VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

renamed libpace to libnpa

Browse Source 
git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@403 96b47cad-a561-4643-ad3b-153ac7d7599c
This commit is contained in:
frankmorgner
2011-02-02 18:49:14 +00:00
parent ddbf72ee2e
commit 8cd77084cc
20 changed files with 286 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
npa/src/Makefile.am
View File

@@ -1,25 +1,25 @@
EXTRA_DIST = opensc
AM_CPPFLAGS = -I$(top_srcdir)/src/pace -I$(top_srcdir)/src/opensc/src
AM_CPPFLAGS = -I$(top_srcdir)/src/npa -I$(top_srcdir)/src/opensc/src
libpace_la_SOURCES = sm.c scutil.c pace.c pace_lib.c
libpace_la_LIBADD = $(OPENSSL_LIBS) $(OPENSC_LIBS)
libpace_la_CFLAGS = $(OPENSSL_CFLAGS)
libnpa_la_SOURCES = sm.c scutil.c npa.c npa_lib.c
libnpa_la_LIBADD = $(OPENSSL_LIBS) $(OPENSC_LIBS)
libnpa_la_CFLAGS = $(OPENSSL_CFLAGS)
pace_tool_SOURCES = pace-tool.c binutil.c
pace_tool_LDADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libpace.la
pace_tool_CFLAGS = $(OPENSSL_CFLAGS)
npa_tool_SOURCES = npa-tool.c binutil.c
npa_tool_LDADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libnpa.la
npa_tool_CFLAGS = $(OPENSSL_CFLAGS)
bin_PROGRAMS = pace-tool
bin_PROGRAMS = npa-tool
lib_LTLIBRARIES = libpace.la
lib_LTLIBRARIES = libnpa.la
noinst_HEADERS = \
binutil.h
nobase_include_HEADERS = \
pace/sm.h \
pace/pace.h \
pace/scutil.h \
pace/pace_lib.h
npa/sm.h \
npa/npa.h \
npa/scutil.h \
npa/npa_lib.h

39
npa/src/pace-tool.c → npa/src/npa-tool.c
View File

@@ -16,8 +16,9 @@
* You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>.
*/
#include "config.h"
#include "binutil.h"
#include "pace.h"
#include "npa.h"
#include "scutil.h"
#include <libopensc/log.h>
#include <openssl/pace.h>
@@ -111,7 +112,7 @@ static const char *option_help[] = {
"Print version, available readers and drivers.",
};
int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input)
int npa_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input)
{
u8 buf[4 + 3 + 0xffff + 3];
char *read = NULL;
@@ -304,8 +305,8 @@ main (int argc, char **argv)
if (doinfo) {
fprintf(stderr, "%s 0.9 written by Frank Morgner.\n\n" ,
argv[0]);
fprintf(stderr, "%s %s written by Frank Morgner.\n\n" ,
argv[0], VERSION);
return print_avail(verbose);
}
@@ -332,12 +333,12 @@ main (int argc, char **argv)
if (pin) {
if (sscanf(pin, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
exit(2);
}
if (strlen(can) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin_length);
exit(2);
}
@@ -348,12 +349,12 @@ main (int argc, char **argv)
if (can) {
if (sscanf(can, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
exit(2);
}
if (strlen(can) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin_length);
exit(2);
}
@@ -364,12 +365,12 @@ main (int argc, char **argv)
if (puk) {
if (sscanf(puk, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
exit(2);
}
if (strlen(puk) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin_length);
exit(2);
}
@@ -388,7 +389,7 @@ main (int argc, char **argv)
gettimeofday(&tv, NULL);
printf("%u,%06u: Trying %s=%s\n",
tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id), pace_input.pin);
npa_secret_name(pace_input.pin_id), pace_input.pin);
i = EstablishPACEChannel(NULL, card, pace_input, &pace_output,
&sctx);
@@ -400,12 +401,12 @@ main (int argc, char **argv)
if (0 > i) {
printf("%u,%06u: Tried breaking %s without success.\n",
tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
goto err;
} else {
printf("%u,%06u: Tried breaking %s with success (=%s).\n",
tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id),
npa_secret_name(pace_input.pin_id),
pace_input.pin);
}
}
@@ -455,7 +456,7 @@ main (int argc, char **argv)
goto err;
printf("Established PACE channel with PUK.\n");
i = pace_unblock_pin(&sctx, card);
i = npa_unblock_pin(&sctx, card);
if (i < 0)
goto err;
printf("Unblocked PIN.\n");
@@ -476,7 +477,7 @@ main (int argc, char **argv)
goto err;
printf("Established PACE channel with PIN.\n");
i = pace_change_pin(&sctx, card, newpin, newpin ? strlen(newpin) : 0);
i = npa_change_pin(&sctx, card, newpin, newpin ? strlen(newpin) : 0);
if (i < 0)
goto err;
printf("Changed PIN.\n");
@@ -520,7 +521,7 @@ main (int argc, char **argv)
if (i < 0)
goto err;
printf("Established PACE channel with %s.\n",
pace_secret_name(pace_input.pin_id));
npa_secret_name(pace_input.pin_id));
if (dotranslate) {
FILE *input;
@@ -532,7 +533,7 @@ main (int argc, char **argv)
perror("Opening file with APDUs");
}
i = pace_translate_apdus(&sctx, card, input);
i = npa_translate_apdus(&sctx, card, input);
fclose(input);
if (i < 0)
goto err;
@@ -540,8 +541,8 @@ main (int argc, char **argv)
}
err:
pace_sm_ctx_clear_free(sctx.cipher_ctx);
pace_sm_ctx_clear_free(tmpctx.cipher_ctx);
npa_sm_ctx_clear_free(sctx.cipher_ctx);
npa_sm_ctx_clear_free(tmpctx.cipher_ctx);
if (pace_output.ef_cardaccess)
free(pace_output.ef_cardaccess);
if (pace_output.recent_car)

