VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

renamed libpace to libnpa

Browse Source 
git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@403 96b47cad-a561-4643-ad3b-153ac7d7599c
This commit is contained in:
frankmorgner
2011-02-02 18:49:14 +00:00
parent ddbf72ee2e
commit 8cd77084cc
20 changed files with 286 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ccid/configure.ac
View File

@@ -70,14 +70,14 @@ AC_ARG_ENABLE(pace,
saved_CPPFLAGS="$CPPFLAGS"
saved_LIBS="$LIBS"
if test "x$enable_pace" != xno ; then
PKG_CHECK_EXISTS([libpace],
[PKG_CHECK_MODULES([LIBPACE], [libpace])],
[AC_MSG_WARN([libpace not found by pkg-config])])
CPPFLAGS="$CPPFLAGS $LIBPACE_CFLAGS -I$(pwd)/src/opensc/src"
LIBS="$LDFLAGS $LIBPACE_LIBS"
AC_CHECK_HEADERS(pace/pace.h, [], [ AC_MSG_ERROR([pace/pace.h not found, install libpace or use ./configure LIBPACE_CFLAGS=...]) ])
PKG_CHECK_EXISTS([libnpa],
[PKG_CHECK_MODULES([LIBNPA], [libnpa])],
[AC_MSG_WARN([libnpa not found by pkg-config])])
CPPFLAGS="$CPPFLAGS $LIBNPA_CFLAGS -I$(pwd)/src/opensc/src"
LIBS="$LDFLAGS $LIBNPA_LIBS"
AC_CHECK_HEADERS(npa/npa.h, [], [ AC_MSG_ERROR([npa/npa.h not found, install libnpa or use ./configure LIBNPA_CFLAGS=...]) ])
AC_MSG_CHECKING([for EstablishPACEChannel])
AC_TRY_LINK_FUNC(EstablishPACEChannel, [ AC_MSG_RESULT([yes]) ], [ AC_MSG_ERROR([libpace not found, use ./configure LIBPACE_LIBS=...]) ])
AC_TRY_LINK_FUNC(EstablishPACEChannel, [ AC_MSG_RESULT([yes]) ], [ AC_MSG_ERROR([libnpa not found, use ./configure LIBNPA_LIBS=...]) ])
enable_pace=yes
else

4
ccid/src/Makefile.am
View File

@@ -31,8 +31,8 @@ endif
if WITH_PACE
ccid_emulator_LDADD += $(LIBPACE_LIBS)
ccid_emulator_CFLAGS += $(LIBPACE_CFLAGS)
ccid_emulator_LDADD += $(LIBNPA_LIBS)
ccid_emulator_CFLAGS += $(LIBNPA_CFLAGS)
else
ccid_emulator_SOURCES += scutil.c
ccid_emulator_LDADD += $(OPENSC_LIBS)

8
ccid/src/ccid.c
View File

@@ -30,9 +30,9 @@
#include "config.h"
#ifdef WITH_PACE
#include <pace/pace.h>
#include <pace/sm.h>
#include <pace/scutil.h>
#include <npa/npa.h>
#include <npa/sm.h>
#include <npa/scutil.h>
static struct sm_ctx sctx;
#ifdef BUERGERCLIENT_WORKAROUND
@@ -154,7 +154,7 @@ void ccid_shutdown()
sc_release_context(ctx);
#ifdef WITH_PACE
pace_sm_ctx_clear_free(sctx.cipher_ctx);
npa_sm_ctx_clear_free(sctx.cipher_ctx);
memset(&sctx, 0, sizeof(sctx));
#ifdef BUERGERCLIENT_WORKAROUND
free(ef_cardaccess);

2
ccid/src/ccid.h
View File

@@ -260,7 +260,7 @@ typedef struct {
} __attribute__ ((packed)) RDR_to_PC_Parameters_t;
typedef struct {
__u8 bMessageType;
__u8 bmSlotICCState; /* we support 4 slots, so we need 2*4 bits = 1 byte */
__u8 bmSlotICCState; /* we support 1 slots, so we need 2*1 bits = 1 byte */
} __attribute__ ((packed)) RDR_to_PC_NotifySlotChange_t;
struct hid_class_descriptor {

2
ccid/src/scutil.h
View File

@@ -1 +1 @@
../../npa/src/pace/scutil.h
../../npa/src/npa/scutil.h

4
ccid/src/usb.c
View File

@@ -1805,8 +1805,8 @@ main (int argc, char **argv)
if (doinfo) {
fprintf(stderr, "%s 0.9 written by Frank Morgner.\n\n" ,
argv[0]);
fprintf(stderr, "%s %s written by Frank Morgner.\n\n" ,
argv[0], VERSION);
return print_avail(verbose);
}

10
npa/Makefile.am
View File

@@ -1,7 +1,7 @@
ACLOCAL_AMFLAGS = -I m4
SUBDIRS = src m4
EXTRA_DIST = README.dox libpace.pc.in Doxyfile.in
EXTRA_DIST = README.dox libnpa.pc.in Doxyfile.in
do_subst = sed \
-e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \
@@ -37,9 +37,9 @@ doc :
endif
pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libpace.pc
libpace.pc:
$(do_subst) < $(srcdir)/libpace.pc.in > libpace.pc
pkgconfig_DATA = libnpa.pc
libnpa.pc:
$(do_subst) < $(srcdir)/libnpa.pc.in > libnpa.pc
clean-local:
rm -rf doc Doxyfile libpace.pc
rm -rf doc Doxyfile libnpa.pc

