# nPA Module

class `virtualsmartcard.cards.nPA.``NPAOS`(mf, sam, ins2handler=None, maxle=65536, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, cvca=None, disable_checks=False, esign_key=None, esign_ca_cert=None, esign_cert=None)

  Bases: `virtualsmartcard.VirtualSmartcard.Iso7816OS`

  `SAM`

    secure access module

  `execute`(msg)
  `formatResult`(seekable, le, data, sw, sm)
  `getATR`()
  `getResponse`(p1, p2, data)
  static `makeATR`(**args)

    Calculate Answer to Reset (ATR) and returns the bitstring.

    > - directConvention (bool): Whether to use direct convention or

    >     inverse convention.

    > - TAi, TBi, TCi (optional): Value between 0 and 0xff. Interface

    >     Characters (for meaning see ISO 7816-3). Note that if no transmission protocol is given, it is automatically selected with T=max{j-1|TAj in args OR TBj in args OR TCj in args}.

    > - T (optional): Value between 0 and 15. Transmission Protocol.

    >     Note that if T is set, TAi/TBi/TCi for i>T are omitted.

    > - histChars (optional): Bitstring with 0 <= len(histChars) <= 15.

    >     Historical Characters T1 to T15 (for meaning see ISO 7816-4).

    T0, TDi and TCK are automatically calculated.

  static `makeThirdSoftwareFunctionTable`(commandChainging=False, extendedLe=False, assignLogicalChannel=0, maximumChannels=0)

    Returns a byte according to the third software function table from the historical bytes of the card capabilities.

  `mf`

    master file

  `powerDown`()

    Powers down the card

  `powerUp`()
  `reset`()
  static `seekable`(ins)

class `virtualsmartcard.cards.nPA.``nPA_AT_CRT`

  Bases: `virtualsmartcard.SEutils.ControlReferenceTemplate`

  `PACE_CAN` = 2
  `PACE_MRZ` = 1
  `PACE_PIN` = 3
  `PACE_PUK` = 4
  `_ControlReferenceTemplate__replace_tag`(tag, data)

    Adjust the config string using a given tag, value combination. If the config string already contains a tag, value pair for the given tag, replace it. Otherwise append tag, length and value to the config string.

  `_ControlReferenceTemplate__set_algo`(data)

    Set the algorithm to be used by this CRT. The algorithms are specified in a global dictionary. New cards may add or modify this table in order to support new or different algorithms.

    Parameters: | data – reference to an algorithm

  `_ControlReferenceTemplate__set_iv`(tag, length, value)
  `_ControlReferenceTemplate__set_key`(tag, value)
  `keyref_is_can`()
  `keyref_is_mrz`()
  `keyref_is_pin`()
  `keyref_is_puk`()
  `parse_SE_config`(config)
  `to_string`()

    Return the content of the CRT, encoded as TLV data in a string

class `virtualsmartcard.cards.nPA.``nPA_SAM`(eid_pin, can, mrz, puk, qes_pin, mf, default_se=<class 'virtualsmartcard.cards.nPA.nPA_SE'>)

  Bases: `virtualsmartcard.SmartcardSAM.SAM`

  `FSdecrypt`(data)

    Decrypt the given data, using the parameters stored in the SAM. Right now we do not encrypt the data. In memory encryption might or might not be added in a future version.

  `FSencrypt`(data)

    Encrypt the given data, using the parameters stored in the SAM. Right now we do not encrypt the data. In memory encryption might or might not be added in a future version.

  `_get_referenced_key`(p1, p2)

    This method returns the key specified by the p2 parameter. The key may be stored on the cards filesystem.

    - Parameters: | p1 – Specifies the algorithm to use. p2 – Specifies a reference to the key to be used for encryption.
      b8 | b7 | b6 | b5 | b4 | b3 | b2 | b1 | Meaning
      --- | --- | --- | --- | --- | --- | --- | --- | ---
      0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | No information is given
      0 |  |  |  |  |  |  |  | Global reference data(e.g. MF specific key)
      1 |  |  |  |  |  |  |  | Specific reference data(e.g. DF specific key)
      |  |  | x | x | x | x | x | Number of the secret
    Any other value RFU

  `change_reference_data`(p1, p2, data)

    Change the specified referenced data (e.g. CHV) of the card

  `erase_SE`(SEID)

    Erases a Security Environment stored under SEID from the SAM

  `external_authenticate`(p1, p2, data)
  `general_authenticate`(p1, p2, data)
  `generate_public_key_pair`(p1, p2, data)
  `get_card_number`()
  `get_challenge`(p1, p2, data)
  `internal_authenticate`(p1, p2, data)

    Authenticate card to terminal. Encrypt the challenge of the terminal to prove key posession

  `manage_security_environment`(p1, p2, data)
  `mutual_authenticate`(p1, p2, mutual_challenge)

    Takes an encrypted challenge in the form ‘Terminal Challenge | Card Challenge | Card number’ and checks it for validity. If the challenge is successful the card encrypts ‘Card Challenge | Terminal challenge’ and returns this value

  `parse_SM_CAPDU`(CAPDU, header_authentication)
  `perform_security_operation`(p1, p2, data)
  `protect_result`(sw, unprotected_result)
  `reset_retry_counter`(p1, p2, data)
  `restore_SE`(SEID)

    Restores a Security Environment from the SAM and replaces the current SE with it.