266
npa/src/pace.c → npa/src/npa.c
View File

@@ -16,7 +16,7 @@
* You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>.
*/
#include "pace.h"
#include "npa.h"
#include "sm.h"
#include "scutil.h"
#include <libopensc/asn1.h>
@@ -40,34 +40,34 @@
* MSE:Set AT
*/
typedef struct pace_mse_set_at_cd_st {
typedef struct npa_mse_set_at_cd_st {
ASN1_OBJECT *cryptographic_mechanism_reference;
ASN1_INTEGER *key_reference1;
ASN1_INTEGER *key_reference2;
ASN1_OCTET_STRING *auxiliary_data;
ASN1_OCTET_STRING *eph_pub_key;
CVC_CHAT *chat;
} PACE_MSE_SET_AT_C;
ASN1_SEQUENCE(PACE_MSE_SET_AT_C) = {
} NPA_MSE_SET_AT_C;
ASN1_SEQUENCE(NPA_MSE_SET_AT_C) = {
/* 0x80
* Cryptographic mechanism reference */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0),
/* 0x83
* Reference of a public key / secret key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, key_reference1, ASN1_INTEGER, 3),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, key_reference1, ASN1_INTEGER, 3),
/* 0x84
* Reference of a private key / Reference for computing a session key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, key_reference2, ASN1_INTEGER, 4),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, key_reference2, ASN1_INTEGER, 4),
/* 0x67
* Auxiliary authenticated data */
ASN1_APP_IMP_OPT(PACE_MSE_SET_AT_C, auxiliary_data, ASN1_OCTET_STRING, 7),
ASN1_APP_IMP_OPT(NPA_MSE_SET_AT_C, auxiliary_data, ASN1_OCTET_STRING, 7),
/* 0x91
* Ephemeral Public Key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, eph_pub_key, ASN1_OCTET_STRING, 0x11),
ASN1_IMP_OPT(NPA_MSE_SET_AT_C, eph_pub_key, ASN1_OCTET_STRING, 0x11),
/* Certificate Holder Authorization Template */
ASN1_OPT(PACE_MSE_SET_AT_C, chat, CVC_CHAT),
} ASN1_SEQUENCE_END(PACE_MSE_SET_AT_C)
IMPLEMENT_ASN1_FUNCTIONS(PACE_MSE_SET_AT_C)
ASN1_OPT(NPA_MSE_SET_AT_C, chat, CVC_CHAT),
} ASN1_SEQUENCE_END(NPA_MSE_SET_AT_C)
IMPLEMENT_ASN1_FUNCTIONS(NPA_MSE_SET_AT_C)
/*
@@ -75,96 +75,96 @@ IMPLEMENT_ASN1_FUNCTIONS(PACE_MSE_SET_AT_C)
*/
/* Protocol Command Data */
typedef struct pace_gen_auth_cd_st {
typedef struct npa_gen_auth_cd_st {
ASN1_OCTET_STRING *mapping_data;
ASN1_OCTET_STRING *eph_pub_key;
ASN1_OCTET_STRING *auth_token;
} PACE_GEN_AUTH_C_BODY;
ASN1_SEQUENCE(PACE_GEN_AUTH_C_BODY) = {
} NPA_GEN_AUTH_C_BODY;
ASN1_SEQUENCE(NPA_GEN_AUTH_C_BODY) = {
/* 0x81
* Mapping Data */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, mapping_data, ASN1_OCTET_STRING, 1),
ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, mapping_data, ASN1_OCTET_STRING, 1),
/* 0x83
* Ephemeral Public Key */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3),
ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3),
/* 0x85
* Authentication Token */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, auth_token, ASN1_OCTET_STRING, 5),
} ASN1_SEQUENCE_END(PACE_GEN_AUTH_C_BODY)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_C_BODY)
ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, auth_token, ASN1_OCTET_STRING, 5),
} ASN1_SEQUENCE_END(NPA_GEN_AUTH_C_BODY)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_C_BODY)
typedef PACE_GEN_AUTH_C_BODY PACE_GEN_AUTH_C;
typedef NPA_GEN_AUTH_C_BODY NPA_GEN_AUTH_C;
/* 0x7C
* Dynamic Authentication Data */
ASN1_ITEM_TEMPLATE(PACE_GEN_AUTH_C) =
ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_C) =
ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION,
0x1c, PACE_GEN_AUTH_C, PACE_GEN_AUTH_C_BODY)
ASN1_ITEM_TEMPLATE_END(PACE_GEN_AUTH_C)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_C)
0x1c, NPA_GEN_AUTH_C, NPA_GEN_AUTH_C_BODY)
ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_C)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_C)
/* Protocol Response Data */
typedef struct pace_gen_auth_rapdu_body_st {
typedef struct npa_gen_auth_rapdu_body_st {
ASN1_OCTET_STRING *enc_nonce;
ASN1_OCTET_STRING *mapping_data;
ASN1_OCTET_STRING *eph_pub_key;
ASN1_OCTET_STRING *auth_token;
ASN1_OCTET_STRING *cur_car;
ASN1_OCTET_STRING *prev_car;
} PACE_GEN_AUTH_R_BODY;
