MikeFaith/aliro-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(applet): CoseVerifier scratch 768B->384B for J3R452 transient pool fit (M2G.2)

Browse Source 
The M2 verdict run on J3R452 04555A4A0B2190 tripped SW=0x6FC4 on
AUTH0 (AliroCrypto.expandScratch makeTransientByteArray failure).
Summed CLEAR_ON_DESELECT allocations exceeded the ~3,120 B pool:
- PersonalizationApplet/CoseVerifier scratch: 768 B
- AliroApplet: 838 B (sessionState + scratch + derivedKeys + saltVolatile + kdh)
- StepUpApplet + StepUpSession: ~893 B (responseBuffer + scratchPlaintext + ...)
- AliroGcm + AliroCrypto (lazy, at first AUTH0): 720 B
Total ~3,220 B vs ~3,120 B cap.

CoseVerifier's 768 B was M2A.2's conservative sizing for up to 512 B COSE
payload. Aliro's IssuerAuth payload is ~188 B today. Tighten:
- MAX_PAYLOAD 512 -> 256 (still 36% headroom over actual)
- scratch 768 -> 384 (Sig_structure ~310 B + DER sig 72 B = ~382 B)

Saved 384 B, brings total to ~2,836 B. CAP rebuilt (100,990 B),
reinstalled + repersonalized + bench-test re-run -- GREEN.

Verdict log: docs/verdicts/2026-06-12-m2-pcsc-verdict.log
  RESULT: OK -- applet round-trip on real hardware
    0x5E signaling_bitmap: 0x0005
    APDU latencies: select 23 ms, auth0 667 ms, auth1 3,258 ms
  STEP-UP M2: OK -- EXCHANGE + ENVELOPE Access Document round-trip
This commit is contained in:
michael
2026-06-17 18:05:16 -07:00
parent 377ce297f1
commit 5521503258
2 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java
View File

@@ -40,9 +40,10 @@ import javacard.security.Signature;
final class CoseVerifier {
/** Maximum supported COSE_Sign1 payload length. The Aliro Access
* Document fits comfortably under this; we size the Sig_structure
* working buffer for it. */
static final short MAX_PAYLOAD = (short) 512;
* Document's inner COSE payload is ~188 B today; we cap at 256 to
* keep the Sig_structure working buffer inside the J3R452 transient
* pool (~3,120 B) once the other applets' allocations are summed in. */
static final short MAX_PAYLOAD = (short) 256;
/** Maximum supported protected bstr length. Aliro IssuerAuth uses a
* single {alg: ES256} map (3 bytes), but we cap at 32 for slack. */
@@ -89,11 +90,13 @@ final class CoseVerifier {
Secp256r1Params.seedPublic(issuerPubKey);
ecdsaVerifier = Signature.getInstance(Signature.ALG_ECDSA_SHA_256, false);
// Sig_structure size = prefix(12) + prot_hdr(<=3) + prot_bytes(<=32)
// + ext_aad(1) + pl_hdr(<=3) + pl_bytes(<=512)
// DER sig max = 2 + 2 + 33 + 2 + 33 = 72.
// Round up to keep arithmetic simple.
// + ext_aad(1) + pl_hdr(<=3) + pl_bytes(<=256)
// DER sig max = 2 + 2 + 33 + 2 + 33 = 72. Total ~381. Round to 384.
// Was 768 (M2A.2) -- blew the J3R452 transient pool budget once all
// applets' allocations summed in (~3,120 B cap). M2G.2 verdict run
// tripped 0x6FC4 from AliroCrypto.expandScratch.
scratch = JCSystem.makeTransientByteArray(
(short) 768, JCSystem.CLEAR_ON_DESELECT);
(short) 384, JCSystem.CLEAR_ON_DESELECT);
}
/**