VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

renamed libpace to libnpa

Browse Source 
git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@403 96b47cad-a561-4643-ad3b-153ac7d7599c
This commit is contained in:
frankmorgner
2011-02-02 18:49:14 +00:00
parent ddbf72ee2e
commit 8cd77084cc
20 changed files with 286 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ccid/configure.ac
View File

@@ -70,14 +70,14 @@ AC_ARG_ENABLE(pace,
saved_CPPFLAGS="$CPPFLAGS" saved_CPPFLAGS="$CPPFLAGS"
saved_LIBS="$LIBS" saved_LIBS="$LIBS"
if test "x$enable_pace" != xno ; then if test "x$enable_pace" != xno ; then
PKG_CHECK_EXISTS([libpace], PKG_CHECK_EXISTS([libnpa],
[PKG_CHECK_MODULES([LIBPACE], [libpace])], [PKG_CHECK_MODULES([LIBNPA], [libnpa])],
[AC_MSG_WARN([libpace not found by pkg-config])]) [AC_MSG_WARN([libnpa not found by pkg-config])])
CPPFLAGS="$CPPFLAGS $LIBPACE_CFLAGS -I$(pwd)/src/opensc/src" CPPFLAGS="$CPPFLAGS $LIBNPA_CFLAGS -I$(pwd)/src/opensc/src"
LIBS="$LDFLAGS $LIBPACE_LIBS" LIBS="$LDFLAGS $LIBNPA_LIBS"
AC_CHECK_HEADERS(pace/pace.h, [], [ AC_MSG_ERROR([pace/pace.h not found, install libpace or use ./configure LIBPACE_CFLAGS=...]) ]) AC_CHECK_HEADERS(npa/npa.h, [], [ AC_MSG_ERROR([npa/npa.h not found, install libnpa or use ./configure LIBNPA_CFLAGS=...]) ])
AC_MSG_CHECKING([for EstablishPACEChannel]) AC_MSG_CHECKING([for EstablishPACEChannel])
AC_TRY_LINK_FUNC(EstablishPACEChannel, [ AC_MSG_RESULT([yes]) ], [ AC_MSG_ERROR([libpace not found, use ./configure LIBPACE_LIBS=...]) ]) AC_TRY_LINK_FUNC(EstablishPACEChannel, [ AC_MSG_RESULT([yes]) ], [ AC_MSG_ERROR([libnpa not found, use ./configure LIBNPA_LIBS=...]) ])
enable_pace=yes enable_pace=yes
else else

4
ccid/src/Makefile.am
View File

@@ -31,8 +31,8 @@ endif
if WITH_PACE if WITH_PACE
ccid_emulator_LDADD += $(LIBPACE_LIBS) ccid_emulator_LDADD += $(LIBNPA_LIBS)
ccid_emulator_CFLAGS += $(LIBPACE_CFLAGS) ccid_emulator_CFLAGS += $(LIBNPA_CFLAGS)
else else
ccid_emulator_SOURCES += scutil.c ccid_emulator_SOURCES += scutil.c
ccid_emulator_LDADD += $(OPENSC_LIBS) ccid_emulator_LDADD += $(OPENSC_LIBS)

8
ccid/src/ccid.c
View File

@@ -30,9 +30,9 @@
#include "config.h" #include "config.h"
#ifdef WITH_PACE #ifdef WITH_PACE
#include <pace/pace.h> #include <npa/npa.h>
#include <pace/sm.h> #include <npa/sm.h>
#include <pace/scutil.h> #include <npa/scutil.h>
static struct sm_ctx sctx; static struct sm_ctx sctx;
#ifdef BUERGERCLIENT_WORKAROUND #ifdef BUERGERCLIENT_WORKAROUND
@@ -154,7 +154,7 @@ void ccid_shutdown()
sc_release_context(ctx); sc_release_context(ctx);
#ifdef WITH_PACE #ifdef WITH_PACE
pace_sm_ctx_clear_free(sctx.cipher_ctx); npa_sm_ctx_clear_free(sctx.cipher_ctx);
memset(&sctx, 0, sizeof(sctx)); memset(&sctx, 0, sizeof(sctx));
#ifdef BUERGERCLIENT_WORKAROUND #ifdef BUERGERCLIENT_WORKAROUND
free(ef_cardaccess); free(ef_cardaccess);