ASN1_SEQUENCE(PACE_GEN_AUTH_R_BODY) = {
} NPA_GEN_AUTH_R_BODY;
ASN1_SEQUENCE(NPA_GEN_AUTH_R_BODY) = {
/* 0x80
* Encrypted Nonce */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0),
/* 0x82
* Mapping Data */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, mapping_data, ASN1_OCTET_STRING, 2),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, mapping_data, ASN1_OCTET_STRING, 2),
/* 0x84
* Ephemeral Public Key */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4),
/* 0x86
* Authentication Token */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, auth_token, ASN1_OCTET_STRING, 6),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, auth_token, ASN1_OCTET_STRING, 6),
/* 0x87
* Most recent Certification Authority Reference */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, cur_car, ASN1_OCTET_STRING, 7),
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, cur_car, ASN1_OCTET_STRING, 7),
/* 0x88
* Previous Certification Authority Reference */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, prev_car, ASN1_OCTET_STRING, 8),
} ASN1_SEQUENCE_END(PACE_GEN_AUTH_R_BODY)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_R_BODY)
ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, prev_car, ASN1_OCTET_STRING, 8),
} ASN1_SEQUENCE_END(NPA_GEN_AUTH_R_BODY)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_R_BODY)
typedef PACE_GEN_AUTH_R_BODY PACE_GEN_AUTH_R;
typedef NPA_GEN_AUTH_R_BODY NPA_GEN_AUTH_R;
/* 0x7C
* Dynamic Authentication Data */
ASN1_ITEM_TEMPLATE(PACE_GEN_AUTH_R) =
ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_R) =
ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION,
0x1c, PACE_GEN_AUTH_R, PACE_GEN_AUTH_R_BODY)
ASN1_ITEM_TEMPLATE_END(PACE_GEN_AUTH_R)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_R)
0x1c, NPA_GEN_AUTH_R, NPA_GEN_AUTH_R_BODY)
ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_R)
IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_R)
const size_t maxresp = SC_MAX_APDU_BUFFER_SIZE - 2;
static int pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **enc);
static int pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *enc, size_t enclen, u8 **data);
static int pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **outdata);
static int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *mac, size_t maclen,
const u8 *macdata, size_t macdatalen);
static int pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *apdu);
static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *sm_apdu);
static int increment_ssc(struct pace_sm_ctx *psmctx);
static int decrement_ssc(struct pace_sm_ctx *psmctx);
static int reset_ssc(struct pace_sm_ctx *psmctx);
static int increment_ssc(struct npa_sm_ctx *psmctx);
static int decrement_ssc(struct npa_sm_ctx *psmctx);
static int reset_ssc(struct npa_sm_ctx *psmctx);
int GetReadersPACECapabilities(u8 *bitmap)
@@ -173,7 +173,7 @@ int GetReadersPACECapabilities(u8 *bitmap)
return SC_ERROR_INVALID_ARGUMENTS;
/* BitMap */
*bitmap = PACE_BITMAP_PACE|PACE_BITMAP_EID|PACE_BITMAP_ESIGN;
*bitmap = NPA_BITMAP_PACE|NPA_BITMAP_EID|NPA_BITMAP_ESIGN;
return SC_SUCCESS;
}
@@ -256,12 +256,12 @@ err:
return r;
}
static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
static int npa_mse_set_at(struct sm_ctx *oldnpactx, sc_card_t *card,
int protocol, int secret_key, const CVC_CHAT *chat, u8 *sw1, u8 *sw2)
{
sc_apdu_t apdu;
unsigned char *d = NULL;
PACE_MSE_SET_AT_C *data = NULL;
NPA_MSE_SET_AT_C *data = NULL;
int r, tries;
if (!sw1 || !sw2) {
@@ -277,7 +277,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
data = PACE_MSE_SET_AT_C_new();
data = NPA_MSE_SET_AT_C_new();
if (!data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -301,7 +301,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
data->chat = (CVC_CHAT *) chat;
r = i2d_PACE_MSE_SET_AT_C(data, &d);
r = i2d_NPA_MSE_SET_AT_C(data, &d);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding MSE:Set AT APDU data");
r = SC_ERROR_INTERNAL;