18
npa/README.dox
View File

@@ -7,8 +7,8 @@ secure messaging, which could also be used for other cards.
npa is implemented using OpenPACE (http://sourceforge.net/projects/openpace/).
Some fragments of the source code are on the source code of the OpenSC tools.
The included pace-tool has support for Password Authenticated Connection
Establishment (PACE). pace-tool can be used for PIN management or to encrypt
The included npa-tool has support for Password Authenticated Connection
Establishment (PACE). npa-tool can be used for PIN management or to encrypt
APDUs inside a secure messaging channel established with PACE.
@@ -38,28 +38,28 @@ against use something like the following command:
@section u USAGE
When testing PACE with either PIN, CAN, MRZ or PUK run pace-tool. Here you can
When testing PACE with either PIN, CAN, MRZ or PUK run npa-tool. Here you can
enter APDUs which are to be converted according to the secure messaging
parameter and to be sent to the card. Herefor insert the APDU in hex (upper or
lower case) with a colon to separate the bytes or without it. Example APDUs can
be found in the file apdus.
To pass a secret to pace-tool, the command line parameters or the environment
To pass a secret to npa-tool, the command line parameters or the environment
variables PIN/CAN/MRZ/PUK/NEWPIN can be used. If none of these options is used,
pace-tool will show a password prompt.
npa-tool will show a password prompt.
@subsection l LINKING AGAINST LIBNPA
If you have a local build of libpace and OpenPACE, the preferred way to adjust
If you have a local build of libnpa and OpenPACE, the preferred way to adjust
libraries and cflags for foreign code is to use pkg-config:
./configure \
PKG_CONFIG_PATH=/path/to/openssl-1.0.0c_with_openpace-0.4/lib/pkgconfig:/path/to/libpace/lib/pkgconfig"
PKG_CONFIG_PATH=/path/to/openssl-1.0.0c_with_openpace-0.4/lib/pkgconfig:/path/to/libnpa/lib/pkgconfig"
Alternatively you can define libs and cflags by hand:
./configure \
OPENSSL_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include" \
LIBPACE_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include -I/path/to/libpace-0.1/src" \
LIBNPA_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include -I/path/to/libnpa-0.1/src" \
OPENSSL_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto" \
LIBPACE_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto -L/path/to/libpace-0.1/src/.libs -lpace"
LIBNPA_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto -L/path/to/libnpa-0.1/src/.libs -lnpa"
@section q QUESTIONS

4
npa/configure.ac
View File

@@ -2,8 +2,8 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ([2.63])
AC_INIT([libpace], [0.1], [http://sourceforge.net/projects/vsmartcard/support])
AC_CONFIG_SRCDIR([src/pace.c])
AC_INIT([npa], [0.2], [http://sourceforge.net/projects/vsmartcard/support])
AC_CONFIG_SRCDIR([src/npa.c])
AC_CONFIG_HEADERS([config.h])
AC_CONFIG_MACRO_DIR([m4])
AM_INIT_AUTOMAKE

11
npa/libnpa.pc.in Normal file
View File

@@ -0,0 +1,11 @@
prefix=@prefix@
exec_prefix=@exec_prefix@
libdir=@libdir@
includedir=@includedir@
Name: lib@PACKAGE_NAME@
Description: Library for the new German ID card (neuer Personalausweis, nPA)
Version: @VERSION@
Requires: libcrypto
Libs: -L${libdir} -lnpa @OPENSC_LIBS@
Cflags: -I${includedir}

11
npa/libpace.pc.in
View File

@@ -1,11 +0,0 @@
prefix=@prefix@
exec_prefix=@exec_prefix@
libdir=@libdir@
includedir=@includedir@
Name: libpace
Description: Password Authenticated Connection Establishment (PACE) library
Version: @VERSION@
Requires: libssl
Libs: -L${libdir} -lpace @OPENSC_LIBS@
Cflags: -I${includedir}

26
npa/src/Makefile.am
View File

@@ -1,25 +1,25 @@
EXTRA_DIST = opensc
AM_CPPFLAGS = -I$(top_srcdir)/src/pace -I$(top_srcdir)/src/opensc/src
AM_CPPFLAGS = -I$(top_srcdir)/src/npa -I$(top_srcdir)/src/opensc/src
libpace_la_SOURCES = sm.c scutil.c pace.c pace_lib.c
libpace_la_LIBADD = $(OPENSSL_LIBS) $(OPENSC_LIBS)
libpace_la_CFLAGS = $(OPENSSL_CFLAGS)
libnpa_la_SOURCES = sm.c scutil.c npa.c npa_lib.c
libnpa_la_LIBADD = $(OPENSSL_LIBS) $(OPENSC_LIBS)
libnpa_la_CFLAGS = $(OPENSSL_CFLAGS)
pace_tool_SOURCES = pace-tool.c binutil.c
pace_tool_LDADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libpace.la
pace_tool_CFLAGS = $(OPENSSL_CFLAGS)
npa_tool_SOURCES = npa-tool.c binutil.c
npa_tool_LDADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libnpa.la
npa_tool_CFLAGS = $(OPENSSL_CFLAGS)
bin_PROGRAMS = pace-tool
bin_PROGRAMS = npa-tool
lib_LTLIBRARIES = libpace.la
lib_LTLIBRARIES = libnpa.la
noinst_HEADERS = \
binutil.h
nobase_include_HEADERS = \
pace/sm.h \
pace/pace.h \
pace/scutil.h \
pace/pace_lib.h
npa/sm.h \
npa/npa.h \
npa/scutil.h \
npa/npa_lib.h