2
ccid/src/ccid.h
View File

@@ -260,7 +260,7 @@ typedef struct {
} __attribute__ ((packed)) RDR_to_PC_Parameters_t; } __attribute__ ((packed)) RDR_to_PC_Parameters_t;
typedef struct { typedef struct {
__u8 bMessageType; __u8 bMessageType;
__u8 bmSlotICCState; /* we support 4 slots, so we need 2*4 bits = 1 byte */ __u8 bmSlotICCState; /* we support 1 slots, so we need 2*1 bits = 1 byte */
} __attribute__ ((packed)) RDR_to_PC_NotifySlotChange_t; } __attribute__ ((packed)) RDR_to_PC_NotifySlotChange_t;
struct hid_class_descriptor { struct hid_class_descriptor {

2
ccid/src/scutil.h
View File

@@ -1 +1 @@
../../npa/src/pace/scutil.h ../../npa/src/npa/scutil.h

4
ccid/src/usb.c
View File

@@ -1805,8 +1805,8 @@ main (int argc, char **argv)
if (doinfo) { if (doinfo) {
fprintf(stderr, "%s 0.9 written by Frank Morgner.\n\n" , fprintf(stderr, "%s %s written by Frank Morgner.\n\n" ,
argv[0]); argv[0], VERSION);
return print_avail(verbose); return print_avail(verbose);
} }

10
npa/Makefile.am
View File

@@ -1,7 +1,7 @@
ACLOCAL_AMFLAGS = -I m4 ACLOCAL_AMFLAGS = -I m4
SUBDIRS = src m4 SUBDIRS = src m4
EXTRA_DIST = README.dox libpace.pc.in Doxyfile.in EXTRA_DIST = README.dox libnpa.pc.in Doxyfile.in
do_subst = sed \ do_subst = sed \
-e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \ -e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \
@@ -37,9 +37,9 @@ doc :
endif endif
pkgconfigdir = $(libdir)/pkgconfig pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libpace.pc pkgconfig_DATA = libnpa.pc
libpace.pc: libnpa.pc:
$(do_subst) < $(srcdir)/libpace.pc.in > libpace.pc $(do_subst) < $(srcdir)/libnpa.pc.in > libnpa.pc
clean-local: clean-local:
rm -rf doc Doxyfile libpace.pc rm -rf doc Doxyfile libnpa.pc

18
npa/README.dox
View File

@@ -7,8 +7,8 @@ secure messaging, which could also be used for other cards.
npa is implemented using OpenPACE (http://sourceforge.net/projects/openpace/). npa is implemented using OpenPACE (http://sourceforge.net/projects/openpace/).
Some fragments of the source code are on the source code of the OpenSC tools. Some fragments of the source code are on the source code of the OpenSC tools.
The included pace-tool has support for Password Authenticated Connection The included npa-tool has support for Password Authenticated Connection
Establishment (PACE). pace-tool can be used for PIN management or to encrypt Establishment (PACE). npa-tool can be used for PIN management or to encrypt
APDUs inside a secure messaging channel established with PACE. APDUs inside a secure messaging channel established with PACE.
@@ -38,28 +38,28 @@ against use something like the following command:
@section u USAGE @section u USAGE
When testing PACE with either PIN, CAN, MRZ or PUK run pace-tool. Here you can When testing PACE with either PIN, CAN, MRZ or PUK run npa-tool. Here you can
enter APDUs which are to be converted according to the secure messaging enter APDUs which are to be converted according to the secure messaging
parameter and to be sent to the card. Herefor insert the APDU in hex (upper or parameter and to be sent to the card. Herefor insert the APDU in hex (upper or
lower case) with a colon to separate the bytes or without it. Example APDUs can lower case) with a colon to separate the bytes or without it. Example APDUs can
be found in the file apdus. be found in the file apdus.
To pass a secret to pace-tool, the command line parameters or the environment To pass a secret to npa-tool, the command line parameters or the environment
variables PIN/CAN/MRZ/PUK/NEWPIN can be used. If none of these options is used, variables PIN/CAN/MRZ/PUK/NEWPIN can be used. If none of these options is used,
pace-tool will show a password prompt. npa-tool will show a password prompt.
@subsection l LINKING AGAINST LIBNPA @subsection l LINKING AGAINST LIBNPA
If you have a local build of libpace and OpenPACE, the preferred way to adjust If you have a local build of libnpa and OpenPACE, the preferred way to adjust
libraries and cflags for foreign code is to use pkg-config: libraries and cflags for foreign code is to use pkg-config:
./configure \ ./configure \
PKG_CONFIG_PATH=/path/to/openssl-1.0.0c_with_openpace-0.4/lib/pkgconfig:/path/to/libpace/lib/pkgconfig" PKG_CONFIG_PATH=/path/to/openssl-1.0.0c_with_openpace-0.4/lib/pkgconfig:/path/to/libnpa/lib/pkgconfig"
Alternatively you can define libs and cflags by hand: Alternatively you can define libs and cflags by hand:
./configure \ ./configure \
OPENSSL_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include" \ OPENSSL_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include" \
LIBPACE_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include -I/path/to/libpace-0.1/src" \ LIBNPA_CFLAGS="-I/path/to/openssl-1.0.0c_with_openpace-0.4/include -I/path/to/libnpa-0.1/src" \
OPENSSL_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto" \ OPENSSL_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto" \
LIBPACE_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto -L/path/to/libpace-0.1/src/.libs -lpace" LIBNPA_LIBS="-L/path/to/openssl-1.0.0c_with_openpace-0.4 -lcrypto -L/path/to/libnpa-0.1/src/.libs -lnpa"
@section q QUESTIONS @section q QUESTIONS

