.setActionCommand(cancelCommand);
+            cancelButton.addActionListener(cancelListener);
+
+            buttonHorizontal
+                    .addComponent(enterPINButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
                     .addPreferredGap(LayoutStyle.ComponentPlacement.RELATED)
-                    .addComponent(msgLabel));
-
-                //no cancel button (cancel via pinpad)
-//                if (renderCancelButton) {
-//                    JButton cancelButton = new JButton();
-//                    cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-//                    cancelButton.setText(getMessage(BUTTON_CANCEL));
-//                    cancelButton.setActionCommand(cancelCommand);
-//                    cancelButton.addActionListener(cancelListener);
-//
-//                    GroupLayout buttonPanelLayout = new GroupLayout(buttonPanel);
-//                    buttonPanel.setLayout(buttonPanelLayout);
-//
-//                    GroupLayout.SequentialGroup buttonHorizontal = buttonPanelLayout.createSequentialGroup()
-//                            .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE);
-//                    GroupLayout.SequentialGroup buttonVertical = buttonPanelLayout.createSequentialGroup()
-//                            .addComponent(cancelButton);
-//
-//                    buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
-//                    buttonPanelLayout.setVerticalGroup(buttonVertical);
-//                }
+                    .addComponent(cancelButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
+                    ;
+            buttonVertical = buttonPanelLayout.createParallelGroup(GroupLayout.Alignment.BASELINE)
+                    .addComponent(enterPINButton)
+                    .addComponent(cancelButton)
+                    ;
+          } else {
+            buttonHorizontal
+                    .addComponent(enterPINButton, GroupLayout.PREFERRED_SIZE, buttonSize, GroupLayout.PREFERRED_SIZE)
+                    ;
+            buttonVertical = buttonPanelLayout.createSequentialGroup()
+                    .addComponent(enterPINButton)
+                    ;
+          }
 
-                contentPanel.validate();
-            }
-        });
+          buttonPanelLayout.setHorizontalGroup(buttonHorizontal);
+          buttonPanelLayout.setVerticalGroup(buttonVertical);
+
+          contentPanel.validate();
+        }
+    });
+  }
+
+  @Override
+  public void correctionButtonPressed() {
+    log.debug("[" + Thread.currentThread().getName() + "] correction button pressed");
+
+    if (pinpadPINField != null) {
+      String maskedPIN = pinpadPINField.getText();
+      pinpadPINField.setText(maskedPIN.substring(0, maskedPIN.length() - 1));
+    }
+  }
+
+  @Override
+  public void allKeysCleared() {
+    log.debug("[" + Thread.currentThread().getName() + "] all keys cleared");
+
+    if (pinpadPINField != null) {
+      pinpadPINField.setText("");
+    }
+  }
+
+  @Override
+  public void validKeyPressed() {
+    log.debug("[" + Thread.currentThread().getName() + "] valid key pressed");
+
+    if (pinpadPINField != null) {
+      pinpadPINField.setText(pinpadPINField.getText() + '*');
     }
+  }
 
     @Override
     public void showSignaturePINDialog(final PINSpec pinSpec, final int numRetries,
             final ActionListener signListener, final String signCommand,
             final ActionListener cancelListener, final String cancelCommand,
             final ActionListener hashdataListener, final String hashdataCommand) {
-//        showSignaturePINDialog(pinSpec, numRetries, okListener, okCommand, cancelListener, cancelCommand, hashdataListener, hashdataCommand);
-//    }
-//
-//    private void showSignaturePINDialog(final PINSpec pinSpec, final int numRetries, final ActionListener signListener, final String signCommand, final ActionListener cancelListener, final String cancelCommand, final ActionListener hashdataListener, final String hashdataCommand) {
 
       log.debug("scheduling signature-pin dialog");
       
@@ -1302,57 +1261,6 @@ public class BKUGUIImpl implements BKUGUIFacade {
         });
     }
 
-//    @Override
-//    public void showWaitDialog(final String waitMessage) {
-//
-//      log.debug("scheduling wait dialog");
-//
-//      SwingUtilities.invokeLater(new Runnable() {
-//
-//            @Override
-//            public void run() {
-//
-//              log.debug("show wait dialog");
-//
-//                mainPanel.removeAll();
-//                buttonPanel.removeAll();
-//
-//                if (renderHeaderPanel) {
-//                  titleLabel.setText(getMessage(TITLE_WAIT));
-//                }
-//
-//                helpListener.setHelpTopic(HELP_WAIT);
-//
-//                JLabel waitMsgLabel = new JLabel();
-//                waitMsgLabel.setFont(waitMsgLabel.getFont().deriveFont(waitMsgLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-//                if (waitMessage != null) {
-//                    waitMsgLabel.setText("<html>" + waitMessage + "</html>");
-//                } else {
-//                    waitMsgLabel.setText(getMessage(MESSAGE_WAIT));
-//                }
-//
-//                GroupLayout mainPanelLayout = new GroupLayout(mainPanel);
-//                mainPanel.setLayout(mainPanelLayout);
-//
-//                GroupLayout.SequentialGroup messageHorizontal = mainPanelLayout.createSequentialGroup()
-//                        .addComponent(waitMsgLabel);
-//                GroupLayout.ParallelGroup messageVertical = mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
-//                        .addComponent(waitMsgLabel);
-//
-//                if (!renderHeaderPanel) {
-//                  messageHorizontal
-//                          .addPreferredGap(LayoutStyle.ComponentPlacement.UNRELATED, 0, Short.MAX_VALUE)
-//                          .addComponent(helpLabel);
-//                  messageVertical
-//                          .addComponent(helpLabel);
-//                }
-//                mainPanelLayout.setHorizontalGroup(messageHorizontal);
-//                mainPanelLayout.setVerticalGroup(messageVertical);
-//
-//                contentPanel.validate();
-//            }
-//        });
-//    }
 
     @Override
     public char[] getPin() {
@@ -1395,7 +1303,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
               @Override
               public void run() {
                 try {
-                  showMessageDialog(TITLE_HASHDATA, MESSAGE_HASHDATA_VIEWER);
+                  showMessageDialog(TITLE_SIGNATURE_DATA, MESSAGE_HASHDATA_VIEWER);
                   showSecureViewer(dataToBeSigned.get(0), backListener, backCommand);
                 } catch (FontProviderException ex) {
                   log.error("failed to display secure viewer", ex);
@@ -1411,7 +1319,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
           }
         } else {
           log.debug("[" + Thread.currentThread().getName() + "] mime-type not supported by secure viewer, scheduling save dialog");
-          showMessageDialog(TITLE_HASHDATA, MESSAGE_UNSUPPORTED_MIMETYPE);
+          showMessageDialog(TITLE_SIGNATURE_DATA, MESSAGE_UNSUPPORTED_MIMETYPE);
           SecureViewerSaveDialog.showSaveDialog(dataToBeSigned.get(0), messages, backListener, backCommand); 
         }
       } else {
@@ -1421,28 +1329,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
     
     /**
      * has to be called from event dispatcher thread
-     * @param hashDataText
-     * @param saveListener
-     * @param saveCommand
      */
-//    private void showSecureViewer(HashDataInput dataToBeSigned) throws FontProviderException {
-//      
-//      log.debug("[" + Thread.currentThread().getName() + "] show secure viewer");
-//      if (secureViewer == null) {
-//        secureViewer = new SecureViewerDialog(null, messages,
-//                fontProvider, helpMouseListener.getActionListener());
-//
-//        // workaround for [#439]
-//        // avoid AlwaysOnTop at least in applet, otherwise make secureViewer AlwaysOnTop since MOCCA Dialog (JFrame created in LocalSTALFactory) is always on top.
-//        Window window = SwingUtilities.getWindowAncestor(contentPane);
-//        if (window != null && window.isAlwaysOnTop()) {
-//          log.debug("make secureViewer alwaysOnTop");
-//          secureViewer.setAlwaysOnTop(true);
-//        }
-//      }
-//      secureViewer.setContent(dataToBeSigned);
-//      log.trace("show secure viewer returned");
-//    }
     private void showSecureViewer(HashDataInput dataToBeSigned, ActionListener closeListener, String closeCommand) throws FontProviderException {
       
       log.debug("[" + Thread.currentThread().getName() + "] show secure viewer");
@@ -1479,7 +1366,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
           buttonPanel.removeAll();
 
           if (renderHeaderPanel) {
-            titleLabel.setText(getMessage(TITLE_HASHDATA));
+            titleLabel.setText(getMessage(TITLE_SIGNATURE_DATA));
           }
           
           helpMouseListener.setHelpTopic(HELP_HASHDATALIST);
@@ -1613,7 +1500,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
               @Override
               public void run() {
                 try {
-                  showMessageDialog(TITLE_HASHDATA, MESSAGE_HASHDATA_VIEWER);
+                  showMessageDialog(TITLE_SIGNATURE_DATA, MESSAGE_HASHDATA_VIEWER);
                   showSecureViewer(selection, backToListListener, null);
 //                  SecureViewerDialog.showSecureViewer(selection, messages, fontProvider, helpMouseListener.getActionListener(), false);
                 } catch (FontProviderException ex) {
@@ -1625,7 +1512,7 @@ public class BKUGUIImpl implements BKUGUIFacade {
             });
           } else {
             log.debug("[" + Thread.currentThread().getName() + "] mime-type not supported by secure viewer, scheduling save dialog");
-            showMessageDialog(BKUGUIFacade.TITLE_HASHDATA, BKUGUIFacade.MESSAGE_UNSUPPORTED_MIMETYPE);
+            showMessageDialog(BKUGUIFacade.TITLE_SIGNATURE_DATA, BKUGUIFacade.MESSAGE_UNSUPPORTED_MIMETYPE);
             SecureViewerSaveDialog.showSaveDialog(selection, messages, backToListListener, null);
           }
         }
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
index 96032dc1..52a3d5fe 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/PinDocument.java
@@ -1,19 +1,19 @@
 /*
-* Copyright 2008 Federal Chancellery Austria and
-* Graz University of Technology
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package at.gv.egiz.bku.gui;
 
 import java.util.regex.Matcher;
@@ -21,7 +21,6 @@ import java.util.regex.Pattern;
 import javax.swing.JButton;
 import javax.swing.text.AttributeSet;
 import javax.swing.text.BadLocationException;
-import javax.swing.text.Document;
 import javax.swing.text.PlainDocument;
 
 /**
@@ -31,16 +30,15 @@ import javax.swing.text.PlainDocument;
 class PINDocument extends PlainDocument {
 
   private static final long serialVersionUID = 1L;
-  
   protected Pattern pinPattern;
   protected int minLength;
   protected int maxLength;
-
   protected JButton enterButton;
-  protected Document compareTo;
-  protected Document oldPin;        
 
   public PINDocument(int minLength, int maxLength, String pattern, JButton enterButton) {
+    if (enterButton == null) {
+      throw new NullPointerException("OK button null");
+    }
     if (pattern != null) {
       pinPattern = Pattern.compile(pattern);
     } else {
@@ -51,73 +49,26 @@ class PINDocument extends PlainDocument {
     this.enterButton = enterButton;
   }
 
-  /**
-   * @param pinSpec
-   * @param enterButton
-   * @param compareTo
-   *          enable enterButton if this pinDocument's pin equals to
-   *          compareTo's pin. may be null
-   */
-  public PINDocument(int minLength, int maxLength, String pattern, JButton enterButton, Document compareTo) {
-    this(minLength, maxLength, pattern, enterButton);
-    this.compareTo = compareTo;
+  @Override
+  public void insertString(int offs, String str, AttributeSet a) throws BadLocationException {
+    if (maxLength < 0 || maxLength >= (getLength() + str.length())) {
+      boolean matches = true;
+      for (int i = 0; i < str.length(); i++) {
+        Matcher m = pinPattern.matcher(str.substring(i, i + 1));
+        if (!m.matches()) {
+          matches = false;
+        }
+      }
+      if (matches) {
+        super.insertString(offs, str, a);
+        enterButton.setEnabled(getLength() >= minLength);
+      }
+    }
   }
 
-  /**
-   * @param pinSpec
-   * @param enterButton
-   *          may be null
-   * @param compareTo
-   *          enable enterButton if this pinDocument's pin equals to
-   *          compareTo's pin. may be null
-   * @param oldPin
-   *          enable enterButton if oldPin meets the pinSpec pin length
-   *          requirements, may be null
-   */
-  public PINDocument(int minLength, int maxLength, String pattern,
-      JButton enterButton, Document compareTo, Document oldPin) {
-    this(minLength, maxLength, pattern, enterButton);
-    this.compareTo = compareTo;
-    this.oldPin = oldPin;
+  @Override
+  public void remove(int offs, int len) throws BadLocationException {
+    super.remove(offs, len);
+    enterButton.setEnabled(getLength() >= minLength);
   }
-
-        @Override
-        public void insertString(int offs, String str, AttributeSet a) throws BadLocationException {
-            if (maxLength < 0 || maxLength >= (getLength() + str.length())) {
-                boolean matches = true;
-                for (int i = 0; i < str.length(); i++) {
-                    Matcher m = pinPattern.matcher(str.substring(i, i + 1));
-                    if (!m.matches()) {
-                        matches = false;
-                    }
-                }
-                if (matches) {
-                    super.insertString(offs, str, a);
-                }
-            }
-            if (enterButton != null) {
-              enterButton.setEnabled(
-                      (oldPin == null || oldPin.getLength() >= minLength) &&
-                      getLength() >= minLength &&
-                      compare());
-            }
-        }
-
-        @Override
-        public void remove(int offs, int len) throws BadLocationException {
-            super.remove(offs, len);
-            if (enterButton != null) {
-              enterButton.setEnabled(
-                      (oldPin == null || oldPin.getLength() >= minLength) &&
-                      getLength() >= minLength &&
-                      compare());
-            }
-        }
-
-        private boolean compare() throws BadLocationException {
-          if (compareTo == null) {
-            return true;
-          }
-          return compareTo.getText(0, compareTo.getLength()).equals(getText(0, getLength()));
-        }
-    }
\ No newline at end of file
+}
diff --git a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java
index 7bae4673..7db70c46 100644
--- a/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java
+++ b/BKUCommonGUI/src/main/java/at/gv/egiz/bku/gui/SecureViewerDialog.java
@@ -17,7 +17,6 @@
 package at.gv.egiz.bku.gui;
 
 import at.gv.egiz.bku.gui.viewer.FontProvider;
-import at.gv.egiz.bku.gui.viewer.FontProviderException;
 import at.gv.egiz.bku.gui.viewer.SecureViewerSaveDialog;
 import at.gv.egiz.stal.HashDataInput;
 import java.awt.Container;
@@ -25,7 +24,6 @@ import java.awt.Cursor;
 import java.awt.Dimension;
 import java.awt.Font;
 import java.awt.Frame;
-import java.awt.Window;
 import java.awt.event.ActionEvent;
 import java.awt.event.ActionListener;
 import java.awt.event.FocusAdapter;
@@ -34,32 +32,26 @@ import java.awt.event.KeyAdapter;
 import java.awt.event.KeyEvent;
 import java.awt.event.MouseAdapter;
 import java.awt.event.MouseEvent;
-import java.io.BufferedOutputStream;
+import java.awt.event.WindowAdapter;
+import java.awt.event.WindowEvent;
 import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
 import java.nio.charset.Charset;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 import java.util.ResourceBundle;
 import javax.swing.GroupLayout;
 import javax.swing.ImageIcon;
 import javax.swing.JButton;
 import javax.swing.JDialog;
 import javax.swing.JEditorPane;
-import javax.swing.JFileChooser;
 import javax.swing.JLabel;
-import javax.swing.JOptionPane;
 import javax.swing.JPanel;
 import javax.swing.JScrollPane;
 import javax.swing.LayoutStyle;
-import javax.swing.SwingUtilities;
+import javax.swing.WindowConstants;
 import javax.swing.text.Document;
 import javax.swing.text.EditorKit;
 import javax.swing.text.StyledEditorKit;
@@ -71,7 +63,7 @@ import org.apache.commons.logging.LogFactory;
  *
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
  */
-public class SecureViewerDialog extends JDialog implements ActionListener {
+public class SecureViewerDialog extends JDialog {
 
   /** don't import BKUFonts in order not to load BKUFonts.jar
    * BKUApplet includes BKUFonts as runtime dependency only, the jar is copied to the applet dir in BKUOnline with dependency-plugin
@@ -100,19 +92,6 @@ public class SecureViewerDialog extends JDialog implements ActionListener {
    * @param owner, dialog is positioned relative to its owner
    * (if null, at default location of native windowing system)
    */
-//  public static void showDataToBeSigned(HashDataInput dataToBeSigned,
-//          ResourceBundle messages,
-//          ActionListener saveListener, String saveCommand,
-//          ActionListener helpListener) {
-//
-////      Frame ownerFrame = (owner != null) ?
-////        JOptionPane.getFrameForComponent(owner) :
-////        null;
-//    dialog = new SecureViewerDialog(null, messages,
-//            saveListener, saveCommand, helpListener);
-//    dialog.setContent(dataToBeSigned);
-//    dialog.setVisible(true);
-//  }
   public SecureViewerDialog(Frame owner, ResourceBundle messages,
           ActionListener closeListener, String closeCommand,
           FontProvider fontProvider, ActionListener helpListener) {
@@ -125,6 +104,10 @@ public class SecureViewerDialog extends JDialog implements ActionListener {
             createViewerPanel(helpListener),
             createButtonPanel(closeListener, closeCommand));
 
+    // also leave defaultWindowClosing HIDE_ON_CLOSE
+    this.addWindowListener(new WindowCloseListener(closeListener, closeCommand));
+    this.setDefaultCloseOperation(WindowConstants.DO_NOTHING_ON_CLOSE);
+
     pack();
     if (owner != null) {
       setLocationRelativeTo(owner);
@@ -305,19 +288,11 @@ public class SecureViewerDialog extends JDialog implements ActionListener {
     JButton closeButton = new JButton();
     closeButton.setText(messages.getString(BKUGUIFacade.BUTTON_CLOSE));
     closeButton.setActionCommand(closeCommand);
-    closeButton.addActionListener(closeListener);
-    closeButton.addActionListener(new ActionListener() {
-      @Override
-      public void actionPerformed(ActionEvent e) {
-        log.trace("[" + Thread.currentThread().getName() + "] closing secure viewer");
-        setVisible(false);
-      }
-    });
+    closeButton.addActionListener(new CloseButtonListener(closeListener));
 
     JButton saveButton = new JButton();
     saveButton.setText(messages.getString(BKUGUIFacade.BUTTON_SAVE));
-    saveButton.setActionCommand("save"); //TODO ensure unequal to closeCommand 
-    saveButton.addActionListener(this);
+    saveButton.addActionListener(new SaveButtonListener());
 
     int buttonSize = closeButton.getPreferredSize().width;
     if (saveButton.getPreferredSize().width > buttonSize) {
@@ -336,39 +311,50 @@ public class SecureViewerDialog extends JDialog implements ActionListener {
     return buttonPanel;
   }
 
-  @Override
-  public void actionPerformed(ActionEvent e) {
-    if ("save".equals(e.getActionCommand())) {
+  public class WindowCloseListener extends WindowAdapter {
+
+    ActionListener closeListener;
+    String closeCommand;
+
+    public WindowCloseListener(ActionListener closeListener, String closeCommand) {
+      this.closeListener = closeListener;
+      this.closeCommand = closeCommand;
+    }
+
+    @Override
+    public void windowClosing(WindowEvent e) {
+      log.trace("[" + Thread.currentThread().getName() + "] closing secure viewer");
+      setVisible(false);
+      if (closeListener != null) {
+        closeListener.actionPerformed(new ActionEvent(e.getSource(), e.getID(), closeCommand));
+      }
+    }
+  }
+
+  public class CloseButtonListener implements ActionListener {
+
+    ActionListener closeListener;
+
+    public CloseButtonListener(ActionListener closeListener) {
+      this.closeListener = closeListener;
+    }
+
+    @Override
+    public void actionPerformed(ActionEvent e) {
+      log.trace("[" + Thread.currentThread().getName() + "] closing secure viewer");
+      setVisible(false);
+      if (closeListener != null) {
+        closeListener.actionPerformed(e);
+    }
+    }
+  }
+
+  public class SaveButtonListener implements ActionListener {
+
+    @Override
+    public void actionPerformed(ActionEvent e) {
       log.trace("[" + Thread.currentThread().getName() + "] display secure viewer save dialog");
       SecureViewerSaveDialog.showSaveDialog(content, messages, null, null);
-      log.trace("done secure viewer save");
-    } else {
-      log.warn("unknown action command " + e.getActionCommand());
     }
   }
-  
-  
-//  //TEST
-//  private static SecureViewerDialog secureViewer;
-//  public static void showSecureViewerXXX(HashDataInput dataToBeSigned, ResourceBundle messages, FontProvider fontProvider, ActionListener helpListener, boolean alwaysOnTop) throws FontProviderException {
-//    
-////    ResourceBundle messages = ResourceBundle.getBundle(BKUGUIFacade.MESSAGES_BUNDLE, locale);
-//    
-//    log.debug("[" + Thread.currentThread().getName() + "] show secure viewer");
-//    if (secureViewer == null) {
-//      secureViewer = new SecureViewerDialog(null, messages,
-//              fontProvider, helpListener); 
-//
-//      // workaround for [#439]
-//      // avoid AlwaysOnTop at least in applet, otherwise make secureViewer AlwaysOnTop since MOCCA Dialog (JFrame created in LocalSTALFactory) is always on top.
-////      Window window = SwingUtilities.getWindowAncestor(contentPane);
-////      if (window != null && window.isAlwaysOnTop()) {
-////        log.debug("make secureViewer alwaysOnTop");
-//        secureViewer.setAlwaysOnTop(alwaysOnTop);
-////      }
-//    }
-//    secureViewer.setContent(dataToBeSigned);
-//    log.trace("show secure viewer returned");
-//  }
-
 }
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
index 3e483fc8..c09433de 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages.properties
@@ -16,15 +16,15 @@
 title.welcome=<html>Willkommen</html>
 title.insertcard=<html>Keine B\u00FCrgerkarte gefunden</html>
 title.cardnotsupported=<html>Die Karte wird nicht unterst\u00FCtzt</html>
-#title.cardpin=<html>{0} eingeben</html>
-title.cardpin=<html>Karte wird gelesen</html>
+title.verify.pin=<html>Karte wird gelesen</html>
 title.sign=<html>Signatur erstellen</html>
+title.verify.pinpad=<html>PIN eingeben
 title.error=<html>Fehler</html>
 title.warning=<html>Achtung
 title.entry.timeout=<html>Zeit\u00FCberschreitung</html>
 title.retry=<html>Falsche PIN</html>
 title.wait=<html>Bitte warten</html>
-title.hashdata=<html>Signaturdaten</html>
+title.signature.data=<html>Signaturdaten</html>
 windowtitle.save=Signaturdaten speichern
 windowtitle.error=Fehler
 windowtitle.savedir=Signaturdaten in Verzeichnis speichern
@@ -38,7 +38,8 @@ wait=<html>Bitte warten...</html>
 cardnotsupported=<html>Bitte die B\u00FCrgerkarte in den Kartenleser stecken</html>
 insertcard=<html>Bitte die B\u00FCrgerkarte in den Kartenleser stecken</html>
 enterpin=<html>{0} eingeben</html>
-enterpin.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben</html>
+enterpin.pinpad=<html>PIN am Kartenleser eingeben</html>
+enterpin.pinpad.direct=<html>{0} ({1} stellig) am Kartenleser eingeben</html>
 hashdatalink=<html><a href=\"anzeige\">Signaturdaten anzeigen</a></html>
 hashdatalink.tiny=<html><a href=\"anzeige\">Signaturdaten</a></html>
 hashdatalink.focus=<html><a href=\"anzeige\">[Signaturdaten anzeigen]</a></html>
diff --git a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
index c553bcb5..4d86d21b 100644
--- a/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
+++ b/BKUCommonGUI/src/main/resources/at/gv/egiz/bku/gui/Messages_en.properties
@@ -16,15 +16,15 @@
 title.welcome=<html>Welcome</html>
 title.insertcard=<html>No citizen card found</html>
 title.cardnotsupported=<html>This card is not supported</html>
-#title.cardpin=<html>Enter {0}</html>
-title.cardpin=<html>Reading card</html>
+title.verify.pin=<html>Reading card</html>
 title.sign=<html>Create signature</html>
+title.verify.pinpad=<html>Enter PIN
 title.error=<html>Error</html>
 title.warning=<html>Warning
 title.entry.timeout=<html>Timeout</html>
 title.retry=<html>Wrong PIN</html>
 title.wait=<html>Please wait</html>
-title.hashdata=<html>Signature data</html>
+title.signature.data=<html>Signature data</html>
 windowtitle.save=Save signature data
 windowtitle.error=Error
 windowtitle.savedir=Save signature data to directory
@@ -38,7 +38,8 @@ wait=<html>Please wait...</html>
 insertcard=<html>Please insert your citizen card into the reader</html>
 cardnotsupported=<html>Please insert your citizen card into the reader</html>
 enterpin=<html>Enter {0}</html>
-enterpin.pinpad=<html>Enter {0} ({1} digits) on card reader pinpad</html>
+enterpin.pinpad=<html>Enter PIN on card reader pinpad</html>
+enterpin.pinpad.direct=<html>Enter {0} ({1} digits) on card reader pinpad</html>
 hashdatalink=<html><a href=\"anzeige\">Display signature data</a></html>
 hashdatalink.tiny=<html><a href=\"anzeige\">signature data</a></html>
 hashdatalink.focus=<html><a href=\"anzeige\">[Display signature data]</a></html>
diff --git a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
index 6e345ee3..a2a84d6e 100644
--- a/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
+++ b/BKUCommonGUI/src/test/java/at/gv/egiz/bku/gui/BKUGUIWorker.java
@@ -45,7 +45,7 @@ public class BKUGUIWorker implements Runnable {
 
   @Override
   public void run() {
-//        try {
+        try {
 
     final PINSpec signPinSpec = new PINSpec(6, 10, "[0-9]", "Test-PIN", (byte) 0x81, null);
     final PINSpec cardPinSpec = new PINSpec(4, 4, "[0-9]", "Test-PIN", (byte) 0x01, null);
@@ -155,7 +155,10 @@ public class BKUGUIWorker implements Runnable {
 //
 //            gui.showSignaturePINDialog(signPinSpec, -1, signListener, "sign", cancelListener, "cancel", hashdataListener, "hashdata");
 
-    gui.showPinpadSignaturePINDialog(signPinSpec, -1, hashdataListener, "hashdata");
+    gui.showSignatureDataDialog(signPinSpec, signListener, "sign", cancelListener, "cancel", hashdataListener, "hashdata");
+    Thread.sleep(2000);
+    
+    gui.showEnterPINDirect(signPinSpec, -1);
 //
 //            Thread.sleep(4000);
 //
@@ -189,8 +192,8 @@ public class BKUGUIWorker implements Runnable {
 //            gui.showTextPlainHashDataInput("hallo,\n welt!", "12345", null, "cancel", null, "save");
 //            Thread.sleep(2000);
 
-//        } catch (InterruptedException ex) {
-//            ex.printStackTrace();
-//        }
+        } catch (InterruptedException ex) {
+            ex.printStackTrace();
+        }
   }
 }
diff --git a/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ComparePinDocument.java b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ComparePinDocument.java
new file mode 100644
index 00000000..623f6fad
--- /dev/null
+++ b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ComparePinDocument.java
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.gui;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import javax.swing.JButton;
+import javax.swing.text.AttributeSet;
+import javax.swing.text.BadLocationException;
+import javax.swing.text.Document;
+import javax.swing.text.PlainDocument;
+
+/**
+ * Checks if the pin confirmation (compareTo) corresponds to this pin.
+ * Additionally, checks if currentPIN (optional) meets the requirements before enabling the OK button.
+ * @author clemens
+ */
+class ComparePinDocument extends PlainDocument {
+
+  private static final long serialVersionUID = 1L;
+  protected Pattern pinPattern;
+  protected int minLength;
+  protected int maxLength;
+  protected JButton enterButton;
+  protected Document compareTo;
+  protected Document currentPIN;
+
+  /**
+   * Constructor without compareTo Document parameter (allow null and set later to avoid cyclic dependencies)
+   */
+  public ComparePinDocument(int minLength, int maxLength, String pattern, JButton enterButton) {
+    if (enterButton == null) {
+      throw new NullPointerException("OK button null");
+    }
+    if (pattern != null) {
+      pinPattern = Pattern.compile(pattern);
+    } else {
+      pinPattern = Pattern.compile(".");
+    }
+    this.minLength = minLength;
+    this.maxLength = maxLength;
+    this.enterButton = enterButton;
+  }
+
+  /**
+   * @param compareTo should not be null (allow null and set later to avoid cyclic dependencies)
+   */
+  public ComparePinDocument(int minLength, int maxLength, String pattern,
+          JButton enterButton, Document compareTo) {
+    this(minLength, maxLength, pattern, enterButton);
+    this.compareTo = compareTo;
+  }
+  
+  public ComparePinDocument(int minLength, int maxLength, String pattern,
+          JButton enterButton, Document compareTo, Document currentPIN) {
+    this(minLength, maxLength, pattern, enterButton, compareTo);
+    this.currentPIN = currentPIN;
+  }
+
+  @Override
+  public void insertString(int offs, String str, AttributeSet a) throws BadLocationException {
+    if (maxLength < 0 || maxLength >= (getLength() + str.length())) {
+      boolean matches = true;
+      for (int i = 0; i < str.length(); i++) {
+        Matcher m = pinPattern.matcher(str.substring(i, i + 1));
+        if (!m.matches()) {
+          matches = false;
+        }
+      }
+      if (matches) {
+        super.insertString(offs, str, a);
+        enterButton.setEnabled(
+                getLength() >= minLength
+                && (currentPIN == null || currentPIN.getLength() >= minLength)
+                && compareTo.getText(0, compareTo.getLength()).equals(getText(0, getLength())));
+      }
+    }
+  }
+
+  @Override
+  public void remove(int offs, int len) throws BadLocationException {
+    super.remove(offs, len);
+    enterButton.setEnabled(
+            getLength() >= minLength
+            && (currentPIN == null || currentPIN.getLength() >= minLength)
+            && compareTo.getText(0, compareTo.getLength()).equals(getText(0, getLength())));
+  }
+}
diff --git a/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ExtendedPinDocument.java b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ExtendedPinDocument.java
new file mode 100644
index 00000000..3a0d7a66
--- /dev/null
+++ b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/ExtendedPinDocument.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.gui;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import javax.swing.JButton;
+import javax.swing.text.AttributeSet;
+import javax.swing.text.BadLocationException;
+import javax.swing.text.Document;
+import javax.swing.text.PlainDocument;
+
+/**
+ * This PINDocument also checks if the additional (optional) pinDocuments also meet the requirements
+ * to enable the OK button. 
+ * Checks if (optional) newPIN and confirmPIN correspond
+ * 
+ * @author clemens
+ */
+class ExtendedPinDocument extends PlainDocument {
+
+  private static final long serialVersionUID = 1L;
+  protected Pattern pinPattern;
+  protected int minLength;
+  protected int maxLength;
+  protected JButton enterButton;
+  protected Document newPIN;
+  protected Document confirmPIN;
+
+  public ExtendedPinDocument(int minLength, int maxLength, String pattern, JButton enterButton) {
+    if (enterButton == null) {
+      throw new NullPointerException("OK Button null");
+    }
+    if (pattern != null) {
+      pinPattern = Pattern.compile(pattern);
+    } else {
+      pinPattern = Pattern.compile(".");
+    }
+    this.minLength = minLength;
+    this.maxLength = maxLength;
+    this.enterButton = enterButton;
+  }
+
+  /**
+   * @param pinSpec
+   * @param enterButton
+   * @param newPIN, confirmPIN
+   */
+  public ExtendedPinDocument(int minLength, int maxLength, String pattern, JButton enterButton, Document newPIN, Document confirmPIN) {
+    this(minLength, maxLength, pattern, enterButton);
+    this.newPIN = newPIN;
+    this.confirmPIN = confirmPIN;
+  }
+
+  @Override
+  public void insertString(int offs, String str, AttributeSet a) throws BadLocationException {
+    if (maxLength < 0 || maxLength >= (getLength() + str.length())) {
+      boolean matches = true;
+      for (int i = 0; i < str.length(); i++) {
+        Matcher m = pinPattern.matcher(str.substring(i, i + 1));
+        if (!m.matches()) {
+          matches = false;
+        }
+      }
+      if (matches) {
+        super.insertString(offs, str, a);
+        enterButton.setEnabled(
+                getLength() >= minLength
+                && (newPIN == null || newPIN.getLength() >= minLength)
+                && (confirmPIN == null || compare()));
+      }
+    }
+  }
+
+  @Override
+  public void remove(int offs, int len) throws BadLocationException {
+    super.remove(offs, len);
+    enterButton.setEnabled(
+            getLength() >= minLength
+            && (newPIN == null || newPIN.getLength() >= minLength)
+            && (confirmPIN == null || compare()));
+  }
+
+  /**
+   * assume confirmPIN != null
+   * @return
+   */
+  private boolean compare() throws BadLocationException {
+    if (newPIN != null) {
+      return confirmPIN.getText(0, confirmPIN.getLength()).equals(newPIN.getText(0, newPIN.getLength()));
+    }
+    return false;
+  }
+}
diff --git a/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
index 5bbed096..4dcc388f 100644
--- a/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
+++ b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
@@ -239,23 +239,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
   }
 