39
npa/src/pace-tool.c → npa/src/npa-tool.c
View File

@@ -16,8 +16,9 @@
* You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>.
*/
#include "config.h"
#include "binutil.h"
#include "pace.h"
#include "npa.h"
#include "scutil.h"
#include <libopensc/log.h>
#include <openssl/pace.h>
@@ -111,7 +112,7 @@ static const char *option_help[] = {
"Print version, available readers and drivers.",
};
int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input)
int npa_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input)
{
u8 buf[4 + 3 + 0xffff + 3];
char *read = NULL;
@@ -304,8 +305,8 @@ main (int argc, char **argv)
if (doinfo) {
fprintf(stderr, "%s 0.9 written by Frank Morgner.\n\n" ,
argv[0]);
fprintf(stderr, "%s %s written by Frank Morgner.\n\n" ,
argv[0], VERSION);
return print_avail(verbose);
}
@@ -332,12 +333,12 @@ main (int argc, char **argv)
if (pin) {
if (sscanf(pin, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
exit(2);
}
if (strlen(can) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin_length);
exit(2);
}
@@ -348,12 +349,12 @@ main (int argc, char **argv)
if (can) {
if (sscanf(can, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
exit(2);
}
if (strlen(can) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin_length);
exit(2);
}
@@ -364,12 +365,12 @@ main (int argc, char **argv)
if (puk) {
if (sscanf(puk, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
exit(2);
}
if (strlen(puk) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin_length);
exit(2);
}
@@ -388,7 +389,7 @@ main (int argc, char **argv)
gettimeofday(&tv, NULL);
printf("%u,%06u: Trying %s=%s\n",
tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id), pace_input.pin);
npa_secret_name(pace_input.pin_id), pace_input.pin);
i = EstablishPACEChannel(NULL, card, pace_input, &pace_output,
&sctx);
@@ -400,12 +401,12 @@ main (int argc, char **argv)
if (0 > i) {
printf("%u,%06u: Tried breaking %s without success.\n",
tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
goto err;
} else {
printf("%u,%06u: Tried breaking %s with success (=%s).\n",
tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin);
}
}
@@ -455,7 +456,7 @@ main (int argc, char **argv)
goto err;
printf("Established PACE channel with PUK.\n");
i = pace_unblock_pin(&sctx, card);
i = npa_unblock_pin(&sctx, card);
if (i < 0)
goto err;
printf("Unblocked PIN.\n");
@@ -476,7 +477,7 @@ main (int argc, char **argv)
goto err;
printf("Established PACE channel with PIN.\n");
i = pace_change_pin(&sctx, card, newpin, newpin ? strlen(newpin) : 0);
i = npa_change_pin(&sctx, card, newpin, newpin ? strlen(newpin) : 0);
if (i < 0)
goto err;
printf("Changed PIN.\n");
@@ -520,7 +521,7 @@ main (int argc, char **argv)
if (i < 0)
goto err;
printf("Established PACE channel with %s.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
if (dotranslate) {
FILE *input;
@@ -532,7 +533,7 @@ main (int argc, char **argv)
perror("Opening file with APDUs");
}
i = pace_translate_apdus(&sctx, card, input);
i = npa_translate_apdus(&sctx, card, input);
fclose(input);
if (i < 0)
goto err;
@@ -540,8 +541,8 @@ main (int argc, char **argv)
}
err:
pace_sm_ctx_clear_free(sctx.cipher_ctx);
pace_sm_ctx_clear_free(tmpctx.cipher_ctx);
npa_sm_ctx_clear_free(sctx.cipher_ctx);
npa_sm_ctx_clear_free(tmpctx.cipher_ctx);
if (pace_output.ef_cardaccess)
free(pace_output.ef_cardaccess);
if (pace_output.recent_car)