4
npa/configure.ac
View File

@@ -2,8 +2,8 @@
# Process this file with autoconf to produce a configure script. # Process this file with autoconf to produce a configure script.
AC_PREREQ([2.63]) AC_PREREQ([2.63])
AC_INIT([libpace], [0.1], [http://sourceforge.net/projects/vsmartcard/support]) AC_INIT([npa], [0.2], [http://sourceforge.net/projects/vsmartcard/support])
AC_CONFIG_SRCDIR([src/pace.c]) AC_CONFIG_SRCDIR([src/npa.c])
AC_CONFIG_HEADERS([config.h]) AC_CONFIG_HEADERS([config.h])
AC_CONFIG_MACRO_DIR([m4]) AC_CONFIG_MACRO_DIR([m4])
AM_INIT_AUTOMAKE AM_INIT_AUTOMAKE

11
npa/libnpa.pc.in Normal file
View File

@@ -0,0 +1,11 @@
prefix=@prefix@
exec_prefix=@exec_prefix@
libdir=@libdir@
includedir=@includedir@
Name: lib@PACKAGE_NAME@
Description: Library for the new German ID card (neuer Personalausweis, nPA)
Version: @VERSION@
Requires: libcrypto
Libs: -L${libdir} -lnpa @OPENSC_LIBS@
Cflags: -I${includedir}

11
npa/libpace.pc.in
View File

@@ -1,11 +0,0 @@
prefix=@prefix@
exec_prefix=@exec_prefix@
libdir=@libdir@
includedir=@includedir@
Name: libpace
Description: Password Authenticated Connection Establishment (PACE) library
Version: @VERSION@
Requires: libssl
Libs: -L${libdir} -lpace @OPENSC_LIBS@
Cflags: -I${includedir}

26
npa/src/Makefile.am
View File

@@ -1,25 +1,25 @@
EXTRA_DIST = opensc EXTRA_DIST = opensc
AM_CPPFLAGS = -I$(top_srcdir)/src/pace -I$(top_srcdir)/src/opensc/src AM_CPPFLAGS = -I$(top_srcdir)/src/npa -I$(top_srcdir)/src/opensc/src
libpace_la_SOURCES = sm.c scutil.c pace.c pace_lib.c libnpa_la_SOURCES = sm.c scutil.c npa.c npa_lib.c
libpace_la_LIBADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libnpa_la_LIBADD = $(OPENSSL_LIBS) $(OPENSC_LIBS)
libpace_la_CFLAGS = $(OPENSSL_CFLAGS) libnpa_la_CFLAGS = $(OPENSSL_CFLAGS)
pace_tool_SOURCES = pace-tool.c binutil.c npa_tool_SOURCES = npa-tool.c binutil.c
pace_tool_LDADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libpace.la npa_tool_LDADD = $(OPENSSL_LIBS) $(OPENSC_LIBS) libnpa.la
pace_tool_CFLAGS = $(OPENSSL_CFLAGS) npa_tool_CFLAGS = $(OPENSSL_CFLAGS)
bin_PROGRAMS = pace-tool bin_PROGRAMS = npa-tool
lib_LTLIBRARIES = libpace.la lib_LTLIBRARIES = libnpa.la
noinst_HEADERS = \ noinst_HEADERS = \
binutil.h binutil.h
nobase_include_HEADERS = \ nobase_include_HEADERS = \
pace/sm.h \ npa/sm.h \
pace/pace.h \ npa/npa.h \
pace/scutil.h \ npa/scutil.h \
pace/pace_lib.h npa/npa_lib.h