@@ -315,8 +315,8 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "MSE:Set AT command data", apdu.data, apdu.datalen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -338,7 +338,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
if (tries <= 1) {
/* this is only a warning... */
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Remaining tries: %d (%s must be %s)\n",
tries, pace_secret_name(secret_key),
tries, npa_secret_name(secret_key),
tries ? "resumed" : "unblocked");
}
r = SC_SUCCESS;
@@ -362,7 +362,7 @@ err:
if (data) {
/* do not free the functions parameter chat */
data->chat = NULL;
PACE_MSE_SET_AT_C_free(data);
NPA_MSE_SET_AT_C_free(data);
}
if (d)
free(d);
@@ -370,12 +370,12 @@ err:
return r;
}
static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
static int npa_gen_auth_1_encrypted_nonce(struct sm_ctx *oldnpactx,
sc_card_t *card, u8 **enc_nonce, size_t *enc_nonce_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -385,12 +385,12 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -403,8 +403,8 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -416,7 +416,7 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -455,7 +455,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -467,7 +467,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -475,13 +475,13 @@ err:
return r;
}
static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
static int npa_gen_auth_2_map_nonce(struct sm_ctx *oldnpactx,
sc_card_t *card, const u8 *in, size_t in_len, u8 **map_data_out,
size_t *map_data_out_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -491,7 +491,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -503,7 +503,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
r = SC_ERROR_INTERNAL;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -516,8 +516,8 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -529,7 +529,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -568,7 +568,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -580,7 +580,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -588,13 +588,13 @@ err:
return r;
}
static int pace_gen_auth_3_perform_key_agreement(
struct sm_ctx *oldpacectx, sc_card_t *card,
static int npa_gen_auth_3_perform_key_agreement(
struct sm_ctx *oldnpactx, sc_card_t *card,
const u8 *in, size_t in_len, u8 **eph_pub_key_out, size_t *eph_pub_key_out_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -604,7 +604,7 @@ static int pace_gen_auth_3_perform_key_agreement(
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -616,7 +616,7 @@ static int pace_gen_auth_3_perform_key_agreement(
r = SC_ERROR_INTERNAL;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -629,8 +629,8 @@ static int pace_gen_auth_3_perform_key_agreement(
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -642,7 +642,7 @@ static int pace_gen_auth_3_perform_key_agreement(
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -681,7 +681,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -693,7 +693,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -701,15 +701,15 @@ err:
return r;
}
static int pace_gen_auth_4_mutual_authentication(
struct sm_ctx *oldpacectx, sc_card_t *card,
static int npa_gen_auth_4_mutual_authentication(
struct sm_ctx *oldnpactx, sc_card_t *card,
const u8 *in, size_t in_len, u8 **auth_token_out,
size_t *auth_token_out_len, u8 **recent_car, size_t *recent_car_len,
u8 **prev_car, size_t *prev_car_len)
{
sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL;
NPA_GEN_AUTH_C *c_data = NULL;
NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p;
int r, l;
@@ -719,7 +719,7 @@ static int pace_gen_auth_4_mutual_authentication(
apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new();
c_data = NPA_GEN_AUTH_C_new();
if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY;
goto err;
@@ -732,7 +732,7 @@ static int pace_gen_auth_4_mutual_authentication(
r = SC_ERROR_INTERNAL;
goto err;
}
r = i2d_PACE_GEN_AUTH_C(c_data, &d);
r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) {
