nPA: added option to disable validity period check

npa/src/npa-tool.c

@@ -224,6 +224,8 @@ main (int argc, char **argv)
     }
     if (cmdline.tr_03110v201_flag)
         tr_version = EAC_TR_VERSION_2_01;
+    if (cmdline.disable_checks_flag)
+        npa_default_flags |= NPA_FLAG_DISABLE_CHECKS;
 
 
     if (cmdline.info_flag)

npa/src/npa-tool.ggo.in

@@ -92,6 +92,9 @@ option "translate"      t
 option "tr-03110v201"    -
     "Force compliance to BSI TR-03110 version 2.01"
     flag off
+option "disable-checks"   -
+    "Disable checking fly-by-data"
+    flag off
 
 text "
 Report bugs to @PACKAGE_BUGREPORT@

npa/src/npa.c

@@ -214,7 +214,6 @@ IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R)
 
 #define maxresp SC_MAX_APDU_BUFFER_SIZE - 2
 
-#define NPA_FLAG_DISABLE_CHECKS 1
 /** NPA secure messaging context */
 struct npa_sm_ctx {
     /** Send sequence counter */
@@ -259,6 +258,10 @@ static int increment_ssc(struct npa_sm_ctx *eacsmctx);
 static int decrement_ssc(struct npa_sm_ctx *eacsmctx);
 static int reset_ssc(struct npa_sm_ctx *eacsmctx);
 
+
+char npa_default_flags = 0;
+
+
 static struct npa_sm_ctx *
 npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description,
         size_t certificate_description_length,
@@ -290,7 +293,9 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description,
     out->eph_pub_key = NULL;
     out->auxiliary_data = NULL;
 
-    out->flags = NPA_FLAG_DISABLE_CHECKS;
+    out->flags = npa_default_flags;
+    if (out->flags & NPA_FLAG_DISABLE_CHECKS)
+        TA_disable_checks(out->ctx);
 
     return out;
 
@@ -1630,8 +1635,6 @@ int perform_terminal_authentication(struct sm_ctx *ctx, sc_card_t *card,
     }
     struct npa_sm_ctx *eacsmctx = ctx->priv_data;
 
-    eacsmctx->flags = 0;
-
 
     while (*certs && *certs_lens) {
         cert = *certs;
@@ -1670,6 +1673,8 @@ int perform_terminal_authentication(struct sm_ctx *ctx, sc_card_t *card,
         r = SC_ERROR_INTERNAL;
         goto err;
     }
+
+
     if (eacsmctx->eph_pub_key)
         BUF_MEM_free(eacsmctx->eph_pub_key);
     eacsmctx->eph_pub_key = TA_STEP3_generate_ephemeral_key(eacsmctx->ctx);
@@ -1852,8 +1857,6 @@ int perform_chip_authentication(struct sm_ctx *ctx, sc_card_t *card)
     }
     struct npa_sm_ctx *eacsmctx = ctx->priv_data;
 
-    eacsmctx->flags = 0;
-
 
     /* Passive Authentication */
     r = get_ef_card_security(ctx, card, &ef_cardsecurity, &ef_cardsecurity_len);
@@ -2213,7 +2216,7 @@ npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
     }
     struct npa_sm_ctx *eacsmctx = ctx->priv_data;
 
-    if (eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS) {
+    if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
         if (apdu->ins == 0x2a && apdu->p1 == 0x00 && apdu->p2 == 0xbe) {
             /* PSO:Verify Certificate
              * check certificate description to match given certificate */
@@ -2430,7 +2433,7 @@ npa_sm_finish(sc_card_t *card, const struct sm_ctx *ctx,
                 SC_ERROR_INVALID_ARGUMENTS);
     struct npa_sm_ctx *eacsmctx = ctx->priv_data;
 
-    if (eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS) {
+    if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
         if (apdu->sw1 == 0x90 && apdu->sw2 == 0x00) {
             if (apdu->ins == 0x84 && apdu->p1 == 0x00 && apdu->p2 == 0x00
                     && apdu->le == 8 && apdu->resplen == 8) {

npa/src/npa/npa.h

@@ -198,6 +198,9 @@ int npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
 #define npa_change_pin(ctx, card, newp, newplen) \
     npa_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
 
+#define NPA_FLAG_DISABLE_CHECKS 1
+extern char npa_default_flags;
+
 #ifdef  __cplusplus
 }
 #endif

virtualsmartcard/src/vpicc/vicc.in

@@ -81,6 +81,10 @@ npa.add_argument("-c", "--ca",
         action="store",
         type=str,
         help="CHR of the CVCA.")
+npa.add_argument("-d", "--disable-checks",
+        action="store_true", default=False,
+        help="Disable checking validity period of TA certificate")
+
 
 args = parser.parse_args()
 
@@ -106,5 +110,5 @@ if (args.ca_pubkey):
 vicc = VirtualICC(args.file, args.type,
         args.hostname, args.port, readernum=args.reader,
         ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data, ca_pubkey=ca_pubkey_data,
-        ca_key=ca_key_data, ca=args.ca)
+        ca_key=ca_key_data, ca=args.ca, disable_checks=args.disable_checks)
 vicc.run()

virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py

@@ -499,11 +499,12 @@ class RelayOS(SmartcardOS):
 
 
 class NPAOS(Iso7816OS):
-    def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None):
+    def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False):
         Iso7816OS.__init__(self, mf, sam, ins2handler, maxle)
         self.ins2handler[0x86] = self.SAM.general_authenticate
         self.ins2handler[0x2c] = self.SAM.reset_retry_counter
         self.atr = '\x3B\x8A\x80\x01\x80\x31\xF8\x73\xF7\x41\xE0\x82\x90\x00\x75'
+        self.SAM.current_SE.disable_checks = disable_checks
         if ef_cardsecurity:
             ef = self.mf.select('fid', 0x011d)
             ef.data = ef_cardsecurity
@@ -556,7 +557,7 @@ class VirtualICC(object):
     the vpcd, which forwards it to the application.
     """ 
     
-    def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None):
+    def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False):
         from os.path import exists
         
         logging.basicConfig(level = logging.INFO, 
@@ -581,7 +582,7 @@ class VirtualICC(object):
         if card_type == "iso7816" or card_type == "ePass":
             self.os = Iso7816OS(MF, SAM)
         elif card_type == "nPA":
-            self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca)
+            self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca, disable_checks=disable_checks)
         elif card_type == "cryptoflex":
             self.os = CryptoflexOS(MF, SAM)
         elif card_type == "relay":

virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py

@@ -109,6 +109,7 @@ class nPA_SE(Security_Environment):
         self.ca = "DECVCAeID00102"
         self.ca_key = None
         self.ca_pubkey = None
+        self.disable_checks = False
 
     def _set_SE(self, p2, data):
         sw, resp = Security_Environment._set_SE(self, p2, data)
@@ -302,6 +303,8 @@ class nPA_SE(Security_Environment):
                 pace.print_ossl_err()
                 raise SwError(SW["WARN_NOINFO63"])
             result.append([0x87, len(self.ca), self.ca])
+            if (self.disable_checks):
+                pace.TA_disable_checks(self.eac_ctx)
 
         return 0x9000, nPA_SE.__pack_general_authenticate(result)