39
npa/src/pace-tool.c → npa/src/npa-tool.c
View File

@@ -16,8 +16,9 @@
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>. * ccid. If not, see <http://www.gnu.org/licenses/>.
*/ */
#include "config.h"
#include "binutil.h" #include "binutil.h"
#include "pace.h" #include "npa.h"
#include "scutil.h" #include "scutil.h"
#include <libopensc/log.h> #include <libopensc/log.h>
#include <openssl/pace.h> #include <openssl/pace.h>
@@ -111,7 +112,7 @@ static const char *option_help[] = {
"Print version, available readers and drivers.", "Print version, available readers and drivers.",
}; };
int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input) int npa_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input)
{ {
u8 buf[4 + 3 + 0xffff + 3]; u8 buf[4 + 3 + 0xffff + 3];
char *read = NULL; char *read = NULL;
@@ -304,8 +305,8 @@ main (int argc, char **argv)
if (doinfo) { if (doinfo) {
fprintf(stderr, "%s 0.9 written by Frank Morgner.\n\n" , fprintf(stderr, "%s %s written by Frank Morgner.\n\n" ,
argv[0]); argv[0], VERSION);
return print_avail(verbose); return print_avail(verbose);
} }
@@ -332,12 +333,12 @@ main (int argc, char **argv)
if (pin) { if (pin) {
if (sscanf(pin, "%llu", &secret) != 1) { if (sscanf(pin, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n", fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id)); npa_secret_name(pace_input.pin_id));
exit(2); exit(2);
} }
if (strlen(can) > pace_input.pin_length) { if (strlen(can) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n", fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id), npa_secret_name(pace_input.pin_id),
pace_input.pin_length); pace_input.pin_length);
exit(2); exit(2);
} }
@@ -348,12 +349,12 @@ main (int argc, char **argv)
if (can) { if (can) {
if (sscanf(can, "%llu", &secret) != 1) { if (sscanf(can, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n", fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id)); npa_secret_name(pace_input.pin_id));
exit(2); exit(2);
} }
if (strlen(can) > pace_input.pin_length) { if (strlen(can) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n", fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id), npa_secret_name(pace_input.pin_id),
pace_input.pin_length); pace_input.pin_length);
exit(2); exit(2);
} }
@@ -364,12 +365,12 @@ main (int argc, char **argv)
if (puk) { if (puk) {
if (sscanf(puk, "%llu", &secret) != 1) { if (sscanf(puk, "%llu", &secret) != 1) {
fprintf(stderr, "%s is not an unsigned long long.\n", fprintf(stderr, "%s is not an unsigned long long.\n",
pace_secret_name(pace_input.pin_id)); npa_secret_name(pace_input.pin_id));
exit(2); exit(2);
} }
if (strlen(puk) > pace_input.pin_length) { if (strlen(puk) > pace_input.pin_length) {
fprintf(stderr, "%s too big, only %d digits allowed.\n", fprintf(stderr, "%s too big, only %d digits allowed.\n",
pace_secret_name(pace_input.pin_id), npa_secret_name(pace_input.pin_id),