   @Override
-  public void showPINDialog(DIALOG type, PINSpec pinSpec,
-          ActionListener okListener, String okCommand,
-          ActionListener cancelListener, String cancelCommand) {
-    showPINDialog(type, pinSpec, -1, false,
-            okListener, okCommand, cancelListener, cancelCommand);
-  }
-
-  @Override
-  public void showPINDialog(DIALOG type, PINSpec pinSpec, int retries,
-          ActionListener okListener, String okCommand,
-          ActionListener cancelListener, String cancelCommand) {
-    showPINDialog(type, pinSpec, retries, false,
-            okListener, okCommand, cancelListener, cancelCommand);
-  }
-
-  @Override
-  public void showPinpadPINDialog(DIALOG type, PINSpec pinSpec, int retries) {
+  public void showModifyPINDirect(DIALOG type, PINSpec pinSpec, int retries) {
     String title, msg;
     Object[] params;
     if (retries < 0) {
@@ -269,19 +253,19 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
       if (type == DIALOG.CHANGE) {
         log.debug("show change pin dialog");
         title = TITLE_CHANGE_PIN;
-        msg = MESSAGE_CHANGEPIN_PINPAD;
+        msg = MESSAGE_CHANGE_PINPAD_DIREKT;
       } else if (type == DIALOG.ACTIVATE) {
         log.debug("show activate pin dialog");
         title = TITLE_ACTIVATE_PIN;
-        msg = MESSAGE_ENTERPIN_PINPAD;
+        msg = MESSAGE_ACTIVATE_PINPAD_DIREKT;
       } else if (type == DIALOG.VERIFY) {
         log.debug("show verify pin dialog");
-        title = TITLE_VERIFY_PIN;
-        msg = MESSAGE_ENTERPIN_PINPAD;
+        title = TITLE_VERIFY_PINPAD;
+        msg = MESSAGE_ENTERPIN_PINPAD_DIRECT;
       } else {
         log.debug("show unblock pin dialog");
         title = TITLE_UNBLOCK_PIN;
-        msg = MESSAGE_ENTERPIN_PINPAD;
+        msg = MESSAGE_UNBLOCK_PINPAD_DIREKT;
       }
 
     } else {
@@ -294,6 +278,15 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
     showMessageDialog(title, msg, params);
   }
 
+  @Override
+  public void showPINDialog(DIALOG type, PINSpec pinSpec, int retries,
+          ActionListener okListener, String okCommand,
+          ActionListener cancelListener, String cancelCommand) {
+    showPINDialog(type, pinSpec, retries, false,
+            okListener, okCommand, cancelListener, cancelCommand);
+  }
+
+
   private void showPINDialog(final DIALOG type, final PINSpec pinSpec,
           final int retries, final boolean pinpad,
           final ActionListener okListener, final String okCommand,
@@ -322,7 +315,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 } else if (type == DIALOG.VERIFY) {
                   log.debug("show verify pin dialog");
                   TITLE = TITLE_VERIFY_PIN;
-                  MESSAGE_MGMT = MESSAGE_VERIFY_PIN;
+                  MESSAGE_MGMT = MESSAGE_ENTERPIN;
                 } else {
                   log.debug("show unblock pin dialog");
                   TITLE = TITLE_UNBLOCK_PIN;
@@ -393,7 +386,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 if (pinpad) {
                   JLabel pinpadLabel = new JLabel();
                   pinpadLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~Font.BOLD));
-                  String pinpadPattern = getMessage(MESSAGE_VERIFYPIN_PINPAD);
+                  String pinpadPattern = getMessage(MESSAGE_ENTERPIN_PINPAD);
                   pinpadLabel.setText(MessageFormat.format(pinpadPattern,
                           new Object[] { pinSpec.getLocalizedName(), pinSpec.getLocalizedLength() }));
                   
@@ -403,7 +396,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                           .addComponent(pinpadLabel);
                 } else {
 
-                JButton okButton = new JButton();
+                final JButton okButton = new JButton();
                 okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~Font.BOLD));
                 okButton.setText(getMessage(BUTTON_OK));
                 okButton.setEnabled(pinSpec.getMinLength() <= 0);
@@ -414,7 +407,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 JLabel repeatPinLabel = null;
                 JLabel pinLabel = new JLabel();
                 pinLabel.setFont(pinLabel.getFont().deriveFont(pinLabel.getFont().getStyle() & ~Font.BOLD));
-                String pinLabelPattern = (type == DIALOG.CHANGE) ? getMessage(LABEL_NEW_PIN) : getMessage(LABEL_PIN);
+                String pinLabelPattern = (type == DIALOG.CHANGE || type == DIALOG.UNBLOCK) ? getMessage(LABEL_NEW_PIN) : getMessage(LABEL_PIN);
                 pinLabel.setText(MessageFormat.format(pinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                 final JPasswordField repeatPinField = new JPasswordField();
@@ -436,8 +429,6 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                 });
 
                 if (type != DIALOG.VERIFY) {
-                  pinField.setDocument(
-                      new PINDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(), null));
                   repeatPinLabel = new JLabel();
                   repeatPinLabel.setFont(pinLabel.getFont());
                   String repeatPinLabelPattern = getMessage(LABEL_REPEAT_PIN);
@@ -449,22 +440,20 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
 
                       @Override
                       public void actionPerformed(ActionEvent e) {
-                          if (pinField.getPassword().length >= pinSpec.getMinLength()) {
+                          if (okButton.isEnabled()) {
                               okListener.actionPerformed(e);
                           }
                       }
                   });
 
-                  if (type == DIALOG.CHANGE) {
+                  if (type == DIALOG.CHANGE || type == DIALOG.UNBLOCK) {
                     oldPinLabel = new JLabel();
                     oldPinLabel.setFont(oldPinLabel.getFont().deriveFont(oldPinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                    String oldPinLabelPattern = getMessage(LABEL_OLD_PIN);
+                    String oldPinLabelPattern = getMessage((type == DIALOG.CHANGE) ? LABEL_OLD_PIN : LABEL_PUK);
                     oldPinLabel.setText(MessageFormat.format(oldPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                     oldPinField = new JPasswordField();
                     oldPinField.setText("");
-                    oldPinField.setDocument(
-                        new PINDocument(pinSpec.getMinLength(), pinSpec.getMaxLength(), pinSpec.getRexepPattern(), null));
                     oldPinField.setActionCommand(okCommand);
                     oldPinField.addActionListener(new ActionListener() {
 
@@ -476,16 +465,45 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
                         }
                     });
 
-                    repeatPinField.setDocument(
-                        new PINDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(), 
-                            okButton, pinField.getDocument(), oldPinField.getDocument()));
+                    ExtendedPinDocument oldPinDocument =
+                        new ExtendedPinDocument(pinSpec.getMinLength(), pinSpec.getMaxLength(),
+                            pinSpec.getRexepPattern(), okButton);
+                    ComparePinDocument newPinDocument =
+                        new ComparePinDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(),
+                            okButton);
+                    ComparePinDocument confirmPinDocument =
+                        new ComparePinDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(),
+                            okButton);
+
+                    oldPinDocument.newPIN = newPinDocument;
+                    oldPinDocument.confirmPIN = confirmPinDocument;
+                    
+                    newPinDocument.compareTo = confirmPinDocument;
+                    newPinDocument.currentPIN = oldPinDocument;
+                    confirmPinDocument.compareTo = newPinDocument;
+                    confirmPinDocument.currentPIN = oldPinDocument;
+
+                    oldPinField.setDocument(oldPinDocument);
+                    pinField.setDocument(newPinDocument);
+                    repeatPinField.setDocument(confirmPinDocument);
+
                   } else {
                     // else -> ACTIVATE (not verify, not change)
-                    repeatPinField.setDocument(
-                        new PINDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(), 
-                            okButton, pinField.getDocument()));
+                    ComparePinDocument newPinDocument =
+                        new ComparePinDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(),
+                            okButton);
+                    ComparePinDocument confirmPinDocument =
+                        new ComparePinDocument(pinSpec.getRecMinLength(), pinSpec.getRecMaxLength(), pinSpec.getRexepPattern(),
+                            okButton);
+
+                    newPinDocument.compareTo = confirmPinDocument;
+                    confirmPinDocument.compareTo = newPinDocument;
+
+                    pinField.setDocument(newPinDocument);
+                    repeatPinField.setDocument(confirmPinDocument);
                   }
                 } else {
+                  // VERIFY
                   pinField.setDocument(
                       new PINDocument(pinSpec.getMinLength(), pinSpec.getMaxLength(), pinSpec.getRexepPattern(), okButton));
                 }
@@ -534,7 +552,7 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
 //                } else {
 
 
-                  if (type == DIALOG.CHANGE) {
+                  if (type == DIALOG.CHANGE || type == DIALOG.UNBLOCK) {
                     pinHorizontal
                           .addGroup(mainPanelLayout.createSequentialGroup()
                             .addGroup(mainPanelLayout.createParallelGroup(GroupLayout.Alignment.LEADING)
@@ -675,4 +693,69 @@ public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFac
     return bs;
   }
 
+  @Override
+  public void showEnterCurrentPIN(DIALOG type, PINSpec pinSpec, int retries) {
+    String title, message;
+//    Object[] params = null;
+    
+    if (type == PINManagementGUIFacade.DIALOG.VERIFY) {
+      title = PINManagementGUIFacade.TITLE_VERIFY_PINPAD;
+      message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
+//      params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
+    } else if (type == PINManagementGUIFacade.DIALOG.ACTIVATE) {
+      title = PINManagementGUIFacade.TITLE_ACTIVATE_PIN;
+      message = PINManagementGUIFacade.MESSAGE_ACTIVATE_PINPAD_CURRENT;
+//      params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
+    } else if (type == PINManagementGUIFacade.DIALOG.CHANGE) {
+      title = PINManagementGUIFacade.TITLE_CHANGE_PIN;
+      message = PINManagementGUIFacade.MESSAGE_CHANGE_PINPAD_CURRENT;
+//      params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
+    } else { //if (type == DIALOG.UNBLOCK) {
+      title = PINManagementGUIFacade.TITLE_UNBLOCK_PIN;
+      message = PINManagementGUIFacade.MESSAGE_UNBLOCK_PINPAD_CURRENT;
+//      params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
+    }
+    showEnterPIN(pinSpec, retries, title, message, null);
+  }
+
+  @Override
+  public void showEnterNewPIN(DIALOG type, PINSpec pinSpec) {
+    String title, message;
+    if (type == PINManagementGUIFacade.DIALOG.ACTIVATE) {
+      title = PINManagementGUIFacade.TITLE_ACTIVATE_PIN;
+      message = PINManagementGUIFacade.MESSAGE_ACTIVATE_PINPAD_NEW;
+    } else if (type == PINManagementGUIFacade.DIALOG.CHANGE) {
+      title = PINManagementGUIFacade.TITLE_CHANGE_PIN;
+      message = PINManagementGUIFacade.MESSAGE_CHANGE_PINPAD_NEW;
+    } else if (type == DIALOG.UNBLOCK) {
+      title = PINManagementGUIFacade.TITLE_UNBLOCK_PIN;
+      message = PINManagementGUIFacade.MESSAGE_UNBLOCK_PINPAD_NEW;
+    } else {
+      log.error("enterNewPIN not supported for dialog type " + type);
+      showErrorDialog(ERR_UNKNOWN, null);
+      return;
+    }
+    showEnterPIN(pinSpec, -1, title, message, null);
+  }
+
+  @Override
+  public void showConfirmNewPIN(DIALOG type, PINSpec pinSpec) {
+    String title, message;
+    if (type == PINManagementGUIFacade.DIALOG.ACTIVATE) {
+      title = PINManagementGUIFacade.TITLE_ACTIVATE_PIN;
+      message = PINManagementGUIFacade.MESSAGE_ACTIVATE_PINPAD_CONFIRM;
+    } else if (type == PINManagementGUIFacade.DIALOG.CHANGE) {
+      title = PINManagementGUIFacade.TITLE_CHANGE_PIN;
+      message = PINManagementGUIFacade.MESSAGE_CHANGE_PINPAD_CONFIRM;
+    } else if (type == DIALOG.UNBLOCK) {
+      title = PINManagementGUIFacade.TITLE_UNBLOCK_PIN;
+      message = PINManagementGUIFacade.MESSAGE_UNBLOCK_PINPAD_CONFIRM;
+    } else {
+      log.error("enterNewPIN not supported for dialog type " + type);
+      showErrorDialog(ERR_UNKNOWN, null);
+      return;
+    }
+    showEnterPIN(pinSpec, -1, title, message, null);
+  }
+
 }
diff --git a/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
index f99bcfd1..46ae18b9 100644
--- a/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
+++ b/BKUGuiExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
@@ -32,26 +32,39 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String TITLE_PINMGMT = "title.pin.mgmt";
   public static final String TITLE_ACTIVATE_PIN = "title.activate.pin";
   public static final String TITLE_CHANGE_PIN = "title.change.pin";
-  public static final String TITLE_VERIFY_PIN = "title.verify.pin";
+//  public static final String TITLE_VERIFY_PIN = "title.verify.pin";
   public static final String TITLE_UNBLOCK_PIN = "title.unblock.pin";
   public static final String TITLE_ACTIVATE_SUCCESS = "title.activate.success";
+  public static final String TITLE_UNBLOCK_SUCCESS = "title.unblock.success";
   public static final String TITLE_CHANGE_SUCCESS = "title.change.success";
 
   // removed message.* prefix to reuse keys as help keys
   public static final String MESSAGE_ACTIVATE_SUCCESS = "activate.success";
   public static final String MESSAGE_CHANGE_SUCCESS = "change.success";
+  public static final String MESSAGE_UNBLOCK_SUCCESS = "unblock.success";
   public static final String MESSAGE_PINMGMT = "pin.mgmt";
 //  public static final String MESSAGE_PINPAD = "pinpad";
+
   public static final String MESSAGE_ACTIVATE_PIN = "activate.pin";
   public static final String MESSAGE_CHANGE_PIN = "change.pin";
-  public static final String MESSAGE_VERIFY_PIN = "verify.pin";
   public static final String MESSAGE_UNBLOCK_PIN = "unblock.pin";
-  public static final String MESSAGE_ACTIVATEPIN_PINPAD = "activate.pinpad";
-  public static final String MESSAGE_CHANGEPIN_PINPAD = "change.pinpad";
-  public static final String MESSAGE_VERIFYPIN_PINPAD = "verify.pinpad";
-  public static final String MESSAGE_UNBLOCKPIN_PINPAD = "unblock.pinpad";
+
+  public static final String MESSAGE_ACTIVATE_PINPAD_CURRENT = "activate.pinpad.current";
+  public static final String MESSAGE_CHANGE_PINPAD_CURRENT = "change.pinpad.current";
+  public static final String MESSAGE_UNBLOCK_PINPAD_CURRENT = "unblock.pinpad.current";
+  public static final String MESSAGE_ACTIVATE_PINPAD_NEW = "activate.pinpad.new";
+  public static final String MESSAGE_CHANGE_PINPAD_NEW = "change.pinpad.new";
+  public static final String MESSAGE_UNBLOCK_PINPAD_NEW = "unblock.pinpad.new";
+  public static final String MESSAGE_ACTIVATE_PINPAD_CONFIRM = "activate.pinpad.confirm";
+  public static final String MESSAGE_CHANGE_PINPAD_CONFIRM = "change.pinpad.confirm";
+  public static final String MESSAGE_UNBLOCK_PINPAD_CONFIRM = "unblock.pinpad.confirm";
+
+  public static final String MESSAGE_ACTIVATE_PINPAD_DIREKT = "activate.pinpad.direct";
+  public static final String MESSAGE_CHANGE_PINPAD_DIREKT = "change.pinpad.direct";
+  public static final String MESSAGE_UNBLOCK_PINPAD_DIREKT = "unblock.pinpad.direct";
 
   public static final String LABEL_OLD_PIN = "label.old.pin";
+  public static final String LABEL_PUK = "label.puk";
   public static final String LABEL_NEW_PIN = "label.new.pin";
   public static final String LABEL_REPEAT_PIN = "label.repeat.pin";
 
@@ -81,35 +94,34 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public enum STATUS { ACTIV, NOT_ACTIV, BLOCKED, UNKNOWN };
   public enum DIALOG { VERIFY, ACTIVATE, CHANGE, UNBLOCK };
 
+  /**
+   * list pins
+   */
   public void showPINManagementDialog(Map<PINSpec, STATUS> pins,
           ActionListener activateListener, String activateCmd, String changeCmd, String unblockCmd, String verifyCmd,
           ActionListener cancelListener, String cancelCmd);
 
-  public void showPINDialog(DIALOG type, PINSpec pin,
+  /**
+   * "software" pin-entry dialog (activate, change, unblock, verify)
+   */
+  public void showPINDialog(DIALOG type, PINSpec pinSpec, int retries,
           ActionListener okListener, String okCmd,
           ActionListener cancelListener, String cancelCmd);
 
-  public void showPINDialog(DIALOG type, PINSpec pin, int retries,
-          ActionListener okListener, String okCmd,
-          ActionListener cancelListener, String cancelCmd);
+  /**
+   * <b>direct</b> pinpad pin-entry dialog
+   */
+  public void showModifyPINDirect(DIALOG type, PINSpec pinSpec, int retries);
+
+  /**
+   * <b>start/finish</b> pinpad pin-entry dialog
+   */
+  public void showEnterCurrentPIN(DIALOG type, PINSpec pinSpec, int retries);
+
+  public void showEnterNewPIN(DIALOG type, PINSpec pinSpec);
+
+  public void showConfirmNewPIN(DIALOG type, PINSpec pinSpec);
 
-  public void showPinpadPINDialog(DIALOG type, PINSpec pin, int retries);
-
-//  public void showActivatePINDialog(PINSpec pin,
-//          ActionListener okListener, String okCmd,
-//          ActionListener cancelListener, String cancelCmd);
-//
-//  public void showChangePINDialog(PINSpec pin,
-//          ActionListener okListener, String okCmd,
-//          ActionListener cancelListener, String cancelCmd);
-//
-//  public void showUnblockPINDialog(PINSpec pin,
-//          ActionListener okListener, String okCmd,
-//          ActionListener cancelListener, String cancelCmd);
-//
-//  public void showVerifyPINDialog(PINSpec pin,
-//          ActionListener okListener, String okCmd,
-//          ActionListener cancelListener, String cancelCmd);
 
   public char[] getOldPin();
 
diff --git a/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties b/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
index 977d6e3a..5ef3edee 100644
--- a/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
+++ b/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
@@ -15,30 +15,44 @@
 
 title.activation=<html>Aktivierung</html>
 title.pin.mgmt=<html>PIN Verwaltung</html>
-title.activate.pin=<html>PIN Aktivieren</html>
-title.change.pin=<html>PIN \u00C4ndern</html>
-title.unblock.pin=<html>PIN Entsperren</html>
-title.verify.pin=<html>PIN Eingeben</html>
+title.activate.pin=<html>PIN aktivieren</html>
+title.change.pin=<html>PIN \u00E4ndern</html>
+title.unblock.pin=<html>PIN entsperren</html>
+#title.verify.pin=<html>PIN Eingeben</html>
 title.activate.success=<html>Erfolg</html>
 title.change.success=<html>Erfolg</html>
+title.unblock.success=<html>Erfolg</html>
 
 # removed message.* prefix to reuse keys as help keys
 pin.mgmt=<html>Die Karte verf\u00FCgt \u00FCber {0} PINs</html>
+# software pin-entry messages
 activate.pin=<html>{0} eingeben und best\u00E4tigen</html>
 change.pin=<html>{0} eingeben und best\u00E4tigen</html>
 unblock.pin=<html>PUK zu {0} eingeben</html>
-verify.pin=<html>{0} eingeben</html>
-verify.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben (und best\u00E4tigen).</html>
-activate.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben und wiederholen (jeweils best\u00E4tigen).</html>
-change.pinpad=<html>Alte {0} ({1} stellig) am Kartenleser eingeben, danach neue {0} eingeben und wiederholen (jeweils best\u00E4tigen). </html>
-unblock.pinpad=<html>{0} ({1} stellig) am Kartenleser eingeben (und best\u00E4tigen).</html>
-activate.success=<html>{0} wurde erfolgreich aktiviert.</html>
-change.success=<html>{0} wurde erfolgreich ge\u00E4ndert.</html>
+# start/finish pin-entry messages
+activate.pinpad.current=<html>Transport-PIN am Kartenleser eingeben
+activate.pinpad.new=<html>Neue PIN am Kartenleser eingeben
+activate.pinpad.confirm=<html>Neue PIN am Kartenleser best\u00E4tigen
+change.pinpad.current=<html>Alte PIN am Kartenleser eingeben
+change.pinpad.new=<html>Neue PIN am Kartenleser eingeben
+change.pinpad.confirm=<html>Neue PIN am Kartenleser best\u00E4tigen
+unblock.pinpad.current=<html>PUK am Kartenleser eingeben
+unblock.pinpad.new=<html>Neue PIN am Kartenleser eingeben
+unblock.pinpad.confirm=<html>Neue PIN am Kartenleser best\u00E4tigen
+# direct pin-entry messages
+activate.pinpad.direct=<html>{0} ({1} stellig) am Kartenleser eingeben und wiederholen (jeweils best\u00E4tigen).</html>
+change.pinpad.direct=<html>Alte {0} ({1} stellig) am Kartenleser eingeben, danach neue {0} eingeben und wiederholen (jeweils best\u00E4tigen). </html>
+unblock.pinpad.direct=<html>{0} ({1} stellig) am Kartenleser eingeben (und best\u00E4tigen).</html>
+# response messages
+activate.success=<html>{0} wurde erfolgreich aktiviert
+change.success=<html>{0} wurde erfolgreich ge\u00E4ndert
+unblock.success=<html>{0} wurde erfolgreich entsperrt
 
 label.activation=<html>e-card Aktivierungsprozess</html>
 label.activation.step=<html>Schritt {0}</html>
 label.activation.idle=<html>Warte auf Server...</html>
 label.old.pin=<html>Alte {0}:</html>
+label.puk=<html>{0} PUK:</html>
 label.new.pin=<html>Neue {0}:</html>
 label.repeat.pin=<html>Best\u00E4tigung:</html>
 
diff --git a/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties b/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
index 7f01971b..87e3f181 100644
--- a/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
+++ b/BKUGuiExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
@@ -16,29 +16,43 @@
 title.activation=<html>Activation</html>
 title.pin.mgmt=<html>PIN Management</html>
 title.activate.pin=<html>Activate PIN</html>
-title.verify.pin=<html>Enter PIN</html>
+#title.verify.pin=<html>Enter PIN</html>
 title.change.pin=<html>Change PIN</html>
 title.unblock.pin=<html>Unblock PIN</html>
 title.activate.success=<html>Success</html>
 title.change.success=<html>Success</html>
+title.unblock.success=<html>Success</html>
 
 # removed message.* prefix to reuse keys as help keys
-pin.mgmt=<html>The smartcard has {0} PINs</html>
-activate.pin=<html>Enter and confirm {0}</html>
-change.pin=<html>Enter and confirm {0}</html>
-unblock.pin=<html>Enter PUK for {0}</html>
-verify.pin=<html>Enter {0}</html>
-verify.pinpad=<html>Enter {0} ({1} digits) on cardreader (and confirm).</html>
-activate.pinpad=<html>Enter {0} ({1} digits) on cardreader and repeat (confirm in each case).</html>
-change.pinpad=<html>Enter old {0} ({1} digits) on cardreader, then enter new {0} and repeat (confirm in each case).</html>
-unblock.pinpad=<html>Enter {0} ({1} digits) on cardreader (and confirm).</html>
+pin.mgmt=<html>{0} PINs available
+# software pin-entry messages
+activate.pin=<html>Enter and confirm {0}
+change.pin=<html>Enter and confirm {0}
+unblock.pin=<html>Enter PUK for {0}
+# start/finish pin-entry messages
+activate.pinpad.current=<html>Enter transport-PIN on cardreader
+activate.pinpad.new=<html>Enter new PIN on cardreader
+activate.pinpad.confirm=<html>Confirm new PIN on cardreader
+change.pinpad.current=<html>Enter old PIN on cardreader
+change.pinpad.new=<html>Enter new PIN on cardreader
+change.pinpad.confirm=<html>Confirm new PIN on cardreader
+unblock.pinpad.current=<html>Enter PUK on cardreader
+unblock.pinpad.new=<html>Enter new PIN on cardreader
+unblock.pinpad.confirm=<html>Confirm new PIN on cardreader
+# direct pin-entry messages
+activate.pinpad.direct=<html>Enter {0} ({1} digits) on cardreader and repeat (confirm in each case)
+change.pinpad.direct=<html>Enter old {0} ({1} digits) on cardreader, then enter new {0} and repeat (confirm in each case)
+unblock.pinpad.direct=<html>Enter {0} ({1} digits) on cardreader, then enter new {0} and repeat (confirm in each case)
+# response messages
 activate.success=<html>{0} successfully activated</html>
 change.success=<html>{0} successfully changed</html>
+unblock.success=<html>{0} successfully unblocked
 
 label.activation=<html>e-card activation process</html>
 label.activation.step=<html>Step {0}</html>
 label.activation.idle=<html>Wait for server...</html>
 label.old.pin=<html>Old {0}:</html>
+label.puk=<html>{0} PUK:</html>
 label.new.pin=<html>New {0}:</html>
 label.repeat.pin=<html>Confirmation:</html>
 
diff --git a/BKUOnline/src/main/resources/log4j.properties b/BKUOnline/src/main/resources/log4j.properties
index 3eab8604..40133c83 100644
--- a/BKUOnline/src/main/resources/log4j.properties
+++ b/BKUOnline/src/main/resources/log4j.properties
@@ -15,7 +15,7 @@
 
 
 #log4j.rootLogger=DEBUG, STDOUT, file
-log4j.rootLogger=INFO, file
+log4j.rootLogger=TRACE, file
 #log4j.logger.at.gv = INFO
 
 
diff --git a/BKUOnline/src/main/webapp/META-INF/context.xml b/BKUOnline/src/main/webapp/META-INF/context.xml
index 2a2da79e..f38215a1 100644
--- a/BKUOnline/src/main/webapp/META-INF/context.xml
+++ b/BKUOnline/src/main/webapp/META-INF/context.xml
@@ -16,4 +16,4 @@
   limitations under the License.
 -->
 <!--Context path="/bkuonline"/-->
-<Context path="/bkuonline"/>
+<Context path=""/>
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
index 1ed5a177..b8cdb208 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ACOSCard.java
@@ -16,6 +16,8 @@
 */
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -79,10 +81,16 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
 
   public static final byte KID_PIN_SIG = (byte) 0x81;
 
+  public static final byte KID_PUK_SIG = (byte) 0x83;
+
   public static final byte KID_PIN_DEC = (byte) 0x81;
 
+  public static final byte KID_PUK_DEC = (byte) 0x82;
+
   public static final byte KID_PIN_INF = (byte) 0x83;
 
+  public static final byte KID_PUK_INF = (byte) 0x84;
+
   public static final byte[] DST_SIG = new byte[] { (byte) 0x84, (byte) 0x01, // tag
       // ,
       // length
@@ -217,7 +225,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
 