r = SC_ERROR_INTERNAL;
goto err;
@@ -745,8 +745,8 @@ static int pace_gen_auth_4_mutual_authentication(
apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen);
if (oldpacectx)
r = sm_transmit_apdu(oldpacectx, card, &apdu);
if (oldnpactx)
r = sm_transmit_apdu(oldnpactx, card, &apdu);
else
r = sc_transmit_apdu(card, &apdu);
if (r < 0)
@@ -758,7 +758,7 @@ static int pace_gen_auth_4_mutual_authentication(
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data,
if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL;
@@ -822,7 +822,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data);
NPA_GEN_AUTH_C_free(c_data);
}
if (d)
free(d);
@@ -834,7 +834,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data);
NPA_GEN_AUTH_R_free(r_data);
}
/* XXX */
/*if (apdu.resp)*/
@@ -844,7 +844,7 @@ err:
}
int
pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
enum s_type pin_id, int ask_for_secret,
const char *new, size_t new_len)
{
@@ -906,19 +906,19 @@ get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id
if (!length_pin || !pin) {
if (0 > snprintf(buf, sizeof buf, "Please enter your %s: ",
pace_secret_name(pin_id))) {
npa_secret_name(pin_id))) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create password prompt.\n");
return NULL;
}
p = malloc(MAX_MRZ_LEN);
if (!p) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for %s.\n",
pace_secret_name(pin_id));
npa_secret_name(pin_id));
return NULL;
}
if (0 > EVP_read_pw_string_min(p, 0, MAX_MRZ_LEN, buf, 0)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read %s.\n",
pace_secret_name(pin_id));
npa_secret_name(pin_id));
return NULL;
}
length_pin = strnlen(p, MAX_MRZ_LEN);
@@ -944,7 +944,7 @@ void ssl_error(sc_context_t *ctx) {
ERR_free_strings();
}
int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
int EstablishPACEChannel(struct sm_ctx *oldnpactx, sc_card_t *card,
struct establish_pace_channel_input pace_input,
struct establish_pace_channel_output *pace_output,
struct sm_ctx *sctx)
@@ -1086,7 +1086,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
}
pctx->tr_version = pace_input.tr_version;
r = pace_mse_set_at(oldpacectx, card, info->protocol, pace_input.pin_id,
r = npa_mse_set_at(oldnpactx, card, info->protocol, pace_input.pin_id,
chat, &pace_output->mse_set_at_sw1, &pace_output->mse_set_at_sw2);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties "
@@ -1098,7 +1098,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_1_encrypted_nonce(oldpacectx, card, (u8 **) &enc_nonce->data,
r = npa_gen_auth_1_encrypted_nonce(oldnpactx, card, (u8 **) &enc_nonce->data,
&enc_nonce->length);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get encrypted nonce from card "
@@ -1127,7 +1127,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_2_map_nonce(oldpacectx, card, (u8 *) mdata->data, mdata->length,
r = npa_gen_auth_2_map_nonce(oldnpactx, card, (u8 *) mdata->data, mdata->length,
(u8 **) &mdata_opp->data, &mdata_opp->length);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange mapping data with card "
@@ -1147,7 +1147,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_3_perform_key_agreement(oldpacectx, card, (u8 *) pub->data, pub->length,
r = npa_gen_auth_3_perform_key_agreement(oldnpactx, card, (u8 *) pub->data, pub->length,
(u8 **) &pub_opp->data, &pub_opp->length);
if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange ephemeral public key with card "
@@ -1175,7 +1175,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
r = pace_gen_auth_4_mutual_authentication(oldpacectx, card, (u8 *) token->data, token->length,
r = npa_gen_auth_4_mutual_authentication(oldnpactx, card, (u8 *) token->data, token->length,
(u8 **) &token_opp->data, &token_opp->length,
&pace_output->recent_car, &pace_output->recent_car_length,
&pace_output->previous_car, &pace_output->previous_car_length);
@@ -1227,7 +1227,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID PCD", pace_output->id_pcd,
pace_output->id_pcd_length);