pace_input.pin_length); pace_input.pin_length);
exit(2); exit(2);
} }
@@ -388,7 +389,7 @@ main (int argc, char **argv)
gettimeofday(&tv, NULL); gettimeofday(&tv, NULL);
printf("%u,%06u: Trying %s=%s\n", printf("%u,%06u: Trying %s=%s\n",
tv.tv_sec, tv.tv_usec, tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id), pace_input.pin); npa_secret_name(pace_input.pin_id), pace_input.pin);
i = EstablishPACEChannel(NULL, card, pace_input, &pace_output, i = EstablishPACEChannel(NULL, card, pace_input, &pace_output,
&sctx); &sctx);
@@ -400,12 +401,12 @@ main (int argc, char **argv)
if (0 > i) { if (0 > i) {
printf("%u,%06u: Tried breaking %s without success.\n", printf("%u,%06u: Tried breaking %s without success.\n",
tv.tv_sec, tv.tv_usec, tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id)); npa_secret_name(pace_input.pin_id));
goto err; goto err;
} else { } else {
printf("%u,%06u: Tried breaking %s with success (=%s).\n", printf("%u,%06u: Tried breaking %s with success (=%s).\n",
tv.tv_sec, tv.tv_usec, tv.tv_sec, tv.tv_usec,
pace_secret_name(pace_input.pin_id), npa_secret_name(pace_input.pin_id),
pace_input.pin); pace_input.pin);
} }
} }
@@ -455,7 +456,7 @@ main (int argc, char **argv)
goto err; goto err;
printf("Established PACE channel with PUK.\n"); printf("Established PACE channel with PUK.\n");
i = pace_unblock_pin(&sctx, card); i = npa_unblock_pin(&sctx, card);
if (i < 0) if (i < 0)
goto err; goto err;
printf("Unblocked PIN.\n"); printf("Unblocked PIN.\n");
@@ -476,7 +477,7 @@ main (int argc, char **argv)
goto err; goto err;
printf("Established PACE channel with PIN.\n"); printf("Established PACE channel with PIN.\n");
i = pace_change_pin(&sctx, card, newpin, newpin ? strlen(newpin) : 0); i = npa_change_pin(&sctx, card, newpin, newpin ? strlen(newpin) : 0);
if (i < 0) if (i < 0)
goto err; goto err;
printf("Changed PIN.\n"); printf("Changed PIN.\n");
@@ -520,7 +521,7 @@ main (int argc, char **argv)
if (i < 0) if (i < 0)
goto err; goto err;
printf("Established PACE channel with %s.\n", printf("Established PACE channel with %s.\n",
pace_secret_name(pace_input.pin_id)); npa_secret_name(pace_input.pin_id));
if (dotranslate) { if (dotranslate) {
FILE *input; FILE *input;
@@ -532,7 +533,7 @@ main (int argc, char **argv)
perror("Opening file with APDUs"); perror("Opening file with APDUs");
} }
i = pace_translate_apdus(&sctx, card, input); i = npa_translate_apdus(&sctx, card, input);
fclose(input); fclose(input);
if (i < 0) if (i < 0)
goto err; goto err;
@@ -540,8 +541,8 @@ main (int argc, char **argv)
} }
err: err:
pace_sm_ctx_clear_free(sctx.cipher_ctx); npa_sm_ctx_clear_free(sctx.cipher_ctx);
pace_sm_ctx_clear_free(tmpctx.cipher_ctx); npa_sm_ctx_clear_free(tmpctx.cipher_ctx);
if (pace_output.ef_cardaccess) if (pace_output.ef_cardaccess)
free(pace_output.ef_cardaccess); free(pace_output.ef_cardaccess);
if (pace_output.recent_car) if (pace_output.recent_car)