   @Override
   @Exclusive
-  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+  public byte[] getInfobox(String infobox, PINGUI provider, String domainId)
       throws SignatureCardException, InterruptedException {
     
     if ("IdentityLink".equals(infobox)) {
@@ -233,7 +241,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   
   }
 
-  protected byte[] getIdentityLinkV1(PINProvider provider, String domainId) 
+  protected byte[] getIdentityLinkV1(PINGUI provider, String domainId)
       throws SignatureCardException, InterruptedException {
     
     try {
@@ -262,7 +270,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
     
   }
   
-  protected byte[] getIdentityLinkV2(PINProvider provider, String domainId)
+  protected byte[] getIdentityLinkV2(PINGUI provider, String domainId)
       throws SignatureCardException, InterruptedException {
     
     try {
@@ -388,7 +396,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   @Override
   @Exclusive
   public byte[] createSignature(InputStream input, KeyboxName keyboxName,
-      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
+      PINGUI provider, String alg) throws SignatureCardException, InterruptedException, IOException {
   
     ByteArrayOutputStream dst = new ByteArrayOutputStream();
     // key ID
@@ -487,7 +495,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
    * @see at.gv.egiz.smcc.AbstractSignatureCard#verifyPIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.PINProvider)
    */
   @Override
-  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void verifyPIN(PINSpec pinSpec, PINGUI pinProvider)
       throws LockedException, NotActivatedException, CancelledException,
       TimeoutException, SignatureCardException, InterruptedException {
 
@@ -509,7 +517,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
    * @see at.gv.egiz.smcc.AbstractSignatureCard#changePIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.ChangePINProvider)
    */
   @Override
-  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+  public void changePIN(PINSpec pinSpec, ModifyPINGUI pinProvider)
       throws LockedException, NotActivatedException, CancelledException,
       TimeoutException, SignatureCardException, InterruptedException {
 
@@ -528,7 +536,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   }
 
   @Override
-  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void activatePIN(PINSpec pinSpec, ModifyPINGUI pinGUI)
       throws CancelledException, SignatureCardException, CancelledException,
       TimeoutException, InterruptedException {
     log.error("ACTIVATE PIN not supported by ACOS");
@@ -536,7 +544,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   }
 
   @Override
-  public void unblockPIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void unblockPIN(PINSpec pinSpec, ModifyPINGUI pinGUI)
       throws CancelledException, SignatureCardException, InterruptedException {
     throw new SignatureCardException("Unblock PIN not supported.");
   }
@@ -570,10 +578,8 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   // PROTECTED METHODS (assume exclusive card access)
   ////////////////////////////////////////////////////////////////////////
 
-  protected void verifyPINLoop(CardChannel channel, PINSpec spec, PINProvider provider)
-      throws InterruptedException, LockedException, NotActivatedException,
-      TimeoutException, PINFormatException, PINOperationAbortedException,
-      SignatureCardException, CardException {
+  protected void verifyPINLoop(CardChannel channel, PINSpec spec, PINGUI provider)
+      throws InterruptedException, CardException, SignatureCardException {
     
     int retries = -1;
     do {
@@ -581,10 +587,8 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
     } while (retries > 0);
   }
 
-  protected void changePINLoop(CardChannel channel, PINSpec spec, ChangePINProvider provider)
-      throws InterruptedException, LockedException, NotActivatedException,
-      TimeoutException, PINFormatException, PINOperationAbortedException,
-      SignatureCardException, CardException {
+  protected void changePINLoop(CardChannel channel, PINSpec spec, ModifyPINGUI provider)
+      throws InterruptedException, CardException, SignatureCardException {
 
     int retries = -1;
     do {
@@ -593,7 +597,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   }
 
   protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
-      PINProvider provider, int retries) throws InterruptedException, CardException, SignatureCardException {
+      PINGUI provider, int retries) throws InterruptedException, CardException, SignatureCardException {
     
     VerifyAPDUSpec apduSpec = new VerifyAPDUSpec(
         new byte[] {
@@ -602,7 +606,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
             (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00 }, 
         0, VerifyAPDUSpec.PIN_FORMAT_ASCII, 8);
     
-    ResponseAPDU resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    ResponseAPDU resp = reader.verify(channel, apduSpec, provider, pinSpec, retries);
     
     if (resp.getSW() == 0x9000) {
       return -1;
@@ -625,7 +629,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
   }
 
   protected int changePIN(CardChannel channel, PINSpec pinSpec,
-      ChangePINProvider pinProvider, int retries) throws CancelledException, InterruptedException, CardException, SignatureCardException {
+      ModifyPINGUI pinProvider, int retries) throws CancelledException, InterruptedException, CardException, SignatureCardException {
 
     ChangeReferenceDataAPDUSpec apduSpec = new ChangeReferenceDataAPDUSpec(
         new byte[] {
@@ -639,7 +643,7 @@ public class ACOSCard extends AbstractSignatureCard implements PINMgmtSignatureC
     
     
     
-    ResponseAPDU resp = reader.modify(channel, apduSpec, pinSpec, pinProvider, retries);
+    ResponseAPDU resp = reader.modify(channel, apduSpec, pinProvider, pinSpec, retries);
     
     if (resp.getSW() == 0x9000) {
       return -1;
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
index 54b4c7fe..fcb94fc6 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/AbstractSignatureCard.java
@@ -16,6 +16,8 @@
 */
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.reader.CardReader;
+import at.gv.egiz.smcc.reader.ReaderFactory;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -29,9 +31,6 @@ import javax.smartcardio.CardTerminal;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import at.gv.egiz.smcc.ccid.CCID;
-import at.gv.egiz.smcc.ccid.ReaderFactory;
-
 public abstract class AbstractSignatureCard implements SignatureCard {
 
   private static Log log = LogFactory.getLog(AbstractSignatureCard.class);
@@ -45,7 +44,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
 
   private Card card_;
   
-  protected CCID reader;
+  protected CardReader reader;
 
   protected AbstractSignatureCard(String resourceBundleName) {
     this.resourceBundleName = resourceBundleName;
@@ -68,7 +67,7 @@ public abstract class AbstractSignatureCard implements SignatureCard {
   @Override
   public void init(Card card, CardTerminal cardTerminal) {
     this.card_ = card;
-    this.reader = ReaderFactory.getInstance().getReader(card, cardTerminal);
+    this.reader = ReaderFactory.getReader(card, cardTerminal);
   }
   
   @Override
@@ -80,11 +79,6 @@ public abstract class AbstractSignatureCard implements SignatureCard {
     return new LogCardChannel(card_.getBasicChannel());
   }
 
-  @Override
-  public CCID getReader() {
-    return reader;
-  }
-
   @Override
   public void setLocale(Locale locale) {
     if (locale == null) {
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java b/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java
index e02a55d4..41358bb5 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/BELPICCard.java
@@ -18,6 +18,7 @@
 
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import java.io.IOException;
 import java.io.InputStream;
 import java.security.MessageDigest;
@@ -110,7 +111,7 @@ public class BELPICCard extends AbstractSignatureCard implements SignatureCard {
 
   @Override
   @Exclusive
-  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+  public byte[] getInfobox(String infobox, PINGUI provider, String domainId)
       throws SignatureCardException, InterruptedException {
       
     throw new IllegalArgumentException("Infobox '" + infobox
@@ -120,7 +121,7 @@ public class BELPICCard extends AbstractSignatureCard implements SignatureCard {
   @Override
   @Exclusive
   public byte[] createSignature(InputStream input, KeyboxName keyboxName,
-      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
+      PINGUI provider, String alg) throws SignatureCardException, InterruptedException, IOException {
     
     if (KeyboxName.SECURE_SIGNATURE_KEYPAIR != keyboxName) {
       throw new SignatureCardException("Card does not support key " + keyboxName + ".");
@@ -176,7 +177,7 @@ public class BELPICCard extends AbstractSignatureCard implements SignatureCard {
   }
   
   protected void verifyPINLoop(CardChannel channel, PINSpec spec,
-      PINProvider provider) throws LockedException, NotActivatedException,
+      PINGUI provider) throws LockedException, NotActivatedException,
       SignatureCardException, InterruptedException, CardException {
     
     int retries = -1; //verifyPIN(channel, spec, null, -1);
@@ -186,7 +187,7 @@ public class BELPICCard extends AbstractSignatureCard implements SignatureCard {
   }
 
   protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
-      PINProvider provider, int retries) throws SignatureCardException,
+      PINGUI provider, int retries) throws SignatureCardException,
       LockedException, NotActivatedException, InterruptedException,
       CardException {
     
@@ -197,7 +198,7 @@ public class BELPICCard extends AbstractSignatureCard implements SignatureCard {
             (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
         1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
     
-    ResponseAPDU resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    ResponseAPDU resp = reader.verify(channel, apduSpec, provider, pinSpec, retries);
     
     if (resp.getSW() == 0x9000) {
       return -1;
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
deleted file mode 100644
index 41010551..00000000
--- a/smcc/src/main/java/at/gv/egiz/smcc/ChangePINProvider.java
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
-* Copyright 2008 Federal Chancellery Austria and
-* Graz University of Technology
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
-package at.gv.egiz.smcc;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public interface ChangePINProvider extends PINProvider {
-
-  /**
-   *
-   * @param spec
-   * @param retries
-   * @return null if no old value for this pin
-   * @throws at.gv.egiz.smcc.CancelledException if cancelled by user
-   * @throws java.lang.InterruptedException
-   */
-  public char[] provideOldPIN(PINSpec spec, int retries)
-          throws CancelledException, InterruptedException;
-
-}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java b/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java
index 831a1f9b..64389190 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ITCard.java
@@ -17,6 +17,7 @@
 
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -96,7 +97,7 @@ public class ITCard extends AbstractSignatureCard {
 
   @Override
   @Exclusive
-  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+  public byte[] getInfobox(String infobox, PINGUI provider, String domainId)
       throws SignatureCardException, InterruptedException {
       
     throw new IllegalArgumentException("Infobox '" + infobox
@@ -106,7 +107,7 @@ public class ITCard extends AbstractSignatureCard {
   @Override
   @Exclusive
   public byte[] createSignature(InputStream input, KeyboxName keyboxName,
-      PINProvider provider, String alg) throws SignatureCardException,
+      PINGUI provider, String alg) throws SignatureCardException,
       InterruptedException, IOException {
 
     if (KeyboxName.SECURE_SIGNATURE_KEYPAIR != keyboxName) {
@@ -159,7 +160,7 @@ public class ITCard extends AbstractSignatureCard {
   }
 
   protected void verifyPINLoop(CardChannel channel, PINSpec spec,
-      PINProvider provider) throws LockedException, NotActivatedException,
+      PINGUI provider) throws LockedException, NotActivatedException,
       SignatureCardException, InterruptedException, CardException {
     
     int retries = -1;
@@ -169,7 +170,7 @@ public class ITCard extends AbstractSignatureCard {
   }
 
   protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
-      PINProvider provider, int retries) throws SignatureCardException,
+      PINGUI provider, int retries) throws SignatureCardException,
       LockedException, NotActivatedException, InterruptedException,
       CardException {
     
@@ -180,7 +181,7 @@ public class ITCard extends AbstractSignatureCard {
             (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
         0, VerifyAPDUSpec.PIN_FORMAT_ASCII, 8);
     
-    ResponseAPDU resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+    ResponseAPDU resp = reader.verify(channel, apduSpec, provider, pinSpec, retries);
     
     if (resp.getSW() == 0x9000) {
       return -2;
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java b/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java
index eaf38435..24dfa53c 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINConfirmationException.java
@@ -23,23 +23,4 @@ package at.gv.egiz.smcc;
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
  */
 public class PINConfirmationException extends SignatureCardException {
-
-  private static final long serialVersionUID = 1L;
-
-  public PINConfirmationException() {
-    super();
-  }
-
-  public PINConfirmationException(String message, Throwable cause) {
-    super(message, cause);
-  }
-
-  public PINConfirmationException(String message) {
-    super(message);
-  }
-
-  public PINConfirmationException(Throwable cause) {
-    super(cause);
-  }
-
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java b/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java
index 774fcdf5..721c63e2 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINFormatException.java
@@ -23,23 +23,4 @@ package at.gv.egiz.smcc;
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
  */
 public class PINFormatException extends SignatureCardException {
-
-  private static final long serialVersionUID = 1L;
-
-  public PINFormatException() {
-    super();
-  }
-
-  public PINFormatException(String message, Throwable cause) {
-    super(message, cause);
-  }
-
-  public PINFormatException(String message) {
-    super(message);
-  }
-
-  public PINFormatException(Throwable cause) {
-    super(cause);
-  }
-
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java
index 53738612..5091c10f 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/PINMgmtSignatureCard.java
@@ -16,6 +16,9 @@
 */
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import java.util.List;
 
 public interface PINMgmtSignatureCard extends SignatureCard {
@@ -26,16 +29,16 @@ public interface PINMgmtSignatureCard extends SignatureCard {
 
   public PIN_STATE getPINState(PINSpec pinSpec) throws SignatureCardException;
   
-  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void verifyPIN(PINSpec pinSpec, PINGUI pinGUI)
   throws LockedException, NotActivatedException, CancelledException, SignatureCardException, InterruptedException;
 
-  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+  public void changePIN(PINSpec pinSpec, ModifyPINGUI changePINGUI)
   throws LockedException, NotActivatedException, CancelledException, PINFormatException, SignatureCardException, InterruptedException;
 
-  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void activatePIN(PINSpec pinSpec, ModifyPINGUI activatePINGUI)
   throws CancelledException, SignatureCardException, InterruptedException;
 
-  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
+  public void unblockPIN(PINSpec pinSpec, ModifyPINGUI pukGUI)
   throws CancelledException, SignatureCardException, InterruptedException;
 
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
deleted file mode 100644
index 5c294b5b..00000000
--- a/smcc/src/main/java/at/gv/egiz/smcc/PINProvider.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
-* Copyright 2008 Federal Chancellery Austria and
-* Graz University of Technology
-*
-* Licensed under the Apache License, Version 2.0 (the "License");
-* you may not use this file except in compliance with the License.
-* You may obtain a copy of the License at
-*
-*     http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
-package at.gv.egiz.smcc;
-
-/**
- * The number of retries is not fixed and there is no way (?) to obtain this value.
- * A PINProvider should therefore maintain an internal retry counter or flag
- * to decide whether or not to warn the user (num retries passed in providePIN).
- *
- * Therefore PINProvider objects should not be reused.
- *
- * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public interface PINProvider {
-
-  /**
-   *
-   * @param spec
-   * @param retries num of remaining retries or -1 if unknown
-   * (a positive value does <em>not</em> necessarily signify that there was
-   * already an unsuccessful PIN verification)
-   * @return pin != null
-   * @throws at.gv.egiz.smcc.CancelledException
-   * @throws java.lang.InterruptedException
-   */
-  public char[] providePIN(PINSpec spec, int retries)
-          throws CancelledException, InterruptedException;
-
-}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/ResetRetryCounterAPDUSpec.java b/smcc/src/main/java/at/gv/egiz/smcc/ResetRetryCounterAPDUSpec.java
new file mode 100644
index 00000000..7e71eb7e
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/ResetRetryCounterAPDUSpec.java
@@ -0,0 +1,38 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc;
+
+public class ResetRetryCounterAPDUSpec extends ChangeReferenceDataAPDUSpec {
+
+  /**
+   * @param apdu
+   * @param pukPosition
+   * @param pukFormat
+   * @param pukLength
+   * @param pukLengthSize
+   * @param pukLengthPos
+   * @param pinInsertionOffsetNew
+   */
+  public ResetRetryCounterAPDUSpec(byte[] apdu, int pukPosition,
+      int pukFormat, int pukLength, int pukLengthSize, int pukLengthPos,
+      int pinInsertionOffsetNew) {
+    super(apdu, pukPosition, pukFormat, pukLength, pukLengthSize, pukLengthPos);
+    this.pinInsertionOffsetNew = pinInsertionOffsetNew;
+  }
+
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
index 79a4cc69..ad05352f 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/STARCOSCard.java
@@ -17,6 +17,8 @@
 
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -225,7 +227,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   
   @Override
   @Exclusive
-  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+  public byte[] getInfobox(String infobox, PINGUI pinGUI, String domainId)
       throws SignatureCardException, InterruptedException {
   
     try {
@@ -243,7 +245,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
           try {
             return ISO7816Utils.readTransparentFileTLV(channel, -1, (byte) 0x30);
           } catch (SecurityStatusNotSatisfiedException e) {
-            verifyPINLoop(channel, spec, provider);
+            verifyPINLoop(channel, spec, pinGUI);
           }
         }
         
@@ -301,7 +303,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   @Override
   @Exclusive
   public byte[] createSignature(InputStream input, KeyboxName keyboxName,
-      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
+      PINGUI provider, String alg) throws SignatureCardException, InterruptedException, IOException {
   
     ByteArrayOutputStream dst = new ByteArrayOutputStream();
     byte[] ht = null;
@@ -431,7 +433,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
    */
   @Override
   @Exclusive
-  public void verifyPIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void verifyPIN(PINSpec pinSpec, PINGUI pinProvider)
       throws LockedException, NotActivatedException, CancelledException,
       TimeoutException, SignatureCardException, InterruptedException {
     
@@ -442,12 +444,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
         // SELECT application
         execSELECT_AID(channel, pinSpec.getContextAID());
       }
-      log.debug("*** verifyPIN loop");
       verifyPINLoop(channel, pinSpec, pinProvider);
-//      log.debug("*** verifyPIN 0");
-//      int retries = verifyPIN(channel, pinSpec, null, 0);
-//      log.debug("*** verifyPIN " + retries + " tries");
-//      verifyPIN(channel, pinSpec, pinProvider, retries);
     } catch (CardException e) {
       log.info("Failed to verify PIN.", e);
       throw new SignatureCardException("Failed to verify PIN.", e);
@@ -460,7 +457,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
    */
   @Override
   @Exclusive
-  public void changePIN(PINSpec pinSpec, ChangePINProvider pinProvider)
+  public void changePIN(PINSpec pinSpec, ModifyPINGUI pinGUI)
       throws LockedException, NotActivatedException, CancelledException,
       TimeoutException, SignatureCardException, InterruptedException {
     
@@ -471,9 +468,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
         // SELECT application
         execSELECT_AID(channel, pinSpec.getContextAID());
       }
-      changePINLoop(channel, pinSpec, pinProvider);
-//      int retries = verifyPIN(channel, pinSpec, null, 0);
-//      changePIN(channel, pinSpec, pinProvider, retries);
+      changePINLoop(channel, pinSpec, pinGUI);
     } catch (CardException e) {
       log.info("Failed to change PIN.", e);
       throw new SignatureCardException("Failed to change PIN.", e);
@@ -486,7 +481,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
    */
   @Override
   @Exclusive
-  public void activatePIN(PINSpec pinSpec, PINProvider pinProvider)
+  public void activatePIN(PINSpec pinSpec, ModifyPINGUI activatePINGUI)
       throws CancelledException, SignatureCardException, CancelledException,
       TimeoutException, InterruptedException {
 
@@ -497,7 +492,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
         // SELECT application
         execSELECT_AID(channel, pinSpec.getContextAID());
       }
-      activatePIN(channel, pinSpec, pinProvider);
+      activatePIN(channel, pinSpec, activatePINGUI);
     } catch (CardException e) {
       log.info("Failed to activate PIN.", e);
       throw new SignatureCardException("Failed to activate PIN.", e);
@@ -509,9 +504,16 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
    * @see at.gv.egiz.smcc.PINMgmtSignatureCard#unblockPIN(at.gv.egiz.smcc.PINSpec, at.gv.egiz.smcc.PINProvider)
    */
   @Override
-  public void unblockPIN(PINSpec pinSpec, PINProvider pukProvider)
+  public void unblockPIN(PINSpec pinSpec, ModifyPINGUI pukProvider)
       throws CancelledException, SignatureCardException, InterruptedException {
-    throw new SignatureCardException("Unblock PIN is not supported.");
+    CardChannel channel = getCardChannel();
+
+    try {
+      unblockPINLoop(channel, pinSpec, pukProvider);
+    } catch (CardException e) {
+      log.info("Failed to activate PIN.", e);
+      throw new SignatureCardException("Failed to activate PIN.", e);
+    }
   }
 
   @Override
@@ -574,7 +576,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
   // PROTECTED METHODS (assume exclusive card access)
   ////////////////////////////////////////////////////////////////////////
   
-  protected void verifyPINLoop(CardChannel channel, PINSpec spec, PINProvider provider)
+  protected void verifyPINLoop(CardChannel channel, PINSpec spec, PINGUI provider)
       throws LockedException, NotActivatedException, SignatureCardException,
       InterruptedException, CardException {
     
@@ -584,7 +586,7 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
     } while (retries > 0);
   }
 
-  protected void changePINLoop(CardChannel channel, PINSpec spec, ChangePINProvider provider)
+  protected void changePINLoop(CardChannel channel, PINSpec spec, ModifyPINGUI provider)
       throws LockedException, NotActivatedException, SignatureCardException,
       InterruptedException, CardException {
 
@@ -594,8 +596,19 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
     } while (retries > 0);
   }
   
+  protected void unblockPINLoop(CardChannel channel, PINSpec spec, ModifyPINGUI provider)
+      throws LockedException, NotActivatedException, SignatureCardException,
+      InterruptedException, CardException {
+
+    //TODO get PUK retry counter from EF FID 0036 in MF
+    int retries = -1;
+    do {
+      retries = unblockPIN(channel, spec, provider, retries);
+    } while (retries > 0);
+  }
+
   protected int verifyPIN(CardChannel channel, PINSpec pinSpec,
-      PINProvider provider, int retries) throws SignatureCardException,
+      PINGUI provider, int retries) throws SignatureCardException,
       LockedException, NotActivatedException, InterruptedException,
       CardException {
     
@@ -608,108 +621,135 @@ public class STARCOSCard extends AbstractSignatureCard implements PINMgmtSignatu
     
     ResponseAPDU resp;
     if (provider != null) {
-      resp = reader.verify(channel, apduSpec, pinSpec, provider, retries);
+      resp = reader.verify(channel, apduSpec, provider, pinSpec, retries);
     } else {
       resp = channel.transmit(new CommandAPDU(0x00, 0x20, 0x00, pinSpec.getKID()));
     }
-    
+
+
     if (resp.getSW() == 0x9000) {
       return -1;
-    }
-    if (resp.getSW() == 0x63c0) {
-      // returned by the 'short' VERIFY
+    } else if (resp.getSW() == 0x6983 || resp.getSW() == 0x63c0) {
+      // authentication method blocked (0x63c0 returned by 'short' VERIFY)
       throw new LockedException();
-    }
-    if (resp.getSW() >> 4 == 0x63c) {
-      return 0x0f & resp.getSW();
-    }
-    
-    switch (resp.getSW()) {
-    case 0x6983:
-      // authentication method blocked
-      // returned by the 'long' VERIFY
-      throw new LockedException();
-    case 0x6984:
-      // reference data not usable
+    } else if (resp.getSW() == 0x6984 || resp.getSW() == 0x6985) {
+      // reference data not usable; conditions of use not satisfied
       throw new NotActivatedException();
-    case 0x6985:
-      // conditions of use not satisfied
+    } else if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    } else if (version > 1.2 && resp.getSW() == 0x6400) {
+      log.warn("cannot query pin status prior to card activation");
       throw new NotActivatedException();
-  
-    default:
+    } else {
       String msg = "VERIFY failed. SW=" + Integer.toHexString(resp.getSW()); 
       log.info(msg);
       throw new SignatureCardException(msg);
     }
-    
   }
   
   protected int changePIN(CardChannel channel, PINSpec pinSpec,
-      ChangePINProvider pinProvider, int retries) throws CancelledException,
+      ModifyPINGUI pinProvider, int retries) throws CancelledException,
       InterruptedException, CardException, SignatureCardException {
-    
-    ChangeReferenceDataAPDUSpec apduSpec = new ChangeReferenceDataAPDUSpec(
-        new byte[] { 
-            (byte) 0x00, (byte) 0x24, (byte) 0x00, pinSpec.getKID(), (byte) 0x10, 
-            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, 
-            (byte) 0xff, (byte) 0xff, (byte) 0xff, 
-            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, 
-            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
+
+      ChangeReferenceDataAPDUSpec apduSpec = new ChangeReferenceDataAPDUSpec(
+        new byte[] {
+            (byte) 0x00, (byte) 0x24, (byte) 0x00, pinSpec.getKID(), (byte) 0x10,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff },
         1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4, 8);
-    
-    ResponseAPDU resp = reader.modify(channel, apduSpec, pinSpec, pinProvider, retries);
-    
+
+    ResponseAPDU resp = reader.modify(channel, apduSpec, pinProvider, pinSpec, retries);
+
     if (resp.getSW() == 0x9000) {
       return -1;
-    }
-    if (resp.getSW() >> 4 == 0x63c) {
-      return 0x0f & resp.getSW();
-    }
-    
-    switch (resp.getSW()) {
-    case 0x6983:
+    } else if (resp.getSW() == 0x6983) {
       // authentication method blocked
       throw new LockedException();
-  
-    default:
+    } else if (resp.getSW() == 0x6984) {
+      throw new NotActivatedException();
+    } else if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    } else {
       String msg = "CHANGE REFERENCE DATA failed. SW=" + Integer.toHexString(resp.getSW()); 
       log.info(msg);
       throw new SignatureCardException(msg);
     }
-   
-    
   }
 
   protected int activatePIN(CardChannel channel, PINSpec pinSpec,
-      PINProvider provider) throws SignatureCardException,
+      ModifyPINGUI provider) throws SignatureCardException,
       InterruptedException, CardException {
     
-    NewReferenceDataAPDUSpec apduSpec = new NewReferenceDataAPDUSpec(
+    ResponseAPDU resp;
+    if (version < 1.2) {
+      NewReferenceDataAPDUSpec apduSpec = new NewReferenceDataAPDUSpec(
+          new byte[] {
+              (byte) 0x00, (byte) 0x24, (byte) 0x01, pinSpec.getKID(), (byte) 0x08,
+              (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+              (byte) 0xff, (byte) 0xff, (byte) 0xff },
+          1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
+
+      resp = reader.modify(channel, apduSpec, provider, pinSpec);
+    } else {
+      NewReferenceDataAPDUSpec apduSpec = new NewReferenceDataAPDUSpec(
+          new byte[] {
+              (byte) 0x00, (byte) 0x24, (byte) 0x00, pinSpec.getKID(), (byte) 0x10,
+              (byte) 0x26, (byte) 0x12, (byte) 0x34, (byte) 0x56, (byte) 0xff,
+              (byte) 0xff, (byte) 0xff, (byte) 0xff, 
+              (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+              (byte) 0xff, (byte) 0xff, (byte) 0xff },
+          1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
+      apduSpec.setPinInsertionOffsetNew(8);
+      resp = reader.modify(channel, apduSpec, provider, pinSpec);
+    }
+
+    if (resp.getSW() == 0x9000) {
+      return -1;
+    } else {
+      String msg = "CHANGE REFERENCE DATA failed. SW=" + Integer.toHexString(resp.getSW());
+      log.info(msg);
+      throw new SignatureCardException(msg);
+    }
+  }
+  
+  protected int unblockPIN(CardChannel channel, PINSpec pinSpec,
+      ModifyPINGUI provider, int retries) throws SignatureCardException,
+      InterruptedException, CardException {
+
+    if (version < 1.2) {
+      // would return 0x6982 (Security status not satisfied)
+      throw new SignatureCardException("RESET RETRY COUNTER is not supported by this card.");
+    }
+
+    ResetRetryCounterAPDUSpec apduSpec = new ResetRetryCounterAPDUSpec(
         new byte[] {
-            (byte) 0x00, (byte) 0x24, (byte) 0x01, pinSpec.getKID(), (byte) 0x08,
+            (byte) 0x00, (byte) 0x2c, (byte) 0x00, pinSpec.getKID(), (byte) 0x10,
             (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
-            (byte) 0xff, (byte) 0xff, (byte) 0xff }, 
-        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4);
-    
-    ResponseAPDU resp = reader.activate(channel, apduSpec, pinSpec, provider);
-    
-    switch (resp.getSW()) {
-    
-    case 0x9000:
-      return -1;
+            (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0x20, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+            (byte) 0xff, (byte) 0xff, (byte) 0xff },
+        1, VerifyAPDUSpec.PIN_FORMAT_BCD, 7, 4, 4, 8);
 
-    case 0x6983:
-      // authentication method blocked
-      throw new LockedException();
+    ResponseAPDU resp = reader.modify(channel, apduSpec, provider, pinSpec, retries);
 
-    default:
-      String msg = "CHANGE REFERENCE DATA failed. SW=" + Integer.toHexString(resp.getSW()); 
+    if (resp.getSW() == 0x9000) {
+      return -1;
+    } else if (resp.getSW() == 0x6983) {
+      // PUK blocked
+      throw new LockedException();
+    } else if (resp.getSW() == 0x6984) {
+      throw new NotActivatedException();
+    } else if (resp.getSW() >> 4 == 0x63c) {
+      return 0x0f & resp.getSW();
+    } else {
+      String msg = "RESET RETRY COUNTER failed. SW=" + Integer.toHexString(resp.getSW());
       log.info(msg);
       throw new SignatureCardException(msg);
     }
-    
   }
-  
+
   protected void execSELECT_MF(CardChannel channel) throws CardException, SignatureCardException {
     ResponseAPDU resp = channel.transmit(
         new CommandAPDU(0x00, 0xA4, 0x00, 0x0C));
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
index 670704d5..73c7faa8 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SWCard.java
@@ -40,15 +40,12 @@ import java.util.Enumeration;
 import java.util.Locale;
 
 import javax.smartcardio.Card;
-import javax.smartcardio.CardChannel;
-import javax.smartcardio.CardException;
 import javax.smartcardio.CardTerminal;
-import javax.smartcardio.ResponseAPDU;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
-import at.gv.egiz.smcc.ccid.CCID;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 
 /**
  *
@@ -280,7 +277,7 @@ public class SWCard implements SignatureCard {
     
   }
 
-  public byte[] getInfobox(String infobox, PINProvider provider, String domainId) throws SignatureCardException {
+  public byte[] getInfobox(String infobox, PINGUI provider, String domainId) throws SignatureCardException {
     
