Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port
Three components, all bench-validated to varying depths: - applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1 expedited-standard flow end-to-end green via PC/SC bench reader (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered on top of J3R180's primitives because the card lacks both natively. P-256 curve params seeded explicitly per J3R180's quirk. - harness/: Python orchestrator (aliro-trustgen, aliro-personalize, aliro-bench-test) for trust-bundle generation, card personalization via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126 pytest cases passing. - reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0 with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200 shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim, ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots, detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails with RFAL ERR_PROTO (0xB) — under investigation, see docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/. Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs, generated aliro_trust.h (contains private reader scalar), all PEMs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
28
applet/scripts/dt-mvn.sh
Executable file
28
applet/scripts/dt-mvn.sh
Executable file
@@ -0,0 +1,28 @@
|
||||
#!/usr/bin/env bash
|
||||
# Run Maven inside the DangerousThings smartcard-ci Docker image.
|
||||
#
|
||||
# The image (vivokey/smartcard-ci) ships a pre-built jcardsim-3.0.5-SNAPSHOT,
|
||||
# Oracle JavaCard SDKs, Java 8, and Maven. On first run we seed a named
|
||||
# Docker volume with the image's baseline .m2 so subsequent runs keep
|
||||
# downloaded deps (JUnit etc.) warm between invocations.
|
||||
#
|
||||
# Usage: ./scripts/dt-mvn.sh <mvn args> e.g.: ./scripts/dt-mvn.sh -q test
|
||||
set -euo pipefail
|
||||
|
||||
IMAGE="vivokey/smartcard-ci:latest"
|
||||
VOLUME="aliro-smartcard-m2"
|
||||
|
||||
project_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." &> /dev/null && pwd)"
|
||||
|
||||
if ! docker volume inspect "$VOLUME" >/dev/null 2>&1; then
|
||||
echo "Seeding $VOLUME with baseline .m2 from $IMAGE (one-time)" >&2
|
||||
docker volume create "$VOLUME" >/dev/null
|
||||
docker run --rm -v "$VOLUME:/dst" --entrypoint sh "$IMAGE" \
|
||||
-c 'cp -a /root/.m2/. /dst/ && chmod -R a+rwX /dst'
|
||||
fi
|
||||
|
||||
exec docker run --rm -t \
|
||||
-v "$project_root:/work" -w /work \
|
||||
-v "$VOLUME:/root/.m2" \
|
||||
-e JC_CLASSIC_HOME=/app/sdks/jc305u3_kit \
|
||||
"$IMAGE" "mvn $*"