266
npa/src/pace.c → npa/src/npa.c
View File

@@ -16,7 +16,7 @@
* You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>.
*/
#include "pace.h"
#include "npa.h"
#include "sm.h"
#include "scutil.h"
#include <libopensc/asn1.h>
@@ -40,34 +40,34 @@
* MSE:Set AT
*/
typedef struct pace_mse_set_at_cd_st {
typedef struct npa_mse_set_at_cd_st {
ASN1_OBJECT *cryptographic_mechanism_reference;
ASN1_INTEGER *key_reference1;
ASN1_INTEGER *key_reference2;
ASN1_OCTET_STRING *auxiliary_data;
ASN1_OCTET_STRING *eph_pub_key;
CVC_CHAT *chat;
} PACE_MSE_SET_AT_C;
ASN1_SEQUENCE(PACE_MSE_SET_AT_C) = {
} NPA_MSE_SET_AT_C;
ASN1_SEQUENCE(NPA_MSE_SET_AT_C) = {
/* 0x80
* Cryptographic mechanism reference */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0),
/* 0x83
* Reference of a public key / secret key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, key_reference1, ASN1_INTEGER, 3),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, key_reference1, ASN1_INTEGER, 3),
/* 0x84
* Reference of a private key / Reference for computing a session key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, key_reference2, ASN1_INTEGER, 4),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, key_reference2, ASN1_INTEGER, 4),
/* 0x67
* Auxiliary authenticated data */
ASN1_APP_IMP_OPT(PACE_MSE_SET_AT_C, auxiliary_data, ASN1_OCTET_STRING, 7),
ASN1_APP_IMP_OPT(NPA_MSE_SET_AT_C, auxiliary_data, ASN1_OCTET_STRING, 7),
/* 0x91
* Ephemeral Public Key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, eph_pub_key, ASN1_OCTET_STRING, 0x11),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, eph_pub_key, ASN1_OCTET_STRING, 0x11),
/* Certificate Holder Authorization Template */
ASN1_OPT(PACE_MSE_SET_AT_C, chat, CVC_CHAT),
} ASN1_SEQUENCE_END(PACE_MSE_SET_AT_C)
IMPLEMENT_ASN1_FUNCTIONS(PACE_MSE_SET_AT_C)
ASN1_OPT(NPA_MSE_SET_AT_C, chat, CVC_CHAT),
} ASN1_SEQUENCE_END(NPA_MSE_SET_AT_C)
IMPLEMENT_ASN1_FUNCTIONS(NPA_MSE_SET_AT_C)
/*
@@ -75,96 +75,96 @@ IMPLEMENT_ASN1_FUNCTIONS(PACE_MSE_SET_AT_C)
*/
/* Protocol Command Data */
typedef struct pace_gen_auth_cd_st {
typedef struct npa_gen_auth_cd_st {
ASN1_OCTET_STRING *mapping_data;
ASN1_OCTET_STRING *eph_pub_key;
ASN1_OCTET_STRING *auth_token;
} PACE_GEN_AUTH_C_BODY;
ASN1_SEQUENCE(PACE_GEN_AUTH_C_BODY) = {
} NPA_GEN_AUTH_C_BODY;
ASN1_SEQUENCE(NPA_GEN_AUTH_C_BODY) = {
/* 0x81
* Mapping Data */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, mapping_data, ASN1_OCTET_STRING, 1),
ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, mapping_data, ASN1_OCTET_STRING, 1),
/* 0x83
* Ephemeral Public Key */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3),
ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3),
/* 0x85
* Authentication Token */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, auth_token, ASN1_OCTET_STRING, 5),
} ASN1_SEQUENCE_END(PACE_GEN_AUTH_C_BODY)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_C_BODY)
ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, auth_token, ASN1_OCTET_STRING, 5),
} ASN1_SEQUENCE_END(NPA_GEN_AUTH_C_BODY)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_C_BODY)
typedef PACE_GEN_AUTH_C_BODY PACE_GEN_AUTH_C;
typedef NPA_GEN_AUTH_C_BODY NPA_GEN_AUTH_C;
/* 0x7C
* Dynamic Authentication Data */
ASN1_ITEM_TEMPLATE(PACE_GEN_AUTH_C) =
ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_C) =
ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION,
0x1c, PACE_GEN_AUTH_C, PACE_GEN_AUTH_C_BODY)
ASN1_ITEM_TEMPLATE_END(PACE_GEN_AUTH_C)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_C)
0x1c, NPA_GEN_AUTH_C, NPA_GEN_AUTH_C_BODY)
ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_C)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_C)
/* Protocol Response Data */
typedef struct pace_gen_auth_rapdu_body_st {
typedef struct npa_gen_auth_rapdu_body_st {
ASN1_OCTET_STRING *enc_nonce;
ASN1_OCTET_STRING *mapping_data;
ASN1_OCTET_STRING *eph_pub_key;
ASN1_OCTET_STRING *auth_token;
ASN1_OCTET_STRING *cur_car;
ASN1_OCTET_STRING *prev_car;
} PACE_GEN_AUTH_R_BODY;
ASN1_SEQUENCE(PACE_GEN_AUTH_R_BODY) = {
} NPA_GEN_AUTH_R_BODY;
ASN1_SEQUENCE(NPA_GEN_AUTH_R_BODY) = {
/* 0x80
* Encrypted Nonce */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0),
/* 0x82
* Mapping Data */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, mapping_data, ASN1_OCTET_STRING, 2),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, mapping_data, ASN1_OCTET_STRING, 2),
/* 0x84
* Ephemeral Public Key */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4),
/* 0x86
* Authentication Token */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, auth_token, ASN1_OCTET_STRING, 6),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, auth_token, ASN1_OCTET_STRING, 6),
/* 0x87
* Most recent Certification Authority Reference */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, cur_car, ASN1_OCTET_STRING, 7),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, cur_car, ASN1_OCTET_STRING, 7),
/* 0x88
* Previous Certification Authority Reference */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, prev_car, ASN1_OCTET_STRING, 8),
} ASN1_SEQUENCE_END(PACE_GEN_AUTH_R_BODY)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_R_BODY)
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, prev_car, ASN1_OCTET_STRING, 8),
} ASN1_SEQUENCE_END(NPA_GEN_AUTH_R_BODY)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_R_BODY)
typedef PACE_GEN_AUTH_R_BODY PACE_GEN_AUTH_R;
typedef NPA_GEN_AUTH_R_BODY NPA_GEN_AUTH_R;
/* 0x7C
* Dynamic Authentication Data */
ASN1_ITEM_TEMPLATE(PACE_GEN_AUTH_R) =
ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_R) =
ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION,
0x1c, PACE_GEN_AUTH_R, PACE_GEN_AUTH_R_BODY)
ASN1_ITEM_TEMPLATE_END(PACE_GEN_AUTH_R)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_R)
0x1c, NPA_GEN_AUTH_R, NPA_GEN_AUTH_R_BODY)
ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_R)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_R)
const size_t maxresp = SC_MAX_APDU_BUFFER_SIZE - 2;
static int pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **enc);
static int pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *enc, size_t enclen, u8 **data);
static int pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **outdata);
static int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *mac, size_t maclen,
