From 5521503258263f1cca31ce03311d16efba453f0d Mon Sep 17 00:00:00 2001 From: michael Date: Wed, 17 Jun 2026 18:05:16 -0700 Subject: [PATCH] fix(applet): CoseVerifier scratch 768B->384B for J3R452 transient pool fit (M2G.2) The M2 verdict run on J3R452 04555A4A0B2190 tripped SW=0x6FC4 on AUTH0 (AliroCrypto.expandScratch makeTransientByteArray failure). Summed CLEAR_ON_DESELECT allocations exceeded the ~3,120 B pool: - PersonalizationApplet/CoseVerifier scratch: 768 B - AliroApplet: 838 B (sessionState + scratch + derivedKeys + saltVolatile + kdh) - StepUpApplet + StepUpSession: ~893 B (responseBuffer + scratchPlaintext + ...) - AliroGcm + AliroCrypto (lazy, at first AUTH0): 720 B Total ~3,220 B vs ~3,120 B cap. CoseVerifier's 768 B was M2A.2's conservative sizing for up to 512 B COSE payload. Aliro's IssuerAuth payload is ~188 B today. Tighten: - MAX_PAYLOAD 512 -> 256 (still 36% headroom over actual) - scratch 768 -> 384 (Sig_structure ~310 B + DER sig 72 B = ~382 B) Saved 384 B, brings total to ~2,836 B. CAP rebuilt (100,990 B), reinstalled + repersonalized + bench-test re-run -- GREEN. Verdict log: docs/verdicts/2026-06-12-m2-pcsc-verdict.log RESULT: OK -- applet round-trip on real hardware 0x5E signaling_bitmap: 0x0005 APDU latencies: select 23 ms, auth0 667 ms, auth1 3,258 ms STEP-UP M2: OK -- EXCHANGE + ENVELOPE Access Document round-trip --- .../com/dangerousthings/aliro/CoseVerifier.java | 17 ++++++++++------- docs/verdicts/2026-06-12-m2-pcsc-verdict.log | 13 +++++++++++++ 2 files changed, 23 insertions(+), 7 deletions(-) create mode 100644 docs/verdicts/2026-06-12-m2-pcsc-verdict.log diff --git a/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java b/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java index 657c265..0079806 100644 --- a/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java +++ b/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java @@ -40,9 +40,10 @@ import javacard.security.Signature; final class CoseVerifier { /** Maximum supported COSE_Sign1 payload length. The Aliro Access - * Document fits comfortably under this; we size the Sig_structure - * working buffer for it. */ - static final short MAX_PAYLOAD = (short) 512; + * Document's inner COSE payload is ~188 B today; we cap at 256 to + * keep the Sig_structure working buffer inside the J3R452 transient + * pool (~3,120 B) once the other applets' allocations are summed in. */ + static final short MAX_PAYLOAD = (short) 256; /** Maximum supported protected bstr length. Aliro IssuerAuth uses a * single {alg: ES256} map (3 bytes), but we cap at 32 for slack. */ @@ -89,11 +90,13 @@ final class CoseVerifier { Secp256r1Params.seedPublic(issuerPubKey); ecdsaVerifier = Signature.getInstance(Signature.ALG_ECDSA_SHA_256, false); // Sig_structure size = prefix(12) + prot_hdr(<=3) + prot_bytes(<=32) - // + ext_aad(1) + pl_hdr(<=3) + pl_bytes(<=512) - // DER sig max = 2 + 2 + 33 + 2 + 33 = 72. - // Round up to keep arithmetic simple. + // + ext_aad(1) + pl_hdr(<=3) + pl_bytes(<=256) + // DER sig max = 2 + 2 + 33 + 2 + 33 = 72. Total ~381. Round to 384. + // Was 768 (M2A.2) -- blew the J3R452 transient pool budget once all + // applets' allocations summed in (~3,120 B cap). M2G.2 verdict run + // tripped 0x6FC4 from AliroCrypto.expandScratch. scratch = JCSystem.makeTransientByteArray( - (short) 768, JCSystem.CLEAR_ON_DESELECT); + (short) 384, JCSystem.CLEAR_ON_DESELECT); } /** diff --git a/docs/verdicts/2026-06-12-m2-pcsc-verdict.log b/docs/verdicts/2026-06-12-m2-pcsc-verdict.log new file mode 100644 index 0000000..6bbdd36 --- /dev/null +++ b/docs/verdicts/2026-06-12-m2-pcsc-verdict.log @@ -0,0 +1,13 @@ +Using reader: NXP PR533 (3.70) 00 00 +Connected. ATR: 3b8a80014a444e4752665334353258 +Loaded trust artifacts from /home/work/aliro-trust +RESULT: OK — applet round-trip on real hardware. + 0x5A credential_PubK: 65B + 0x9E UD signature: 64B + 0x5E signaling_bitmap: 0x0005 + APDU latencies (ms): + select 23.1 + auth0 667.1 + auth1 3258.3 + total 3948.4 +STEP-UP M2: OK — M2 step-up verified (EXCHANGE + ENVELOPE Access Document round-trip)