MikeFaith/aliro-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: M2 close-out draft — INSTALL.md acceptance criterion + step-up implementation notes (M2H.1 draft)

Browse Source 
Adds the `aliro-bench-test --step-up` verification sub-section to
applet/INSTALL.md under "Validate after personalization" — explains
what the M2 path checks (SELECT-STEPUP / EXCHANGE / ENVELOPE / GET
RESPONSE / AD round-trip), what success looks like, and the three
common failure modes.

Also writes the user's auto-memory `step_up_implementation_notes.md`
(persisted outside this repo at
~/.claude/projects/.../memory/step_up_implementation_notes.md) with
the final form of the four Step-Up optimizations, spec citations, and
codebase pointers — so the operator can look up "how did Step-Up end
up" without re-reading the v2 plan. Three TODO markers left for the
M2H.1 final commit to update once M2E + M2F land.

DRAFT — final M2H.1 commit happens after M2G.2 verdict + M2E + M2F.
This commit is contained in:
michael
2026-06-17 16:43:06 -07:00
parent 1ed32d3872
commit f0765eb329
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
applet/INSTALL.md
View File

@@ -193,6 +193,30 @@ step the real firmware will eventually run — so a green bench-test is
strong evidence the applet is correct independently of any future
reader implementation.
### Step-Up M2 verification (`--step-up`)
```
aliro-bench-test --trust-dir ~/aliro-trust --step-up
```
Adds the Step-Up phase on top of the EXPEDITED verdict: SELECT-STEPUP
(ACCE5502) derives session keys from the cached `StepUpSK`, EXCHANGE
+ ENVELOPE + chained GET RESPONSE drive a real mdoc DeviceRequest to
the card and pull the encrypted DeviceResponse back. The harness
decrypts under `StepUpSKDevice` and asserts the embedded Access
Document round-trips byte-for-byte against the personalized blob.
Successful output appends:
```
STEP-UP M2: OK — Access Document round-trip verified, 272 bytes match
```
A `STEP-UP M2: FAIL` line means one of: SELECT-STEPUP didn't arm
(no preceding AUTH1), GCM tag mismatch (key/counter divergence), or
the recovered AD bytes don't match. The Expedited block above still
needs to be `OK` for any of this to run.
## Uninstall / re-install
`gp --delete <pkg_AID>` won't succeed while applet *instances* still