const u8 *macdata, size_t macdatalen);
static int pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *apdu);
static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *sm_apdu);
static int increment_ssc(struct pace_sm_ctx *psmctx);
static int decrement_ssc(struct pace_sm_ctx *psmctx);
static int reset_ssc(struct pace_sm_ctx *psmctx);
static int increment_ssc(struct npa_sm_ctx *psmctx);
static int decrement_ssc(struct npa_sm_ctx *psmctx);
static int reset_ssc(struct npa_sm_ctx *psmctx);
int GetReadersPACECapabilities(u8 *bitmap)
@@ -173,7 +173,7 @@ int GetReadersPACECapabilities(u8 *bitmap)
return SC_ERROR_INVALID_ARGUMENTS;
/* BitMap */
*bitmap = PACE_BITMAP_PACE|PACE_BITMAP_EID|PACE_BITMAP_ESIGN;
*bitmap = NPA_BITMAP_PACE|NPA_BITMAP_EID|NPA_BITMAP_ESIGN;
return SC_SUCCESS;
}
@@ -256,12 +256,12 @@ err:
return r;
}
static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
static int npa_mse_set_at(struct sm_ctx *oldnpactx, sc_card_t *card,
int protocol, int secret_key, const CVC_CHAT *chat, u8 *sw1, u8 *sw2)
{
sc_apdu_t apdu;
unsigned char *d = NULL;
PACE_MSE_SET_AT_C *data = NULL;
NPA_MSE_SET_AT_C *data = NULL;
int r, tries;
if (!sw1 || !sw2) {
@@ -277,7 +277,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
data = PACE_MSE_SET_AT_C_new();
data = NPA_MSE_SET_AT_C_new();
if (!data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -301,7 +301,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
data->chat = (CVC_CHAT *) chat;
r = i2d_PACE_MSE_SET_AT_C(data, &d);
r = i2d_NPA_MSE_SET_AT_C(data, &d);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding MSE:Set AT APDU data");
r = SC_ERROR_INTERNAL;
@@ -315,8 +315,8 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "MSE:Set AT command data", apdu.data, apdu.datalen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -338,7 +338,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
if (tries <= 1) {
/* this is only a warning... */
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Remaining tries: %d (%s must be %s)\n",
tries, pace_secret_name(secret_key),
tries, npa_secret_name(secret_key),
tries ? "resumed" : "unblocked");
}
r = SC_SUCCESS;
@@ -362,7 +362,7 @@ err:
if (data) {
/* do not free the functions parameter chat */
data->chat = NULL;
PACE_MSE_SET_AT_C_free(data);
NPA_MSE_SET_AT_C_free(data);
}
if (d)
free(d);
@@ -370,12 +370,12 @@ err:
return r;
}
static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
static int npa_gen_auth_1_encrypted_nonce(struct sm_ctx *oldnpactx,
sc_card_t *card, u8 **enc_nonce, size_t *enc_nonce_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -385,12 +385,12 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -403,8 +403,8 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -416,7 +416,7 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -455,7 +455,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -467,7 +467,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -475,13 +475,13 @@ err:
return r;
}
static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
static int npa_gen_auth_2_map_nonce(struct sm_ctx *oldnpactx,
sc_card_t *card, const u8 *in, size_t in_len, u8 **map_data_out,
size_t *map_data_out_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -491,7 +491,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -503,7 +503,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
r = SC_ERROR_INTERNAL;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -516,8 +516,8 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -529,7 +529,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -568,7 +568,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -580,7 +580,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -588,13 +588,13 @@ err:
return r;
}
static int pace_gen_auth_3_perform_key_agreement(
struct sm_ctx *oldpacectx, sc_card_t *card,
static int npa_gen_auth_3_perform_key_agreement(
struct sm_ctx *oldnpactx, sc_card_t *card,
const u8 *in, size_t in_len, u8 **eph_pub_key_out, size_t *eph_pub_key_out_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -604,7 +604,7 @@ static int pace_gen_auth_3_perform_key_agreement(
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -616,7 +616,7 @@ static int pace_gen_auth_3_perform_key_agreement(
r = SC_ERROR_INTERNAL;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -629,8 +629,8 @@ static int pace_gen_auth_3_perform_key_agreement(
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -642,7 +642,7 @@ static int pace_gen_auth_3_perform_key_agreement(
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -681,7 +681,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -693,7 +693,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -701,15 +701,15 @@ err:
return r;
}
static int pace_gen_auth_4_mutual_authentication(
struct sm_ctx *oldpacectx, sc_card_t *card,
static int npa_gen_auth_4_mutual_authentication(
struct sm_ctx *oldnpactx, sc_card_t *card,
const u8 *in, size_t in_len, u8 **auth_token_out,
size_t *auth_token_out_len, u8 **recent_car, size_t *recent_car_len,
u8 **prev_car, size_t *prev_car_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -719,7 +719,7 @@ static int pace_gen_auth_4_mutual_authentication(
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -732,7 +732,7 @@ static int pace_gen_auth_4_mutual_authentication(
r = SC_ERROR_INTERNAL;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -745,8 +745,8 @@ static int pace_gen_auth_4_mutual_authentication(
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -758,7 +758,7 @@ static int pace_gen_auth_4_mutual_authentication(
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -822,7 +822,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -834,7 +834,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -844,7 +844,7 @@ err:
}
int
pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
enum s_type pin_id, int ask_for_secret,
const char *new, size_t new_len)
{
@@ -906,19 +906,19 @@ get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id
if (!length_pin || !pin) {
if (0 > snprintf(buf, sizeof buf, "Please enter your %s: ",
pace_secret_name(pin_id))) {
npa_secret_name(pin_id))) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create password prompt.\n");
return NULL;
}
p = malloc(MAX_MRZ_LEN);
if (!p) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for %s.\n",
pace_secret_name(pin_id));