|
||||
67
applet/scripts/install-jcardsim-gcm.sh
Executable file
67
applet/scripts/install-jcardsim-gcm.sh
Executable file
@@ -0,0 +1,67 @@
|
||||
#!/usr/bin/env bash
|
||||
# Install licel/jcardsim master (which has AES-GCM support) into the persistent
|
||||
# aliro-smartcard-m2 Docker volume, shadowing the jcardsim-3.0.5-SNAPSHOT jar
|
||||
# baked into vivokey/smartcard-ci:latest.
|
||||
#
|
||||
# Why: the DT smartcard-ci image pins a jcardsim fork that is 13 commits behind
|
||||
# licel upstream and lacks the AES-GCM/CCM implementation merged in licel PR
|
||||
# #187 (2022-07). Aliro §8.3.1.6 requires AES-256-GCM; without the impl,
|
||||
# `Cipher.getInstance(AEADCipher.ALG_AES_GCM, false)` throws CryptoException.
|
||||
#
|
||||
# Rerun this when the base image or the m2 volume is recreated.
|
||||
#
|
||||
# Usage: ./scripts/install-jcardsim-gcm.sh
|
||||
set -euo pipefail
|
||||
|
||||
IMAGE="vivokey/smartcard-ci:latest"
|
||||
VOLUME="aliro-smartcard-m2"
|
||||
UPSTREAM_COMMIT="aa60a02f" # licel/jcardsim master HEAD as of 2024-04-03 (last verified)
|
||||
|
||||
project_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." &> /dev/null && pwd)"
|
||||
build_dir="$project_root/build-tools/jcardsim"
|
||||
|
||||
if [[ ! -d "$build_dir" ]]; then
|
||||
echo "Cloning licel/jcardsim master into $build_dir" >&2
|
||||
mkdir -p "$project_root/build-tools"
|
||||
git clone --depth 50 https://github.com/licel/jcardsim.git "$build_dir"
|
||||
fi
|
||||
|
||||
(cd "$build_dir" \
|
||||
&& git fetch --depth 50 origin master \
|
||||
&& git checkout master \
|
||||
&& git reset --hard origin/master)
|
||||
|
||||
patches_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/jcardsim-patches"
|
||||
if [[ -d "$patches_dir" ]]; then
|
||||
echo "Applying local patches from $patches_dir" >&2
|
||||
for patch in "$patches_dir"/*.patch; do
|
||||
[[ -e "$patch" ]] || continue
|
||||
(cd "$build_dir" && git apply "$patch")
|
||||
done
|
||||
fi
|
||||
|
||||
if ! docker volume inspect "$VOLUME" >/dev/null 2>&1; then
|
||||
echo "Volume $VOLUME missing. Run ./scripts/dt-mvn.sh once first to seed it." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Building jcardsim inside $IMAGE..." >&2
|
||||
docker run --rm -v "$build_dir:/src" -w /src \
|
||||
-v "$VOLUME:/root/.m2" \
|
||||
--entrypoint bash \
|
||||
"$IMAGE" -c \
|
||||
"export JC_CLASSIC_HOME=/app/sdks/jc305u3_kit && \
|
||||
mvn -q -DskipTests initialize && \
|
||||
mvn -q -DskipTests package && \
|
||||
mvn -q install:install-file \
|
||||
-Dfile=target/jcardsim-3.0.5-SNAPSHOT.jar \
|
||||
-DgroupId=com.licel -DartifactId=jcardsim \
|
||||
-Dversion=3.0.5-SNAPSHOT -Dpackaging=jar \
|
||||
-DpomFile=pom.xml"
|
||||
|
||||
echo "Verifying AEAD implementation is present in installed jar..." >&2
|
||||
docker run --rm -v "$VOLUME:/root/.m2" --entrypoint bash "$IMAGE" -c \
|
||||
"jar tf /root/.m2/repository/com/licel/jcardsim/3.0.5-SNAPSHOT/jcardsim-3.0.5-SNAPSHOT.jar \
|
||||
| grep -q 'AuthenticatedSymmetricCipherImpl.class'"
|
||||
|
||||
echo "jcardsim with AES-GCM installed. Run ./scripts/dt-mvn.sh test to verify." >&2
|
||||
@@ -0,0 +1,24 @@
|
||||
Fix ByteContainer.setBytes to reallocate data when the incoming length
|
||||
differs from the currently stored length.
|
||||
|
||||
Upstream licel/jcardsim master drops `this.length != length` from the
|
||||
reallocation guard; the DT fork kept it. Without the check, calling
|
||||
setKey(buf13, 0, 13) then setKey(buf64, 32, 32) on the same key reuses the
|
||||
already-sized-13 internal data[] and triggers ArrayIndexOutOfBoundsException
|
||||
in the subsequent Util.arrayCopy.
|
||||
|
||||
This regression hits HKDF-Extract-then-Expand on the same HMACKey, which is
|
||||
exactly the shape Aliro §8.3.1.4 / §8.3.1.13 require.
|
||||
|
||||
diff --git a/src/main/java/com/licel/jcardsim/crypto/ByteContainer.java b/src/main/java/com/licel/jcardsim/crypto/ByteContainer.java
|
||||
--- a/src/main/java/com/licel/jcardsim/crypto/ByteContainer.java
|
||||
+++ b/src/main/java/com/licel/jcardsim/crypto/ByteContainer.java
|
||||
@@ -106,7 +106,7 @@ public final class ByteContainer {
|
||||
* @param length length of data in byte array
|
||||
*/
|
||||
public void setBytes(byte[] buff, short offset, short length) {
|
||||
- if (data == null) {
|
||||
+ if (data == null || this.length != length) {
|
||||
switch (memoryType) {
|
||||
case JCSystem.MEMORY_TYPE_TRANSIENT_DESELECT:
|
||||
data = JCSystem.makeTransientByteArray(length, JCSystem.CLEAR_ON_DESELECT);
|
||||
Reference in New Issue
Block a user