182 lines
6.8 KiB
Python
182 lines
6.8 KiB
Python
"""Tests for the Infineon OPTIGA Authenticate NBT (ISO 14443-A, NFC Type 4)."""
|
|
import asyncio
|
|
import pytest
|
|
|
|
from pm3py.sim.frame import RFFrame
|
|
from pm3py.transponders.hf.iso14443a.base import _compute_bcc
|
|
from pm3py.transponders.hf.iso14443a.infineon.optiga_nbt import OptigaAuthenticateNBT
|
|
|
|
UID = b"\x05\x84\x89\x02\x95\x43\x00"
|
|
NDEF = b"\xD1\x01\x04\x54\x02enHi" # 9 bytes
|
|
|
|
|
|
def run(coro):
|
|
return asyncio.new_event_loop().run_until_complete(coro)
|
|
|
|
|
|
class Session:
|
|
def __init__(self, tag):
|
|
self.tag = tag
|
|
self.blk = 0
|
|
run(tag.power_on())
|
|
self.atqa = run(tag.handle_frame(RFFrame.from_hex("26"))).data
|
|
uid = tag._uid
|
|
ct = b"\x88" + uid[0:3]
|
|
run(tag.handle_frame(RFFrame.from_bytes(b"\x93\x70" + ct + bytes([_compute_bcc(ct)]))))
|
|
r = run(tag.handle_frame(RFFrame.from_bytes(b"\x95\x70" + uid[3:7] + bytes([_compute_bcc(uid[3:7])]))))
|
|
self.sak = r.data
|
|
self.ats = run(tag.handle_frame(RFFrame.from_bytes(b"\xE0\x50"))).data
|
|
|
|
def apdu(self, hexstr: str) -> bytes:
|
|
pcb = 0x02 | self.blk
|
|
self.blk ^= 1
|
|
return run(self.tag.handle_frame(RFFrame.from_bytes(bytes([pcb]) + bytes.fromhex(hexstr)))).data[1:]
|
|
|
|
def select_app(self):
|
|
return self.apdu("00A4040007D276000085010100")
|
|
|
|
def select_file(self, fid):
|
|
return self.apdu("00A4000C02" + fid)
|
|
|
|
|
|
class TestActivation:
|
|
def test_atqa_sak(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
assert s.atqa == b"\x44\x00" # ATQA 0x0044 (7-byte UID)
|
|
assert s.sak[0] & 0x20 # SAK ISO-DEP bit
|
|
|
|
def test_ats_historical_nbt2000(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
assert s.ats == b"\x0C\x78\x77\x70\x02NBT2000"
|
|
|
|
def test_infineon_uid_prefix(self):
|
|
assert OptigaAuthenticateNBT()._uid[0] == 0x05
|
|
|
|
|
|
class TestFileSystem:
|
|
def test_cc_contents(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
assert s.select_file("E103") == b"\x90\x00"
|
|
cc = s.apdu("00B0000020")
|
|
assert cc[0:3] == b"\x00\x2F\x20" # CCLEN, mapping ver 2.0
|
|
assert cc[3:5] == b"\x01\x00" # MLe 0x0100
|
|
assert cc[5:7] == b"\x00\xFF" # MLc 0x00FF
|
|
assert cc[7:15] == b"\x04\x06\xE1\x04\x10\x00\x00\x00" # NDEF TLV
|
|
assert cc[15:23] == b"\x05\x06\xE1\xA1\x04\x00\x00\x00" # proprietary TLV
|
|
|
|
def test_ndef_read(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID, ndef_message=NDEF))
|
|
s.select_app()
|
|
s.select_file("E104")
|
|
assert s.apdu("00B0000002")[0:2] == len(NDEF).to_bytes(2, "big")
|
|
assert s.apdu("00B00002%02X" % len(NDEF))[:-2] == NDEF
|
|
|
|
def test_proprietary_files_present(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
for fid in ("E1A1", "E1A2", "E1A3", "E1A4", "E1AF"):
|
|
assert s.select_file(fid) == b"\x90\x00"
|
|
|
|
def test_cc_write_never(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
s.select_file("E103")
|
|
# EF.CC write policy is NEVER → 6982 (offset 0x20 is outside the fixed 02..0E range)
|
|
assert s.apdu("00D6002001FF") == b"\x69\x82"
|
|
|
|
def test_cc_fixed_region_protected(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