npa_secret_name(pin_id));
return NULL;
}
if (0 > EVP_read_pw_string_min(p, 0, MAX_MRZ_LEN, buf, 0)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read %s.\n",
pace_secret_name(pin_id));
npa_secret_name(pin_id));
return NULL;
}
length_pin = strnlen(p, MAX_MRZ_LEN);
@@ -944,7 +944,7 @@ void ssl_error(sc_context_t *ctx) {
ERR_free_strings();
}
int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
int EstablishPACEChannel(struct sm_ctx *oldnpactx, sc_card_t *card,
struct establish_pace_channel_input pace_input,
struct establish_pace_channel_output *pace_output,
struct sm_ctx *sctx)
@@ -1086,7 +1086,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
}
pctx->tr_version = pace_input.tr_version;
r = pace_mse_set_at(oldpacectx, card, info->protocol, pace_input.pin_id,
r = npa_mse_set_at(oldnpactx, card, info->protocol, pace_input.pin_id,
chat, &pace_output->mse_set_at_sw1, &pace_output->mse_set_at_sw2);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties "
@@ -1098,7 +1098,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_1_encrypted_nonce(oldpacectx, card, (u8 **) &enc_nonce->data,
r = npa_gen_auth_1_encrypted_nonce(oldnpactx, card, (u8 **) &enc_nonce->data,
&enc_nonce->length);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get encrypted nonce from card "
@@ -1127,7 +1127,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_2_map_nonce(oldpacectx, card, (u8 *) mdata->data, mdata->length,
r = npa_gen_auth_2_map_nonce(oldnpactx, card, (u8 *) mdata->data, mdata->length,
(u8 **) &mdata_opp->data, &mdata_opp->length);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange mapping data with card "
@@ -1147,7 +1147,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_3_perform_key_agreement(oldpacectx, card, (u8 *) pub->data, pub->length,
r = npa_gen_auth_3_perform_key_agreement(oldnpactx, card, (u8 *) pub->data, pub->length,
(u8 **) &pub_opp->data, &pub_opp->length);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange ephemeral public key with card "
@@ -1175,7 +1175,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_4_mutual_authentication(oldpacectx, card, (u8 *) token->data, token->length,
r = npa_gen_auth_4_mutual_authentication(oldnpactx, card, (u8 *) token->data, token->length,
(u8 **) &token_opp->data, &token_opp->length,
&pace_output->recent_car, &pace_output->recent_car_length,
&pace_output->previous_car, &pace_output->previous_car_length);
@@ -1227,7 +1227,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID PCD", pace_output->id_pcd,
pace_output->id_pcd_length);
sctx->authentication_ctx = pace_sm_ctx_create(k_mac,
sctx->authentication_ctx = npa_sm_ctx_create(k_mac,
k_enc, pctx);
if (!sctx->authentication_ctx) {
r = SC_ERROR_OUT_OF_MEMORY;
@@ -1237,12 +1237,12 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
if (r < 0)
goto err;
sctx->cipher_ctx = sctx->authentication_ctx;
sctx->authenticate = pace_sm_authenticate;
sctx->encrypt = pace_sm_encrypt;
sctx->decrypt = pace_sm_decrypt;
sctx->verify_authentication = pace_sm_verify_authentication;
sctx->pre_transmit = pace_sm_pre_transmit;
sctx->post_transmit = pace_sm_post_transmit;
sctx->authenticate = npa_sm_authenticate;
sctx->encrypt = npa_sm_encrypt;
sctx->decrypt = npa_sm_decrypt;
sctx->verify_authentication = npa_sm_verify_authentication;
sctx->pre_transmit = npa_sm_pre_transmit;
sctx->post_transmit = npa_sm_post_transmit;
sctx->padding_indicator = SM_ISO_PADDING;
sctx->block_length = EVP_CIPHER_block_size(pctx->cipher);
sctx->active = 1;
@@ -1299,7 +1299,7 @@ err:
if (pctx)
PACE_CTX_clear_free(pctx);
if (sctx->authentication_ctx)
pace_sm_ctx_free(sctx->authentication_ctx);
npa_sm_ctx_free(sctx->authentication_ctx);
}
return r;
@@ -1310,7 +1310,7 @@ static const char *PIN_name = "PIN";
static const char *PUK_name = "PUK";
static const char *CAN_name = "CAN";
static const char *UNDEF_name = "UNDEF";
const char *pace_secret_name(enum s_type pin_id) {
const char *npa_secret_name(enum s_type pin_id) {
switch (pin_id) {
case PACE_MRZ:
return MRZ_name;
@@ -1326,7 +1326,7 @@ const char *pace_secret_name(enum s_type pin_id) {
}
int
increment_ssc(struct pace_sm_ctx *psmctx)
increment_ssc(struct npa_sm_ctx *psmctx)
{
if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS;
@@ -1337,7 +1337,7 @@ increment_ssc(struct pace_sm_ctx *psmctx)
}
int
decrement_ssc(struct pace_sm_ctx *psmctx)
decrement_ssc(struct npa_sm_ctx *psmctx)
{
if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS;
@@ -1348,7 +1348,7 @@ decrement_ssc(struct pace_sm_ctx *psmctx)
}
int
reset_ssc(struct pace_sm_ctx *psmctx)
reset_ssc(struct npa_sm_ctx *psmctx)
{
if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS;
@@ -1359,7 +1359,7 @@ reset_ssc(struct pace_sm_ctx *psmctx)
}
static int
pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **enc)
{
BUF_MEM *encbuf = NULL, *databuf = NULL;
@@ -1370,7 +1370,7 @@ pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
databuf = BUF_MEM_create_init(data, datalen);
encbuf = PACE_encrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, databuf);
@@ -1403,7 +1403,7 @@ err:
}
static int
pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *enc, size_t enclen, u8 **data)
{
BUF_MEM *encbuf = NULL, *databuf = NULL;
@@ -1414,7 +1414,7 @@ pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
encbuf = BUF_MEM_create_init(enc, enclen);
databuf = PACE_decrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, encbuf);
@@ -1447,7 +1447,7 @@ err:
}
static int
pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **macdata)
{
BUF_MEM *macbuf = NULL;
@@ -1458,7 +1458,7 @@ pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
macbuf = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac,
data, datalen);
@@ -1490,7 +1490,7 @@ err:
}
static int
pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *mac, size_t maclen,
const u8 *macdata, size_t macdatalen)
{
@@ -1502,7 +1502,7 @@ pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
my_mac = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac,
macdata, macdatalen);
@@ -1534,14 +1534,14 @@ err:
}
static int
pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *apdu)
{
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL,
increment_ssc(ctx->cipher_ctx));
}
static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *sm_apdu)
{
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL,

