Dangerous Things
782074f6ae
Three components, all bench-validated to varying depths: - applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1 expedited-standard flow end-to-end green via PC/SC bench reader (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered on top of J3R180's primitives because the card lacks both natively. P-256 curve params seeded explicitly per J3R180's quirk. - harness/: Python orchestrator (aliro-trustgen, aliro-personalize, aliro-bench-test) for trust-bundle generation, card personalization via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126 pytest cases passing. - reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0 with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200 shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim, ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots, detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails with RFAL ERR_PROTO (0xB) — under investigation, see docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/. Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs, generated aliro_trust.h (contains private reader scalar), all PEMs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
79 lines
2.8 KiB
Python
79 lines
2.8 KiB
Python
from aliro_harness.reader.key_derivation import (
|
|
build_salt_volatile,
|
|
derive_expedited_session_keys,
|
|
)
|
|
|
|
|
|
def test_salt_volatile_layout_per_spec_8_3_1_13():
|
|
salt = build_salt_volatile(
|
|
reader_long_term_pub_x=b"\x01" * 32,
|
|
reader_group_id=b"\xaa" * 16,
|
|
reader_group_sub_id=b"\xbb" * 16,
|
|
reader_ephem_pub_x=b"\x33" * 32,
|
|
transaction_id=b"\xcc" * 16,
|
|
command_parameters=0x00,
|
|
authentication_policy=0x00,
|
|
credential_long_term_pub_x=b"\x55" * 32,
|
|
)
|
|
p = 0
|
|
assert salt[p : p + 32] == b"\x01" * 32 # x(reader_group_identifier_key)
|
|
p += 32
|
|
assert salt[p : p + 12] == b"Volatile****"
|
|
p += 12
|
|
assert salt[p : p + 16] == b"\xaa" * 16 # group_id
|
|
p += 16
|
|
assert salt[p : p + 16] == b"\xbb" * 16 # sub_id
|
|
p += 16
|
|
assert salt[p] == 0x5E # interface_byte = NFC
|
|
p += 1
|
|
assert salt[p : p + 2] == bytes([0x5C, 0x02]) # literal
|
|
p += 2
|
|
assert salt[p : p + 2] == bytes([0x01, 0x00]) # protocol_version
|
|
p += 2
|
|
assert salt[p : p + 32] == b"\x33" * 32 # x(reader_ephem)
|
|
p += 32
|
|
assert salt[p : p + 16] == b"\xcc" * 16 # txn_id
|
|
p += 16
|
|
assert salt[p : p + 2] == bytes([0x00, 0x00]) # flag = cmd_params || auth_policy
|
|
p += 2
|
|
assert salt[p : p + 10] == bytes.fromhex("A50880020000 5C020100".replace(" ", ""))
|
|
p += 10
|
|
assert salt[p : p + 32] == b"\x55" * 32 # x(credential_long_term)
|
|
p += 32
|
|
assert len(salt) == p == 173
|
|
|
|
|
|
def test_salt_volatile_threads_flag_bytes_in_correct_order():
|
|
"""Guards against cmd_params/auth_policy swap."""
|
|
salt = build_salt_volatile(
|
|
reader_long_term_pub_x=b"\x00" * 32,
|
|
reader_group_id=b"\x00" * 16,
|
|
reader_group_sub_id=b"\x00" * 16,
|
|
reader_ephem_pub_x=b"\x00" * 32,
|
|
transaction_id=b"\x00" * 16,
|
|
command_parameters=0xAB,
|
|
authentication_policy=0xCD,
|
|
credential_long_term_pub_x=b"\x00" * 32,
|
|
)
|
|
# flag offset: 32 + 12 + 16 + 16 + 1 + 2 + 2 + 32 + 16 = 129
|
|
assert salt[129] == 0xAB
|
|
assert salt[130] == 0xCD
|
|
|
|
|
|
def test_derive_expedited_session_keys_returns_160_bytes_deterministic():
|
|
kdh = bytes.fromhex("11" * 32)
|
|
salt = bytes.fromhex("22" * 173)
|
|
info = bytes.fromhex("33" * 65) # x(credential_ephem_pub) is 32B in practice; any bytes OK here
|
|
out1 = derive_expedited_session_keys(kdh, salt, info)
|
|
out2 = derive_expedited_session_keys(kdh, salt, info)
|
|
assert len(out1) == 160
|
|
assert out1 == out2
|
|
|
|
|
|
def test_derive_expedited_session_keys_changes_with_inputs():
|
|
kdh = bytes.fromhex("11" * 32)
|
|
salt_a = bytes.fromhex("22" * 173)
|
|
salt_b = bytes.fromhex("23" + "22" * 172)
|
|
info = bytes.fromhex("33" * 32)
|
|
assert derive_expedited_session_keys(kdh, salt_a, info) != derive_expedited_session_keys(kdh, salt_b, info)
|