     String fileName = getFileName(infobox + ".ibx");
     FileInputStream file;
@@ -309,7 +306,7 @@ public class SWCard implements SignatureCard {
   }
 
   @Override
-  public byte[] createSignature(InputStream input, KeyboxName keyboxName, PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException {
+  public byte[] createSignature(InputStream input, KeyboxName keyboxName, PINGUI provider, String alg) throws SignatureCardException, InterruptedException, IOException {
 
     // KeyStore password
     char[] password = getPassword(keyboxName);
@@ -396,101 +393,4 @@ public class SWCard implements SignatureCard {
   @Override
   public void reset() throws SignatureCardException {
   }
-
-  @Override
-  public CCID getReader() {
-    return new CCID() {
-
-      @Override
-      public boolean hasFeature(Byte feature) {
-        return false;
-      }
-
-      @Override
-      public byte getbTimeOut() {
-        return 0;
-      }
-
-      @Override
-      public byte getbTimeOut2() {
-        return 0;
-      }
-
-      @Override
-      public byte getwPINMaxExtraDigitL() {
-        return 0x12;
-      }
-
-      @Override
-      public byte getwPINMaxExtraDigitH() {
-        return 0x00;
-      }
-
-      @Override
-      public byte getbEntryValidationCondition() {
-        return 0x02;
-      }
-
-      @Override
-      public Card connect() {
-        return null;
-      }
-
-      @Override
-      public String getName() {
-        return "Software CardReader";
-      }
-
-      @Override
-      public byte[] verifyPin(byte[] PIN_VERIFY) throws CardException {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
-
-      @Override
-      public byte[] verifyPinDirect(byte[] PIN_VERIFY) throws CardException {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
-
-      @Override
-      public byte[] modifyPin(byte[] PIN_MODIFY) throws CardException {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
-
-      @Override
-      public byte[] modifyPinDirect(byte[] PIN_MODIFY) throws CardException {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
-
-      @Override
-      public void setDisablePinpad(boolean disable) {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
-
-      @Override
-      public ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
-          PINSpec pinSpec, PINProvider provider, int retries)
-          throws CancelledException, InterruptedException, CardException,
-          SignatureCardException {
-        throw new UnsupportedOperationException("Not supported yet.");
-      }
-
-      @Override
-      public ResponseAPDU activate(CardChannel channel,
-          NewReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
-          PINProvider provider) throws CancelledException,
-          InterruptedException, CardException, SignatureCardException {
-        // TODO Auto-generated method stub
-        return null;
-      }
-
-      @Override
-      public ResponseAPDU modify(CardChannel channel,
-          ChangeReferenceDataAPDUSpec apduSpec, PINSpec pinSpec,
-          ChangePINProvider provider, int retries) throws CancelledException,
-          InterruptedException, CardException, SignatureCardException {
-        // TODO Auto-generated method stub
-        return null;
-      }
-    };
-  }
 }
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
index 3d56f97b..fa589b84 100644
--- a/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
+++ b/smcc/src/main/java/at/gv/egiz/smcc/SignatureCard.java
@@ -17,8 +17,7 @@
 
 package at.gv.egiz.smcc;
 
-import at.gv.egiz.smcc.ccid.CCID;
-
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.Locale;
@@ -99,7 +98,7 @@ public interface SignatureCard {
    * @throws SignatureCardException
    * @throws InterruptedException if applet is destroyed while in pin dialog
    */
-  public byte[] getInfobox(String infobox, PINProvider provider, String domainId)
+  public byte[] getInfobox(String infobox, PINGUI pinGUI, String domainId)
       throws SignatureCardException, InterruptedException;
 
   /**
@@ -114,9 +113,7 @@ public interface SignatureCard {
    * @throws IOException 
    */
   public byte[] createSignature(InputStream input, KeyboxName keyboxName,
-      PINProvider provider, String alg) throws SignatureCardException, InterruptedException, IOException;
-
-  public CCID getReader();
+      PINGUI pinGUI, String alg) throws SignatureCardException, InterruptedException, IOException;
 
   /**
    * Sets the local for evtl. required callbacks (e.g. PINSpec)
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINGUI.java b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINGUI.java
new file mode 100644
index 00000000..00dc2d0e
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINGUI.java
@@ -0,0 +1,36 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+
+public interface ModifyPINGUI extends ModifyPINProvider {
+
+  void modifyPINDirect(PINSpec spec, int retries) throws CancelledException, InterruptedException;
+  void finishDirect();
+
+  void enterCurrentPIN(PINSpec spec, int retries);
+  void enterNewPIN(PINSpec spec);
+  void confirmNewPIN(PINSpec spec);
+  void validKeyPressed();
+  void correctionButtonPressed();
+  void allKeysCleared();
+  /** called prior to MODIFY_PIN_FINISH control command transmission (clear display or display wait message) */
+  void finish();
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINProvider.java
new file mode 100644
index 00000000..36f0097d
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/ModifyPINProvider.java
@@ -0,0 +1,48 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+
+/**
+ * user interface for "software pin-entry" of
+ * <ul>
+ * <li> current pin and new pin (change pin)
+ * <li> new pin (pin activation, no current pin)
+ * <li> puk and new pin (probably verify only?)
+ * </ul>
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface ModifyPINProvider {
+
+  /**
+   *
+   * @param spec
+   * @param retries
+   * @return null if no old value for this pin
+   * @throws at.gv.egiz.smcc.CancelledException if cancelled by user
+   * @throws java.lang.InterruptedException
+   */
+  public char[] provideCurrentPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException;
+
+  public char[] provideNewPIN(PINSpec spec)
+          throws CancelledException, InterruptedException;
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINGUI.java b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINGUI.java
new file mode 100644
index 00000000..5199977b
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINGUI.java
@@ -0,0 +1,42 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+
+/**
+ * Display messages for pinpad pin-entry.
+ * Provides an interface for two types of pinpad pin-entry: pinpad-direct and pinpad-start/finish
+ * @author clemens.orthacker@iaik.tugraz.at
+ */
+public interface PINGUI extends PINProvider {
+
+  void enterPINDirect(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException;
+  
+  /**
+   * @throws CancelledException, InterruptedException if signature-data dialog is interrupted or cancelled
+   */
+  void enterPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException;
+  void validKeyPressed();
+  void correctionButtonPressed();
+  void allKeysCleared();
+  
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINProvider.java b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINProvider.java
new file mode 100644
index 00000000..3bf49888
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/pin/gui/PINProvider.java
@@ -0,0 +1,49 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+
+/**
+ * The number of retries is not fixed and there is no way (?) to obtain this value.
+ * A PINProvider should therefore maintain an internal retry counter or flag
+ * to decide whether or not to warn the user (num retries passed in providePIN).
+ *
+ * Therefore PINProvider objects should not be reused.
+ *
+ * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface PINProvider {
+
+  /**
+   *
+   * @param spec
+   * @param retries num of remaining retries or -1 if unknown
+   * (a positive value does <em>not</em> necessarily signify that there was
+   * already an unsuccessful PIN verification)
+   * @return pin != null
+   * @throws at.gv.egiz.smcc.CancelledException
+   * @throws java.lang.InterruptedException
+   */
+  char[] providePIN(PINSpec pinSpec, int retries)
+          throws CancelledException, InterruptedException;
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/reader/CardReader.java b/smcc/src/main/java/at/gv/egiz/smcc/reader/CardReader.java
new file mode 100644
index 00000000..a1246dd6
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/reader/CardReader.java
@@ -0,0 +1,92 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.reader;
+
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.ResponseAPDU;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.ChangeReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.NewReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.ResetRetryCounterAPDUSpec;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.VerifyAPDUSpec;
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
+import javax.smartcardio.Card;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public interface CardReader {
+
+
+  String[] FEATURES = new String[]{"NO_FEATURE",
+    "FEATURE_VERIFY_PIN_START",
+    "FEATURE_VERIFY_PIN_FINISH",
+    "FEATURE_MODIFY_PIN_START",
+    "FEATURE_MODIFY_PIN_FINISH",
+    "FEATURE_GET_KEY_PRESSED",
+    "FEATURE_VERIFY_PIN_DIRECT",
+    "FEATURE_MODIFY_PIN_DIRECT",
+    "FEATURE_MCT_READER_DIRECT",
+    "FEATURE_MCT_UNIVERSAL",
+    "FEATURE_IFD_PIN_PROPERTIES",
+    "FEATURE_ABORT",
+    "FEATURE_SET_SPE_MESSAGE",
+    "FEATURE_VERIFY_PIN_DIRECT_APP_ID",
+    "FEATURE_MODIFY_PIN_DIRECT_APP_ID",
+    "FEATURE_WRITE_DISPLAY",
+    "FEATURE_GET_KEY",
+    "FEATURE_IFD_DISPLAY_PROPERTIES"};
+
+  Byte FEATURE_VERIFY_PIN_START = new Byte((byte) 0x01);
+  Byte FEATURE_VERIFY_PIN_FINISH = new Byte((byte) 0x02);
+  Byte FEATURE_MODIFY_PIN_START = new Byte((byte) 0x03);
+  Byte FEATURE_MODIFY_PIN_FINISH = new Byte((byte) 0x04);
+  Byte FEATURE_GET_KEY_PRESSED = new Byte((byte) 0x05);
+  Byte FEATURE_VERIFY_PIN_DIRECT = new Byte((byte) 0x06);
+  Byte FEATURE_MODIFY_PIN_DIRECT = new Byte((byte) 0x07);
+  Byte FEATURE_MCT_READER_DIRECT = new Byte((byte) 0x08);
+  Byte FEATURE_MCT_UNIVERSAL = new Byte((byte) 0x09);
+  Byte FEATURE_IFD_PIN_PROPERTIES = new Byte((byte) 0x0a);
+  //TODO continue list
+
+
+  Card connect() throws CardException;
+
+  boolean hasFeature(Byte feature);
+
+  ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
+          PINGUI pinGUI, PINSpec pinSpec, int retries)
+      throws CancelledException, InterruptedException, CardException, SignatureCardException;
+
+  ResponseAPDU modify(CardChannel channel, ChangeReferenceDataAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec, int retries)
+      throws CancelledException, InterruptedException, CardException, SignatureCardException;
+
+  ResponseAPDU modify(CardChannel channel, NewReferenceDataAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec)
+      throws CancelledException, InterruptedException, CardException, SignatureCardException;
+
+  ResponseAPDU modify(CardChannel channel, ResetRetryCounterAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec, int retries)
+      throws CancelledException, InterruptedException, CardException, SignatureCardException;
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/reader/DefaultCardReader.java b/smcc/src/main/java/at/gv/egiz/smcc/reader/DefaultCardReader.java
new file mode 100644
index 00000000..45ea7a5a
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/reader/DefaultCardReader.java
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.reader;
+
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
+import javax.smartcardio.ResponseAPDU;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.gv.egiz.smcc.ChangeReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.NewReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.ResetRetryCounterAPDUSpec;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.VerifyAPDUSpec;
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
+import at.gv.egiz.smcc.util.ISO7816Utils;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class DefaultCardReader implements CardReader {
+
+  protected final static Log log = LogFactory.getLog(DefaultCardReader.class);
+
+  protected CardTerminal ct;
+  protected String name;
+
+  public DefaultCardReader(CardTerminal ct) {
+    if (ct == null) {
+      throw new NullPointerException("no card or card terminal provided");
+    }
+    this.ct = ct;
+    this.name = ct.getName();
+  }
+
+  @Override
+  public ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
+          PINGUI pinGUI, PINSpec pinSpec, int retries)
+        throws SignatureCardException, CardException, InterruptedException {
+
+    log.debug("VERIFY");
+    return channel.transmit(ISO7816Utils.createVerifyAPDU(apduSpec, pinGUI.providePIN(pinSpec, retries)));
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel, ChangeReferenceDataAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec, int retries)
+        throws SignatureCardException, CardException, InterruptedException {
+    log.debug("MODIFY (CHANGE_REFERENCE_DATA)");
+    char[] oldPin = pinGUI.provideCurrentPIN(pinSpec, retries);
+    char[] newPin = pinGUI.provideNewPIN(pinSpec);
+    return channel.transmit(ISO7816Utils.createChangeReferenceDataAPDU(apduSpec, oldPin, newPin));
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel, NewReferenceDataAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec)
+        throws SignatureCardException, CardException, InterruptedException {
+    log.debug("MODIFY (NEW_REFERENCE_DATA)");
+    char[] newPIN = pinGUI.provideNewPIN(pinSpec);
+    return channel.transmit(ISO7816Utils.createNewReferenceDataAPDU(apduSpec, newPIN));
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel, ResetRetryCounterAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec, int retries)
+          throws InterruptedException, CardException, SignatureCardException {
+    log.debug("MODIFY (RESET_RETRY_COUNTER)");
+    //TODO
+    return modify(channel, (ChangeReferenceDataAPDUSpec) apduSpec, pinGUI, pinSpec, retries);
+  }
+
+  @Override
+  public Card connect() throws CardException {
+    log.debug("connect icc");
+    return ct.connect("*");
+  }
+
+  @Override
+  public boolean hasFeature(Byte feature) {
+    return false;
+  }
+
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/reader/PinpadCardReader.java b/smcc/src/main/java/at/gv/egiz/smcc/reader/PinpadCardReader.java
new file mode 100644
index 00000000..c2537af8
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/reader/PinpadCardReader.java
@@ -0,0 +1,703 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.reader;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Map;
+
+import javax.smartcardio.Card;
+import javax.smartcardio.CardChannel;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
+import javax.smartcardio.ResponseAPDU;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.ChangeReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.NewReferenceDataAPDUSpec;
+import at.gv.egiz.smcc.PINConfirmationException;
+import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINOperationAbortedException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.ResetRetryCounterAPDUSpec;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.TimeoutException;
+import at.gv.egiz.smcc.VerifyAPDUSpec;
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
+import at.gv.egiz.smcc.util.SMCCHelper;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class PinpadCardReader extends DefaultCardReader {
+
+  public static final int PIN_ENTRY_POLLING_INTERVAL = 10;
+
+  protected final static Log log = LogFactory.getLog(PinpadCardReader.class);
+
+  protected byte bEntryValidationCondition = 0x02;  // validation key pressed
+  protected byte bTimeOut = 0x3c;                   // 60sec (= max on ReinerSCT)
+  protected byte bTimeOut2 = 0x00;                  // default (attention with SCM)
+  protected byte wPINMaxExtraDigitH = 0x00;         // min pin length zero digits
+  protected byte wPINMaxExtraDigitL = 0x0c;         // max pin length 12 digits
+
+  /**
+   * supported features and respective control codes
+   */
+  protected Map<Byte, Integer> features;
+  protected boolean VERIFY, MODIFY, VERIFY_DIRECT, MODIFY_DIRECT;
+
+  public PinpadCardReader(CardTerminal ct, Map<Byte, Integer> features) {
+    super(ct);
+    if (features == null) {
+      throw new NullPointerException("Pinpad card reader does not support any features");
+    }
+    this.features = features;
+
+    if (features.containsKey(FEATURE_VERIFY_PIN_START) &&
+        features.containsKey(FEATURE_GET_KEY_PRESSED) &&
+        features.containsKey(FEATURE_VERIFY_PIN_FINISH)) {
+      VERIFY = true;
+    }
+    if (features.containsKey(FEATURE_MODIFY_PIN_START) &&
+        features.containsKey(FEATURE_GET_KEY_PRESSED) &&
+        features.containsKey(FEATURE_MODIFY_PIN_FINISH)) {
+      MODIFY = true;
+    }
+    if (features.containsKey(FEATURE_VERIFY_PIN_DIRECT)) {
+      VERIFY_DIRECT = true;
+    }
+    if (features.containsKey(FEATURE_MODIFY_PIN_DIRECT)) {
+      MODIFY_DIRECT = true;
+    }
+
+    if (name != null) {
+      name = name.toLowerCase();
+      //ReinerSCT: http://support.reiner-sct.de/downloads/LINUX
+      //           http://www.linux-club.de/viewtopic.php?f=61&t=101287&start=0
+      //old: REINER SCT CyberJack 00 00
+      //new (CCID): 0C4B/0300 Reiner-SCT cyberJack pinpad(a) 00 00
+      //Snow Leopard: Reiner-SCT cyberJack pinpad(a) 00 00
+      //display: REINER SCT CyberJack 00 00
+      if(name.startsWith("gemplus gempc pinpad") || name.startsWith("gemalto gempc pinpad")) {
+        log.debug("setting custom wPINMaxExtraDigitH (0x04) for " + name);
+        wPINMaxExtraDigitH = 0x04;
+        log.debug("setting custom wPINMaxExtraDigitL (0x08) for " + name);
+        wPINMaxExtraDigitL = 0x08;
+      } else if (name.startsWith("omnikey cardman 3621")) {
+        log.debug("setting custom wPINMaxExtraDigitH (0x01) for " + name);
+        wPINMaxExtraDigitH = 0x01;
+      } else if (name.startsWith("scm spr 532") || name.startsWith("scm microsystems inc. sprx32 usb smart card reader")) {
+        log.debug("setting custom bTimeOut (0x3c) for " + name);
+        bTimeOut = 0x3c;
+        log.debug("setting custom bTimeOut2 (0x0f) for " + name);
+        bTimeOut2 = 0x0f;
+      } else if (name.startsWith("cherry smartboard xx44")) {
+        log.debug("setting custom wPINMaxExtraDigitH (0x01) for " + name);
+        wPINMaxExtraDigitH = 0x01;
+      }
+    }
+
+  }
+
+  @Override
+  public boolean hasFeature(Byte feature) {
+    return features.containsKey(feature);
+  }
+  
+  private void VERIFY_PIN_START(Card icc, byte[] PIN_VERIFY) throws CardException {
+    int ioctl = features.get(FEATURE_VERIFY_PIN_START);
+    if (log.isTraceEnabled()) {
+      log.trace("VERIFY_PIN_START (" + Integer.toHexString(ioctl) +
+              ")  " + SMCCHelper.toString(PIN_VERIFY));
+    }
+    byte[] resp = icc.transmitControlCommand(ioctl, PIN_VERIFY);
+    if (resp != null && resp.length > 0) {
+      if (resp[0] == (byte) 0x57) {
+        log.error("Invalid parameter in PIN_VERIFY structure");
+        throw new CardException("ERROR_INVALID_PARAMETER");
+      } else {
+        log.error("unexpected response to VERIFY_PIN_START: " +
+                SMCCHelper.toString(resp));
+        throw new CardException("unexpected response to VERIFY_PIN_START: " +
+                SMCCHelper.toString(resp));
+      }
+    }
+  }
+
+  private byte GET_KEY_PRESSED(Card icc) throws CardException {
+    int ioctl = features.get(FEATURE_GET_KEY_PRESSED);
+    byte[] resp = icc.transmitControlCommand(ioctl, new byte[0]);
+    if (resp != null && resp.length == 1) {
+//      if (log.isTraceEnabled()) {
+//        log.trace("response " + SMCCHelper.toString(resp));
+//      }
+      return resp[0];
+    }
+    log.error("unexpected response to GET_KEY_PRESSED: " +
+            SMCCHelper.toString(resp));
+    throw new CardException("unexpected response to GET_KEY_PRESSED: " +
+            SMCCHelper.toString(resp));
+  }
+
+  private byte[] VERIFY_PIN_FINISH(Card icc) throws CardException {
+    int ioctl = features.get(FEATURE_VERIFY_PIN_FINISH);
+    if (log.isTraceEnabled()) {
+      log.trace("VERIFY_PIN_FINISH (" + Integer.toHexString(ioctl) + ")");
+    }
+    byte[] resp = icc.transmitControlCommand(ioctl, new byte[0]);
+    if (resp != null && resp.length == 2) {
+      if (log.isTraceEnabled()) {
+        log.trace("response " + SMCCHelper.toString(resp));
+      }
+      return resp;
+    }
+    log.error("unexpected response to VERIFY_PIN_FINISH: " +
+            SMCCHelper.toString(resp));
+    throw new CardException("unexpected response to VERIFY_PIN_FINISH: " +
+            SMCCHelper.toString(resp));
+  }
+
+  private void MODIFY_PIN_START(Card icc, byte[] PIN_MODIFY) throws CardException {
+    int ioctl = features.get(FEATURE_MODIFY_PIN_START);
+    if (log.isTraceEnabled()) {
+      log.trace("MODFIY_PIN_START (" + Integer.toHexString(ioctl) +
+              ")  " + SMCCHelper.toString(PIN_MODIFY));
+    }
+    byte[] resp = icc.transmitControlCommand(ioctl, PIN_MODIFY);
+    if (resp != null && resp.length > 0) {
+      if (resp[0] == (byte) 0x57) {
+        log.error("Invalid parameter in PIN_MODIFY structure");
+        throw new CardException("ERROR_INVALID_PARAMETER");
+      } else {
+        log.error("unexpected response to MODIFY_PIN_START: " +
+                SMCCHelper.toString(resp));
+        throw new CardException("unexpected response to MODIFY_PIN_START: " +
+                SMCCHelper.toString(resp));
+      }
+    }
+  }
+
+  private byte[] MODIFY_PIN_FINISH(Card icc) throws CardException {
+    int ioctl = features.get(FEATURE_MODIFY_PIN_FINISH);
+    if (log.isTraceEnabled()) {
+      log.trace("MODIFY_PIN_FINISH (" + Integer.toHexString(ioctl) + ")");
+    }
+    byte[] resp = icc.transmitControlCommand(ioctl, new byte[0]);
+    if (resp != null && resp.length == 2) {
+      if (log.isTraceEnabled()) {
+        log.trace("response " + SMCCHelper.toString(resp));
+      }
+      return resp;
+    }
+    log.error("unexpected response to MODIFY_PIN_FINISH: " +
+            SMCCHelper.toString(resp));
+    throw new CardException("unexpected response to MODIFY_PIN_FINISH: " +
+            SMCCHelper.toString(resp));
+  }
+
+  private byte[] VERIFY_PIN_DIRECT(Card icc, byte[] PIN_VERIFY) throws CardException {
+    int ioctl = features.get(FEATURE_VERIFY_PIN_DIRECT);
+    if (log.isTraceEnabled()) {
+      log.trace("VERIFY_PIN_DIRECT (" + Integer.toHexString(ioctl) +
+              ")  " + SMCCHelper.toString(PIN_VERIFY));
+    }
+    byte[] resp = icc.transmitControlCommand(ioctl, PIN_VERIFY);
+    if (log.isTraceEnabled()) {
+      log.trace("response " + SMCCHelper.toString(resp));
+    }
+    return resp;
+  }
+
+  private byte[] verifyPin(Card icc, byte[] PIN_VERIFY, PINGUI pinGUI) 
+          throws SignatureCardException, CardException, InterruptedException {
+
+//    pinGUI.enterPIN(pinSpec, retries);
+
+    log.debug("VERIFY_PIN_START [" + FEATURES[FEATURE_VERIFY_PIN_START] + "]");
+    VERIFY_PIN_START(icc, PIN_VERIFY);
+
+    byte resp;
+    do {
+      resp = GET_KEY_PRESSED(icc);
+      if (resp == (byte) 0x00) {
+        synchronized(this) {
+          try {
+            wait(PIN_ENTRY_POLLING_INTERVAL);
+          } catch (InterruptedException ex) {
+            log.error("interrupted in VERIFY_PIN");
+          }
+        }
+      } else if (resp == (byte) 0x0d) {
+        log.debug("GET_KEY_PRESSED: 0x0d (user confirmed)");
+        break;
+      } else if (resp == (byte) 0x2b) {
+        log.trace("GET_KEY_PRESSED: 0x2b (user entered valid key 0-9)");
+        pinGUI.validKeyPressed();
+      } else if (resp == (byte) 0x1b) {
+        log.debug("GET_KEY_PRESSED: 0x1b (user cancelled VERIFY_PIN via cancel button)");
+        break; // returns 0x6401
+      } else if (resp == (byte) 0x08) {
+        log.debug("GET_KEY_PRESSED: 0x08 (user pressed correction/backspace button)");
+        pinGUI.correctionButtonPressed();
+      } else if (resp == (byte) 0x0e) {
+        log.debug("GET_KEY_PRESSED: 0x0e (timeout occured)");
+        break; // return 0x6400
+      } else if (resp == (byte) 0x40) {
+        log.debug("GET_KEY_PRESSED: 0x40 (PIN_Operation_Aborted)");
+        throw new PINOperationAbortedException("PIN_Operation_Aborted (0x40)");
+      } else if (resp == (byte) 0x0a) {
+        log.debug("GET_KEY_PRESSED: 0x0a (all keys cleared");
+        pinGUI.allKeysCleared();
+      } else {
+        log.error("unexpected response to GET_KEY_PRESSED: " +
+            Integer.toHexString(resp));
+        throw new CardException("unexpected response to GET_KEY_PRESSED: " +
+            Integer.toHexString(resp));
+      }
+    } while (true); 
+
+    return VERIFY_PIN_FINISH(icc);
+  }
+
+  /**
+   * does not display the first pin dialog (enterCurrentPIN or enterNewPIN, depends on bConfirmPIN),
+   * since this is easier to do in calling modify()
+   */
+  private byte[] modifyPin(Card icc, byte[] PIN_MODIFY, ModifyPINGUI pinGUI, PINSpec pINSpec)
+          throws PINOperationAbortedException, CardException {
+
+    byte pinConfirmations = (byte) 0x00; //b0: new pin not entered (0) / entered (1)
+                                         //b1: current pin not entered (0) / entered (1)
+    byte bConfirmPIN = PIN_MODIFY[9];
+    
+//    if ((bConfirmPIN & (byte) 0x02) == 0) {
+//      log.debug("no current PIN entry requested");
+//      pinGUI.enterNewPIN(pINSpec);
+//    } else {
+//      log.debug("current PIN entry requested");
+//      pinGUI.enterCurrentPIN(pINSpec, retries);
+//    }
+
+    log.debug("MODIFY_PIN_START [" + FEATURES[FEATURE_MODIFY_PIN_START] + "]");
+    MODIFY_PIN_START(icc, PIN_MODIFY);
+
+    byte resp;
+    while (true) {
+      resp = GET_KEY_PRESSED(icc);
+      if (resp == (byte) 0x00) {
+        synchronized(this) {
+          try {
+            wait(PIN_ENTRY_POLLING_INTERVAL);
+          } catch (InterruptedException ex) {
+            log.error("interrupted in MODIFY_PIN");
+          }
+        }
+      } else if (resp == (byte) 0x0d) {
+        if (log.isTraceEnabled()) {
+          log.trace("requested pin confirmations: 0b" + Integer.toBinaryString(bConfirmPIN & 0xff));
+          log.trace("performed pin confirmations: 0b" + Integer.toBinaryString(pinConfirmations & 0xff));
+        }
+        log.debug("GET_KEY_PRESSED: 0x0d (user confirmed)");
+        if (pinConfirmations == bConfirmPIN) {
+          break;
+        } else if ((bConfirmPIN & (byte) 0x02) == 0 ||
+            (pinConfirmations & (byte) 0x02) == (byte) 0x02) {
+          // no current pin entry or current pin entry already performed
+          if ((pinConfirmations & (byte) 0x01) == 0) {
+            // new pin
+            pinConfirmations |= (byte) 0x01;
+            pinGUI.confirmNewPIN(pINSpec);
+          } // else: new pin confirmed
+        } else {
+          // current pin entry
+          pinConfirmations |= (byte) 0x02;
+          pinGUI.enterNewPIN(pINSpec);
+        }
+      } else if (resp == (byte) 0x2b) {
+        log.trace("GET_KEY_PRESSED: 0x2b (user entered valid key 0-9)");
+        pinGUI.validKeyPressed();
+      } else if (resp == (byte) 0x1b) {
+        log.debug("GET_KEY_PRESSED: 0x1b (user cancelled VERIFY_PIN via cancel button)");
+        break; // returns 0x6401
+      } else if (resp == (byte) 0x08) {
+        log.debug("GET_KEY_PRESSED: 0x08 (user pressed correction/backspace button)");
+        pinGUI.correctionButtonPressed();
+      } else if (resp == (byte) 0x0e) {
+        log.debug("GET_KEY_PRESSED: 0x0e (timeout occured)");
+        break; // return 0x6400
+      } else if (resp == (byte) 0x40) {
+        log.debug("GET_KEY_PRESSED: 0x40 (PIN_Operation_Aborted)");
+        throw new PINOperationAbortedException("PIN_Operation_Aborted (0x40)");
+      } else if (resp == (byte) 0x0a) {
+        log.debug("GET_KEY_PRESSED: 0x0a (all keys cleared");
+        pinGUI.allKeysCleared();
+      } else {
+        log.error("unexpected response to GET_KEY_PRESSED: " +
+            Integer.toHexString(resp));
+        throw new CardException("unexpected response to GET_KEY_PRESSED: " +
+            Integer.toHexString(resp));
+      }
+
+    }
+
+    pinGUI.finish();
+    return MODIFY_PIN_FINISH(icc);
+  }
+
+  private byte[] MODIFY_PIN_DIRECT(Card icc, byte[] PIN_MODIFY) throws CardException {
+    int ioctl = features.get(FEATURE_MODIFY_PIN_DIRECT);
+    if (log.isTraceEnabled()) {
+      log.trace("MODIFY_PIN_DIRECT (" + Integer.toHexString(ioctl) +
+              ")  " + SMCCHelper.toString(PIN_MODIFY));
+    }
+    byte[] resp = icc.transmitControlCommand(ioctl, PIN_MODIFY);
+    if (log.isTraceEnabled()) {
+      log.trace("response " + SMCCHelper.toString(resp));
+    }
+    return resp;
+  }
+  
+  protected byte[] createPINModifyStructure(NewReferenceDataAPDUSpec apduSpec, PINSpec pinSpec) {
+
+    ByteArrayOutputStream s = new ByteArrayOutputStream();
+    // bTimeOut
+    s.write(bTimeOut);
+    // bTimeOut2
+    s.write(bTimeOut2);
+    // bmFormatString
+    s.write(1 << 7 // system unit = byte
+        | (0xF & apduSpec.getPinPosition()) << 3
+        | (0x1 & apduSpec.getPinJustification() << 2)
+        | (0x3 & apduSpec.getPinFormat()));
+    // bmPINBlockString
+    s.write((0xF & apduSpec.getPinLengthSize()) << 4
+        | (0xF & apduSpec.getPinLength()));
+    // bmPINLengthFormat
+    s.write(// system unit = bit
+        (0xF & apduSpec.getPinLengthPos()));
+    // bInsertionOffsetOld
+    s.write(0x00);
+    // bInsertionOffsetNew
+    s.write(apduSpec.getPinInsertionOffsetNew());
+    // wPINMaxExtraDigit
+    s.write(Math.min(pinSpec.getMaxLength(), wPINMaxExtraDigitL));
+    s.write(Math.max(pinSpec.getMinLength(), wPINMaxExtraDigitH));
+    // bConfirmPIN
+    s.write(0x01);
+    // bEntryValidationCondition
+    s.write(bEntryValidationCondition);
+    // bNumberMessage
+    s.write(0x02);
+    // wLangId English (United States), see http://www.usb.org/developers/docs/USB_LANGIDs.pdf
+    s.write(0x09);
+    s.write(0x04);
+    // bMsgIndex1
+    s.write(0x01);
+    // bMsgIndex2
+    s.write(0x02);
+    // bMsgIndex3
+    s.write(0x00);
+
+    // bTeoPrologue
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // ulDataLength
+    s.write(apduSpec.getApdu().length);
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // abData
+    try {
+      s.write(apduSpec.getApdu());
+    } catch (IOException e) {
+      // As we are dealing with ByteArrayOutputStreams no exception is to be
+      // expected.
+      throw new RuntimeException(e);
+    }
+
+    return s.toByteArray();
+
+  }
+  
+  protected byte[] createPINModifyStructure(ChangeReferenceDataAPDUSpec apduSpec, PINSpec pinSpec) {
+    //TODO bInsertionOffsetOld (0x00), bConfirmPIN (0x01), bNumberMessage (0x02), bMsgIndex1/2/3
+
+    ByteArrayOutputStream s = new ByteArrayOutputStream();
+    // bTimeOut
+    s.write(bTimeOut);
+    // bTimeOut2
+    s.write(bTimeOut2);
+    // bmFormatString
+    s.write(1 << 7 // system unit = byte
+        | (0xF & apduSpec.getPinPosition()) << 3
+        | (0x1 & apduSpec.getPinJustification() << 2)
+        | (0x3 & apduSpec.getPinFormat()));
+    // bmPINBlockString
+    s.write((0xF & apduSpec.getPinLengthSize()) << 4
+        | (0xF & apduSpec.getPinLength()));
+    // bmPINLengthFormat
+    s.write(// system unit = bit
+        (0xF & apduSpec.getPinLengthPos()));
+    // bInsertionOffsetOld (0x00 for no old pin?)
+    s.write(apduSpec.getPinInsertionOffsetOld());
+    // bInsertionOffsetNew
+    s.write(apduSpec.getPinInsertionOffsetNew());
+    // wPINMaxExtraDigit
+    s.write(Math.min(pinSpec.getMaxLength(), wPINMaxExtraDigitL));
+    s.write(Math.max(pinSpec.getMinLength(), wPINMaxExtraDigitH));
+    // bConfirmPIN
+    s.write(0x03);
+    // bEntryValidationCondition
+    s.write(bEntryValidationCondition);
+    // bNumberMessage
+    s.write(0x03);
+    // wLangId English (United States), see http://www.usb.org/developers/docs/USB_LANGIDs.pdf
+    s.write(0x09);
+    s.write(0x04);
+    // bMsgIndex1
+    s.write(0x00);
+    // bMsgIndex2
+    s.write(0x01);
+    // bMsgIndex3
+    s.write(0x02);
+    
+    // bTeoPrologue
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // ulDataLength
+    s.write(apduSpec.getApdu().length);
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // abData
+    try {
+      s.write(apduSpec.getApdu());
+    } catch (IOException e) {
+      // As we are dealing with ByteArrayOutputStreams no exception is to be
+      // expected.
+      throw new RuntimeException(e);
+    }
+    
+    return s.toByteArray();
+
+  }
+  
+  protected byte[] createPINVerifyStructure(VerifyAPDUSpec apduSpec, PINSpec pinSpec) {
+    
+    ByteArrayOutputStream s = new ByteArrayOutputStream();
+    // bTimeOut
+    s.write(bTimeOut);
+    // bTimeOut2
+    s.write(bTimeOut2);
+    // bmFormatString
+    s.write(1 << 7 // system unit = byte
+        | (0xF & apduSpec.getPinPosition()) << 3
+        | (0x1 & apduSpec.getPinJustification() << 2)
+        | (0x3 & apduSpec.getPinFormat()));
+    // bmPINBlockString
+    s.write((0xF & apduSpec.getPinLengthSize()) << 4
+        | (0xF & apduSpec.getPinLength()));
+    // bmPINLengthFormat
+    s.write(// system unit = bit
+        (0xF & apduSpec.getPinLengthPos()));
+    // wPINMaxExtraDigit
+    s.write(Math.min(pinSpec.getMaxLength(), wPINMaxExtraDigitL)); // max PIN length
+    s.write(Math.max(pinSpec.getMinLength(), wPINMaxExtraDigitH)); // min PIN length
+    // bEntryValidationCondition
+    s.write(bEntryValidationCondition);
+    // bNumberMessage
+    s.write(0x01);
+    // wLangId
+    s.write(0x09);
+    s.write(0x04);
+    // bMsgIndex
+    s.write(0x00);
+    // bTeoPrologue
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // ulDataLength
+    s.write(apduSpec.getApdu().length);
+    s.write(0x00);
+    s.write(0x00);
+    s.write(0x00);
+    // abData
+    try {
+      s.write(apduSpec.getApdu());
+    } catch (IOException e) {
+      // As we are dealing with ByteArrayOutputStreams no exception is to be
+      // expected.
+      throw new RuntimeException(e);
+    }
+    
+    return s.toByteArray();
+    
+  }
+
+  @Override
+  public ResponseAPDU verify(CardChannel channel, VerifyAPDUSpec apduSpec,
+          PINGUI pinGUI, PINSpec pinSpec, int retries)
+        throws SignatureCardException, CardException, InterruptedException {
+
+    ResponseAPDU resp = null;
+
+    byte[] s = createPINVerifyStructure(apduSpec, pinSpec);
+    Card icc = channel.getCard();
+
+    if (VERIFY) {
+      pinGUI.enterPIN(pinSpec, retries);
+      resp = new ResponseAPDU(verifyPin(icc, s, pinGUI));
+    } else if (VERIFY_DIRECT) {
+      pinGUI.enterPINDirect(pinSpec, retries);
+      log.debug("VERIFY_PIN_DIRECT [" + FEATURES[FEATURE_VERIFY_PIN_DIRECT] + "]");
+      resp = new ResponseAPDU(VERIFY_PIN_DIRECT(icc, s));
+    } else {
+      log.warn("falling back to default pin-entry");
+      return super.verify(channel, apduSpec, pinGUI, pinSpec, retries);
+    }
+
+    switch (resp.getSW()) {
+      case 0x6400:
+        log.debug("SPE operation timed out.");
+        throw new TimeoutException();
+      case 0x6401:
+        log.debug("SPE operation was cancelled by the 'Cancel' button.");
+        throw new CancelledException();
+      case 0x6403:
+          log.debug("User entered too short or too long PIN "
+              + "regarding MIN/MAX PIN length.");
+          throw new PINFormatException();
+      case 0x6480:
+        log.debug("SPE operation was aborted by the 'Cancel' operation "
+            + "at the host system.");
+      case 0x6b80:
+        log.info("Invalid parameter in passed structure.");
+      default:
+        return resp;
+    }
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel, ChangeReferenceDataAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec, int retries)
+        throws SignatureCardException, CardException, InterruptedException {
+    
+    ResponseAPDU resp = null;
+
+    byte[] s = createPINModifyStructure(apduSpec, pinSpec);
+    Card icc = channel.getCard();
+    
+    if (MODIFY) {
+      pinGUI.enterCurrentPIN(pinSpec, retries);
+      resp = new ResponseAPDU(modifyPin(icc, s, pinGUI, pinSpec));
+    } else if (MODIFY_DIRECT) {
+      pinGUI.modifyPINDirect(pinSpec, retries);
+      log.debug("MODIFY_PIN_DIRECT [" + FEATURES[FEATURE_MODIFY_PIN_DIRECT] + "]");
+      resp = new ResponseAPDU(MODIFY_PIN_DIRECT(icc, s));
+    } else {
+      log.warn("falling back to default pin-entry");
+      return super.modify(channel, apduSpec, pinGUI, pinSpec, retries);
+    }
+
+    switch (resp.getSW()) {
+      case 0x6400:
+        log.debug("SPE operation timed out.");
+        throw new TimeoutException();
+      case 0x6401:
+        log.debug("SPE operation was cancelled by the 'Cancel' button.");
+        throw new CancelledException();
+      case 0x6402:
+        log.debug("Modify PIN operation failed because two 'new PIN' " +
+                "entries do not match");
+        throw new PINConfirmationException();
+      case 0x6403:
+        log.debug("User entered too short or too long PIN "
+              + "regarding MIN/MAX PIN length.");
+        throw new PINFormatException();
+      case 0x6480:
+        log.debug("SPE operation was aborted by the 'Cancel' operation "
+            + "at the host system.");
+      case 0x6b80:
+        log.info("Invalid parameter in passed structure.");
+      default:
+        return resp;
+    }
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel, NewReferenceDataAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec)
+        throws SignatureCardException, CardException, InterruptedException {
+
+    ResponseAPDU resp = null;
+
+    byte[] s = createPINModifyStructure(apduSpec, pinSpec);
+    Card icc = channel.getCard();
+
+    if (MODIFY) {
+      pinGUI.enterNewPIN(pinSpec);
+      resp = new ResponseAPDU(modifyPin(icc, s, pinGUI, pinSpec));
+    } else if (MODIFY_DIRECT) {
+      pinGUI.modifyPINDirect(pinSpec, -1);
+      log.debug("MODIFY_PIN_DIRECT [" + FEATURES[FEATURE_MODIFY_PIN_DIRECT] + "]");
+      resp = new ResponseAPDU(MODIFY_PIN_DIRECT(icc, s));
+    } else {
+      log.warn("falling back to default pin-entry");
+      return super.modify(channel, apduSpec, pinGUI, pinSpec);
+    }
+
+    switch (resp.getSW()) {
+      case 0x6400:
+        log.debug("SPE operation timed out.");
+        throw new TimeoutException();
+      case 0x6401:
+        log.debug("SPE operation was cancelled by the 'Cancel' button.");
+        throw new CancelledException();
+      case 0x6402:
+        log.debug("Modify PIN operation failed because two 'new PIN' " +
+                "entries do not match");
+        throw new PINConfirmationException();
+      case 0x6403:
+        log.debug("User entered too short or too long PIN "
+              + "regarding MIN/MAX PIN length.");
+        throw new PINFormatException();
+      case 0x6480:
+        log.debug("SPE operation was aborted by the 'Cancel' operation "
+            + "at the host system.");
+      case 0x6b80:
+        log.info("Invalid parameter in passed structure.");
+      default:
+        return resp;
+    }
+  }
+
+  @Override
+  public ResponseAPDU modify(CardChannel channel, ResetRetryCounterAPDUSpec apduSpec,
+          ModifyPINGUI pinGUI, PINSpec pinSpec, int retries)
+          throws InterruptedException, CardException, SignatureCardException {
+    //TODO
+    return modify(channel, (ChangeReferenceDataAPDUSpec) apduSpec, pinGUI, pinSpec, retries);
+  }
+}
diff --git a/smcc/src/main/java/at/gv/egiz/smcc/reader/ReaderFactory.java b/smcc/src/main/java/at/gv/egiz/smcc/reader/ReaderFactory.java
new file mode 100644
index 00000000..eb197d9f
--- /dev/null
+++ b/smcc/src/main/java/at/gv/egiz/smcc/reader/ReaderFactory.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.smcc.reader;
+
+import at.gv.egiz.smcc.conf.SMCCConfiguration;
+import at.gv.egiz.smcc.util.SMCCHelper;
+import java.util.HashMap;
+import java.util.Map;
+import javax.smartcardio.Card;
+import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminal;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class ReaderFactory {
+
+  protected final static Log log = LogFactory.getLog(ReaderFactory.class);
+  
+  protected SMCCConfiguration configuration;
+
+  private ReaderFactory() {
+  }
+
+  /**
+   * @param configuration the configuration to set
+   */
+  public void setConfiguration(SMCCConfiguration configuration) {
+    this.configuration = configuration;
+  }
+
+  public static CardReader getReader(Card icc, CardTerminal ct) {
+
+    String name = ct.getName();
+    log.info("creating reader " + name);
+
+    Map<Byte, Integer> features = queryFeatures(icc);
+    boolean disablePinpad = false;
+    CardReader reader;
+
+        //TODO query application context for reader config
+//    if (configuration != null) {
+//      String disablePinpad = configuration.getProperty(SMCCConfiguration.DISABLE_PINPAD_P);
+//      log.debug("setting disablePinpad to " + Boolean.parseBoolean(disablePinpad));
+//      reader.setDisablePinpad(Boolean.parseBoolean(disablePinpad));
+//    }
+    log.warn("card reader configuration is not considered");
+
+    if (features.isEmpty() || disablePinpad) {
+      reader = new DefaultCardReader(ct);
+    } else {
+      reader = new PinpadCardReader(ct, features);
+    }
+
+    return reader;
+  }
+
+  private static int CTL_CODE(int code) {
+    String os_name = System.getProperty("os.name").toLowerCase();
+    if (os_name.indexOf("windows") > -1) {
+      // cf. WinIOCTL.h
+      return (0x31 << 16 | (code) << 2);
+    }
+    // cf. reader.h
+    return 0x42000000 + (code);
+  }
+
+  static int IOCTL_GET_FEATURE_REQUEST = CTL_CODE(3400);
+
+  private static Map<Byte, Integer> queryFeatures(Card icc) {
+    Map<Byte, Integer> features = new HashMap<Byte, Integer>();
+
+    if (icc == null) {
+      log.warn("invalid card handle, cannot query ifd features");
+    } else {
+      try {
+        if (log.isTraceEnabled()) {
+          log.trace("GET_FEATURE_REQUEST " + Integer.toHexString(IOCTL_GET_FEATURE_REQUEST));
+        }
+        byte[] resp = icc.transmitControlCommand(IOCTL_GET_FEATURE_REQUEST,
+                new byte[0]);
+
+        if (log.isTraceEnabled()) {
+          log.trace("Response TLV " + SMCCHelper.toString(resp));
+        }
+        // tag
+        // length in bytes (always 4)
+        // control code value for supported feature (in big endian)
+        for (int i = 0; i < resp.length; i += 6) {
+          Byte feature = new Byte(resp[i]);
+          Integer ioctl = new Integer((0xff & resp[i + 2]) << 24) |
+                  ((0xff & resp[i + 3]) << 16) |
+                  ((0xff & resp[i + 4]) << 8) |
+                  (0xff & resp[i + 5]);
+          if (log.isInfoEnabled()) {
+            log.info("IFD supports " + CardReader.FEATURES[feature.intValue()] +
+                    ": " + Integer.toHexString(ioctl.intValue()));
+          }
+          features.put(feature, ioctl);
+        }
+      } catch (CardException ex) {
+        log.debug("Failed to query IFD features: " + ex.getMessage());
+        log.trace(ex);
+        log.info("IFD does not support secure pin entry");
+      }
+    }
+    return features;
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java b/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java
index 137de509..affb06ff 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/AbstractAppl.java
@@ -51,6 +51,7 @@ public abstract class AbstractAppl implements CardAppl {
     return files;
   }
 