110
npa/src/pace/pace.h → npa/src/npa/npa.h
View File

@@ -19,11 +19,11 @@
/**
* @file
*/
#ifndef _CCID_PACE_H
#define _CCID_PACE_H
#ifndef _CCID_NPA_H
#define _CCID_NPA_H
#include <pace/pace_lib.h>
#include <pace/sm.h>
#include <npa/npa_lib.h>
#include <npa/sm.h>
#include <libopensc/opensc.h>
#include <openssl/bn.h>
#include <openssl/pace.h>
@@ -32,49 +32,49 @@
extern "C" {
#endif
/** PACE capabilities (TR-03119): PACE */
#define PACE_BITMAP_PACE 0x40
/** PACE capabilities (TR-03119): EPA: eID */
#define PACE_BITMAP_EID 0x20
/** PACE capabilities (TR-03119): EPA: eSign */
#define PACE_BITMAP_ESIGN 0x10
/** NPA capabilities (TR-03119): PACE */
#define NPA_BITMAP_PACE 0x40
/** NPA capabilities (TR-03119): EPA: eID */
#define NPA_BITMAP_EID 0x20
/** NPA capabilities (TR-03119): EPA: eSign */
#define NPA_BITMAP_ESIGN 0x10
/** PACE result (TR-03119): Kein Fehler */
#define PACE_SUCCESS 0x00000000
/** PACE result (TR-03119): Längen im Input sind inkonsistent */
#define PACE_ERROR_LENGTH_INCONSISTENT 0xD0000001
/** PACE result (TR-03119): Unerwartete Daten im Input */
#define PACE_ERROR_UNEXPECTED_DATA 0xD0000002
/** PACE result (TR-03119): Unerwartete Kombination von Daten im Input */
#define PACE_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003
/** PACE result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */
#define PACE_ERROR_CARD_NOT_SUPPORTED 0xE0000001
/** PACE result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */
#define PACE_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002
/** PACE result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */
#define PACE_ERROR_PINID_NOT_SUPPORTED 0xE0000003
/** PACE result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_SELECT_EF_CARDACCESS 0xF0000000
/** PACE result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_READ_BINARY 0xF0010000
/** PACE result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_MSE_SET_AT 0xF0020000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000
/** PACE result (TR-03119): Kommunikationsabbruch mit Karte. */
#define PACE_ERROR_COMMUNICATION 0xF0100001
/** PACE result (TR-03119): Keine Karte im Feld. */
#define PACE_ERROR_NO_CARD 0xF0100002
/** PACE result (TR-03119): Benutzerabbruch. */
#define PACE_ERROR_ABORTED 0xF0200001
/** PACE result (TR-03119): Benutzer – Timeout */
#define PACE_ERROR_TIMEOUT 0xF0200002
/** NPA result (TR-03119): Kein Fehler */
#define NPA_SUCCESS 0x00000000
/** NPA result (TR-03119): Längen im Input sind inkonsistent */
#define NPA_ERROR_LENGTH_INCONSISTENT 0xD0000001
/** NPA result (TR-03119): Unerwartete Daten im Input */
#define NPA_ERROR_UNEXPECTED_DATA 0xD0000002
/** NPA result (TR-03119): Unerwartete Kombination von Daten im Input */
#define NPA_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003
/** NPA result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */
#define NPA_ERROR_CARD_NOT_SUPPORTED 0xE0000001
/** NPA result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */
#define NPA_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002
/** NPA result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */
#define NPA_ERROR_PINID_NOT_SUPPORTED 0xE0000003
/** NPA result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_SELECT_EF_CARDACCESS 0xF0000000
/** NPA result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_READ_BINARY 0xF0010000
/** NPA result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_MSE_SET_AT 0xF0020000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000
/** NPA result (TR-03119): Kommunikationsabbruch mit Karte. */
#define NPA_ERROR_COMMUNICATION 0xF0100001
/** NPA result (TR-03119): Keine Karte im Feld. */
#define NPA_ERROR_NO_CARD 0xF0100002
/** NPA result (TR-03119): Benutzerabbruch. */
#define NPA_ERROR_ABORTED 0xF0200001
/** NPA result (TR-03119): Benutzer – Timeout */
#define NPA_ERROR_TIMEOUT 0xF0200002
//#define PACE_MRZ 0x01
//#define PACE_CAN 0x02
@@ -93,7 +93,7 @@ extern "C" {
/** Minimum length of MRZ */
#define MAX_MRZ_LEN 128
const char *pace_secret_name(enum s_type pin_id);
const char *npa_secret_name(enum s_type pin_id);
/**
@@ -213,7 +213,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
* operation to be authorized either by an established PACE channel or by the
* effective authorization of the terminal's certificate.
*
* @param[in] ctx (optional) PACE SM context
* @param[in] ctx (optional) NPA SM context
* @param[in] card
* @param[in] pin_id Type of secret (usually PIN or CAN). You may use <tt>enum s_type</tt> from \c <openssl/pace.h>.
* @param[in] ask_for_secret whether to ask the user for the secret (\c 1) or not (\c 0)
@@ -222,26 +222,26 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
*
* @return \c SC_SUCCESS or error code if an error occurred
*/
int pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
int npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
enum s_type pin_id, int ask_for_secret,
const char *new, size_t new_len);
/**
* @brief Send APDU to unblock the PIN
*
* @param[in] ctx (optional) PACE SM context
* @param[in] ctx (optional) NPA SM context
* @param[in] card
*/
#define pace_unblock_pin(ctx, card) \
pace_reset_retry_counter(ctx, card, PACE_PIN, 0, NULL, 0)
#define npa_unblock_pin(ctx, card) \
npa_reset_retry_counter(ctx, card, PACE_PIN, 0, NULL, 0)
/** Send APDU to set a new PIN
*
* @param[in] ctx (optional) PACE SM context
* @param[in] ctx (optional) NPA SM context
* @param[in] card
* @param[in] new (optional) new PIN
* @param[in] new_len (optional) length of \a new
*/
#define pace_change_pin(ctx, card, newp, newplen) \
pace_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
#define npa_change_pin(ctx, card, newp, newplen) \
npa_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
#ifdef __cplusplus
}