266
npa/src/pace.c → npa/src/npa.c
View File

@@ -16,7 +16,7 @@
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>. * ccid. If not, see <http://www.gnu.org/licenses/>.
*/ */
#include "pace.h" #include "npa.h"
#include "sm.h" #include "sm.h"
#include "scutil.h" #include "scutil.h"
#include <libopensc/asn1.h> #include <libopensc/asn1.h>
@@ -40,34 +40,34 @@
* MSE:Set AT * MSE:Set AT
*/ */
typedef struct pace_mse_set_at_cd_st { typedef struct npa_mse_set_at_cd_st {
ASN1_OBJECT *cryptographic_mechanism_reference; ASN1_OBJECT *cryptographic_mechanism_reference;
ASN1_INTEGER *key_reference1; ASN1_INTEGER *key_reference1;
ASN1_INTEGER *key_reference2; ASN1_INTEGER *key_reference2;
ASN1_OCTET_STRING *auxiliary_data; ASN1_OCTET_STRING *auxiliary_data;
ASN1_OCTET_STRING *eph_pub_key; ASN1_OCTET_STRING *eph_pub_key;
CVC_CHAT *chat; CVC_CHAT *chat;
} PACE_MSE_SET_AT_C; } NPA_MSE_SET_AT_C;
ASN1_SEQUENCE(PACE_MSE_SET_AT_C) = { ASN1_SEQUENCE(NPA_MSE_SET_AT_C) = {
/* 0x80 /* 0x80
* Cryptographic mechanism reference */ * Cryptographic mechanism reference */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0), ASN1_IMP_OPT(NPA_MSE_SET_AT_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0),
/* 0x83 /* 0x83
* Reference of a public key / secret key */ * Reference of a public key / secret key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, key_reference1, ASN1_INTEGER, 3), ASN1_IMP_OPT(NPA_MSE_SET_AT_C, key_reference1, ASN1_INTEGER, 3),
/* 0x84 /* 0x84
* Reference of a private key / Reference for computing a session key */ * Reference of a private key / Reference for computing a session key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, key_reference2, ASN1_INTEGER, 4), ASN1_IMP_OPT(NPA_MSE_SET_AT_C, key_reference2, ASN1_INTEGER, 4),
/* 0x67 /* 0x67
* Auxiliary authenticated data */ * Auxiliary authenticated data */
ASN1_APP_IMP_OPT(PACE_MSE_SET_AT_C, auxiliary_data, ASN1_OCTET_STRING, 7), ASN1_APP_IMP_OPT(NPA_MSE_SET_AT_C, auxiliary_data, ASN1_OCTET_STRING, 7),
/* 0x91 /* 0x91
* Ephemeral Public Key */ * Ephemeral Public Key */
ASN1_IMP_OPT(PACE_MSE_SET_AT_C, eph_pub_key, ASN1_OCTET_STRING, 0x11), ASN1_IMP_OPT(NPA_MSE_SET_AT_C, eph_pub_key, ASN1_OCTET_STRING, 0x11),
/* Certificate Holder Authorization Template */ /* Certificate Holder Authorization Template */
ASN1_OPT(PACE_MSE_SET_AT_C, chat, CVC_CHAT), ASN1_OPT(NPA_MSE_SET_AT_C, chat, CVC_CHAT),
} ASN1_SEQUENCE_END(PACE_MSE_SET_AT_C) } ASN1_SEQUENCE_END(NPA_MSE_SET_AT_C)
IMPLEMENT_ASN1_FUNCTIONS(PACE_MSE_SET_AT_C) IMPLEMENT_ASN1_FUNCTIONS(NPA_MSE_SET_AT_C)
/* /*
@@ -75,96 +75,96 @@ IMPLEMENT_ASN1_FUNCTIONS(PACE_MSE_SET_AT_C)
*/ */
/* Protocol Command Data */ /* Protocol Command Data */
typedef struct pace_gen_auth_cd_st { typedef struct npa_gen_auth_cd_st {
ASN1_OCTET_STRING *mapping_data; ASN1_OCTET_STRING *mapping_data;
ASN1_OCTET_STRING *eph_pub_key; ASN1_OCTET_STRING *eph_pub_key;
ASN1_OCTET_STRING *auth_token; ASN1_OCTET_STRING *auth_token;
} PACE_GEN_AUTH_C_BODY; } NPA_GEN_AUTH_C_BODY;
ASN1_SEQUENCE(PACE_GEN_AUTH_C_BODY) = { ASN1_SEQUENCE(NPA_GEN_AUTH_C_BODY) = {
/* 0x81 /* 0x81
* Mapping Data */ * Mapping Data */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, mapping_data, ASN1_OCTET_STRING, 1), ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, mapping_data, ASN1_OCTET_STRING, 1),
/* 0x83 /* 0x83
* Ephemeral Public Key */ * Ephemeral Public Key */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3), ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3),
/* 0x85 /* 0x85
* Authentication Token */ * Authentication Token */