+  @Override
   public abstract void setPin(int kid, char[] value);
   
 }
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java
index 6017bcce..3dfc8510 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardEmul.java
@@ -28,15 +28,15 @@ import javax.smartcardio.CardException;
 @SuppressWarnings("restriction")
 public abstract class CardEmul extends Card {
 
-  protected Thread exclThread = null;
-  protected CardChannel channel = newCardChannel(this);
+  protected Thread exclThread; // = null;
+  protected CardChannel channel; // = newCardChannel(this);
   protected List<AbstractAppl> applications = new ArrayList<AbstractAppl>();
 
   public CardEmul() {
     super();
   }
 
-  protected abstract CardChannelEmul newCardChannel(CardEmul cardEmul);
+//  protected abstract CardChannelEmul newCardChannel(CardEmul cardEmul);
 
   @Override
   public void beginExclusive() throws CardException {
@@ -71,9 +71,9 @@ public abstract class CardEmul extends Card {
 
   @Override
   public void disconnect(boolean reset) throws CardException {
-    if (reset) {
-      channel = newCardChannel(this);
-    }
+//    if (reset) {
+//      channel = newCardChannel(this);
+//    }
   }
 
   @Override
@@ -93,7 +93,7 @@ public abstract class CardEmul extends Card {
       }
 
   public AbstractAppl getApplication(byte[] fid) {
-    
+
     for(AbstractAppl appl : applications) {
       if (Arrays.equals(appl.getAID(), fid) || Arrays.equals(appl.getFID(), fid)) {
         return appl;
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
index b3bd07ab..44e48836 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/CardTest.java
@@ -16,12 +16,14 @@
 */
 package at.gv.egiz.smcc;
 
+import at.gv.egiz.smcc.pin.gui.CancelPINProvider;
+import at.gv.egiz.smcc.pin.gui.InterruptPINProvider;
+import at.gv.egiz.smcc.pin.gui.CancelChangePINProvider;
 import static org.junit.Assert.*;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
-import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 import java.util.List;
@@ -32,119 +34,15 @@ import org.junit.Test;
 
 import at.gv.egiz.smcc.SignatureCard.KeyboxName;
 import at.gv.egiz.smcc.acos.A04ApplDEC;
+import at.gv.egiz.smcc.pin.gui.DummyPINGUI;
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
+import at.gv.egiz.smcc.pin.gui.SMCCTestPINProvider;
+import org.junit.Ignore;
 
 @SuppressWarnings("restriction")
 public abstract class CardTest {
 
-  public class TestPINProvider implements PINProvider {
-    
-    int provided = 0;
-  
-    char[] pin;
-  
-    public TestPINProvider(char[] pin) {
-      super();
-      this.pin = pin;
-    }
-  
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-        throws CancelledException, InterruptedException {
-      provided++;
-      return pin;
-    }
-
-    public int getProvided() {
-      return provided;
-    }
-  
-  }
-
-  public class TestChangePINProvider extends TestPINProvider implements
-      ChangePINProvider {
-  
-    char[] oldPin;
-  
-    public TestChangePINProvider(char[] oldPin, char[] pin) {
-      super(pin);
-      this.oldPin = oldPin;
-    }
-  
-    @Override
-    public char[] provideOldPIN(PINSpec spec, int retries)
-        throws CancelledException, InterruptedException {
-      return oldPin;
-    }
-  
-  }
-
-  public class TestInvalidPINProvider implements PINProvider {
-
-    int provided = 0;
-    int numWrongTries = 0;
-
-    char[] pin;
-
-    public TestInvalidPINProvider(char[] pin, int numWrongTries) {
-      super();
-      this.pin = pin;
-      this.numWrongTries = numWrongTries;
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-        throws CancelledException, InterruptedException {
-      if (provided >= numWrongTries) {
-        throw new CancelledException("Number of wrong tries reached: " + provided);
-      } else {
-        provided++;
-        return pin;
-      }
-    }
-
-    public int getProvided() {
-      return provided;
-    }
-  }
-
-  public class TestInvalidChangePINProvider implements ChangePINProvider {
-
-    int provided = 0;
-    int numWrongTries = 0;
-
-    char[] pin;
-    char[] oldPin;
-
-    /** emulate ChangePinProvider */
-    public TestInvalidChangePINProvider(char[] oldPin, char[] newPin, int numWrongTries) {
-      super();
-      this.pin = newPin;
-      this.oldPin = oldPin;
-      this.numWrongTries = numWrongTries;
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-        throws CancelledException, InterruptedException {
-      return pin;
-    }
-
-    public int getProvided() {
-      return provided;
-    }
-
-    @Override
-    public char[] provideOldPIN(PINSpec spec, int retries)
-        throws CancelledException, InterruptedException {
-      if (provided >= numWrongTries) {
-        throw new CancelledException("Number of wrong tries reached: " + provided);
-      } else {
-        provided++;
-        return oldPin;
-      }
-    }
-  }
-
   public CardTest() {
     super();
   }
@@ -167,7 +65,7 @@ public abstract class CardTest {
     
     SignatureCard signatureCard = createSignatureCard();
     
-    TestPINProvider pinProvider = new TestPINProvider(pin);
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider(pin);
 
     byte[] idlink = signatureCard.getInfobox("IdentityLink",
         pinProvider, null);
@@ -184,13 +82,7 @@ public abstract class CardTest {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
-          @Override
-          public char[] providePIN(PINSpec spec, int retries)
-              throws CancelledException, InterruptedException {
-            throw new CancelledException();
-          }
-        };
+        PINGUI pinProvider = new CancelPINProvider();
       
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR, pinProvider,
@@ -205,13 +97,7 @@ public abstract class CardTest {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
-          @Override
-          public char[] providePIN(PINSpec spec, int retries)
-              throws CancelledException, InterruptedException {
-            throw new CancelledException();
-          }
-        };
+        PINGUI pinProvider = new CancelPINProvider();
       
         signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
             .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
@@ -226,13 +112,7 @@ public abstract class CardTest {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
-          @Override
-          public char[] providePIN(PINSpec spec, int retries)
-              throws CancelledException, InterruptedException {
-            throw new InterruptedException();
-          }
-        };
+        PINGUI pinProvider = new InterruptPINProvider();
       
         signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
             .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
@@ -247,13 +127,7 @@ public abstract class CardTest {
       
         SignatureCard signatureCard = createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
-          @Override
-          public char[] providePIN(PINSpec spec, int retries)
-              throws CancelledException, InterruptedException {
-            throw new InterruptedException();
-          }
-        };
+        PINGUI pinProvider = new InterruptPINProvider();
       
         signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
             .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
@@ -268,11 +142,11 @@ public abstract class CardTest {
       
         final SignatureCard signatureCard = createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
+        PINGUI pinProvider = new DummyPINGUI() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
               throws CancelledException, InterruptedException {
-      
+
             try {
               signatureCard.getCertificate(KeyboxName.SECURE_SIGNATURE_KEYPAIR);
               assertTrue(false);
@@ -281,10 +155,10 @@ public abstract class CardTest {
               // expected
               throw new CancelledException();
             }
-      
+
           }
         };
-      
+
         signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
             .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
             pinProvider, null);
@@ -298,7 +172,7 @@ public abstract class CardTest {
       
         final SignatureCard signatureCard = createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
+        PINGUI pinProvider = new DummyPINGUI() {
           @Override
           public char[] providePIN(PINSpec spec, int retries)
               throws CancelledException, InterruptedException {
@@ -311,7 +185,6 @@ public abstract class CardTest {
               // expected
               throw new CancelledException();
             }
-      
           }
         };
       
@@ -339,13 +212,7 @@ public abstract class CardTest {
       
         PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
       
-        PINProvider pinProvider = new PINProvider() {
-          @Override
-          public char[] providePIN(PINSpec spec, int retries)
-              throws CancelledException, InterruptedException {
-            throw new CancelledException();
-          }
-        };
+        ModifyPINGUI pinProvider = new CancelChangePINProvider();
       
         List<PINSpec> specs = signatureCard.getPINSpecs();
       
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/PIN.java b/smcc/src/test/java/at/gv/egiz/smcc/PIN.java
index ae883727..2cda0c2f 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/PIN.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/PIN.java
@@ -23,19 +23,23 @@ public class PIN {
   public static final int STATE_PIN_VERIFIED = 1;
   
   public static final int STATE_PIN_BLOCKED = -1;
+
+  public static final int STATE_PIN_NOTACTIVE = 2;
   
   public byte[] pin;
   
   public int kid;
   
-  public int state = STATE_RESET;
+  public int state; // = STATE_RESET;
   
-  public int kfpc = 10;
+  public int kfpc; // = 10;
 
-  public PIN(byte[] pin, int kid, int kfpc) {
+  //TODO also provde default constructor without state param
+  public PIN(byte[] pin, int kid, int kfpc, int state) {
     this.pin = pin;
     this.kid = kid;
     this.kfpc = kfpc;
+    this.state = state;
   }
 
 }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java
index 9fd96d73..f4ac5c35 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03ApplDEC.java
@@ -40,7 +40,7 @@ public class A03ApplDEC extends ACOSApplDEC {
     putFile(new File(FID_EF_INFOBOX, EF_INFOBOX, FCI_EF_INFOBOX, KID_PIN_INF));
 
     try {
-      pins.put(KID_PIN_INF, new PIN("0000\0\0\0\0".getBytes("ASCII"), KID_PIN_INF, 10));
+      pins.put(KID_PIN_INF, new PIN("0000\0\0\0\0".getBytes("ASCII"), KID_PIN_INF, 10, PIN.STATE_RESET));
     } catch (UnsupportedEncodingException e) {
       throw new RuntimeException(e);
     }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java
index 58216b6b..7394bae7 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardEmul.java
@@ -24,13 +24,8 @@ import at.gv.egiz.smcc.CardEmul;
 public class A03CardEmul extends ACOSCardEmul {
 
   public A03CardEmul(A03ApplSIG applSIG, A03ApplDEC applDEC) {
+    channel = new A03CardChannelEmul(this);
     applications.add(applSIG);
     applications.add(applDEC);
   }
-
-  @Override
-  protected CardChannelEmul newCardChannel(CardEmul cardEmul) {
-    return new A03CardChannelEmul(this);
-  }
-
 }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java
index 776c0370..3a8ac41c 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A03CardTest.java
@@ -22,15 +22,16 @@ import java.util.Arrays;
 
 import org.junit.Test;
 
-import at.gv.egiz.smcc.ACOSCard;
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.CardEmul;
 import at.gv.egiz.smcc.CardNotSupportedException;
 import at.gv.egiz.smcc.CardTerminalEmul;
+import at.gv.egiz.smcc.pin.gui.ChangePINProvider;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
 import at.gv.egiz.smcc.PINFormatException;
 import at.gv.egiz.smcc.PINMgmtSignatureCard;
+import at.gv.egiz.smcc.pin.gui.SMCCTestPINProvider;
 import at.gv.egiz.smcc.PINSpec;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
@@ -74,12 +75,12 @@ public class A03CardTest extends ACOSCardTest {
       char[] pin = defaultPin;
 
       for (int i = pinSpec.getMinLength(); i <= pinSpec.getMaxLength(); i++) {
-        signatureCard.verifyPIN(pinSpec, new TestPINProvider(pin));
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
         char[] newPin = new char[i];
         Arrays.fill(newPin, '0');
         signatureCard
-            .changePIN(pinSpec, new TestChangePINProvider(pin, newPin));
-        signatureCard.verifyPIN(pinSpec, new TestPINProvider(newPin));
+            .changePIN(pinSpec, new ChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(newPin));
         pin = newPin;
       }
 
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java
index 70925aa6..dd44d05b 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardEmul.java
@@ -24,14 +24,9 @@ import at.gv.egiz.smcc.CardEmul;
 public class A04CardEmul extends ACOSCardEmul {
 
   public A04CardEmul(A04ApplSIG applSIG, A04ApplDEC applDEC) {
+    channel = new A04CardChannelEmul(this);
     applications.add(applSIG);
     applications.add(applDEC);
   }
-
-  @Override
-  protected CardChannelEmul newCardChannel(CardEmul cardEmul) {
-    return new A04CardChannelEmul(this);
-  }
-
   
 }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java
index d15e80d7..1cbea1b3 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/A04CardTest.java
@@ -28,7 +28,6 @@ import java.util.Arrays;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
-import at.gv.egiz.smcc.ACOSCard;
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.CardEmul;
 import at.gv.egiz.smcc.CardNotSupportedException;
@@ -41,7 +40,8 @@ import at.gv.egiz.smcc.PINSpec;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.SignatureCardFactory;
-import at.gv.egiz.smcc.CardTest.TestPINProvider;
+import at.gv.egiz.smcc.pin.gui.ChangePINProvider;
+import at.gv.egiz.smcc.pin.gui.SMCCTestPINProvider;
 
 public class A04CardTest extends ACOSCardTest {
 
@@ -88,8 +88,8 @@ public class A04CardTest extends ACOSCardTest {
         char[] newPin = new char[i];
         Arrays.fill(newPin, '0');
         signatureCard
-            .changePIN(pinSpec, new TestChangePINProvider(pin, newPin));
-        signatureCard.verifyPIN(pinSpec, new TestPINProvider(newPin));
+            .changePIN(pinSpec, new ChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(newPin));
         pin = newPin;
       }
 
@@ -111,7 +111,7 @@ public class A04CardTest extends ACOSCardTest {
     SignatureCard signatureCard = factory.createSignatureCard(card,
         new CardTerminalEmul(card));
 
-    TestPINProvider pinProvider = new TestPINProvider(pin);
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider(pin);
 
     byte[] idlink = signatureCard.getInfobox("IdentityLink",
         pinProvider, null);
@@ -129,7 +129,7 @@ public class A04CardTest extends ACOSCardTest {
     
     SignatureCard signatureCard = createSignatureCard();
     
-    TestPINProvider pinProvider = new TestPINProvider(pin);
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider(pin);
 
     byte[] idlink = signatureCard.getInfobox("IdentityLink",
         pinProvider, null);
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java
index 08979536..09a754f3 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplDEC.java
@@ -297,7 +297,7 @@ public abstract class ACOSApplDEC extends ACOSAppl {
     System.arraycopy(C_CH_EKEY, 0, EF_C_CH_EKEY, 0, C_CH_EKEY.length);
     putFile(new File(FID_EF_C_CH_EKEY, EF_C_CH_EKEY, FCI_EF_C_CH_EKEY));
     try {
-      pins.put(KID_PIN_DEC, new PIN("1234\0\0\0\0".getBytes("ASCII"), KID_PIN_DEC, 10));
+      pins.put(KID_PIN_DEC, new PIN("1234\0\0\0\0".getBytes("ASCII"), KID_PIN_DEC, 10, PIN.STATE_RESET));
     } catch (UnsupportedEncodingException e) {
       throw new RuntimeException(e);
     }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java
index e476b434..6ab5903a 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSApplSIG.java
@@ -221,7 +221,7 @@ public abstract class ACOSApplSIG extends ACOSAppl {
     