24
npa/src/pace/pace_lib.h → npa/src/npa/npa_lib.h
View File

@@ -19,8 +19,8 @@
/**
* @file
*/
#ifndef _CCID_PACE_LIB_H
#define _CCID_PACE_LIB_H
#ifndef _CCID_NPA_LIB_H
#define _CCID_NPA_LIB_H
#include <openssl/pace.h>
@@ -28,8 +28,8 @@
extern "C" {
#endif
/** PACE secure messaging context */
struct pace_sm_ctx {
/** NPA secure messaging context */
struct npa_sm_ctx {
/** Send sequence counter */
BIGNUM *ssc;
/** Key for message authentication code */
@@ -42,34 +42,34 @@ struct pace_sm_ctx {
/**
* @brief Creates a PACE SM object
* @brief Creates a NPA SM object
*
* @param[in] key_mac Key for message authentication code
* @param[in] key_enc Key for encryption and decryption
* @param[in] ctx PACE context
* @param[in] ctx NPA context
*
* @return Initialized PACE SM object or NULL, if an error occurred
* @return Initialized NPA SM object or NULL, if an error occurred
*/
struct pace_sm_ctx * pace_sm_ctx_create(const BUF_MEM *key_mac,
struct npa_sm_ctx * npa_sm_ctx_create(const BUF_MEM *key_mac,
const BUF_MEM *key_enc, PACE_CTX *ctx);
/**
* @brief Frees a PACE SM object
* @brief Frees a NPA SM object
*
* Frees memory allocated for \a ctx and its send sequence counter
*
* @param[in] ctx object to be freed
*/
void pace_sm_ctx_free(struct pace_sm_ctx *ctx);
void npa_sm_ctx_free(struct npa_sm_ctx *ctx);
/**
* @brief Frees a PACE SM object and all its components
* @brief Frees a NPA SM object and all its components
*
* Frees memory allocated for \a ctx and its send sequence counter, keys and PACE context
*
* @param[in] ctx object to be freed
*/
void pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx);
void npa_sm_ctx_clear_free(struct npa_sm_ctx *ctx);
#ifdef __cplusplus
}

0
npa/src/pace/scutil.h → npa/src/npa/scutil.h
View File

0
npa/src/pace/sm.h → npa/src/npa/sm.h
View File

14
npa/src/pace_lib.c → npa/src/npa_lib.c
View File

@@ -16,15 +16,15 @@
* You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>.
*/
#include "pace_lib.h"
#include "npa_lib.h"
#include <openssl/buffer.h>
#include <openssl/pace.h>
struct pace_sm_ctx *
pace_sm_ctx_create(const BUF_MEM *key_mac,
struct npa_sm_ctx *
npa_sm_ctx_create(const BUF_MEM *key_mac,
const BUF_MEM *key_enc, PACE_CTX *ctx)
{
struct pace_sm_ctx *out = malloc(sizeof *out);
struct npa_sm_ctx *out = malloc(sizeof *out);
if (!out)
return NULL;
@@ -42,7 +42,7 @@ pace_sm_ctx_create(const BUF_MEM *key_mac,
}
void
pace_sm_ctx_free(struct pace_sm_ctx *ctx)
npa_sm_ctx_free(struct npa_sm_ctx *ctx)
{
if (ctx) {
if (ctx->ssc)
@@ -52,7 +52,7 @@ pace_sm_ctx_free(struct pace_sm_ctx *ctx)
}
void
pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx)
npa_sm_ctx_clear_free(struct npa_sm_ctx *ctx)
{
if (ctx) {
if (ctx->key_mac) {
@@ -64,6 +64,6 @@ pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx)
BUF_MEM_free((BUF_MEM *) ctx->key_enc);
}
PACE_CTX_clear_free(ctx->ctx);
pace_sm_ctx_free(ctx);
npa_sm_ctx_free(ctx);
}
}

4
npa/src/scutil.c
View File

@@ -29,7 +29,7 @@ int initialize(int reader_id, const char *cdriver, int verbose,
if (!ctx || !reader)
return SC_ERROR_INVALID_ARGUMENTS;
int r = sc_context_create(ctx, NULL);
int r = sc_establish_context(ctx, "");
if (r < 0) {
fprintf(stderr, "Failed to create initial context: %s", sc_strerror(r));
return r;
@@ -257,7 +257,7 @@ int print_avail(int verbose)
sc_context_t *ctx = NULL;
int r;
r = sc_context_create(&ctx, NULL);
r = sc_establish_context(&ctx, "");
if (r) {
fprintf(stderr, "Failed to establish context: %s\n", sc_strerror(r));
return 1;