  `set_MF`(mf)

    Setter function for the internal reference to the Filesystem. The SAM needs a reference to the filesystem in order to store/retrieve keys.

  `set_asym_algorithm`(cipher, keytype)

    Parameters: | cipher – Public/private key object from used for encryption keytype – Type of the public key (e.g. RSA, DSA)

  `store_SE`(SEID)

    Stores the current Security environment in the secure access module. The SEID is used as a reference to identify the SE.

  `verify`(p1, p2, data)

class `virtualsmartcard.cards.nPA.``nPA_SE`(MF, SAM)

  Bases: `virtualsmartcard.SEutils.Security_Environment`

  `_nPA_SE__eac_ca`(data)
  `_nPA_SE__eac_pace_step1`(data)
  `_nPA_SE__eac_pace_step2`(data)
  `_nPA_SE__eac_pace_step3`(data)
  `_nPA_SE__eac_pace_step4`(data)
  static `_nPA_SE__pack_general_authenticate`(data)
  static `_nPA_SE__unpack_general_authenticate`(data)
  `_set_SE`(p2, data)
  `compute_cryptographic_checksum`(p1, p2, data)
  `compute_digital_signature`(p1, p2, data)
  `decipher`(p1, p2, data)
  `eac_step`

    next step to performed for EAC

  `encipher`(p1, p2, data)
  `external_authenticate`(p1, p2, data)

    Authenticate the terminal to the card. Check whether Terminal correctly encrypted the given challenge or not

  `general_authenticate`(p1, p2, data)
  `generate_public_key_pair`(p1, p2, data)

    The GENERATE PUBLIC-KEY PAIR command either initiates the generation and storing of a key pair, i.e., a public key and a private key, in the card, or accesses a key pair previously generated in the card.

    Parameters: | p1 – should be 0x00 (generate new key) p2 – ‘00’ (no information provided) or reference of the key to be generated data – One or more CRTs associated to the key generation if P1-P2 different from ‘0000’

  `hash`(p1, p2, data)

    Hash the given data using the algorithm specified by the current Security environment.

    Returns: | raw data (no TLV coding).

  `manage_security_environment`(p1, p2, data)

    This method is used to store, restore or erase Security Environments or to manipulate the various parameters of the current SE. P1 specifies the operation to perform, p2 is either the SEID for the referred SE or the tag of a control reference template

    Parameters: | p1 – Bitmask according to this table
    b8 | b7 | b6 | b5 | b4 | b3 | b2 | b1 | Meaning
    --- | --- | --- | --- | --- | --- | --- | --- | ---
    |  |  | 1 |  |  |  |  | Secure messaging in command data field
    |  | 1 |  |  |  |  |  | Secure messaging in response data field
    | 1 |  |  |  |  |  |  | Computation, decipherment, internal authentication and key agreement
    1 |  |  |  |  |  |  |  | Verification, encipherment, external authentication and key agreement
    |  |  |  | 0 | 0 | 0 | 1 | SET
    1 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | STORE
    1 | 1 | 1 | 1 | 0 | 0 | 1 | 1 | RESTORE
    1 | 1 | 1 | 1 | 0 | 1 | 0 | 0 | ERASE

  `parse_SM_CAPDU`(CAPDU, authenticate_header)

    This methods parses a data field including Secure Messaging objects. SM_header indicates whether or not the header of the message shall be authenticated. It returns an unprotected command APDU

    Parameters: | CAPDU – The protected CAPDU to be parsed authenticate_header – Whether or not the header should be included in authentication mechanisms
    Returns: | Unprotected command APDU

  `perform_security_operation`(p1, p2, data)

    In the end this command is nothing but a big switch for all the other commands in ISO 7816-8. It will invoke the appropriate command and return its result

  `protect_response`(sw, result)

    This method protects a response APDU using secure messaging mechanisms

    Returns: | the protected data and the SW bytes

  `verify_certificate`(p1, p2, data)
  `verify_cryptographic_checksum`(p1, p2, data)

    Verify the cryptographic checksum contained in the data field. Data field must contain a cryptographic checksum (tag 0x8E) and a plain value (tag 0x80)

  `verify_digital_signature`(p1, p2, data)

    Verify the digital signature contained in the data field. Data must contain a data to sign (tag 0x9A, 0xAC or 0xBC) and a digital signature (0x9E)