sctx->authentication_ctx = pace_sm_ctx_create(k_mac,
sctx->authentication_ctx = npa_sm_ctx_create(k_mac,
k_enc, pctx);
if (!sctx->authentication_ctx) {
r = SC_ERROR_OUT_OF_MEMORY;
@@ -1237,12 +1237,12 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
if (r < 0)
goto err;
sctx->cipher_ctx = sctx->authentication_ctx;
sctx->authenticate = pace_sm_authenticate;
sctx->encrypt = pace_sm_encrypt;
sctx->decrypt = pace_sm_decrypt;
sctx->verify_authentication = pace_sm_verify_authentication;
sctx->pre_transmit = pace_sm_pre_transmit;
sctx->post_transmit = pace_sm_post_transmit;
sctx->authenticate = npa_sm_authenticate;
sctx->encrypt = npa_sm_encrypt;
sctx->decrypt = npa_sm_decrypt;
sctx->verify_authentication = npa_sm_verify_authentication;
sctx->pre_transmit = npa_sm_pre_transmit;
sctx->post_transmit = npa_sm_post_transmit;
sctx->padding_indicator = SM_ISO_PADDING;
sctx->block_length = EVP_CIPHER_block_size(pctx->cipher);
sctx->active = 1;
@@ -1299,7 +1299,7 @@ err:
if (pctx)
PACE_CTX_clear_free(pctx);
if (sctx->authentication_ctx)
pace_sm_ctx_free(sctx->authentication_ctx);
npa_sm_ctx_free(sctx->authentication_ctx);
}
return r;
@@ -1310,7 +1310,7 @@ static const char *PIN_name = "PIN";
static const char *PUK_name = "PUK";
static const char *CAN_name = "CAN";
static const char *UNDEF_name = "UNDEF";
const char *pace_secret_name(enum s_type pin_id) {
const char *npa_secret_name(enum s_type pin_id) {
switch (pin_id) {
case PACE_MRZ:
return MRZ_name;
@@ -1326,7 +1326,7 @@ const char *pace_secret_name(enum s_type pin_id) {
}
int
increment_ssc(struct pace_sm_ctx *psmctx)
increment_ssc(struct npa_sm_ctx *psmctx)
{
if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS;
@@ -1337,7 +1337,7 @@ increment_ssc(struct pace_sm_ctx *psmctx)
}
int
decrement_ssc(struct pace_sm_ctx *psmctx)
decrement_ssc(struct npa_sm_ctx *psmctx)
{
if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS;
@@ -1348,7 +1348,7 @@ decrement_ssc(struct pace_sm_ctx *psmctx)
}
int
reset_ssc(struct pace_sm_ctx *psmctx)
reset_ssc(struct npa_sm_ctx *psmctx)
{
if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS;
@@ -1359,7 +1359,7 @@ reset_ssc(struct pace_sm_ctx *psmctx)
}
static int
pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **enc)
{
BUF_MEM *encbuf = NULL, *databuf = NULL;
@@ -1370,7 +1370,7 @@ pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
databuf = BUF_MEM_create_init(data, datalen);
encbuf = PACE_encrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, databuf);
@@ -1403,7 +1403,7 @@ err:
}
static int
pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *enc, size_t enclen, u8 **data)
{
BUF_MEM *encbuf = NULL, *databuf = NULL;
@@ -1414,7 +1414,7 @@ pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
encbuf = BUF_MEM_create_init(enc, enclen);
databuf = PACE_decrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, encbuf);
@@ -1447,7 +1447,7 @@ err:
}
static int
pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **macdata)
{
BUF_MEM *macbuf = NULL;
@@ -1458,7 +1458,7 @@ pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
macbuf = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac,
data, datalen);
@@ -1490,7 +1490,7 @@ err:
}
static int
pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *mac, size_t maclen,
const u8 *macdata, size_t macdatalen)
{
@@ -1502,7 +1502,7 @@ pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS;
goto err;
}
struct pace_sm_ctx *psmctx = ctx->cipher_ctx;
struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
my_mac = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac,
macdata, macdatalen);
@@ -1534,14 +1534,14 @@ err:
}
static int
pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *apdu)
{
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL,
increment_ssc(ctx->cipher_ctx));
}
static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
static int npa_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *sm_apdu)
{
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL,

