English 
Español 
A custom Java Card is more than just a smart card that runs Java Card applets. It is also a secure execution environment in which millisecond-level response times, memory capacity, certificate verification, and encryption are all critical. In deployment scenarios such as payments, identity authentication, telecommunications, the Internet of Things (IoT), transportation, and access control, Java Card must perform operations such as authentication, signing, encryption, key derivation, and information protection within strict power consumption, timing, and storage constraints. Cryptographic hardware acceleration enables Java Card to remain responsive, secure, and reliable, resulting in faster APDU response times, lower power consumption, more stable performance, and greater resilience to implementation errors.
For Custom Java Card, the primary acceleration options include:
| Acceleration option | Typical use | Value |
|---|---|---|
| AES / symmetric engine | Encryption, secure messaging, SCP03, data protection | High throughput and low latency |
| RSA engine | Legacy PKI, signature, certificate workflows | Compatibility with established infrastructure |
| ECC engine | ECDSA, ECDH, modern authentication | Strong security with smaller keys |
| Hash / MAC engine | SHA-2, SHA-3, HMAC, CMAC | Faster protocol processing |
| TRNG / DRBG hardware | Key generation, nonce generation | Stronger entropy foundation |
| KDF acceleration | TLS, secure channel, derived session keys | Efficient protocol support |
| Proprietary vendor crypto APIs | Specialized algorithms or optimized operations | Differentiation, with portability tradeoffs |
How Custom Java Card Utilizes Cryptographic Hardware？
Java Card applications typically do not call hardware accelerators directly; instead, they use the standard Java Card cryptographic APIs. The Java Card runtime environment and card operating system then decide whether to execute the requested algorithms using dedicated hardware, optimized firmware, or a hybrid of the two.
Common Java Card cryptographic classes include APIs for signing, hashing, key agreement, generating random data, and performing cryptographic operations. For example, an applet can request AES encryption, ECDSA signing, RSA authentication, or SHA-256 hashing through standardized interfaces. If the underlying chip and operating system support hardware acceleration for these functions, the platform can route the operations to the appropriate cryptographic engine. This mechanism is highly valuable because it ensures applets are portable.
What Must Be Verified
A rigorous evaluation of a Custom Java Card should confirm the following: supported algorithms, key lengths, cipher modes, padding schemes, elliptic curves, secure channel protocols, the quality of random number generation, and the scope of certification. Furthermore, the evaluation should test actual APDU workflows rather than relying solely on theoretical performance data.
Symmetric Encryption Acceleration in Custom Java Card: AES, DES, SM4, and MAC
Symmetric cryptography is typically the most common type of hardware-accelerated cryptography in custom Java Cards. It protects secure message transmission, encrypted storage, issuer authentication, application-level data, card management, and personalization across a wide range of applications.
AES acceleration is standard for modern applications. Depending on the target use case and platform, custom Java Cards should typically support hardware acceleration for AES in common modes such as CBC, ECB, CTR, CMAC, or GCM.
Although support for Triple DES may still be required in legacy systems, it should not dominate the cryptographic roadmap for new Java Card projects. Many industries have shifted to AES-based secure message transmission and stronger algorithm policies. If interoperability with legacy systems must be maintained, support for DES-family algorithms should be viewed as a compatibility feature rather than a long-term security pillar.
Key Application Scenarios
Symmetric encryption acceleration primarily protects secure channels, encrypts applet data, authenticates transactions, secures the personalization process, and speeds up high-frequency cryptographic operations. When evaluating AES or SM4 support capabilities, be sure to verify the specific modes, padding schemes, key lengths, transaction durations, memory usage, and scope of certification. The best choice is not the card that supports the widest variety of algorithms, but rather the card that can accelerate the algorithms actually used by your application.
Public-Key Acceleration: RSA, ECC, EdDSA, and SM2
Compared to symmetric encryption, public-key cryptography places a heavier computational burden on Java Card. On resource-constrained hardware, signature generation, key agreement, certificate authentication, and private-key operations often incur significant overhead. Therefore, public-key acceleration capabilities are typically among the most significant performance differentiators among Java Card platforms.
RSA acceleration remains relevant because many enterprise, government, payment, and PKI environments still use RSA certificates and signatures, particularly for private-key signing and decryption.
For modern Java Card designs, ECC acceleration is generally preferred. Elliptic curve cryptography (ECC) offers strong security with shorter keys and signatures, as well as lower transmission overhead. This makes custom Java Cards well-suited for applications such as Internet of Things (IoT) devices, digital identity credentials, mobile secure elements (SEs), and compact access control tokens.
SM2 acceleration is essential for compliance with Chinese cryptographic standards. Like SM4, SM2 should be incorporated into the product’s initial design specifications rather than added as a subsequent feature.
Hash Functions and Key Derivation Functions (KDF)
The scope of cryptographic hardware acceleration extends far beyond the cryptographic algorithms themselves. Secure Java Card also relies on hashing, random number generation, key derivation, and secure channel operations.
Hash acceleration supports operations such as SHA-256, SHA-384, and SHA-512, as well as certificate processing, digital signatures, and protocol transcript hashing. In use cases involving frequent certificate verification, signature processing, or secure session establishment, hash acceleration can significantly improve transaction speed.
As organizations increasingly use Java Card products for advanced authentication and secure communication protocols, support for key derivation functions (KDFs) has become much more important. KDFs help systems derive session keys, diversify master keys, and generate protocol-specific keys for secure operations. Efficient KDF support enables customized Java Cards to better meet the needs of Internet of Things (IoT) device onboarding, secure device identification, and modern credential management.
Key Considerations for Customized Java Cards
A robust, customized Java Card platform should integrate hardware-accelerated hashing, efficient KDF support, and modern AES-based secure channel capabilities. These features strengthen the overall security workflow, rather than merely supporting isolated cryptographic calls.
Selecting the Right Acceleration Solution for Custom Java Card
Cryptographic hardware acceleration options for custom Java Cards include: AES and other symmetric encryption engines; support for RSA, ECC, EdDSA, and SM2; hash engines; MAC; and KDF support. The optimal combination depends on the product’s specific use case. Payment cards, national ID cards, telecom cards, Internet of Things (IoT) security elements, and access control cards each have different encryption priorities. A well-designed custom Java Card leverages acceleration technology to enhance security, speed, reliability, compliance, and commercial lifecycle.