MikeFaith/aliro-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(applet): CoseVerifier RFC 9052 verify (M2A.2)

Browse Source 
Adds CoseVerifier.verifyCoseSign1 — single-purpose RFC 9052 COSE_Sign1
verifier for the Aliro IssuerAuth signature, used once at personalization
(M2A.3) to set CredentialStore.accessDocumentVerified.

Wire walk uses hardcoded offsets that assume the
aliro_harness.issuer.cose shape (matches RFC 9052 §3 but is not a generic
CBOR parser). TODO marker for M2B.3 to swap in StructuralCbor.elementSpan.

Extracts SECP256R1_{P,A,B,G,R} into Secp256r1Params so AliroApplet and
CoseVerifier share one copy. seed(KeyPair) handles full keypair seeding;
seedPublic(ECPublicKey) covers the verify-only case for the new verifier.

Test vector: deterministic-seeded P-256 key + literal payload, signed
once via the harness cose helpers and self-verified, hex-pasted into
CoseVerifierTest. Two cases (good signature; flipped payload byte).

Regression: 80 tests green; the 3 pre-existing GCM errors from the
jcardsim m2-volume swap (AliroCryptoTest#jcardsimSupportsAesGcm,
AliroGcmTest#{partialFinalBlock,roundTripAgainstJcardsimAEADCipher})
still error, unrelated to this change.
This commit is contained in:
michael
2026-06-17 14:07:47 -07:00
parent 531b1d3186
commit 3868678bf9
4 changed files with 486 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java
View File

@@ -193,45 +193,10 @@ public class AliroApplet extends Applet {
'V', 'o', 'l', 'a', 't', 'i', 'l', 'e', '*', '*', '*', '*'
};
// secp256r1 / NIST P-256 curve parameters per FIPS 186-4 / SEC2 §2.7.2.
// J3R180 doesn't ship a default P-256 parameter set on its EC keys, so
// calls into genKeyPair / setS / setW / Signature.init throw
// CryptoException.ILLEGAL_VALUE until we seed the curve explicitly.
private static final byte[] SECP256R1_P = {
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,0x00,0x00,0x00,0x01,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF
};
private static final byte[] SECP256R1_A = {
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,0x00,0x00,0x00,0x01,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFC
};
private static final byte[] SECP256R1_B = {
0x5A,(byte)0xC6,0x35,(byte)0xD8,(byte)0xAA,0x3A,(byte)0x93,(byte)0xE7,
(byte)0xB3,(byte)0xEB,(byte)0xBD,0x55,0x76,(byte)0x98,(byte)0x86,(byte)0xBC,
0x65,0x1D,0x06,(byte)0xB0,(byte)0xCC,0x53,(byte)0xB0,(byte)0xF6,
0x3B,(byte)0xCE,0x3C,0x3E,0x27,(byte)0xD2,0x60,0x4B
};
private static final byte[] SECP256R1_G = {
0x04,
0x6B,0x17,(byte)0xD1,(byte)0xF2,(byte)0xE1,0x2C,0x42,0x47,
(byte)0xF8,(byte)0xBC,(byte)0xE6,(byte)0xE5,0x63,(byte)0xA4,0x40,(byte)0xF2,
0x77,0x03,0x7D,(byte)0x81,0x2D,(byte)0xEB,0x33,(byte)0xA0,
(byte)0xF4,(byte)0xA1,0x39,0x45,(byte)0xD8,(byte)0x98,(byte)0xC2,(byte)0x96,
0x4F,(byte)0xE3,0x42,(byte)0xE2,(byte)0xFE,0x1A,0x7F,(byte)0x9B,
(byte)0x8E,(byte)0xE7,(byte)0xEB,0x4A,0x7C,0x0F,(byte)0x9E,0x16,
0x2B,(byte)0xCE,0x33,0x57,0x6B,0x31,0x5E,(byte)0xCE,
(byte)0xCB,(byte)0xB6,0x40,0x68,0x37,(byte)0xBF,0x51,(byte)0xF5
};
private static final byte[] SECP256R1_R = {
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,0x00,0x00,0x00,0x00,
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
(byte)0xBC,(byte)0xE6,(byte)0xFA,(byte)0xAD,(byte)0xA7,0x17,(byte)0x9E,(byte)0x84,
(byte)0xF3,(byte)0xB9,(byte)0xCA,(byte)0xC2,(byte)0xFC,0x63,0x25,0x51
};
// secp256r1 / NIST P-256 curve parameters live in {@link Secp256r1Params}
// — shared with {@link CoseVerifier}. J3R180 doesn't ship a default P-256
// parameter set on its EC keys, so seedSecp256r1() must run before any
// genKeyPair / setS / setW / Signature.init.
/** NFC interface byte, spec §8.3.1.13. */
private static final byte INTERFACE_BYTE_NFC = (byte) 0x5E;
/** Table 8-13 usage constant for UD signature (spec §8.3.3.4.3). */
@@ -317,22 +282,12 @@ public class AliroApplet extends Applet {
/** Loads the secp256r1 / NIST P-256 curve parameters into both halves of
* {@code kp}. Must run before any {@code genKeyPair}, {@code setS},
* {@code setW}, or {@code Signature.init} on cards (like J3R180) that
* don't preset domain parameters on freshly-allocated EC keys. */
* don't preset domain parameters on freshly-allocated EC keys.
*
* <p>Thin wrapper over {@link Secp256r1Params#seed(KeyPair)} kept for
* call-site readability; the byte arrays live in the shared class. */
private static void seedSecp256r1(KeyPair kp) {
javacard.security.ECPublicKey pub = (javacard.security.ECPublicKey) kp.getPublic();
javacard.security.ECPrivateKey priv = (javacard.security.ECPrivateKey) kp.getPrivate();
pub.setFieldFP(SECP256R1_P, (short) 0, (short) SECP256R1_P.length);
pub.setA(SECP256R1_A, (short) 0, (short) SECP256R1_A.length);
pub.setB(SECP256R1_B, (short) 0, (short) SECP256R1_B.length);
pub.setG(SECP256R1_G, (short) 0, (short) SECP256R1_G.length);
pub.setR(SECP256R1_R, (short) 0, (short) SECP256R1_R.length);
pub.setK((short) 1);
priv.setFieldFP(SECP256R1_P, (short) 0, (short) SECP256R1_P.length);
priv.setA(SECP256R1_A, (short) 0, (short) SECP256R1_A.length);
priv.setB(SECP256R1_B, (short) 0, (short) SECP256R1_B.length);
priv.setG(SECP256R1_G, (short) 0, (short) SECP256R1_G.length);
priv.setR(SECP256R1_R, (short) 0, (short) SECP256R1_R.length);
priv.setK((short) 1);
Secp256r1Params.seed(kp);
}
// --- Diagnostic test vectors -------------------------------------------
@@ -436,7 +391,7 @@ public class AliroApplet extends Applet {
AliroCrypto cryptoEcdh = CryptoSingletons.getAliroCrypto();
for (short i = 0; i < n; i++) {
cryptoEcdh.computeEcdhSharedX(priv,
SECP256R1_G, (short) 0,
Secp256r1Params.SECP256R1_G, (short) 0,
buf, DIAG_OUT_OFF);
}
return;