     // PINs
     try {
-      pins.put(KID_PIN_SIG, new PIN(Arrays.copyOf("123456".getBytes("ASCII"), 8), KID_PIN_SIG, 3));
+      pins.put(KID_PIN_SIG, new PIN(Arrays.copyOf("123456".getBytes("ASCII"), 8), KID_PIN_SIG, 3, PIN.STATE_RESET));
     } catch (UnsupportedEncodingException e) {
       throw new RuntimeException(e);
     }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
index 56d1e4b2..4f012739 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/acos/ACOSCardTest.java
@@ -16,26 +16,23 @@
 */
 package at.gv.egiz.smcc.acos;
 
-import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 
 import org.junit.Test;
 
-import at.gv.egiz.smcc.ACOSCard;
 import at.gv.egiz.smcc.CardEmul;
 import at.gv.egiz.smcc.CardNotSupportedException;
 import at.gv.egiz.smcc.CardTest;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.pin.gui.SMCCTestPINProvider;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.SignatureCard.KeyboxName;
@@ -60,7 +57,7 @@ public abstract class ACOSCardTest extends CardTest {
     appl.clearInfobox();
 
     byte[] idlink = signatureCard.getInfobox("IdentityLink",
-        new TestPINProvider(pin), null);
+        new SMCCTestPINProvider(pin), null);
     assertNull(idlink);
 
   }
@@ -76,7 +73,7 @@ public abstract class ACOSCardTest extends CardTest {
     ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
     appl.setInfoboxHeader((byte) 0xFF);
 
-    signatureCard.getInfobox("IdentityLink", new TestPINProvider(pin), null);
+    signatureCard.getInfobox("IdentityLink", new SMCCTestPINProvider(pin), null);
 
   }
 
@@ -138,7 +135,7 @@ public abstract class ACOSCardTest extends CardTest {
 
     byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")),
-        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin), null);
+        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new SMCCTestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -158,7 +155,7 @@ public abstract class ACOSCardTest extends CardTest {
 
     byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")),
-        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin), null);
+        KeyboxName.CERITIFIED_KEYPAIR, new SMCCTestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -171,7 +168,7 @@ public abstract class ACOSCardTest extends CardTest {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("000000".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
@@ -186,7 +183,7 @@ public abstract class ACOSCardTest extends CardTest {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("0000".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
@@ -204,7 +201,7 @@ public abstract class ACOSCardTest extends CardTest {
     ACOSApplSIG appl = (ACOSApplSIG) card.getApplication(ACOSAppl.AID_SIG);
     appl.setPin(ACOSApplSIG.KID_PIN_SIG, null);
 
-    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("000000".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
@@ -222,7 +219,7 @@ public abstract class ACOSCardTest extends CardTest {
     ACOSApplDEC appl = (ACOSApplDEC) card.getApplication(ACOSAppl.AID_DEC);
     appl.setPin(ACOSApplDEC.KID_PIN_DEC, null);
 
-    TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("0000".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelChangePINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelChangePINProvider.java
new file mode 100644
index 00000000..dffe7e29
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelChangePINProvider.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public class CancelChangePINProvider extends DummyChangePINGUI implements ModifyPINGUI {
+
+  public CancelChangePINProvider() {
+  }
+
+  @Override
+  public char[] provideCurrentPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    throw new CancelledException("cancelled by cancelPINProvider");
+  }
+
+  @Override
+  public char[] provideNewPIN(PINSpec spec)
+          throws CancelledException, InterruptedException {
+    throw new CancelledException("cancelled by cancelPINProvider");
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelPINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelPINProvider.java
new file mode 100644
index 00000000..77f19345
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/CancelPINProvider.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public class CancelPINProvider extends DummyPINGUI implements PINGUI {
+
+  @Override
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    throw new CancelledException("cancelled by cancelPINProvider");
+  }
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/ChangePINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/ChangePINProvider.java
new file mode 100644
index 00000000..5eb8b9a1
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/ChangePINProvider.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public class ChangePINProvider extends DummyChangePINGUI implements ModifyPINGUI {
+
+  int provided = 0;
+  char[] pin;
+  char[] oldPin;
+
+  public ChangePINProvider(char[] oldPin, char[] pin) {
+    this.pin = pin;
+    this.oldPin = oldPin;
+  }
+
+  public int getProvided() {
+    return provided;
+  }
+
+  @Override
+  public char[] provideCurrentPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    provided++;
+    return oldPin;
+  }
+
+  @Override
+  public char[] provideNewPIN(PINSpec spec) {
+    return pin;
+  }
+
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyChangePINGUI.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyChangePINGUI.java
new file mode 100644
index 00000000..fff89409
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyChangePINGUI.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public abstract class DummyChangePINGUI implements ModifyPINGUI {
+
+  @Override
+  public void validKeyPressed() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void correctionButtonPressed() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void allKeysCleared() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void finish() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void finishDirect() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void modifyPINDirect(PINSpec spec, int retries) throws CancelledException, InterruptedException {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void enterCurrentPIN(PINSpec spec, int retries) {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void enterNewPIN(PINSpec spec) {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void confirmNewPIN(PINSpec spec) {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyPINGUI.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyPINGUI.java
new file mode 100644
index 00000000..4d99b5c1
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/DummyPINGUI.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public abstract class DummyPINGUI implements PINGUI {
+
+   @Override
+  public void enterPINDirect(PINSpec spec, int retries) throws CancelledException, InterruptedException {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void enterPIN(PINSpec spec, int retries) throws CancelledException, InterruptedException {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void validKeyPressed() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void correctionButtonPressed() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
+  @Override
+  public void allKeysCleared() {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InterruptPINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InterruptPINProvider.java
new file mode 100644
index 00000000..5706b888
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InterruptPINProvider.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+@SuppressWarnings("restriction")
+public class InterruptPINProvider extends DummyPINGUI implements PINGUI {
+
+  public InterruptPINProvider() {
+  }
+
+  @Override
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    throw new InterruptedException("interrupted by cancelPINProvider");
+  }
+
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidChangePINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidChangePINProvider.java
new file mode 100644
index 00000000..69c9f42a
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidChangePINProvider.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public class InvalidChangePINProvider extends DummyChangePINGUI implements ModifyPINGUI {
+
+  int provided = 0;
+  int numWrongTries = 0;
+  char[] pin;
+  char[] oldPin;
+
+  /** emulate ChangePinProvider */
+  public InvalidChangePINProvider(char[] oldPin, char[] newPin, int numWrongTries) {
+    super();
+    this.pin = newPin;
+    this.oldPin = oldPin;
+    this.numWrongTries = numWrongTries;
+  }
+
+  @Override
+  public char[] provideCurrentPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    if (provided >= numWrongTries) {
+      throw new CancelledException("Number of wrong tries reached: " + provided);
+    } else {
+      provided++;
+      return oldPin;
+    }
+  }
+
+  public int getProvided() {
+    return provided;
+  }
+
+  @Override
+  public char[] provideNewPIN(PINSpec spec) {
+    return pin;
+  }
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidPINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidPINProvider.java
new file mode 100644
index 00000000..db01fd0d
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/InvalidPINProvider.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public class InvalidPINProvider extends DummyPINGUI implements PINGUI {
+
+  int provided = 0;
+  int numWrongTries = 0;
+  char[] pin;
+
+  public InvalidPINProvider(char[] pin, int numWrongTries) {
+    super();
+    this.pin = pin;
+    this.numWrongTries = numWrongTries;
+  }
+
+  @Override
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    if (provided >= numWrongTries) {
+      throw new CancelledException("Number of wrong tries reached: " + provided);
+    } else {
+      provided++;
+      return pin;
+    }
+  }
+
+  public int getProvided() {
+    return provided;
+  }
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/SMCCTestPINProvider.java b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/SMCCTestPINProvider.java
new file mode 100644
index 00000000..dffc90d7
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/pin/gui/SMCCTestPINProvider.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.pin.gui;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+
+public class SMCCTestPINProvider extends DummyPINGUI implements PINGUI {
+
+  public int provided = 0;
+  char[] pin;
+
+  public SMCCTestPINProvider(char[] pin) {
+    this.pin = pin;
+  }
+
+  @Override
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    provided++;
+    return pin;
+  }
+
+  public int getProvided() {
+    return provided;
+  }
+
+ 
+}
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java
index 2ca63eea..62528e6e 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSAppl.java
@@ -69,27 +69,4 @@ public abstract class STARCOSAppl extends AbstractAppl implements CardAppl {
       pin.next().state = PIN.STATE_RESET;
     }
   }
-  
-  public void setPin(int kid, char[] value) {
-    PIN pin = pins.get(kid);
-    if (pin != null) {
-      if (value == null) {
-        pin.pin = null;
-      } else {
-        byte[] b = new byte[8];
-        b[0] = (byte) (0x20 | value.length);
-        for(int i = 1, j = 0; i < b.length; i++) {
-          int h = ((j < value.length) 
-                  ? Character.digit(value[j++], 10) 
-                  : 0x0F);
-          int l = ((j < value.length) 
-                  ? Character.digit(value[j++], 10) 
-                  : 0x0F);
-          b[i] = (byte) ((h << 4) | l);
-        }
-        pin.pin = b;
-      }
-    }
-  }
-
 }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java
index cec305da..8741dd2d 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplGewoehnlicheSignatur.java
@@ -16,7 +16,6 @@
 */
 package at.gv.egiz.smcc.starcos;
 
-import java.io.UnsupportedEncodingException;
 import java.util.Arrays;
 import java.util.Random;
 
@@ -200,12 +199,18 @@ public class STARCOSApplGewoehnlicheSignatur extends STARCOSAppl {
   
 
   protected byte[] EF_C_X509_CH_AUT = new byte[2000];
-  
-  public STARCOSApplGewoehnlicheSignatur(STARCOSCardChannelEmul channel) {
+
+  protected byte[] dst;
+
+  public static final byte[] DST = new byte[] { (byte) 0x84, (byte) 0x03, (byte) 0x80, (byte) 0x02, (byte) 0x00, (byte) 0x89, (byte) 0x03, (byte) 0x13, (byte) 0x35, (byte) 0x10};
+  public static final byte[] DST_G3 = new byte[] { (byte) 0x84, (byte) 0x03, (byte) 0x80, (byte) 0x02, (byte) 0x00, (byte) 0x80, (byte) 0x01, (byte) 0x04 };
+
+  public STARCOSApplGewoehnlicheSignatur(STARCOSCardChannelEmul channel, byte[] dst) {
     super(channel);
     // Files
     System.arraycopy(C_X509_CH_AUT, 0, EF_C_X509_CH_AUT, 0, C_X509_CH_AUT.length);
     putFile(new File(FID_EF_C_X509_CH_AUT, EF_C_X509_CH_AUT, FCI_EF_C_X509_CH_AUT));
+    this.dst = dst;
   }
 
   @Override
@@ -240,12 +245,19 @@ public class STARCOSApplGewoehnlicheSignatur extends STARCOSAppl {
       case 0x81:
         // EXTERNAL AUTHENTICATE
       }
+    case 0xAA:
+      switch (command.getP1()) {
+      case 0x41: 
+        if (Arrays.equals(new byte[] {(byte) 0x80, (byte) 0x01, (byte) 0x10}, command.getData())) {
+          return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
+        }
+      default:
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x80});
+      }
     case 0xB6:
       switch (command.getP1()) {
       case 0x41: {
         // PSO - COMPUTE DIGITAL SIGNATURE
-        byte[] dst = new byte[] { (byte) 0x84, (byte) 0x03, (byte) 0x80,
-            (byte) 0x02, (byte) 0x00, (byte) 0x89, (byte) 0x03, (byte) 0x13, (byte) 0x35, (byte) 0x10};
         if (Arrays.equals(dst, command.getData())) {
           securityEnv = command.getData();
           return new ResponseAPDU(new byte[] {(byte) 0x90, (byte) 0x00});
@@ -328,5 +340,10 @@ public class STARCOSApplGewoehnlicheSignatur extends STARCOSAppl {
     
   }
 
+  @Override
+  public void setPin(int kid, char[] value) {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
   
 }
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java
index b7835a43..c470351a 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplInfobox.java
@@ -156,5 +156,10 @@ public class STARCOSApplInfobox extends STARCOSAppl {
     throw new CardException("Not supported.");
   }
 
+  @Override
+  public void setPin(int kid, char[] value) {
+    throw new UnsupportedOperationException("Not supported yet.");
+  }
+
   
 }
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java
index 9fb5ad37..4036ca41 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSApplSichereSignatur.java
@@ -213,16 +213,14 @@ public class STARCOSApplSichereSignatur extends STARCOSAppl {
 
   protected byte[] EF_C_X509_CH_DS = new byte[2000];
   
-  public STARCOSApplSichereSignatur(STARCOSCardChannelEmul channel) {
+  public STARCOSApplSichereSignatur(STARCOSCardChannelEmul channel, byte[] SS_pin, int pinState) {
     super(channel);
     // Files
     System.arraycopy(C_X509_CH_DS, 0, EF_C_X509_CH_DS, 0, C_X509_CH_DS.length);
     putFile(new File(FID_EF_C_X509_CH_DS, EF_C_X509_CH_DS, FCI_EF_C_X509_CH_DS));
     
     // PINs
-    pins.put(KID_PIN_SS, new PIN(new byte[] { (byte) 0x24, (byte) 0x12,
-        (byte) 0x34, (byte) 0x56, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF,
-        (byte) 0xFF }, KID_PIN_SS, 3));
+    pins.put(KID_PIN_SS, new PIN(SS_pin, KID_PIN_SS, 3, pinState));
   }
 
   @Override
@@ -344,4 +342,34 @@ public class STARCOSApplSichereSignatur extends STARCOSAppl {
   
   }
 
+  /**
+   * set and activate pin
+   * @param value if null, pin will be set to NOTACTIVE
+   */
+  @Override
+  public void setPin(int kid, char[] value) {
+    PIN pin = pins.get(kid);
+    if (pin != null) {
+      if (value == null) {
+//        pin.pin = null;
+        //TransportPIN
+//        pin.pin = new byte[] { (byte) 0x26, (byte) 0x12, (byte) 0x34, (byte) 0x56, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+        pin.state = PIN.STATE_PIN_NOTACTIVE;
+      } else {
+        byte[] b = new byte[8];
+        b[0] = (byte) (0x20 | value.length);
+        for(int i = 1, j = 0; i < b.length; i++) {
+          int h = ((j < value.length)
+                  ? Character.digit(value[j++], 10)
+                  : 0x0F);
+          int l = ((j < value.length)
+                  ? Character.digit(value[j++], 10)
+                  : 0x0F);
+          b[i] = (byte) ((h << 4) | l);
+        }
+        pin.pin = b;
+        pin.state = PIN.STATE_RESET;
+      }
+    }
+  }
 }
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java
index 89030894..2e0c54eb 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardChannelEmul.java
@@ -16,7 +16,6 @@
 */
 package at.gv.egiz.smcc.starcos;
 
-import java.io.UnsupportedEncodingException;
 import java.util.Arrays;
 import java.util.HashMap;
 
@@ -30,6 +29,8 @@ import at.gv.egiz.smcc.CardChannelEmul;
 import at.gv.egiz.smcc.CardEmul;
 import at.gv.egiz.smcc.File;
 import at.gv.egiz.smcc.PIN;
+import java.util.ArrayList;
+import java.util.List;
 
 @SuppressWarnings("restriction")
 public class STARCOSCardChannelEmul extends CardChannelEmul {
@@ -40,14 +41,13 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
    * 
    */
   protected CardEmul cardEmul;
-  
+
+  public final List<File> globalFiles = new ArrayList<File>();
   public final HashMap<Integer, PIN> globalPins = new HashMap<Integer, PIN>();
 
-  public STARCOSCardChannelEmul(CardEmul cardEmul) {
+  public STARCOSCardChannelEmul(CardEmul cardEmul, byte[] Glob_PIN, int PIN_STATE) {
     this.cardEmul = cardEmul;
-    globalPins.put(KID_PIN_Glob, new PIN(new byte[] { (byte) 0x24, (byte) 0x00,
-        (byte) 0x00, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF,
-        (byte) 0xFF }, KID_PIN_Glob, 10));
+    globalPins.put(KID_PIN_Glob, new PIN(Glob_PIN, KID_PIN_Glob, 10, PIN_STATE));
  }
 
   @Override
@@ -88,6 +88,21 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
           }
         }
         return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x82});
+      } else if (globalFiles != null) {
+        if (command.getP2() != 0x04) {
+          throw new CardException("Not supported.");
+        }
+        for (File file : globalFiles) {
+          if (Arrays.equals(fid, file.fid)) {
+            currentFile = file;
+            byte[] response = new byte[file.fcx.length + 2];
+            System.arraycopy(file.fcx, 0, response, 0, file.fcx.length);
+            response[file.fcx.length] = (byte) 0x90;
+            response[file.fcx.length + 1] = (byte) 0x00;
+            return new ResponseAPDU(response);
+          }
+        }
+        return new ResponseAPDU(new byte[] {(byte) 0x6A, (byte) 0x82});
       } else {
         throw new CardException("Not supported.");
       }
@@ -121,6 +136,23 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
     
   }
   
+  protected ResponseAPDU cmdREAD_RECORD(CommandAPDU command) throws CardException {
+    if (command.getINS() != 0xB2) {
+      throw new IllegalArgumentException("INS has to be 0xB2");
+    }
+    if (currentFile == null) {
+      return new ResponseAPDU(new byte[]{ (byte) 0x69, (byte) 0x86 });
+    }
+    if (command.getP1() != 0x01 || command.getP2() != 0x04) {
+      throw new CardException("Not implemented.");
+    }
+    byte[] response = new byte[currentFile.file.length + 2];
+    System.arraycopy(currentFile.file, 0, response, 0, currentFile.file.length);
+    response[currentFile.file.length] = (byte) 0x90;
+    response[currentFile.file.length + 1] = (byte) 0x00;
+    return new ResponseAPDU(response);
+  }
+
   protected ResponseAPDU cmdREAD_BINARY(CommandAPDU command) throws CardException {
 
     if (command.getINS() != 0xB0) {
@@ -192,6 +224,10 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
       case 0xB0:
         return cmdREAD_BINARY(command);
       
+      // READ RECORD
+      case 0xB2:
+        return cmdREAD_RECORD(command);
+
       // VERIFY
       case 0x20:
         return cmdVERIFY(command);
@@ -248,9 +284,15 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
     }
     
     if (pin != null) {
-  
-      if (reference.length == 0) {
-        return new ResponseAPDU(new byte[] { (byte) 0x63, (byte) (pin.kfpc | 0xC0)});
+
+      if (reference == null || reference.length == 0) {
+        if (pin.state == PIN.STATE_PIN_NOTACTIVE) {
+          return new ResponseAPDU(new byte[] { (byte) 0x69, (byte) 0x84 });
+        } else if (pin.state == PIN.STATE_PIN_BLOCKED) {
+          return new ResponseAPDU(new byte[] { (byte) 0x63, (byte) 0xc0 });
+        } else {
+          return new ResponseAPDU(new byte[] { (byte) 0x63, (byte) (pin.kfpc | 0xC0)});
+        }
       }
       
       if (reference.length != 8) {
@@ -264,7 +306,7 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
   
         case PIN.STATE_RESET:
           pin.state = PIN.STATE_PIN_VERIFIED;
-          
+
         default:
           pin.kfpc = 10;
           return new ResponseAPDU(new byte[] { (byte) 0x90, (byte) 0x00 });
@@ -321,7 +363,20 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
         return new ResponseAPDU(new byte[] {(byte) 0x67, (byte) 0x00});
       }
       
-      response = verifyPin(0xFF & command.getP2(), data);
+      PIN pin;
+      if (currentAppl != null) {
+        pin = currentAppl.pins.get(command.getP2());
+      } else {
+        pin = globalPins.get(command.getP2());
+      }
+      if (pin.state == PIN.STATE_PIN_NOTACTIVE) {
+        pin.pin = data;
+        pin.state = PIN.STATE_RESET;
+        response = new ResponseAPDU(new byte[] { (byte) 0x90, (byte) 0x00 });
+      } else {
+        // P1 == 0x01 not allowed on active pin (?)
+        response = new ResponseAPDU(new byte[] { (byte) 0x6A, (byte) 0x86});
+      }
 
     } else if (command.getP1() == 0x00) {
       
@@ -330,21 +385,22 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
       }
   
       response = verifyPin(0xFF & command.getP2(), Arrays.copyOf(data, 8));
-    
+
+      if (response.getSW() == 0x9000) {
+        PIN pin;
+        if (currentAppl != null) {
+          pin = currentAppl.pins.get(command.getP2());
+        } else {
+          pin = globalPins.get(command.getP2());
+        }
+        pin.pin = Arrays.copyOfRange(data, 8, 16);
+        pin.state = PIN.STATE_PIN_VERIFIED;
+      }
+
     } else {
       return new ResponseAPDU(new byte[] { (byte) 0x6A, (byte) 0x81 });
     }
      
-    if (response.getSW() == 0x9000) {
-      PIN pin;
-      if (currentAppl != null) {
-        pin = currentAppl.pins.get(command.getP2());
-      } else {
-        pin = globalPins.get(command.getP2());
-      }
-      pin.pin = Arrays.copyOfRange(data, 8, 16);
-    }
-
     return response;
     
   }
@@ -353,7 +409,10 @@ public class STARCOSCardChannelEmul extends CardChannelEmul {
     PIN pin = globalPins.get(kid);
     if (pin != null) {
       if (value == null) {
-        pin.pin = null;
+//        pin.pin = null;
+        //TransportPIN
+//        pin.pin = new byte[] { (byte) 0x24, (byte) 0x12, (byte) 0x34, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+        pin.state = PIN.STATE_PIN_NOTACTIVE;
       } else {
         byte[] b = new byte[8];
         b[0] = (byte) (0x20 | value.length);
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java
index 7b2f3fbe..5963fb63 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardEmul.java
@@ -21,30 +21,34 @@ import javax.smartcardio.ATR;
 
 import at.gv.egiz.smcc.CardChannelEmul;
 import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.PIN;
 
 @SuppressWarnings("restriction")
 public class STARCOSCardEmul extends CardEmul {
-  
+
+  public static byte[] DEFAULT_SS_PIN = new byte[] { (byte) 0x26, (byte) 0x12, (byte) 0x34, (byte) 0x56, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+  public static byte[] DEFAULT_Glob_PIN = new byte[] { (byte) 0x24, (byte) 0x00, (byte) 0x00, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+
   protected static ATR ATR = new ATR(new byte[] {
       (byte) 0x3b, (byte) 0xbd, (byte) 0x18, (byte) 0x00, (byte) 0x81, (byte) 0x31, (byte) 0xfe, (byte) 0x45, 
       (byte) 0x80, (byte) 0x51, (byte) 0x02, (byte) 0x67, (byte) 0x05, (byte) 0x18, (byte) 0xb1, (byte) 0x02, 
       (byte) 0x02, (byte) 0x02, (byte) 0x01, (byte) 0x81, (byte) 0x05, (byte) 0x31
   });
-  
+
   public STARCOSCardEmul() {
-    applications.add(new STARCOSApplSichereSignatur((STARCOSCardChannelEmul) channel));
+    this(DEFAULT_SS_PIN, DEFAULT_Glob_PIN, PIN.STATE_RESET);
+  }
+
+  public STARCOSCardEmul(byte[] SS_PIN, byte[] Glob_PIN, int PIN_STATE) {
+    channel = new STARCOSCardChannelEmul(this, Glob_PIN, PIN_STATE);
+    applications.add(new STARCOSApplSichereSignatur((STARCOSCardChannelEmul) channel, SS_PIN, PIN_STATE));
     applications.add(new STARCOSApplInfobox((STARCOSCardChannelEmul) channel));
-    applications.add(new STARCOSApplGewoehnlicheSignatur((STARCOSCardChannelEmul) channel));
+    applications.add(new STARCOSApplGewoehnlicheSignatur((STARCOSCardChannelEmul) channel,
+            STARCOSApplGewoehnlicheSignatur.DST));
   }
 
   @Override
   public ATR getATR() {
     return ATR;
   }
-
-  @Override
-  protected CardChannelEmul newCardChannel(CardEmul cardEmul) {
-    return new STARCOSCardChannelEmul(this);
-  }
-
 }
\ No newline at end of file
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
index b7dc9a0c..154884d4 100644
--- a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSCardTest.java
@@ -22,12 +22,9 @@ import static org.junit.Assert.assertTrue;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 
-import javax.smartcardio.CardChannel;
 
 import org.junit.Test;
 
@@ -36,25 +33,20 @@ import at.gv.egiz.smcc.CardEmul;
 import at.gv.egiz.smcc.CardNotSupportedException;
 import at.gv.egiz.smcc.CardTerminalEmul;
 import at.gv.egiz.smcc.CardTest;
+import at.gv.egiz.smcc.pin.gui.ChangePINProvider;
+import at.gv.egiz.smcc.pin.gui.InvalidChangePINProvider;
+import at.gv.egiz.smcc.pin.gui.InvalidPINProvider;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.PIN;
 import at.gv.egiz.smcc.PINFormatException;
 import at.gv.egiz.smcc.PINMgmtSignatureCard;
 import at.gv.egiz.smcc.PINSpec;
-import at.gv.egiz.smcc.STARCOSCard;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.smcc.SignatureCardFactory;
-import at.gv.egiz.smcc.CardTest.TestChangePINProvider;
-import at.gv.egiz.smcc.CardTest.TestPINProvider;
-import at.gv.egiz.smcc.PINProvider;
+import at.gv.egiz.smcc.pin.gui.SMCCTestPINProvider;
 import at.gv.egiz.smcc.SignatureCard.KeyboxName;
-import at.gv.egiz.smcc.acos.A03ApplDEC;
-import at.gv.egiz.smcc.acos.A04ApplDEC;
-import at.gv.egiz.smcc.acos.A04ApplSIG;
-import at.gv.egiz.smcc.acos.ACOSAppl;
-import at.gv.egiz.smcc.acos.ACOSApplDEC;
-import at.gv.egiz.smcc.acos.ACOSApplSIG;
 import org.junit.Ignore;
 
 public class STARCOSCardTest extends CardTest {
@@ -69,7 +61,17 @@ public class STARCOSCardTest extends CardTest {
     assertTrue(signatureCard instanceof PINMgmtSignatureCard);
     return signatureCard;
   }
-  
+
+  protected SignatureCard createSignatureCard(byte[] SS_PIN, byte[] Glob_PIN, int pinState)
+      throws CardNotSupportedException {
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    STARCOSCardEmul card = new STARCOSCardEmul(SS_PIN, Glob_PIN, pinState);
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+    assertTrue(signatureCard instanceof PINMgmtSignatureCard);
+    return signatureCard;
+  }
+
   @Test
   public void testGetInfoboxIdentityLinkEmpty() throws SignatureCardException,
       InterruptedException, CardNotSupportedException {
@@ -82,7 +84,7 @@ public class STARCOSCardTest extends CardTest {
     appl.clearInfobox();
 
     byte[] idlink = signatureCard.getInfobox("IdentityLink",
-        new TestPINProvider(pin), null);
+        new SMCCTestPINProvider(pin), null);
     assertNull(idlink);
 
   }
@@ -98,10 +100,10 @@ public class STARCOSCardTest extends CardTest {
     STARCOSApplInfobox appl = (STARCOSApplInfobox) card.getApplication(STARCOSAppl.AID_Infobox);
     appl.setInfoboxHeader((byte) 0xFF);
 
-    signatureCard.getInfobox("IdentityLink", new TestPINProvider(pin), null);
+    signatureCard.getInfobox("IdentityLink", new SMCCTestPINProvider(pin), null);
 
   }
- 
+
   @Test
   public void testGetCerts() throws SignatureCardException,
       InterruptedException, CardNotSupportedException {
@@ -145,7 +147,7 @@ public class STARCOSCardTest extends CardTest {
     signatureCard.getCertificate(KeyboxName.CERITIFIED_KEYPAIR);
 
   }
-  
+
   @Test
   public void testSignSichereSignatur() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
@@ -160,7 +162,7 @@ public class STARCOSCardTest extends CardTest {
 
     byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")),
-        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new TestPINProvider(pin), null);
+        KeyboxName.SECURE_SIGNATURE_KEYPAIR, new SMCCTestPINProvider(pin), null);
 
     assertNotNull(signature);
 
@@ -180,12 +182,12 @@ public class STARCOSCardTest extends CardTest {
 
     byte[] signature = signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")),
-        KeyboxName.CERITIFIED_KEYPAIR, new TestPINProvider(pin), null);
+        KeyboxName.CERITIFIED_KEYPAIR, new SMCCTestPINProvider(pin), null);
 
     assertNotNull(signature);
 
   }
-  
+
   @Test(expected = LockedException.class)
   public void testSignSichereSignaturInvalidPin() throws SignatureCardException,
       InterruptedException, CardNotSupportedException,
@@ -193,7 +195,7 @@ public class STARCOSCardTest extends CardTest {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("000000".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.SECURE_SIGNATURE_KEYPAIR,
@@ -208,7 +210,7 @@ public class STARCOSCardTest extends CardTest {
 
     SignatureCard signatureCard = createSignatureCard();
 
-    TestPINProvider pinProvider = new TestPINProvider("1234".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("1234".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
@@ -221,12 +223,9 @@ public class STARCOSCardTest extends CardTest {
       InterruptedException, CardNotSupportedException,
       NoSuchAlgorithmException, IOException {
 
-    SignatureCard signatureCard = createSignatureCard();
-    CardEmul card = (CardEmul) signatureCard.getCard();
-    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
-    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, null);
+    SignatureCard signatureCard = createSignatureCard(null, null, PIN.STATE_PIN_BLOCKED);
 
-    TestPINProvider pinProvider = new TestPINProvider("000000".toCharArray());
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("000000".toCharArray());
     assertTrue(pinProvider.getProvided() <= 0);
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
@@ -240,68 +239,79 @@ public class STARCOSCardTest extends CardTest {
       InterruptedException, CardNotSupportedException,
       NoSuchAlgorithmException, IOException {
 
