Dangerous Things
782074f6ae
Three components, all bench-validated to varying depths: - applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1 expedited-standard flow end-to-end green via PC/SC bench reader (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered on top of J3R180's primitives because the card lacks both natively. P-256 curve params seeded explicitly per J3R180's quirk. - harness/: Python orchestrator (aliro-trustgen, aliro-personalize, aliro-bench-test) for trust-bundle generation, card personalization via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126 pytest cases passing. - reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0 with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200 shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim, ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots, detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails with RFAL ERR_PROTO (0xB) — under investigation, see docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/. Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs, generated aliro_trust.h (contains private reader scalar), all PEMs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
69 lines
2.5 KiB
Python
69 lines
2.5 KiB
Python
"""Reader-side mirror of AliroApplet.buildSaltVolatile / deriveSessionKeys.
|
|
|
|
Keep this BYTE-IDENTICAL to the applet implementation in
|
|
applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java
|
|
(buildSaltVolatile). Drift here = decryption fails on real card.
|
|
"""
|
|
|
|
from io import BytesIO
|
|
|
|
from aliro_harness.reader.crypto import hkdf_sha256
|
|
|
|
SALT_VOLATILE_TAG = b"Volatile****"
|
|
INTERFACE_BYTE_NFC = 0x5E
|
|
PROPRIETARY_A5_TLV = bytes.fromhex("A50880020000" "5C020100")
|
|
PROTOCOL_VERSION_1_0 = bytes([0x01, 0x00])
|
|
|
|
# Offsets into the 160B derived_keys_volatile (§8.3.1.13).
|
|
OFF_EXPEDITED_SK_READER = 0
|
|
OFF_EXPEDITED_SK_DEVICE = 32
|
|
OFF_STEP_UP_SK = 64
|
|
|
|
|
|
def build_salt_volatile(
|
|
*,
|
|
reader_long_term_pub_x: bytes,
|
|
reader_group_id: bytes,
|
|
reader_group_sub_id: bytes,
|
|
reader_ephem_pub_x: bytes,
|
|
transaction_id: bytes,
|
|
command_parameters: int,
|
|
authentication_policy: int,
|
|
credential_long_term_pub_x: bytes,
|
|
) -> bytes:
|
|
"""Per spec §8.3.1.13. Mirrors AliroApplet.buildSaltVolatile (lines 406-446)."""
|
|
if not (0 <= command_parameters <= 0xFF and 0 <= authentication_policy <= 0xFF):
|
|
raise ValueError(
|
|
"command_parameters and authentication_policy must each fit in one byte"
|
|
)
|
|
out = BytesIO()
|
|
out.write(reader_long_term_pub_x) # 32
|
|
out.write(SALT_VOLATILE_TAG) # 12
|
|
out.write(reader_group_id) # 16
|
|
out.write(reader_group_sub_id) # 16
|
|
out.write(bytes([INTERFACE_BYTE_NFC])) # 1
|
|
out.write(bytes([0x5C, 0x02])) # 2
|
|
out.write(PROTOCOL_VERSION_1_0) # 2
|
|
out.write(reader_ephem_pub_x) # 32
|
|
out.write(transaction_id) # 16
|
|
out.write(bytes([command_parameters, authentication_policy])) # 2
|
|
out.write(PROPRIETARY_A5_TLV) # 10
|
|
out.write(credential_long_term_pub_x) # 32
|
|
salt = out.getvalue()
|
|
if len(salt) != 173:
|
|
raise ValueError(
|
|
f"salt_volatile must be 173 bytes (caller passed wrong-length x-coord or ID); "
|
|
f"got {len(salt)}. Each 32B field must be exactly 32B; each 16B field must be 16B."
|
|
)
|
|
return salt
|
|
|
|
|
|
def derive_expedited_session_keys(
|
|
kdh: bytes,
|
|
salt_volatile: bytes,
|
|
info_credential_ephem_pub_x: bytes,
|
|
) -> bytes:
|
|
"""§8.3.1.13: derived_keys_volatile (160B). info = x(credential_ephem_pub) +
|
|
AUTH0 vendor extensions (none in v1)."""
|
|
return hkdf_sha256(kdh, salt_volatile, info_credential_ephem_pub_x, 160)
|