s.select_file("E103")
|
|
assert s.apdu("00D6000201FF") == b"\x69\x85" # offset 02 in fixed region
|
|
|
|
def test_read_binary_6cxx(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
s.select_file("E103") # 64-byte CC
|
|
r = s.apdu("00B00000FF") # Le 255 > file size
|
|
assert r[0] == 0x6C and r[1] == 64
|
|
|
|
|
|
class TestAuthenticate:
|
|
def test_ecdsa_signature(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
sig = s.apdu("0088000004DEADBEEF00")
|
|
assert sig[-2:] == b"\x90\x00"
|
|
assert sig[0] == 0x30 # DER SEQUENCE
|
|
# verify the signature against the tag's public key
|
|
from Crypto.Signature import DSS
|
|
from Crypto.Hash import SHA256
|
|
h = SHA256.new(bytes.fromhex("DEADBEEF"))
|
|
DSS.new(s.tag._ecc_key.public_key(), "fips-186-3", encoding="der").verify(h, sig[:-2])
|
|
|
|
def test_empty_challenge_rejected(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
assert s.apdu("0088000000") == b"\x67\x00"
|
|
|
|
|
|
class TestPasswordManagement:
|
|
def test_create_and_fap_gating(self):
|
|
tag = OptigaAuthenticateNBT(uid=UID)
|
|
s = Session(tag)
|
|
s.select_app()
|
|
assert s.apdu("00E10000090111223344AABB0003") == b"\x90\x00" # create pwid 1
|
|
tag.set_fap(b"\xE1\x04", nfc_read=0x81, nfc_write=0x40) # NDEF read pw-protected
|
|
# read without verify → 6982
|
|
s.select_file("E104")
|
|
assert s.apdu("00B0000002") == b"\x69\x82"
|
|
# select with read password (tag 52) then read
|
|
assert s.apdu("00A4000C08E1045204 11223344".replace(" ", ""))[-2:] == b"\x90\x00"
|
|
assert s.apdu("00B0000002")[-2:] == b"\x90\x00"
|
|
|
|
def test_create_password_validation(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
# password response 0000 is RFU/rejected
|
|
assert s.apdu("00E1000009011122334400000003") == b"\x6A\x80"
|
|
|
|
def test_change_password(self):
|
|
tag = OptigaAuthenticateNBT(uid=UID)
|
|
s = Session(tag)
|
|
s.select_app()
|
|
s.apdu("00E10000090111223344AABB0003")
|
|
# CHANGE (P2 b7=1 → 0x41 for pwid 1): new password
|
|
assert s.apdu("0024004104AABBCCDD") == b"\x90\x00"
|
|
assert tag._passwords[1].value == b"\xAA\xBB\xCC\xDD"
|
|
|
|
def test_delete_password(self):
|
|
tag = OptigaAuthenticateNBT(uid=UID)
|
|
s = Session(tag)
|
|
s.select_app()
|
|
s.apdu("00E10000090111223344AABB0003")
|
|
assert s.apdu("00E4000100") == b"\x90\x00" # delete pwid 1
|
|
assert 1 not in tag._passwords
|
|
|
|
|
|
class TestLifecycle:
|
|
def test_finalize_personalization(self):
|
|
tag = OptigaAuthenticateNBT(uid=UID)
|
|
s = Session(tag)
|
|
s.select_app()
|
|
assert tag.lifecycle == "PERSONALIZATION"
|
|
assert s.apdu("00E2000003BF6300") == b"\x90\x00"
|
|
assert tag.lifecycle == "OPERATIONAL"
|
|
# PERSONALIZE DATA rejected in OPERATIONAL
|
|
assert s.apdu("00E2000003BF6300") == b"\x69\x85"
|
|
|
|
def test_get_data_applet_version(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
assert s.apdu("0030DF3A00")[-2:] == b"\x90\x00"
|
|
|
|
|
|
class TestRobustness:
|
|
def test_short_apdu_no_crash(self):
|
|
s = Session(OptigaAuthenticateNBT(uid=UID))
|
|
s.select_app()
|
|
assert s.apdu("00B0") == b"\x67\x00" # truncated, no IndexError
|
|
assert s.apdu("00A4") == b"\x67\x00"
|