MikeFaith/aliro-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(harness): --step-up asserts Access Document round-trip (M2G.1)

Browse Source
This commit is contained in:
michael
2026-06-17 16:42:50 -07:00
parent bf65607ce5
commit 1ed32d3872
3 changed files with 333 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
harness/src/aliro_harness/reader/cli.py
View File

@@ -12,7 +12,7 @@ from pathlib import Path
import click
from aliro_harness.reader.step_up import verify_step_up_m1
from aliro_harness.reader.step_up import verify_step_up_m2
from aliro_harness.reader.transaction import TrustBundle, run_aliro_transaction
@@ -42,9 +42,10 @@ from aliro_harness.reader.transaction import TrustBundle, run_aliro_transaction
@click.option(
"--step-up",
is_flag=True,
help="After AUTH1, also exercise Step-Up Milestone 1: SELECT ACCE5502, "
"INS=0xC9 EXCHANGE, INS=0xC3 ENVELOPE. Verifies the StepUpApplet decrypts "
"with StepUpSKReader and encrypts the empty-CBOR-map ack with StepUpSKDevice.",
help="After AUTH1, also exercise Step-Up Milestone 2: SELECT ACCE5502, "
"INS=0xC9 EXCHANGE, INS=0xC3 ENVELOPE (DeviceRequest) + GET RESPONSE "
"chaining. Decrypts the DeviceResponse under StepUpSKDevice and asserts "
"documents[0].issuerSigned.issuerAuth == access_document.bin from --trust-dir.",
)
def main(
trust_dir: Path | None, reader_index: int, list_readers: bool, step_up: bool
@@ -87,6 +88,12 @@ def main(
bundle = TrustBundle.from_trust_dir(trust_dir)
click.echo(f"Loaded trust artifacts from {trust_dir}")
# Lazy: only load the AD if --step-up is set — otherwise this would
# gratuitously require access_document.bin for the AUTH1-only path.
expected_ad: bytes | None = None
if step_up:
expected_ad = (trust_dir / "access_document.bin").read_bytes()
def transmit(apdu: bytes) -> tuple[bytes, int]:
data, sw1, sw2 = connection.transmit(list(apdu))
return bytes(data), (sw1 << 8) | sw2
@@ -94,7 +101,10 @@ def main(
result = run_aliro_transaction(transmit=transmit, bundle=bundle)
step_up_verdict: tuple[bool, str] | None = None
if step_up and result.ok and result.step_up_sk is not None:
step_up_verdict = verify_step_up_m1(transmit, result.step_up_sk)
assert expected_ad is not None # set above whenever step_up is true
step_up_verdict = verify_step_up_m2(
transmit, result.step_up_sk, expected_ad
)
finally:
connection.disconnect()
@@ -131,9 +141,9 @@ def main(
if step_up_verdict is not None:
ok, msg = step_up_verdict
if ok:
click.echo(f"STEP-UP M1: OK \u2014 {msg}")
click.echo(f"STEP-UP M2: OK \u2014 {msg}")
else:
click.echo(f"STEP-UP M1: FAIL \u2014 {msg}", err=True)
click.echo(f"STEP-UP M2: FAIL \u2014 {msg}", err=True)
raise click.exceptions.Exit(1)