-    SignatureCard signatureCard = createSignatureCard();
-    CardEmul card = (CardEmul) signatureCard.getCard();
-    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
-    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, null);
-
-    TestPINProvider pinProvider = new TestPINProvider("0000".toCharArray());
+    SignatureCard signatureCard = createSignatureCard(null, null, PIN.STATE_PIN_BLOCKED);
+    
+    SMCCTestPINProvider pinProvider = new SMCCTestPINProvider("0000".toCharArray());
 
     signatureCard.createSignature(new ByteArrayInputStream("MOCCA"
         .getBytes("ASCII")), KeyboxName.CERITIFIED_KEYPAIR,
         pinProvider, null);
 
   }
-  
+
   @Test
   public void testChangePin() throws CardNotSupportedException,
       LockedException, NotActivatedException, CancelledException,
       PINFormatException, SignatureCardException, InterruptedException {
 
-    char[] defaultPin = "123456".toCharArray();
-
-    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
-    CardEmul card = (CardEmul) signatureCard.getCard();
-    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
-    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, defaultPin);
-    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
-    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, defaultPin);
+    // set all initial pins to DEFAULT_SS_PIN (123456)
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard(
+            STARCOSCardEmul.DEFAULT_SS_PIN, STARCOSCardEmul.DEFAULT_SS_PIN, PIN.STATE_RESET);
     
     for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
 
-      char[] pin = defaultPin;
+      char[] pin = "123456".toCharArray();
 
       for (int i = pinSpec.getMinLength(); i <= pinSpec.getMaxLength(); i++) {
-        signatureCard.verifyPIN(pinSpec, new TestPINProvider(pin));
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
         char[] newPin = new char[i];
         Arrays.fill(newPin, '0');
         signatureCard
-            .changePIN(pinSpec, new TestChangePINProvider(pin, newPin));
-        signatureCard.verifyPIN(pinSpec, new TestPINProvider(newPin));
+            .changePIN(pinSpec, new ChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(newPin));
         pin = newPin;
       }
     }
   }
 
   @Test
-  public void testVerifyInvalidPin() throws CardNotSupportedException,
+  @Override
+  public void testActivatePin() throws CardNotSupportedException,
       LockedException, NotActivatedException, CancelledException,
       PINFormatException, SignatureCardException, InterruptedException {
 
-    char[] defaultPin = "123456".toCharArray();
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard(
+            null, null, PIN.STATE_PIN_NOTACTIVE);
+
+    for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
+
+      char[] pin = "1234567890".substring(0, pinSpec.getMinLength()).toCharArray();
+
+      boolean notActive = false;
+      try {
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
+      } catch (NotActivatedException ex) {
+        notActive = true;
+      }
+      assertTrue(notActive);
+
+      signatureCard.activatePIN(pinSpec, new ChangePINProvider(null, pin));
+      signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
+    }
+  }
+
+  @Test
+  public void testVerifyInvalidPin() throws CardNotSupportedException,
+      LockedException, NotActivatedException, CancelledException,
+      PINFormatException, SignatureCardException, InterruptedException {
 
     PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
-    CardEmul card = (CardEmul) signatureCard.getCard();
-    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
-    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, defaultPin);
-    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
-    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, defaultPin);
 
     for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
 
       char[] invalidPin = "999999".toCharArray();
       int numInvalidTries = 2;
-      TestInvalidPINProvider invalidPinProvider = new TestInvalidPINProvider(invalidPin, numInvalidTries);
+      InvalidPINProvider invalidPinProvider = new InvalidPINProvider(invalidPin, numInvalidTries);
       try {
         signatureCard.verifyPIN(pinSpec, invalidPinProvider);
       } catch (CancelledException ex) {
@@ -315,21 +325,15 @@ public class STARCOSCardTest extends CardTest {
   public void testChangeInvalidPin() throws CardNotSupportedException,
       LockedException, NotActivatedException, CancelledException,
       PINFormatException, SignatureCardException, InterruptedException {
-    char[] defaultPin = "123456".toCharArray();
 
     PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard();
-    CardEmul card = (CardEmul) signatureCard.getCard();
-    STARCOSCardChannelEmul channel = (STARCOSCardChannelEmul) card.getBasicChannel();
-    channel.setPin(STARCOSCardChannelEmul.KID_PIN_Glob, defaultPin);
-    STARCOSApplSichereSignatur appl = (STARCOSApplSichereSignatur) card.getApplication(STARCOSApplSichereSignatur.AID_SichereSignatur);
-    appl.setPin(STARCOSApplSichereSignatur.KID_PIN_SS, defaultPin);
-
+    
     for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
 
       char[] invalidPin = "999999".toCharArray();
       int numInvalidTries = 2;
-      TestInvalidChangePINProvider invalidPinProvider =
-              new TestInvalidChangePINProvider(invalidPin, defaultPin, numInvalidTries);
+      InvalidChangePINProvider invalidPinProvider =
+              new InvalidChangePINProvider(invalidPin, invalidPin, numInvalidTries);
 
       try {
         signatureCard.changePIN(pinSpec, invalidPinProvider);
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardChannelEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardChannelEmul.java
new file mode 100644
index 00000000..dc6836ae
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardChannelEmul.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.starcos;
+
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.File;
+import at.gv.egiz.smcc.PIN;
+
+/**
+ *
+ * @author clemens
+ */
+public class STARCOSG3CardChannelEmul extends STARCOSCardChannelEmul {
+
+  public STARCOSG3CardChannelEmul(CardEmul cardEmul, byte[] Glob_PIN, int PIN_STATE) {
+    super(cardEmul, Glob_PIN, PIN_STATE);
+
+    // G3 version file
+    byte[] versionFileFID = new byte[]{(byte) 0x00, (byte) 0x32};
+    byte[] versionFile = new byte[]{
+      (byte) 0xa5, (byte) 0x0e, (byte) 0x53, (byte) 0x02, (byte) 0x01, (byte) 0x20, (byte) 0x54, (byte) 0x08,
+      (byte) 0x01, (byte) 0x01, (byte) 0x03, (byte) 0x01, (byte) 0x04, (byte) 0x01, (byte) 0x70, (byte) 0x01};
+    byte[] versionFileFCX = new byte[]{
+      (byte) 0x62, (byte) 0x1a, (byte) 0x80, (byte) 0x02, (byte) 0x00, (byte) 0x14, (byte) 0x82, (byte) 0x05,
+      (byte) 0x44, (byte) 0x41, (byte) 0x00, (byte) 0x14, (byte) 0x01, (byte) 0x83, (byte) 0x02, (byte) 0x00,
+      (byte) 0x32, (byte) 0x88, (byte) 0x01, (byte) 0xd8, (byte) 0x8a, (byte) 0x01, (byte) 0x05, (byte) 0xa1,
+      (byte) 0x03, (byte) 0x8b, (byte) 0x01, (byte) 0x03};
+
+    globalFiles.add(new File(versionFileFID, versionFile, versionFileFCX));
+
+  }
+ }
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardEmul.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardEmul.java
new file mode 100644
index 00000000..7583b3ad
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardEmul.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.smcc.starcos;
+
+import at.gv.egiz.smcc.CardEmul;
+import javax.smartcardio.ATR;
+
+import at.gv.egiz.smcc.PIN;
+
+@SuppressWarnings("restriction")
+public class STARCOSG3CardEmul extends CardEmul {
+
+  public static byte[] TRANSPORT_SS_PIN = new byte[] { (byte) 0x26, (byte) 0x12, (byte) 0x34, (byte) 0x56, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+  public static byte[] TRANSPORT_Glob_PIN = new byte[] { (byte) 0x24, (byte) 0x12, (byte) 0x34, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+
+  public static byte[] DEFAULT_SS_PIN = TRANSPORT_SS_PIN;
+  public static byte[] DEFAULT_Glob_PIN = new byte[] { (byte) 0x24, (byte) 0x00, (byte) 0x00, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff};
+
+  protected static ATR ATR = new ATR(new byte[] {
+      (byte) 0x3b, (byte) 0xbd, (byte) 0x18, (byte) 0x00, (byte) 0x81, (byte) 0x31, (byte) 0xfe, (byte) 0x45,
+      (byte) 0x80, (byte) 0x51, (byte) 0x02, (byte) 0x67, (byte) 0x05, (byte) 0x18, (byte) 0xb1, (byte) 0x02,
+      (byte) 0x02, (byte) 0x02, (byte) 0x01, (byte) 0x81, (byte) 0x05, (byte) 0x31
+  });
+
+  public STARCOSG3CardEmul(byte[] SS_PIN, byte[] Glob_PIN, int PIN_STATE){
+    channel = new STARCOSG3CardChannelEmul(this, Glob_PIN, PIN_STATE);
+    applications.add(new STARCOSApplSichereSignatur((STARCOSCardChannelEmul) channel,
+            SS_PIN, PIN_STATE));
+    applications.add(new STARCOSApplInfobox((STARCOSCardChannelEmul) channel));
+    applications.add(new STARCOSApplGewoehnlicheSignatur((STARCOSCardChannelEmul) channel,
+            STARCOSApplGewoehnlicheSignatur.DST_G3));
+  }
+
+
+  public STARCOSG3CardEmul() {
+    this(DEFAULT_SS_PIN, DEFAULT_Glob_PIN, PIN.STATE_RESET);
+  }
+
+  @Override
+  public ATR getATR() {
+    return ATR;
+  }
+}
diff --git a/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardTest.java b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardTest.java
new file mode 100644
index 00000000..06744c82
--- /dev/null
+++ b/smcc/src/test/java/at/gv/egiz/smcc/starcos/STARCOSG3CardTest.java
@@ -0,0 +1,119 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.smcc.starcos;
+
+import static org.junit.Assert.assertTrue;
+
+import java.util.Arrays;
+
+
+import org.junit.Test;
+
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.CardEmul;
+import at.gv.egiz.smcc.CardNotSupportedException;
+import at.gv.egiz.smcc.CardTerminalEmul;
+import at.gv.egiz.smcc.CardTest;
+import at.gv.egiz.smcc.pin.gui.ChangePINProvider;
+import at.gv.egiz.smcc.LockedException;
+import at.gv.egiz.smcc.NotActivatedException;
+import at.gv.egiz.smcc.PIN;
+import at.gv.egiz.smcc.PINFormatException;
+import at.gv.egiz.smcc.PINMgmtSignatureCard;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.SignatureCard;
+import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.SignatureCardFactory;
+import at.gv.egiz.smcc.pin.gui.SMCCTestPINProvider;
+import org.junit.Ignore;
+
+public class STARCOSG3CardTest extends CardTest {
+
+  @Override
+  protected SignatureCard createSignatureCard()
+      throws CardNotSupportedException {
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    STARCOSG3CardEmul card = new STARCOSG3CardEmul();
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+    assertTrue(signatureCard instanceof PINMgmtSignatureCard);
+    return signatureCard;
+  }
+
+  protected SignatureCard createSignatureCard(byte[] SS_PIN, byte[] Glob_PIN, int pinState)
+      throws CardNotSupportedException {
+    SignatureCardFactory factory = SignatureCardFactory.getInstance();
+    STARCOSG3CardEmul card = new STARCOSG3CardEmul(SS_PIN, Glob_PIN, pinState);
+    SignatureCard signatureCard = factory.createSignatureCard(card,
+        new CardTerminalEmul(card));
+    assertTrue(signatureCard instanceof PINMgmtSignatureCard);
+    return signatureCard;
+  }
+
+  @Test
+  public void testChangePin() throws CardNotSupportedException,
+      LockedException, NotActivatedException, CancelledException,
+      PINFormatException, SignatureCardException, InterruptedException {
+
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard(
+            STARCOSG3CardEmul.DEFAULT_SS_PIN, STARCOSG3CardEmul.DEFAULT_SS_PIN, PIN.STATE_RESET);
+    
+    for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
+
+      char[] pin = "123456".toCharArray();
+
+      for (int i = pinSpec.getMinLength(); i <= pinSpec.getMaxLength(); i++) {
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
+        char[] newPin = new char[i];
+        Arrays.fill(newPin, '0');
+        signatureCard
+            .changePIN(pinSpec, new ChangePINProvider(pin, newPin));
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(newPin));
+        pin = newPin;
+      }
+    }
+  }
+
+  @Test
+  @Override
+  public void testActivatePin() throws CardNotSupportedException,
+      LockedException, NotActivatedException, CancelledException,
+      PINFormatException, SignatureCardException, InterruptedException {
+
+    PINMgmtSignatureCard signatureCard = (PINMgmtSignatureCard) createSignatureCard(
+            STARCOSG3CardEmul.TRANSPORT_SS_PIN, STARCOSG3CardEmul.TRANSPORT_SS_PIN, PIN.STATE_PIN_NOTACTIVE);
+    
+    for (PINSpec pinSpec : signatureCard.getPINSpecs()) {
+
+      char[] pin = "123456789".substring(0, pinSpec.getMinLength()).toCharArray();
+      char[] transportPIN = "123456".toCharArray();
+
+      boolean notActive = false;
+      try {
+        signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
+      } catch (NotActivatedException ex) {
+        notActive = true;
+      }
+      assertTrue(notActive);
+
+      signatureCard.activatePIN(pinSpec, new ChangePINProvider(transportPIN, pin));
+      signatureCard.verifyPIN(pinSpec, new SMCCTestPINProvider(pin));
+    }
+  }
+
+  
+}
diff --git a/smccSTAL/src/main/java/META-INF/MANIFEST.MF b/smccSTAL/src/main/java/META-INF/MANIFEST.MF
deleted file mode 100644
index 5e949512..00000000
--- a/smccSTAL/src/main/java/META-INF/MANIFEST.MF
+++ /dev/null
@@ -1,3 +0,0 @@
-Manifest-Version: 1.0
-Class-Path: 
-
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/AbstractPINProvider.java b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/AbstractPINProvider.java
new file mode 100644
index 00000000..00738188
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/AbstractPINProvider.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.smcc.pin.gui.PINProvider;
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * common super class providing action listener for all PIN GUIs
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public abstract class AbstractPINProvider implements ActionListener {
+
+  protected static final Log log = LogFactory.getLog(AbstractPINProvider.class);
+
+  protected String action;
+  protected boolean actionPerformed;
+
+  protected synchronized void waitForAction() throws InterruptedException {
+    try {
+      while (!actionPerformed) {
+        this.wait();
+      }
+    } catch (InterruptedException e) {
+      log.error("[" + Thread.currentThread().getName() + "] interrupt in waitForAction");
+      throw e;
+    }
+    actionPerformed = false;
+  }
+
+  private synchronized void actionPerformed() {
+    actionPerformed = true;
+    notify();//All();
+  }
+
+  @Override
+  public void actionPerformed(ActionEvent e) {
+    log.debug("[" + Thread.currentThread().getName() + "] action performed - " + e.getActionCommand());
+    action = e.getActionCommand();
+    actionPerformed();
+  }
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINGUI.java b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINGUI.java
new file mode 100644
index 00000000..81db0e90
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINGUI.java
@@ -0,0 +1,136 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.smccstal.SecureViewer;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.security.DigestException;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * The number of retries is not fixed and there is no way (?) to obtain this value.
+ * A PINProvider should therefore maintain an internal retry counter or flag
+ * to decide whether or not to warn the user (num retries passed in providePIN).
+ *
+ * Therefore PINProvider objects should not be reused.
+ *
+ * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class SignPINGUI extends SignPINProvider implements PINGUI {
+
+  protected static final Log log = LogFactory.getLog(SignPINGUI.class);
+
+  private boolean retry = false;
+
+  public SignPINGUI(BKUGUIFacade gui, SecureViewer viewer, SignedInfoType signedInfo) {
+    super(gui, viewer, signedInfo);
+  }
+
+  @Override
+  public void enterPINDirect(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    if (retry) {
+      gui.showEnterPINDirect(spec, retries);
+    } else {
+      showSignatureData(spec);
+      gui.showEnterPINDirect(spec, -1);
+      retry = true;
+    }
+  }
+
+  @Override
+  public void enterPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+    if (retry) {
+      gui.showEnterPIN(spec, retries);
+    } else {
+      showSignatureData(spec);
+      gui.showEnterPIN(spec, -1);
+      retry = true;
+    }
+  }
+
+  private void showSignatureData(PINSpec spec)
+          throws CancelledException, InterruptedException {
+
+    gui.showSignatureDataDialog(spec,
+            this, "enterPIN",
+            this, "cancel",
+            this, "secureViewer");
+
+    do {
+      log.trace("[" + Thread.currentThread().getName() + "] wait for action");
+      waitForAction();
+      log.trace("[" + Thread.currentThread().getName() + "] received action " + action);
+
+      if ("secureViewer".equals(action)) {
+        try {
+          viewer.displayDataToBeSigned(signedInfo, this, "signatureData");
+        } catch (DigestException ex) {
+          log.error("Bad digest value: " + ex.getMessage());
+          gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
+                  new Object[]{ex.getMessage()},
+                  this, "error");
+        } catch (Exception ex) {
+          log.error("Could not display hashdata inputs: " +
+                  ex.getMessage());
+          gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
+                  new Object[]{ex.getMessage()},
+                  this, "error");
+        }
+      } else if ("signatureData".equals(action)) {
+        gui.showSignatureDataDialog(spec,
+                this, "enterPIN",
+                this, "cancel",
+                this, "secureViewer");
+      } else if ("enterPIN".equals(action)) {
+        return;
+      } else if ("cancel".equals(action) ||
+              "error".equals(action)) {
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
+        throw new CancelledException(spec.getLocalizedName() +
+                " entry cancelled");
+      } else {
+        log.error("unknown action command " + action);
+      }
+    } while (true);
+  }
+
+  @Override
+  public void validKeyPressed() {
+    gui.validKeyPressed();
+  }
+
+  @Override
+  public void correctionButtonPressed() {
+    gui.correctionButtonPressed();
+  }
+
+  @Override
+  public void allKeysCleared() {
+    gui.allKeysCleared();
+  }
+
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINProvider.java b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINProvider.java
new file mode 100644
index 00000000..fc1d39af
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/SignPINProvider.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.smccstal.SecureViewer;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.pin.gui.PINProvider;
+import at.gv.egiz.stal.signedinfo.SignedInfoType;
+import java.security.DigestException;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * The number of retries is not fixed and there is no way (?) to obtain this value.
+ * A PINProvider should therefore maintain an internal retry counter or flag
+ * to decide whether or not to warn the user (num retries passed in providePIN).
+ *
+ * Therefore PINProvider objects should not be reused.
+ *
+ * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class SignPINProvider extends AbstractPINProvider implements PINProvider {
+
+  protected static final Log log = LogFactory.getLog(SignPINProvider.class);
+
+  protected BKUGUIFacade gui;
+  protected SecureViewer viewer;
+  protected SignedInfoType signedInfo;
+  private boolean retry = false;
+
+  public SignPINProvider(BKUGUIFacade gui, SecureViewer viewer, SignedInfoType signedInfo) {
+    this.gui = gui;
+    this.viewer = viewer;
+    this.signedInfo = signedInfo;
+  }
+
+  @Override
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+
+    gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+            this, "sign",
+            this, "cancel",
+            this, "secureViewer");
+
+    do {
+      log.trace("[" + Thread.currentThread().getName() + "] wait for action");
+      waitForAction();
+      log.trace("[" + Thread.currentThread().getName() + "] received action " + action);
+
+      if ("secureViewer".equals(action)) {
+        try {
+          viewer.displayDataToBeSigned(signedInfo, this, "pinEntry");
+        } catch (DigestException ex) {
+          log.error("Bad digest value: " + ex.getMessage());
+          gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
+                  new Object[]{ex.getMessage()},
+                  this, "error");
+        } catch (Exception ex) {
+          log.error("Could not display hashdata inputs: " +
+                  ex.getMessage());
+          gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
+                  new Object[]{ex.getMessage()},
+                  this, "error");
+        }
+      } else if ("sign".equals(action)) {
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
+        retry = true;
+        return gui.getPin();
+      } else if ("pinEntry".equals(action)) {
+        gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
+                this, "sign",
+                this, "cancel",
+                this, "secureViewer");
+      } else if ("cancel".equals(action) ||
+              "error".equals(action)) {
+        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+                BKUGUIFacade.MESSAGE_WAIT);
+        throw new CancelledException(spec.getLocalizedName() +
+                " entry cancelled");
+      } else {
+        log.error("unknown action command " + action);
+      }
+    } while (true);
+  }
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINGUI.java b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINGUI.java
new file mode 100644
index 00000000..dc21492e
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINGUI.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * The number of retries is not fixed and there is no way (?) to obtain this value.
+ * A PINProvider should therefore maintain an internal retry counter or flag
+ * to decide whether or not to warn the user (num retries passed in providePIN).
+ *
+ * Therefore PINProvider objects should not be reused.
+ *
+ * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class VerifyPINGUI extends VerifyPINProvider implements PINGUI {
+
+  protected static final Log log = LogFactory.getLog(VerifyPINGUI.class);
+
+  private boolean retry = false;
+
+  public VerifyPINGUI(BKUGUIFacade gui) {
+    super(gui);
+  }
+
+  @Override
+  public void enterPINDirect(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {    
+    gui.showEnterPINDirect(spec, (retry) ? retries : -1);
+    retry = true;
+  }
+
+  @Override
+  public void enterPIN(PINSpec spec, int retries) {
+    gui.showEnterPIN(spec, (retry) ? retries : -1);
+    retry = true;
+  }
+
+
+  @Override
+  public void validKeyPressed() {
+    gui.validKeyPressed();
+  }
+
+  @Override
+  public void correctionButtonPressed() {
+    gui.correctionButtonPressed();
+  }
+
+  @Override
+  public void allKeysCleared() {
+    gui.allKeysCleared();
+  }
+
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINProvider.java b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINProvider.java
new file mode 100644
index 00000000..fda1e402
--- /dev/null
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/pin/gui/VerifyPINProvider.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.pin.gui.PINProvider;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * The number of retries is not fixed and there is no way (?) to obtain this value.
+ * A PINProvider should therefore maintain an internal retry counter or flag
+ * to decide whether or not to warn the user (num retries passed in providePIN).
+ *
+ * Therefore PINProvider objects should not be reused.
+ *
+ * (ACOS: reload counter: between 0 and 15, where 15 meens deactivated)
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class VerifyPINProvider extends AbstractPINProvider implements PINProvider {
+
+  protected static final Log log = LogFactory.getLog(VerifyPINProvider.class);
+
+  protected BKUGUIFacade gui;
+  private boolean retry = false;
+
+  public VerifyPINProvider(BKUGUIFacade gui) {
+    this.gui = gui;
+  }
+
+  @Override
+  public char[] providePIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+
+    gui.showVerifyPINDialog(spec, (retry) ? retries : -1,
+            this, "verify",
+            this, "cancel");
+
+    log.trace("[" + Thread.currentThread().getName() + "] wait for action");
+    waitForAction();
+    log.trace("[" + Thread.currentThread().getName() + "] received action " + action);
+
+    if ("cancel".equals(action)) {
+      gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+              BKUGUIFacade.MESSAGE_WAIT);
+      throw new CancelledException(spec.getLocalizedName() +
+              " entry cancelled");
+    }
+    
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+            BKUGUIFacade.MESSAGE_WAIT);
+    retry = true;
+    return gui.getPin();
+  }
+}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
deleted file mode 100644
index bc52c955..00000000
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/AbstractPINProvider.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.bku.smccstal;
-
-import at.gv.egiz.smcc.PINProvider;
-import java.awt.event.ActionEvent;
-import java.awt.event.ActionListener;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public abstract class AbstractPINProvider implements PINProvider, ActionListener {
-
-  protected static final Log log = LogFactory.getLog(AbstractPINProvider.class);
-
-  protected boolean retry = false;
-
-  protected String action;
-
-  protected boolean actionPerformed;
-
-//  protected void waitForAction() throws InterruptedException {
-//    super.wait();
-//  }
-
-  protected synchronized void waitForAction() throws InterruptedException {
-    try {
-      while (!actionPerformed) {
-        this.wait();
-      }
-    } catch (InterruptedException e) {
-      log.error("[" + Thread.currentThread().getName() + "] interrupt in waitForAction");
-      throw e;
-    }
-    actionPerformed = false;
-  }
-
-  private synchronized void actionPerformed() {
-    actionPerformed = true;
-    notify();//All();
-  }
-
-  @Override
-  public void actionPerformed(ActionEvent e) {
-    log.debug("[" + Thread.currentThread().getName() + "] action performed - " + e.getActionCommand());
-    action = e.getActionCommand();
-    actionPerformed();
-  }
-}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
index 32e990c5..b34ab862 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/InfoBoxReadRequestHandler.java
@@ -17,14 +17,13 @@
 package at.gv.egiz.bku.smccstal;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.pin.gui.VerifyPINGUI;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
-import at.gv.egiz.smcc.PINProvider;
-import at.gv.egiz.smcc.PINSpec;
 import at.gv.egiz.smcc.SignatureCard;
 import at.gv.egiz.smcc.SignatureCardException;
 import at.gv.egiz.stal.ErrorResponse;
@@ -49,8 +48,7 @@ public class InfoBoxReadRequestHandler extends AbstractRequestHandler {
           newSTALMessage("Message.RequestCaption", "Message.IdentityLink");
           log.debug("Handling identitylink infobox");
           byte[] resp = card.getInfobox(infoBox.getInfoboxIdentifier(),
-                  new PINProviderFactory(card.getReader(), gui)
-                  .getCardPINProvider(),
+                  new VerifyPINGUI(gui),
                   infoBox.getDomainIdentifier());
           if (resp == null) {
             log.info("Infobox doesn't contain any data. Assume card is not activated.");
@@ -97,8 +95,7 @@ public class InfoBoxReadRequestHandler extends AbstractRequestHandler {
           log.warn("Unknown infobox identifier: "
               + infoBox.getInfoboxIdentifier() + " trying generic request");
           byte[] resp = card.getInfobox(infoBox.getInfoboxIdentifier(),
-                  new PINProviderFactory(card.getReader(), gui)
-                  .getCardPINProvider(),
+                  new VerifyPINGUI(gui),
                   infoBox.getDomainIdentifier());
           if (resp == null) {
             return new ErrorResponse(6001);
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
deleted file mode 100644
index e5afe0ae..00000000
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/PINProviderFactory.java
+++ /dev/null
@@ -1,327 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.bku.smccstal;
-
-import at.gv.egiz.bku.gui.BKUGUIFacade;
-import at.gv.egiz.smcc.CancelledException;
-import at.gv.egiz.smcc.ccid.CCID;
-import at.gv.egiz.smcc.PINProvider;
-import at.gv.egiz.smcc.PINSpec;
-import at.gv.egiz.stal.signedinfo.SignedInfoType;
-import java.security.DigestException;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- * don't reuse the instance if the card reader might have changed!
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class PINProviderFactory {
-
-  protected static final Log log = LogFactory.getLog(PINProviderFactory.class);
-
-  protected CCID reader;
-  protected BKUGUIFacade gui;
-
-  /**
-   * don't reuse the instance if the card reader might have changed!
-   * @param reader
-   * @param gui
-   */
-  public PINProviderFactory(CCID reader, BKUGUIFacade gui) {
-    log.trace("PINProviderFactory for " + reader.getName());
-    this.reader = reader;
-    this.gui = gui;
-  }
-
-
-  
-//  public static PINProviderFactory getInstance(SignatureCard forCard,
-//          BKUGUIFacade gui) {
-//    if (forCard.getReader().hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT) ||
-//            forCard.getReader().hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-//      return new PinpadPINProviderFactory(gui);
-//    } else {
-//      return new SoftwarePINProviderFactory(gui);
-//    }
-//  }
-
-  /**
-   * don't reuse the instance if the card reader might have changed!
-   * @param reader
-   * @param gui
-   * @return
-   */
-//  public static PINProviderFactory getInstance(CCID reader, BKUGUIFacade gui) {
-//    log.trace("PINProviderFactory for " + reader.getName());
-//    return new PINProviderFactory(reader, gui);
-//  }
-
-  public PINProvider getSignaturePINProvider(SecureViewer viewer,
-          SignedInfoType signedInfo) {
-    if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_START) ||
-            reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-      log.debug("pinpad signature-pin provider");
-      return new PinpadSignaturePinProvider(viewer, signedInfo);
-    } else {
-      log.debug("software signature-pin provider");
-      return new SoftwareSignaturePinProvider(viewer, signedInfo);
-    }
-  }
-
-  public PINProvider getCardPINProvider() {
-    if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_START) ||
-            reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-      log.debug("pinpad card-pin provider");
-      return new PinpadCardPinProvider();
-    } else {
-      log.debug("software card-pin provider");
-      return new SoftwareCardPinProvider();
-    }
-  }
-
-  class SoftwareSignaturePinProvider extends AbstractPINProvider {
-
-    protected SecureViewer viewer;
-    protected SignedInfoType signedInfo;
-
-    private SoftwareSignaturePinProvider(SecureViewer viewer,
-            SignedInfoType signedInfo) {
-      this.viewer = viewer;
-      this.signedInfo = signedInfo;
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-
-      gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
-              this, "sign",
-              this, "cancel",
-              this, "secureViewer");
-
-      do {
-        log.debug("[" + Thread.currentThread().getName() + "] wait for action");
-        waitForAction();
-        log.debug("[" + Thread.currentThread().getName() + "] received action");
-
-        if ("secureViewer".equals(action)) {
-          try {
-            viewer.displayDataToBeSigned(signedInfo, this, "pinEntry");
-          } catch (DigestException ex) {
-            log.error("Bad digest value: " + ex.getMessage());
-            gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
-                    new Object[]{ex.getMessage()},
-                    this, "error");
-          } catch (Exception ex) {
-            log.error("Could not display hashdata inputs: " +
-                    ex.getMessage());
-            gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
-                    new Object[]{ex.getMessage()},
-                    this, "error");
-          }
-        } else if ("sign".equals(action)) {
-          gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
-                BKUGUIFacade.MESSAGE_WAIT);
-          retry = true;
-          return gui.getPin();
-        } else if ("pinEntry".equals(action)) {
-          gui.showSignaturePINDialog(spec, (retry) ? retries : -1,
-                  this, "sign",
-                  this, "cancel",
-                  this, "secureViewer");
-        } else if ("cancel".equals(action) ||
-                "error".equals(action)) {
-          gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
-                BKUGUIFacade.MESSAGE_WAIT);
-          throw new CancelledException(spec.getLocalizedName() +
-                  " entry cancelled");
-        } else {
-          log.error("unknown action command " + action);
-        }
-      } while (true);
-    }
-  }
-
-  class SoftwareCardPinProvider extends AbstractPINProvider {
-
-    private SoftwareCardPinProvider() {
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-
-      gui.showCardPINDialog(spec, (retry) ? retries : -1,
-              this, "ok",
-              this, "cancel");
-
-      log.debug("[" + Thread.currentThread().getName() + "] wait for action");
-      waitForAction();
-
-      gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
-              BKUGUIFacade.MESSAGE_WAIT);
-
-      if ("cancel".equals(action)) {
-        throw new CancelledException(spec.getLocalizedName() +
-                  " entry cancelled");
-      }
-      retry = true;
-      return gui.getPin();
-    }
-  }
-
-    class PinpadSignaturePinProvider extends AbstractPINProvider {
-
-//    protected BKUGUIFacade gui;
-    protected SecureViewer viewer;
-    protected ViewerThread viewerThread;
-    protected SignedInfoType signedInfo;
-
-
-    private PinpadSignaturePinProvider(SecureViewer viewer,
-            SignedInfoType signedInfo) {
-      this.viewer = viewer;
-      this.signedInfo = signedInfo;
-    }
-
-    protected class ViewerThread extends Thread {
-
-      PINSpec pinSpec;
-      int retries;
-
-      public ViewerThread(PINSpec pinSpec, int retries) {
-        this.pinSpec = pinSpec;
-        this.retries = retries;
-      }
-
-      @Override
-      public void run() {
-
-        try {
-
-          gui.showPinpadSignaturePINDialog(pinSpec, retries,
-              PinpadSignaturePinProvider.this, "secureViewer");
-
-          while (true) {
-            log.debug("[" + Thread.currentThread().getName() + "] wait for action");
-            waitForAction();
-            log.debug("[" + Thread.currentThread().getName() + "] received action");
-
-            if ("secureViewer".equals(action)) {
-              viewer.displayDataToBeSigned(signedInfo,
-                      PinpadSignaturePinProvider.this, "pinEntry");
-            } else if ("pinEntry".equals(action)) {
-              gui.showPinpadSignaturePINDialog(pinSpec, retries,
-                      PinpadSignaturePinProvider.this, "secureViewer");
-            } else {
-              log.error("unsupported action command: " + action);
-            }
-          }
-
-        } catch (DigestException ex) {
-          log.error("Bad digest value: " + ex.getMessage());
-          gui.showErrorDialog(BKUGUIFacade.ERR_INVALID_HASH,
-                  new Object[]{ex.getMessage()});
-        } catch (InterruptedException ex) {
-          log.info("pinpad secure viewer thread interrupted");
-        } catch (Exception ex) {
-          log.error("Could not display hashdata inputs: " +
-                  ex.getMessage());
-          gui.showErrorDialog(BKUGUIFacade.ERR_DISPLAY_HASHDATA,
-                  new Object[]{ex.getMessage()});
-        }
-      }
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-
-      if (viewerThread != null) {
-        updateViewerThread(retries);
-      } else {
-        viewerThread = new ViewerThread(spec, -1);
-        viewerThread.start();
-      }
-//      if (viewerThread != null) {
-//        log.trace("interrupt old secure viewer thread");
-//        viewerThread.interrupt();
-//      }
-//      viewerThread = new ViewerThread(spec, (retry) ? retries : -1);
-//      log.trace("start new secure viewer thread");
-//      viewerThread.start();
-
-      retry = true;
-      return null;
-    }
-
-    private synchronized void updateViewerThread(int retries) {
-      log.trace("update viewer thread");
-      viewerThread.retries = retries;
-      action = "pinEntry";
-      actionPerformed = true;
-      notify();
-    }
-
-
-//    @Override
-//    protected void finalize() throws Throwable {
-//      if (viewerThread != null) {
-//        viewerThread.interrupt();
-//      }
-//      log.info("finalizing Pinpad SignaturePinProvider");
-//      super.finalize();
-//    }
-  }
-
-  class PinpadCardPinProvider extends AbstractPINProvider {
-
-    private PinpadCardPinProvider() {
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-
-      showPinpadPINDialog(retries, spec);
-      retry = true;
-      return null;
-
-    }
-
-    private void showPinpadPINDialog(int retries, PINSpec pinSpec) {
-      String title, message;
-      Object[] params;
-      if (retry) {
-        title = BKUGUIFacade.TITLE_RETRY;
-        message = BKUGUIFacade.MESSAGE_RETRIES;
-        params = new Object[]{String.valueOf(retries)};
-      } else {
-        title = BKUGUIFacade.TITLE_CARDPIN;
-        message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
-        String pinSize = String.valueOf(pinSpec.getMinLength());
-        if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
-          pinSize += "-" + pinSpec.getMaxLength();
-        }
-        params = new Object[]{pinSpec.getLocalizedName(), pinSize};
-      }
-      gui.showMessageDialog(title, message, params);
-    }
-  }
-}
diff --git a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
index 58d7b305..5b436d16 100644
--- a/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
+++ b/smccSTAL/src/main/java/at/gv/egiz/bku/smccstal/SignRequestHandler.java
@@ -17,6 +17,7 @@
 package at.gv.egiz.bku.smccstal;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.pin.gui.SignPINGUI;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -78,8 +79,7 @@ public class SignRequestHandler extends AbstractRequestHandler {
                 KeyboxName kb = SignatureCard.KeyboxName.getKeyboxName(signReq.getKeyIdentifier());
 
