Dangerous Things
782074f6ae
Three components, all bench-validated to varying depths: - applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1 expedited-standard flow end-to-end green via PC/SC bench reader (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered on top of J3R180's primitives because the card lacks both natively. P-256 curve params seeded explicitly per J3R180's quirk. - harness/: Python orchestrator (aliro-trustgen, aliro-personalize, aliro-bench-test) for trust-bundle generation, card personalization via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126 pytest cases passing. - reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0 with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200 shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim, ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots, detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails with RFAL ERR_PROTO (0xB) — under investigation, see docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/. Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs, generated aliro_trust.h (contains private reader scalar), all PEMs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.2 KiB
Python
40 lines
1.2 KiB
Python
from cryptography import x509
|
|
from cryptography.hazmat.primitives.asymmetric import ec
|
|
|
|
from aliro_harness.issuer.ca import create_self_signed_ca
|
|
|
|
|
|
def test_create_self_signed_ca_returns_p256_cert_and_key():
|
|
cert, key = create_self_signed_ca(common_name="Test Credential Issuer CA")
|
|
|
|
assert isinstance(cert, x509.Certificate)
|
|
assert isinstance(key, ec.EllipticCurvePrivateKey)
|
|
assert key.curve.name == "secp256r1"
|
|
|
|
|
|
def test_self_signed_ca_subject_and_issuer_match():
|
|
cert, _ = create_self_signed_ca(common_name="Test Credential Issuer CA")
|
|
|
|
assert cert.subject == cert.issuer
|
|
cn = cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)[0].value
|
|
assert cn == "Test Credential Issuer CA"
|
|
|
|
|
|
def test_self_signed_ca_has_ca_basic_constraints():
|
|
cert, _ = create_self_signed_ca(common_name="Test CA")
|
|
|
|
bc = cert.extensions.get_extension_for_class(x509.BasicConstraints)
|
|
assert bc.value.ca is True
|
|
assert bc.critical is True
|
|
|
|
|
|
def test_self_signed_ca_signature_verifies_with_own_key():
|
|
cert, key = create_self_signed_ca(common_name="Test CA")
|
|
|
|
public_key = key.public_key()
|
|
public_key.verify(
|
|
cert.signature,
|
|
cert.tbs_certificate_bytes,
|
|
ec.ECDSA(cert.signature_hash_algorithm),
|
|
)
|