Dangerous Things
782074f6ae
Three components, all bench-validated to varying depths: - applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1 expedited-standard flow end-to-end green via PC/SC bench reader (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered on top of J3R180's primitives because the card lacks both natively. P-256 curve params seeded explicitly per J3R180's quirk. - harness/: Python orchestrator (aliro-trustgen, aliro-personalize, aliro-bench-test) for trust-bundle generation, card personalization via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126 pytest cases passing. - reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0 with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200 shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim, ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots, detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails with RFAL ERR_PROTO (0xB) — under investigation, see docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/. Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs, generated aliro_trust.h (contains private reader scalar), all PEMs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
62 lines
1.7 KiB
Python
62 lines
1.7 KiB
Python
"""APDU constructor tests — exact byte-shape locks."""
|
|
|
|
import pytest
|
|
|
|
from aliro_harness.personalizer.apdus import (
|
|
CLA_PROPRIETARY,
|
|
INS_COMMIT,
|
|
INS_SET_CRED_PRIV,
|
|
INS_SET_CRED_PUBK,
|
|
INS_SET_READER_PUBK,
|
|
PROVISIONING_AID,
|
|
commit_apdu,
|
|
select_provisioning_apdu,
|
|
set_credential_priv_apdu,
|
|
set_credential_pubk_apdu,
|
|
set_reader_pubk_apdu,
|
|
)
|
|
|
|
|
|
def test_provisioning_aid_matches_applet_constant():
|
|
"""If this changes, AliroAids.PROVISIONING in the applet has drifted."""
|
|
assert PROVISIONING_AID.hex().upper() == "A000000909ACCE559901"
|
|
|
|
|
|
def test_select_provisioning_apdu_shape():
|
|
apdu = select_provisioning_apdu()
|
|
assert apdu == bytes([0x00, 0xA4, 0x04, 0x00, 0x0A]) + PROVISIONING_AID
|
|
|
|
|
|
def test_set_credential_priv_apdu():
|
|
priv = bytes(range(32))
|
|
apdu = set_credential_priv_apdu(priv)
|
|
assert apdu == bytes([CLA_PROPRIETARY, INS_SET_CRED_PRIV, 0x00, 0x00, 0x20]) + priv
|
|
|
|
|
|
def test_set_credential_priv_rejects_wrong_length():
|
|
with pytest.raises(ValueError, match="32B"):
|
|
set_credential_priv_apdu(bytes(31))
|
|
|
|
|
|
def test_set_credential_pubk_apdu():
|
|
pub = bytes(range(64))
|
|
apdu = set_credential_pubk_apdu(pub)
|
|
assert apdu == bytes([CLA_PROPRIETARY, INS_SET_CRED_PUBK, 0x00, 0x00, 0x40]) + pub
|
|
|
|
|
|
def test_set_credential_pubk_rejects_wrong_length():
|
|
with pytest.raises(ValueError, match="64B"):
|
|
set_credential_pubk_apdu(bytes(65))
|
|
|
|
|
|
def test_set_reader_pubk_apdu():
|
|
pub = bytes(range(64))
|
|
apdu = set_reader_pubk_apdu(pub)
|
|
assert apdu == bytes([CLA_PROPRIETARY, INS_SET_READER_PUBK, 0x00, 0x00, 0x40]) + pub
|
|
|
|
|
|
def test_commit_apdu_has_no_data_field():
|
|
apdu = commit_apdu()
|
|
assert apdu == bytes([CLA_PROPRIETARY, INS_COMMIT, 0x00, 0x00])
|
|
assert len(apdu) == 4
|