                 byte[] resp = card.createSignature(new ByteArrayInputStream(signReq.getSignedInfo()), kb,
-                        new PINProviderFactory(card.getReader(), gui)
-                        .getSignaturePINProvider(secureViewer, si.getValue()), signatureMethod);
+                        new SignPINGUI(gui, secureViewer, si.getValue()), signatureMethod);
                 if (resp == null) {
                     return new ErrorResponse(6001);
                 }
diff --git a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
index 16d3efa9..bf57b0a6 100644
--- a/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
+++ b/smccSTAL/src/test/java/at/gv/egiz/smcc/AbstractSMCCSTALTest.java
@@ -16,7 +16,7 @@ import org.junit.Test;
 import at.gv.egiz.bku.gui.BKUGUIFacade;
 import at.gv.egiz.bku.smccstal.AbstractSMCCSTAL;
 import at.gv.egiz.bku.smccstal.SMCCSTALRequestHandler;
-import at.gv.egiz.smcc.ccid.CCID;
+import at.gv.egiz.smcc.pin.gui.PINGUI;
 import at.gv.egiz.stal.ErrorResponse;
 import at.gv.egiz.stal.InfoboxReadRequest;
 import at.gv.egiz.stal.InfoboxReadResponse;
@@ -39,7 +39,7 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
 
     @Override
     public byte[] createSignature(InputStream input, KeyboxName keyboxName,
-        PINProvider provider, String alg) throws SignatureCardException {
+        PINGUI provider, String alg) throws SignatureCardException {
       // TODO Auto-generated method stub
       return null;
     }
@@ -58,7 +58,7 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
     }
 
     @Override
-    public byte[] getInfobox(String infobox, PINProvider provider,
+    public byte[] getInfobox(String infobox, PINGUI provider,
         String domainId) throws SignatureCardException {
       // TODO Auto-generated method stub
       return null;
@@ -87,13 +87,6 @@ public class AbstractSMCCSTALTest extends AbstractSMCCSTAL implements
       // TODO Auto-generated method stub
       
     }
-
-    @Override
-    public CCID getReader() {
-      // TODO Auto-generated method stub
-      return null;
-    }
-
    };
     return false;
   }
diff --git a/smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINGUI.java b/smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINGUI.java
new file mode 100644
index 00000000..26a24609
--- /dev/null
+++ b/smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINGUI.java
@@ -0,0 +1,88 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade.DIALOG;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.pin.gui.ModifyPINGUI;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+public class ManagementPINGUI extends ManagementPINProvider implements ModifyPINGUI {
+
+  protected static final Log log = LogFactory.getLog(ManagementPINGUI.class);
+
+  private boolean retry = false;
+
+  public ManagementPINGUI(PINManagementGUIFacade gui, DIALOG type) {
+    super(gui, type);
+  }
+
+  @Override
+  public void modifyPINDirect(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {    
+    gui.showModifyPINDirect(type, spec, (retry) ? retries : -1);
+    retry = true;
+  }
+
+  @Override
+  public void finishDirect() {
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT, BKUGUIFacade.MESSAGE_WAIT);
+  }
+
+  @Override
+  public void enterCurrentPIN(PINSpec spec, int retries) {
+    gui.showEnterCurrentPIN(type, spec, (retry) ? retries : -1);
+    retry = true;
+  }
+
+  @Override
+  public void enterNewPIN(PINSpec spec) {
+    gui.showEnterNewPIN(type, spec);
+    retry = true;
+  }
+
+  @Override
+  public void confirmNewPIN(PINSpec spec) {
+    gui.showConfirmNewPIN(type, spec);
+    retry = true;
+  }
+
+
+  @Override
+  public void validKeyPressed() {
+    gui.validKeyPressed();
+  }
+
+  @Override
+  public void correctionButtonPressed() {
+    gui.correctionButtonPressed();
+  }
+
+  @Override
+  public void allKeysCleared() {
+    gui.allKeysCleared();
+  }
+
+  @Override
+  public void finish() {
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT, BKUGUIFacade.MESSAGE_WAIT);
+  }
+}
diff --git a/smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINProvider.java b/smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINProvider.java
new file mode 100644
index 00000000..8d842d13
--- /dev/null
+++ b/smccSTALExt/src/main/java/at/gv/egiz/bku/pin/gui/ManagementPINProvider.java
@@ -0,0 +1,89 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.pin.gui;
+
+import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUIFacade;
+import at.gv.egiz.smcc.CancelledException;
+import at.gv.egiz.smcc.PINSpec;
+import at.gv.egiz.smcc.pin.gui.ModifyPINProvider;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+public class ManagementPINProvider extends AbstractPINProvider implements ModifyPINProvider {
+
+  protected static final Log log = LogFactory.getLog(ManagementPINProvider.class);
+  protected PINManagementGUIFacade gui;
+  protected PINManagementGUIFacade.DIALOG type;
+  private boolean retry = false;
+
+  public ManagementPINProvider(PINManagementGUIFacade gui, PINManagementGUIFacade.DIALOG type) {
+    this.gui = gui;
+    this.type = type;
+  }
+
+  @Override
+  public char[] provideCurrentPIN(PINSpec spec, int retries)
+          throws CancelledException, InterruptedException {
+
+    gui.showPINDialog(type, spec, (retry) ? retries : -1,
+            this, "change",
+            this, "cancel");
+
+    log.trace("[" + Thread.currentThread().getName() + "] wait for action");
+    waitForAction();
+    log.trace("[" + Thread.currentThread().getName() + "] received action " + action);
+
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+            BKUGUIFacade.MESSAGE_WAIT);
+
+    if ("cancel".equals(action)) {
+      throw new CancelledException(spec.getLocalizedName() +
+              " entry cancelled");
+    }
+    retry = true;
+    return gui.getOldPin();
+  }
+
+  @Override
+  public char[] provideNewPIN(PINSpec spec)
+          throws CancelledException, InterruptedException {
+    
+    char[] pin = gui.getPin();
+    if (pin != null) {
+      // change pin dialog also returns new pin
+      return pin;
+    }
+
+    gui.showPINDialog(type, spec, -1,
+            this, "activate",
+            this, "cancel");
+
+    log.trace("[" + Thread.currentThread().getName() + "] wait for action");
+    waitForAction();
+    log.trace("[" + Thread.currentThread().getName() + "] received action " + action);
+
+    gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
+              BKUGUIFacade.MESSAGE_WAIT);
+
+    if ("cancel".equals(action)) {
+      throw new CancelledException(spec.getLocalizedName() +
+              " entry cancelled");
+    }
+    return gui.getPin();
+  }
+}
diff --git a/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/ManagementPINProviderFactory.java b/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/ManagementPINProviderFactory.java
deleted file mode 100644
index 493733b8..00000000
--- a/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/ManagementPINProviderFactory.java
+++ /dev/null
@@ -1,246 +0,0 @@
-/*
- * Copyright 2008 Federal Chancellery Austria and
- * Graz University of Technology
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package at.gv.egiz.bku.smccstal;
-
-import at.gv.egiz.bku.gui.BKUGUIFacade;
-import at.gv.egiz.smcc.ChangePINProvider;
-import at.gv.egiz.bku.gui.PINManagementGUIFacade;
-import at.gv.egiz.bku.smccstal.AbstractPINProvider;
-import at.gv.egiz.bku.smccstal.PINProviderFactory;
-import at.gv.egiz.smcc.CancelledException;
-import at.gv.egiz.smcc.ccid.CCID;
-import at.gv.egiz.smcc.PINProvider;
-import at.gv.egiz.smcc.PINSpec;
-import at.gv.egiz.smcc.SignatureCard;
-
-/**
- *
- * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
- */
-public class ManagementPINProviderFactory extends PINProviderFactory {
-
-  public ManagementPINProviderFactory(CCID reader, PINManagementGUIFacade gui) {
-    super(reader, gui);
-  }
-  
-//  public static ManagementPINProviderFactory getInstance(SignatureCard forCard,
-//          PINManagementGUIFacade gui) {
-//    if (forCard.getReader().hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-//      return new PinpadPINProviderFactory(gui);
-//
-//    } else {
-//      return new SoftwarePINProviderFactory(gui);
-//    }
-//  }
-
-  public PINProvider getVerifyPINProvider() {
-    if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_START)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.VERIFY);
-    } else if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.VERIFY);
-    } else {
-      return new SoftwareGenericPinProvider(PINManagementGUIFacade.DIALOG.VERIFY);
-    }
-  }
-
-  public PINProvider getActivatePINProvider() {
-    if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_START)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.ACTIVATE);
-    } else if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_DIRECT)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.ACTIVATE);
-    } else {
-      return new SoftwareGenericPinProvider(PINManagementGUIFacade.DIALOG.ACTIVATE);
-    }
-  }
-
-  public ChangePINProvider getChangePINProvider() {
-    if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_START)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.CHANGE);
-    } else if (reader.hasFeature(CCID.FEATURE_MODIFY_PIN_DIRECT)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.CHANGE);
-    } else {
-      return new ChangePinProvider();
-    }
-  }
-
-  public PINProvider getUnblockPINProvider() {
-    if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_START)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.UNBLOCK);
-    } else if (reader.hasFeature(CCID.FEATURE_VERIFY_PIN_DIRECT)) {
-      return new PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG.UNBLOCK);
-    } else {
-      return new SoftwareGenericPinProvider(PINManagementGUIFacade.DIALOG.UNBLOCK);
-    }
-  }
-
-  class PinpadGenericPinProvider extends AbstractPINProvider
-          implements ChangePINProvider {
-
-    protected PINManagementGUIFacade.DIALOG type;
-
-    private PinpadGenericPinProvider(PINManagementGUIFacade.DIALOG type) {
-      this.type = type;
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-
-      showPinpadPINDialog(retries, spec);
-      retry = true;
-      return null;
-    }
-
-    /**
-     * do not call this method without calling providePIN()
-     * (no message is displayed)
-     * @param spec
-     * @param retries
-     * @return
-     */
-    @Override
-    public char[] provideOldPIN(PINSpec spec, int retries) {
-      return null;
-    }
-
-    private void showPinpadPINDialog(int retries, PINSpec pinSpec) {
-      String title, message;
-      Object[] params;
-      if (retry) {
-        if (retries == 1) {
-          message = BKUGUIFacade.MESSAGE_LAST_RETRY_PINPAD;
-        } else {
-          message = BKUGUIFacade.MESSAGE_RETRIES_PINPAD;
-        }
-        title = BKUGUIFacade.TITLE_RETRY;
-        params = new Object[]{String.valueOf(retries)};
-      } else if (type == PINManagementGUIFacade.DIALOG.VERIFY) {
-        title = PINManagementGUIFacade.TITLE_VERIFY_PIN;
-        message = BKUGUIFacade.MESSAGE_ENTERPIN_PINPAD;
-        params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
-      } else if (type == PINManagementGUIFacade.DIALOG.ACTIVATE) {
-        title = PINManagementGUIFacade.TITLE_ACTIVATE_PIN;
-        message = PINManagementGUIFacade.MESSAGE_ACTIVATEPIN_PINPAD;
-        params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
-      } else if (type == PINManagementGUIFacade.DIALOG.CHANGE) {
-        title = PINManagementGUIFacade.TITLE_CHANGE_PIN;
-        message = PINManagementGUIFacade.MESSAGE_CHANGEPIN_PINPAD;
-        params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
-      } else { //if (type == DIALOG.UNBLOCK) {
-        title = PINManagementGUIFacade.TITLE_UNBLOCK_PIN;
-        message = PINManagementGUIFacade.MESSAGE_UNBLOCKPIN_PINPAD;
-        params = new Object[]{pinSpec.getLocalizedName(), pinSpec.getLocalizedLength()};
-      }
-      gui.showMessageDialog(title, message, params);
-    }
-  }
-
-
-  class SoftwareGenericPinProvider extends AbstractPINProvider {
-
-//    protected PINManagementGUIFacade gui;
-    protected PINManagementGUIFacade.DIALOG type;
-
-    private SoftwareGenericPinProvider(PINManagementGUIFacade.DIALOG type) {
-      this.type = type;
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-
-      ((PINManagementGUIFacade) gui).showPINDialog(type, spec,
-              (retry) ? retries : -1,
-              this, "exec",
-              this, "back");
-
-      waitForAction();
-
-      if ("exec".equals(action)) {
-        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
-                BKUGUIFacade.MESSAGE_WAIT);
-        retry = true;
-        return gui.getPin();
-      } else if ("back".equals(action)) {
-        throw new CancelledException();
-      } else {
-        log.error("unsupported command " + action);
-        throw new CancelledException();
-      }
-    }
-  }
-
-  class ChangePinProvider extends AbstractPINProvider
-          implements ChangePINProvider {
-
-//    protected PINManagementGUIFacade gui;
-
-    private char[] oldPin;
-    private char[] newPin;
-
-    private ChangePinProvider() {
-    }
-
-    @Override
-    public char[] providePIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-      if (newPin == null) {
-        getPINs(spec, retries);
-      }
-      char[] pin = newPin;
-      newPin = null;
-      return pin;
-    }
-
-    @Override
-    public char[] provideOldPIN(PINSpec spec, int retries)
-            throws CancelledException, InterruptedException {
-      if (oldPin == null) {
-        getPINs(spec, retries);
-      }
-      char[] pin = oldPin;
-      oldPin = null;
-      return pin;
-    }
-
-    private void getPINs(PINSpec spec, int retries)
-            throws InterruptedException, CancelledException {
-
-      ((PINManagementGUIFacade) gui).showPINDialog(
-              PINManagementGUIFacade.DIALOG.CHANGE, spec,
-              (retry) ? retries : -1,
-              this, "exec",
-              this, "back");
-
-      waitForAction();
-
-      if ("exec".equals(action)) {
-        gui.showMessageDialog(BKUGUIFacade.TITLE_WAIT,
-                BKUGUIFacade.MESSAGE_WAIT);
-        retry = true;
-        oldPin = ((PINManagementGUIFacade) gui).getOldPin();
-        newPin = gui.getPin();
-      } else if ("back".equals(action)) {
-        throw new CancelledException();
-      } else {
-        log.error("unsupported command " + action);
-        throw new CancelledException();
-      }
-    }
-  }
-}
diff --git a/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/PINManagementRequestHandler.java b/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/PINManagementRequestHandler.java
index bfeb90b0..0d49afd0 100644
--- a/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/PINManagementRequestHandler.java
+++ b/smccSTALExt/src/main/java/at/gv/egiz/bku/smccstal/PINManagementRequestHandler.java
@@ -23,9 +23,11 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 import at.gv.egiz.bku.gui.BKUGUIFacade;
+import at.gv.egiz.bku.gui.PINManagementGUI;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade;
 import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
-import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
+import at.gv.egiz.bku.pin.gui.ManagementPINGUI;
+import at.gv.egiz.bku.pin.gui.VerifyPINGUI;
 import at.gv.egiz.smcc.CancelledException;
 import at.gv.egiz.smcc.LockedException;
 import at.gv.egiz.smcc.NotActivatedException;
@@ -96,40 +98,15 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
             throw new NullPointerException("no PIN selected for activation/change");
           }
 
-          ManagementPINProviderFactory ppfac =
-                  new ManagementPINProviderFactory(card.getReader(), gui);
-
           try {
             if ("activate_enterpin".equals(actionCommand)) {
-              log.info("activate " + selectedPIN.getLocalizedName());
-              ((PINMgmtSignatureCard) card).activatePIN(selectedPIN,
-                      ppfac.getActivatePINProvider());
-              updatePINState(selectedPIN, STATUS.ACTIV);
-              gui.showMessageDialog(PINManagementGUIFacade.TITLE_ACTIVATE_SUCCESS,
-                      PINManagementGUIFacade.MESSAGE_ACTIVATE_SUCCESS,
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      BKUGUIFacade.BUTTON_OK, this, "ok");
-              waitForAction();
+              activatePIN(selectedPIN);
             } else if ("change_enterpin".equals(actionCommand)) {
-              log.info("change " + selectedPIN.getLocalizedName());
-              ((PINMgmtSignatureCard) card).changePIN(selectedPIN, 
-                      ppfac.getChangePINProvider());
-              updatePINState(selectedPIN, STATUS.ACTIV);
-              gui.showMessageDialog(PINManagementGUIFacade.TITLE_CHANGE_SUCCESS,
-                      PINManagementGUIFacade.MESSAGE_CHANGE_SUCCESS,
-                      new Object[] {selectedPIN.getLocalizedName()},
-                      BKUGUIFacade.BUTTON_OK, this, "ok");
-              waitForAction();
-
+              changePIN(selectedPIN);
             } else if ("unblock_enterpuk".equals(actionCommand)) {
-              log.info("unblock " + selectedPIN.getLocalizedName());
-              ((PINMgmtSignatureCard) card).unblockPIN(selectedPIN,
-                      ppfac.getUnblockPINProvider());
+              unblockPIN(selectedPIN);
             } else if ("verify_enterpin".equals(actionCommand)) {
-              log.info("verify " + selectedPIN.getLocalizedName());
-              ((PINMgmtSignatureCard) card).verifyPIN(selectedPIN,
-                      ppfac.getVerifyPINProvider());
-              updatePINState(selectedPIN, STATUS.ACTIV);
+              verifyPIN(selectedPIN);
             }
           } catch (CancelledException ex) {
             log.trace("cancelled");
@@ -154,29 +131,17 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
                     new Object[] {selectedPIN.getLocalizedName()},
                     this, null);
             waitForAction();
-          } catch (PINConfirmationException ex) {
-            log.error("confirmation pin does not match new " + selectedPIN.getLocalizedName());
-            gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_CONFIRMATION,
-                    new Object[] {selectedPIN.getLocalizedName()},
-                    this, null);
-            waitForAction();
+
+            // inner loop for pinConfirmation and pinFormat ex
+//          } catch (PINConfirmationException ex) {
+//          } catch (PINFormatException ex) {
+
           } catch (PINOperationAbortedException ex) {
             log.error("pin operation aborted without further details");
             gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_OPERATION_ABORTED,
                     new Object[] {selectedPIN.getLocalizedName()},
                     this, null);
             waitForAction();
-          } catch (PINFormatException ex) {
-            log.error("wrong format of new " + selectedPIN.getLocalizedName());
-//            updatePINStatus(selectedPIN, STATUS.NOT_ACTIV);
-            String pinSize = String.valueOf(selectedPIN.getMinLength());
-            if (selectedPIN.getMinLength() != selectedPIN.getMaxLength()) {
-                pinSize += "-" + selectedPIN.getMaxLength();
-            }
-            gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_FORMAT,
-                    new Object[] {selectedPIN.getLocalizedName(), pinSize},
-                    this, null);
-            waitForAction();
           }
         } // end if
 
@@ -206,6 +171,157 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
     }
   }
 
+  private void activatePIN(PINSpec selectedPIN)
+          throws InterruptedException, SignatureCardException, GetPINStatusException {
+
+    log.info("activate " + selectedPIN.getLocalizedName());
+    ManagementPINGUI pinGUI = new ManagementPINGUI((PINManagementGUI) gui,
+            PINManagementGUIFacade.DIALOG.ACTIVATE);
+
+    boolean reentry;
+    do {
+      try {
+        reentry = false;
+        ((PINMgmtSignatureCard) card).activatePIN(selectedPIN, pinGUI);
+      } catch (PINConfirmationException ex) {
+        reentry = true;
+        log.error("confirmation pin does not match new " + selectedPIN.getLocalizedName());
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_CONFIRMATION,
+                new Object[] {selectedPIN.getLocalizedName()},
+                this, null);
+        waitForAction();
+      } catch (PINFormatException ex) {
+        reentry = true;
+        log.error("wrong format of new " + selectedPIN.getLocalizedName());
+        String pinSize = String.valueOf(selectedPIN.getMinLength());
+        if (selectedPIN.getMinLength() != selectedPIN.getMaxLength()) {
+            pinSize += "-" + selectedPIN.getMaxLength();
+        }
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_FORMAT,
+                new Object[] {selectedPIN.getLocalizedName(), pinSize},
+                this, null);
+        waitForAction();
+      }
+    } while (reentry);
+
+    updatePINState(selectedPIN, STATUS.ACTIV);
+    gui.showMessageDialog(PINManagementGUIFacade.TITLE_ACTIVATE_SUCCESS,
+            PINManagementGUIFacade.MESSAGE_ACTIVATE_SUCCESS,
+            new Object[]{selectedPIN.getLocalizedName()},
+            BKUGUIFacade.BUTTON_OK, this, "ok");
+    waitForAction();
+  }
+
+  private void verifyPIN(PINSpec selectedPIN)
+          throws InterruptedException, SignatureCardException, GetPINStatusException {
+
+    log.info("verify " + selectedPIN.getLocalizedName());
+    VerifyPINGUI pinGUI = new VerifyPINGUI(gui);
+
+    boolean reentry;
+    do {
+      try {
+        reentry = false;
+        ((PINMgmtSignatureCard) card).verifyPIN(selectedPIN, pinGUI);
+      } catch (PINFormatException ex) {
+        reentry = true;
+        log.error("wrong format of new " + selectedPIN.getLocalizedName());
+        String pinSize = String.valueOf(selectedPIN.getMinLength());
+        if (selectedPIN.getMinLength() != selectedPIN.getMaxLength()) {
+            pinSize += "-" + selectedPIN.getMaxLength();
+        }
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_FORMAT,
+                new Object[] {selectedPIN.getLocalizedName(), pinSize},
+                this, null);
+        waitForAction();
+      }
+    } while (reentry);
+
+    updatePINState(selectedPIN, STATUS.ACTIV);
+  }
+
+  private void changePIN(PINSpec selectedPIN)
+          throws SignatureCardException, GetPINStatusException, InterruptedException {
+
+    log.info("change " + selectedPIN.getLocalizedName());
+    ManagementPINGUI pinGUI = new ManagementPINGUI((PINManagementGUI) gui,
+            PINManagementGUIFacade.DIALOG.CHANGE);
+
+    boolean reentry;
+    do {
+      try {
+        reentry = false;
+        ((PINMgmtSignatureCard) card).changePIN(selectedPIN, pinGUI);
+      } catch (PINConfirmationException ex) {
+        reentry = true;
+        log.error("confirmation pin does not match new " + selectedPIN.getLocalizedName());
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_CONFIRMATION,
+                new Object[] {selectedPIN.getLocalizedName()},
+                this, null);
+        waitForAction();
+      } catch (PINFormatException ex) {
+        reentry = true;
+        log.error("wrong format of new " + selectedPIN.getLocalizedName());
+        String pinSize = String.valueOf(selectedPIN.getMinLength());
+        if (selectedPIN.getMinLength() != selectedPIN.getMaxLength()) {
+            pinSize += "-" + selectedPIN.getMaxLength();
+        }
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_FORMAT,
+                new Object[] {selectedPIN.getLocalizedName(), pinSize},
+                this, null);
+        waitForAction();
+      }
+    } while (reentry);
+
+    updatePINState(selectedPIN, STATUS.ACTIV);
+    gui.showMessageDialog(PINManagementGUIFacade.TITLE_CHANGE_SUCCESS,
+            PINManagementGUIFacade.MESSAGE_CHANGE_SUCCESS,
+            new Object[]{selectedPIN.getLocalizedName()},
+            BKUGUIFacade.BUTTON_OK, this, "ok");
+    waitForAction();
+  }
+
+  private void unblockPIN(PINSpec selectedPIN)
+          throws SignatureCardException, GetPINStatusException, InterruptedException {
+
+    log.info("unblock " + selectedPIN.getLocalizedName());
+    ManagementPINGUI pinGUI = new ManagementPINGUI((PINManagementGUI) gui,
+            PINManagementGUIFacade.DIALOG.UNBLOCK);
+
+    boolean reentry;
+    do {
+      try {
+        reentry = false;
+        ((PINMgmtSignatureCard) card).unblockPIN(selectedPIN, pinGUI);
+      } catch (PINConfirmationException ex) {
+        reentry = true;
+        log.error("confirmation pin does not match new " + selectedPIN.getLocalizedName());
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_CONFIRMATION,
+                new Object[] {selectedPIN.getLocalizedName()},
+                this, null);
+        waitForAction();
+      } catch (PINFormatException ex) {
+        reentry = true;
+        log.error("wrong format of new " + selectedPIN.getLocalizedName());
+        String pinSize = String.valueOf(selectedPIN.getMinLength());
+        if (selectedPIN.getMinLength() != selectedPIN.getMaxLength()) {
+            pinSize += "-" + selectedPIN.getMaxLength();
+        }
+        gui.showErrorDialog(PINManagementGUIFacade.ERR_PIN_FORMAT,
+                new Object[] {selectedPIN.getLocalizedName(), pinSize},
+                this, null);
+        waitForAction();
+      }
+    } while (reentry);
+
+    updatePINState(selectedPIN, STATUS.ACTIV);
+    gui.showMessageDialog(PINManagementGUIFacade.TITLE_UNBLOCK_SUCCESS,
+            PINManagementGUIFacade.MESSAGE_UNBLOCK_SUCCESS,
+            new Object[]{selectedPIN.getLocalizedName()},
+            BKUGUIFacade.BUTTON_OK, this, "ok");
+    waitForAction();
+  }
+
   @Override
   public boolean requireCard() {
     return true;
-- 
cgit v1.2.3