Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port

Three components, all bench-validated to varying depths:

- applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1
  expedited-standard flow end-to-end green via PC/SC bench reader
  (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered
  on top of J3R180's primitives because the card lacks both natively.
  P-256 curve params seeded explicitly per J3R180's quirk.

- harness/: Python orchestrator (aliro-trustgen, aliro-personalize,
  aliro-bench-test) for trust-bundle generation, card personalization
  via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126
  pytest cases passing.

- reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0
  with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200
  shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim,
  ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an
  ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots,
  detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails
  with RFAL ERR_PROTO (0xB) — under investigation, see
  docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/.

Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs,
generated aliro_trust.h (contains private reader scalar), all PEMs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harness/src/aliro_harness/reader/key_derivation.py

@@ -0,0 +1,68 @@
+"""Reader-side mirror of AliroApplet.buildSaltVolatile / deriveSessionKeys.
+
+Keep this BYTE-IDENTICAL to the applet implementation in
+applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java
+(buildSaltVolatile). Drift here = decryption fails on real card.
+"""
+
+from io import BytesIO
+
+from aliro_harness.reader.crypto import hkdf_sha256
+
+SALT_VOLATILE_TAG = b"Volatile****"
+INTERFACE_BYTE_NFC = 0x5E
+PROPRIETARY_A5_TLV = bytes.fromhex("A50880020000" "5C020100")
+PROTOCOL_VERSION_1_0 = bytes([0x01, 0x00])
+
+# Offsets into the 160B derived_keys_volatile (§8.3.1.13).
+OFF_EXPEDITED_SK_READER = 0
+OFF_EXPEDITED_SK_DEVICE = 32
+OFF_STEP_UP_SK = 64
+
+
+def build_salt_volatile(
+    *,
+    reader_long_term_pub_x: bytes,
+    reader_group_id: bytes,
+    reader_group_sub_id: bytes,
+    reader_ephem_pub_x: bytes,
+    transaction_id: bytes,
+    command_parameters: int,
+    authentication_policy: int,
+    credential_long_term_pub_x: bytes,
+) -> bytes:
+    """Per spec §8.3.1.13. Mirrors AliroApplet.buildSaltVolatile (lines 406-446)."""
+    if not (0 <= command_parameters <= 0xFF and 0 <= authentication_policy <= 0xFF):
+        raise ValueError(
+            "command_parameters and authentication_policy must each fit in one byte"
+        )
+    out = BytesIO()
+    out.write(reader_long_term_pub_x)              # 32
+    out.write(SALT_VOLATILE_TAG)                   # 12
+    out.write(reader_group_id)                     # 16
+    out.write(reader_group_sub_id)                 # 16
+    out.write(bytes([INTERFACE_BYTE_NFC]))         # 1
+    out.write(bytes([0x5C, 0x02]))                 # 2
+    out.write(PROTOCOL_VERSION_1_0)                # 2
+    out.write(reader_ephem_pub_x)                  # 32
+    out.write(transaction_id)                      # 16
+    out.write(bytes([command_parameters, authentication_policy]))  # 2
+    out.write(PROPRIETARY_A5_TLV)                  # 10
+    out.write(credential_long_term_pub_x)          # 32
+    salt = out.getvalue()
+    if len(salt) != 173:
+        raise ValueError(
+            f"salt_volatile must be 173 bytes (caller passed wrong-length x-coord or ID); "
+            f"got {len(salt)}. Each 32B field must be exactly 32B; each 16B field must be 16B."
+        )
+    return salt
+
+
+def derive_expedited_session_keys(
+    kdh: bytes,
+    salt_volatile: bytes,
+    info_credential_ephem_pub_x: bytes,
+) -> bytes:
+    """§8.3.1.13: derived_keys_volatile (160B). info = x(credential_ephem_pub) +
+    AUTH0 vendor extensions (none in v1)."""
+    return hkdf_sha256(kdh, salt_volatile, info_credential_ephem_pub_x, 160)