Dangerous Things
782074f6ae
Three components, all bench-validated to varying depths: - applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1 expedited-standard flow end-to-end green via PC/SC bench reader (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered on top of J3R180's primitives because the card lacks both natively. P-256 curve params seeded explicitly per J3R180's quirk. - harness/: Python orchestrator (aliro-trustgen, aliro-personalize, aliro-bench-test) for trust-bundle generation, card personalization via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126 pytest cases passing. - reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0 with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200 shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim, ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots, detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails with RFAL ERR_PROTO (0xB) — under investigation, see docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/. Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs, generated aliro_trust.h (contains private reader scalar), all PEMs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
146 lines
6.3 KiB
XML
146 lines
6.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<groupId>com.dangerousthings.aliro</groupId>
|
|
<artifactId>aliro-applet</artifactId>
|
|
<version>0.1.0-SNAPSHOT</version>
|
|
<packaging>jar</packaging>
|
|
|
|
<description>
|
|
Java Card applet implementing the CSA Aliro v1.0 User Device role over NFC.
|
|
Built and tested inside the vivokey/smartcard-ci Docker image; see scripts/dt-mvn.sh.
|
|
</description>
|
|
|
|
<properties>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
<!-- JC 3.0.5 converter supports up to 1.7 bytecode (v51.0). Source
|
|
stays at 1.7 to match. Test classes can be compiled at 1.8 via
|
|
the test compiler config below — they don't go through the JC
|
|
converter and the image's javac handles either version. -->
|
|
<maven.compiler.source>1.7</maven.compiler.source>
|
|
<maven.compiler.target>1.7</maven.compiler.target>
|
|
|
|
<junit.jupiter.version>5.10.2</junit.jupiter.version>
|
|
</properties>
|
|
|
|
<dependencies>
|
|
<!--
|
|
jcardsim is pre-built into the smartcard-ci image's local m2 repo
|
|
(see https://github.com/DangerousThings/smartcard-ci Dockerfile).
|
|
No jitpack / central resolution needed.
|
|
-->
|
|
<dependency>
|
|
<groupId>com.licel</groupId>
|
|
<artifactId>jcardsim</artifactId>
|
|
<version>3.0.5-SNAPSHOT</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>${junit.jupiter.version}</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<repositories>
|
|
<!-- ant-javacard's recent releases are published via jitpack rather
|
|
than Maven Central; the Central artifact is stuck on 2019. -->
|
|
<repository>
|
|
<id>jitpack.io</id>
|
|
<url>https://jitpack.io</url>
|
|
</repository>
|
|
</repositories>
|
|
|
|
<pluginRepositories>
|
|
<pluginRepository>
|
|
<id>jitpack.io</id>
|
|
<url>https://jitpack.io</url>
|
|
</pluginRepository>
|
|
</pluginRepositories>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-compiler-plugin</artifactId>
|
|
<version>3.13.0</version>
|
|
<configuration>
|
|
<!-- Main: 1.7 bytecode for the JC 3.0.5 converter. -->
|
|
<source>1.7</source>
|
|
<target>1.7</target>
|
|
<!-- Tests: JUnit 5 + our helpers use 1.8 features. They
|
|
don't go through the JC converter. -->
|
|
<testSource>1.8</testSource>
|
|
<testTarget>1.8</testTarget>
|
|
</configuration>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.2.5</version>
|
|
</plugin>
|
|
|
|
<!--
|
|
Builds the Java Card CAP file via ant-javacard, which wraps
|
|
Oracle's converter from the JC SDK pinned by JC_CLASSIC_HOME
|
|
(the dt-mvn.sh wrapper sets this to /app/sdks/jc305u3_kit).
|
|
|
|
Output: target/aliro-applet.cap
|
|
|
|
Package AID: A0 00 00 09 09 44 54 41 4C 49 52 4F (CSA RID + "DTALIRO")
|
|
Applet AIDs:
|
|
AliroApplet A0 00 00 09 09 AC CE 55 01 (Aliro EXPEDITED, spec)
|
|
StepUpApplet A0 00 00 09 09 AC CE 55 02 (Aliro STEP_UP, spec)
|
|
PersonalizationApplet A0 00 00 09 09 AC CE 55 99 01 (DT-internal, CSA-RID-namespaced)
|
|
|
|
JavaCard requires all applet AIDs in a CAP to share the
|
|
package's RID (first 5 bytes); using the CSA RID throughout
|
|
lets the three applets ship in one CAP.
|
|
-->
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-antrun-plugin</artifactId>
|
|
<version>3.1.0</version>
|
|
<executions>
|
|
<execution>
|
|
<id>build-cap</id>
|
|
<phase>package</phase>
|
|
<goals><goal>run</goal></goals>
|
|
<configuration>
|
|
<target>
|
|
<taskdef name="javacard"
|
|
classname="pro.javacard.ant.JavaCard"
|
|
classpathref="maven.plugin.classpath"/>
|
|
<javacard jckit="${env.JC_CLASSIC_HOME}">
|
|
<cap output="${project.build.directory}/aliro-applet.cap"
|
|
aid="A0000009094454414C49524F"
|
|
package="com.dangerousthings.aliro"
|
|
version="0.1"
|
|
classes="${project.build.outputDirectory}">
|
|
<applet class="com.dangerousthings.aliro.AliroApplet"
|
|
aid="A000000909ACCE5501"/>
|
|
<applet class="com.dangerousthings.aliro.StepUpApplet"
|
|
aid="A000000909ACCE5502"/>
|
|
<applet class="com.dangerousthings.aliro.PersonalizationApplet"
|
|
aid="A000000909ACCE559901"/>
|
|
</cap>
|
|
</javacard>
|
|
</target>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>com.github.martinpaljak</groupId>
|
|
<artifactId>ant-javacard</artifactId>
|
|
<version>v26.02.22</version>
|
|
</dependency>
|
|
</dependencies>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</project>
|