110
npa/src/pace/pace.h → npa/src/npa/npa.h
View File

@@ -19,11 +19,11 @@
/**
* @file
*/
#ifndef _CCID_PACE_H
#define _CCID_PACE_H
#ifndef _CCID_NPA_H
#define _CCID_NPA_H
#include <pace/pace_lib.h>
#include <pace/sm.h>
#include <npa/npa_lib.h>
#include <npa/sm.h>
#include <libopensc/opensc.h>
#include <openssl/bn.h>
#include <openssl/pace.h>
@@ -32,49 +32,49 @@
extern "C" {
#endif
/** PACE capabilities (TR-03119): PACE */
#define PACE_BITMAP_PACE 0x40
/** PACE capabilities (TR-03119): EPA: eID */
#define PACE_BITMAP_EID 0x20
/** PACE capabilities (TR-03119): EPA: eSign */
#define PACE_BITMAP_ESIGN 0x10
/** NPA capabilities (TR-03119): PACE */
#define NPA_BITMAP_PACE 0x40
/** NPA capabilities (TR-03119): EPA: eID */
#define NPA_BITMAP_EID 0x20
/** NPA capabilities (TR-03119): EPA: eSign */
#define NPA_BITMAP_ESIGN 0x10
/** PACE result (TR-03119): Kein Fehler */
#define PACE_SUCCESS 0x00000000
/** PACE result (TR-03119): Längen im Input sind inkonsistent */
#define PACE_ERROR_LENGTH_INCONSISTENT 0xD0000001
/** PACE result (TR-03119): Unerwartete Daten im Input */
#define PACE_ERROR_UNEXPECTED_DATA 0xD0000002
/** PACE result (TR-03119): Unerwartete Kombination von Daten im Input */
#define PACE_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003
/** PACE result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */
#define PACE_ERROR_CARD_NOT_SUPPORTED 0xE0000001
/** PACE result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */
#define PACE_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002
/** PACE result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */
#define PACE_ERROR_PINID_NOT_SUPPORTED 0xE0000003
/** PACE result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_SELECT_EF_CARDACCESS 0xF0000000
/** PACE result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_READ_BINARY 0xF0010000
/** PACE result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_MSE_SET_AT 0xF0020000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000
/** PACE result (TR-03119): Kommunikationsabbruch mit Karte. */
#define PACE_ERROR_COMMUNICATION 0xF0100001
/** PACE result (TR-03119): Keine Karte im Feld. */
#define PACE_ERROR_NO_CARD 0xF0100002
/** PACE result (TR-03119): Benutzerabbruch. */
#define PACE_ERROR_ABORTED 0xF0200001
/** PACE result (TR-03119): Benutzer – Timeout */
#define PACE_ERROR_TIMEOUT 0xF0200002
/** NPA result (TR-03119): Kein Fehler */
#define NPA_SUCCESS 0x00000000
/** NPA result (TR-03119): Längen im Input sind inkonsistent */
#define NPA_ERROR_LENGTH_INCONSISTENT 0xD0000001
/** NPA result (TR-03119): Unerwartete Daten im Input */
#define NPA_ERROR_UNEXPECTED_DATA 0xD0000002
/** NPA result (TR-03119): Unerwartete Kombination von Daten im Input */
#define NPA_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003
/** NPA result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */
#define NPA_ERROR_CARD_NOT_SUPPORTED 0xE0000001
/** NPA result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */
#define NPA_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002
/** NPA result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */
#define NPA_ERROR_PINID_NOT_SUPPORTED 0xE0000003
/** NPA result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_SELECT_EF_CARDACCESS 0xF0000000
/** NPA result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_READ_BINARY 0xF0010000
/** NPA result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_MSE_SET_AT 0xF0020000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000
/** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */
#define NPA_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000
/** NPA result (TR-03119): Kommunikationsabbruch mit Karte. */
#define NPA_ERROR_COMMUNICATION 0xF0100001
/** NPA result (TR-03119): Keine Karte im Feld. */
#define NPA_ERROR_NO_CARD 0xF0100002
/** NPA result (TR-03119): Benutzerabbruch. */
#define NPA_ERROR_ABORTED 0xF0200001
/** NPA result (TR-03119): Benutzer – Timeout */
#define NPA_ERROR_TIMEOUT 0xF0200002
//#define PACE_MRZ 0x01
//#define PACE_CAN 0x02
@@ -93,7 +93,7 @@ extern "C" {
/** Minimum length of MRZ */
#define MAX_MRZ_LEN 128
const char *pace_secret_name(enum s_type pin_id);
const char *npa_secret_name(enum s_type pin_id);
/**
@@ -213,7 +213,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
* operation to be authorized either by an established PACE channel or by the
* effective authorization of the terminal's certificate.
*
* @param[in] ctx (optional) PACE SM context
* @param[in] ctx (optional) NPA SM context
* @param[in] card
* @param[in] pin_id Type of secret (usually PIN or CAN). You may use <tt>enum s_type</tt> from \c <openssl/pace.h>.
* @param[in] ask_for_secret whether to ask the user for the secret (\c 1) or not (\c 0)
@@ -222,26 +222,26 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
*
* @return \c SC_SUCCESS or error code if an error occurred
*/
int pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
int npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
enum s_type pin_id, int ask_for_secret,
const char *new, size_t new_len);
/**
* @brief Send APDU to unblock the PIN
*
* @param[in] ctx (optional) PACE SM context
* @param[in] ctx (optional) NPA SM context
* @param[in] card
*/
#define pace_unblock_pin(ctx, card) \
pace_reset_retry_counter(ctx, card, PACE_PIN, 0, NULL, 0)
#define npa_unblock_pin(ctx, card) \
npa_reset_retry_counter(ctx, card, PACE_PIN, 0, NULL, 0)
/** Send APDU to set a new PIN
*
* @param[in] ctx (optional) PACE SM context
* @param[in] ctx (optional) NPA SM context
* @param[in] card
* @param[in] new (optional) new PIN
* @param[in] new_len (optional) length of \a new
*/
#define pace_change_pin(ctx, card, newp, newplen) \
pace_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
#define npa_change_pin(ctx, card, newp, newplen) \
npa_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
#ifdef __cplusplus
}

24
npa/src/pace/pace_lib.h → npa/src/npa/npa_lib.h
View File

@@ -19,8 +19,8 @@
/**
* @file
*/
#ifndef _CCID_PACE_LIB_H
#define _CCID_PACE_LIB_H
#ifndef _CCID_NPA_LIB_H
#define _CCID_NPA_LIB_H
#include <openssl/pace.h>
@@ -28,8 +28,8 @@
extern "C" {
#endif
/** PACE secure messaging context */
struct pace_sm_ctx {
/** NPA secure messaging context */
struct npa_sm_ctx {
/** Send sequence counter */
BIGNUM *ssc;
/** Key for message authentication code */
@@ -42,34 +42,34 @@ struct pace_sm_ctx {
/**
* @brief Creates a PACE SM object
* @brief Creates a NPA SM object
*
* @param[in] key_mac Key for message authentication code
* @param[in] key_enc Key for encryption and decryption
* @param[in] ctx PACE context
* @param[in] ctx NPA context
*
* @return Initialized PACE SM object or NULL, if an error occurred
* @return Initialized NPA SM object or NULL, if an error occurred
*/
struct pace_sm_ctx * pace_sm_ctx_create(const BUF_MEM *key_mac,
struct npa_sm_ctx * npa_sm_ctx_create(const BUF_MEM *key_mac,
const BUF_MEM *key_enc, PACE_CTX *ctx);
/**
* @brief Frees a PACE SM object
* @brief Frees a NPA SM object
*
* Frees memory allocated for \a ctx and its send sequence counter
*
* @param[in] ctx object to be freed
*/
void pace_sm_ctx_free(struct pace_sm_ctx *ctx);
void npa_sm_ctx_free(struct npa_sm_ctx *ctx);
/**
* @brief Frees a PACE SM object and all its components
* @brief Frees a NPA SM object and all its components
*
* Frees memory allocated for \a ctx and its send sequence counter, keys and PACE context
*
* @param[in] ctx object to be freed
*/
void pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx);
void npa_sm_ctx_clear_free(struct npa_sm_ctx *ctx);
#ifdef __cplusplus
}

0
npa/src/pace/scutil.h → npa/src/npa/scutil.h
View File

0
npa/src/pace/sm.h → npa/src/npa/sm.h
View File

14
npa/src/pace_lib.c → npa/src/npa_lib.c
View File

@@ -16,15 +16,15 @@
* You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>.
*/
#include "pace_lib.h"
#include "npa_lib.h"
#include <openssl/buffer.h>
#include <openssl/pace.h>
struct pace_sm_ctx *
pace_sm_ctx_create(const BUF_MEM *key_mac,
struct npa_sm_ctx *
npa_sm_ctx_create(const BUF_MEM *key_mac,
const BUF_MEM *key_enc, PACE_CTX *ctx)
{
struct pace_sm_ctx *out = malloc(sizeof *out);
struct npa_sm_ctx *out = malloc(sizeof *out);
if (!out)
return NULL;
@@ -42,7 +42,7 @@ pace_sm_ctx_create(const BUF_MEM *key_mac,
}
void
pace_sm_ctx_free(struct pace_sm_ctx *ctx)
npa_sm_ctx_free(struct npa_sm_ctx *ctx)
{
if (ctx) {
if (ctx->ssc)
@@ -52,7 +52,7 @@ pace_sm_ctx_free(struct pace_sm_ctx *ctx)
}
void
pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx)
npa_sm_ctx_clear_free(struct npa_sm_ctx *ctx)
{
if (ctx) {
if (ctx->key_mac) {
@@ -64,6 +64,6 @@ pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx)
BUF_MEM_free((BUF_MEM *) ctx->key_enc);
}
PACE_CTX_clear_free(ctx->ctx);
pace_sm_ctx_free(ctx);
npa_sm_ctx_free(ctx);
}
}

4
npa/src/scutil.c
View File

@@ -29,7 +29,7 @@ int initialize(int reader_id, const char *cdriver, int verbose,
if (!ctx || !reader)
return SC_ERROR_INVALID_ARGUMENTS;
int r = sc_context_create(ctx, NULL);
int r = sc_establish_context(ctx, "");
if (r < 0) {
fprintf(stderr, "Failed to create initial context: %s", sc_strerror(r));
return r;
@@ -257,7 +257,7 @@ int print_avail(int verbose)
sc_context_t *ctx = NULL;
int r;
r = sc_context_create(&ctx, NULL);
r = sc_establish_context(&ctx, "");
if (r) {
fprintf(stderr, "Failed to establish context: %s\n", sc_strerror(r));
return 1;