ASN1_IMP_OPT(PACE_GEN_AUTH_C_BODY, auth_token, ASN1_OCTET_STRING, 5), ASN1_IMP_OPT(NPA_GEN_AUTH_C_BODY, auth_token, ASN1_OCTET_STRING, 5),
} ASN1_SEQUENCE_END(PACE_GEN_AUTH_C_BODY) } ASN1_SEQUENCE_END(NPA_GEN_AUTH_C_BODY)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_C_BODY) IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_C_BODY)
typedef PACE_GEN_AUTH_C_BODY PACE_GEN_AUTH_C; typedef NPA_GEN_AUTH_C_BODY NPA_GEN_AUTH_C;
/* 0x7C /* 0x7C
* Dynamic Authentication Data */ * Dynamic Authentication Data */
ASN1_ITEM_TEMPLATE(PACE_GEN_AUTH_C) = ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_C) =
ASN1_EX_TEMPLATE_TYPE( ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION,
0x1c, PACE_GEN_AUTH_C, PACE_GEN_AUTH_C_BODY) 0x1c, NPA_GEN_AUTH_C, NPA_GEN_AUTH_C_BODY)
ASN1_ITEM_TEMPLATE_END(PACE_GEN_AUTH_C) ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_C)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_C) IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_C)
/* Protocol Response Data */ /* Protocol Response Data */
typedef struct pace_gen_auth_rapdu_body_st { typedef struct npa_gen_auth_rapdu_body_st {
ASN1_OCTET_STRING *enc_nonce; ASN1_OCTET_STRING *enc_nonce;
ASN1_OCTET_STRING *mapping_data; ASN1_OCTET_STRING *mapping_data;
ASN1_OCTET_STRING *eph_pub_key; ASN1_OCTET_STRING *eph_pub_key;
ASN1_OCTET_STRING *auth_token; ASN1_OCTET_STRING *auth_token;
ASN1_OCTET_STRING *cur_car; ASN1_OCTET_STRING *cur_car;
ASN1_OCTET_STRING *prev_car; ASN1_OCTET_STRING *prev_car;
} PACE_GEN_AUTH_R_BODY; } NPA_GEN_AUTH_R_BODY;
ASN1_SEQUENCE(PACE_GEN_AUTH_R_BODY) = { ASN1_SEQUENCE(NPA_GEN_AUTH_R_BODY) = {
/* 0x80 /* 0x80
* Encrypted Nonce */ * Encrypted Nonce */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0), ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0),
/* 0x82 /* 0x82
* Mapping Data */ * Mapping Data */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, mapping_data, ASN1_OCTET_STRING, 2), ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, mapping_data, ASN1_OCTET_STRING, 2),
/* 0x84 /* 0x84
* Ephemeral Public Key */ * Ephemeral Public Key */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4), ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4),
/* 0x86 /* 0x86
* Authentication Token */ * Authentication Token */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, auth_token, ASN1_OCTET_STRING, 6), ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, auth_token, ASN1_OCTET_STRING, 6),
/* 0x87 /* 0x87
* Most recent Certification Authority Reference */ * Most recent Certification Authority Reference */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, cur_car, ASN1_OCTET_STRING, 7), ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, cur_car, ASN1_OCTET_STRING, 7),
/* 0x88 /* 0x88
* Previous Certification Authority Reference */ * Previous Certification Authority Reference */
ASN1_IMP_OPT(PACE_GEN_AUTH_R_BODY, prev_car, ASN1_OCTET_STRING, 8), ASN1_IMP_OPT(NPA_GEN_AUTH_R_BODY, prev_car, ASN1_OCTET_STRING, 8),
} ASN1_SEQUENCE_END(PACE_GEN_AUTH_R_BODY) } ASN1_SEQUENCE_END(NPA_GEN_AUTH_R_BODY)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_R_BODY) IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_R_BODY)
typedef PACE_GEN_AUTH_R_BODY PACE_GEN_AUTH_R; typedef NPA_GEN_AUTH_R_BODY NPA_GEN_AUTH_R;
/* 0x7C /* 0x7C
* Dynamic Authentication Data */ * Dynamic Authentication Data */
ASN1_ITEM_TEMPLATE(PACE_GEN_AUTH_R) = ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_R) =
ASN1_EX_TEMPLATE_TYPE( ASN1_EX_TEMPLATE_TYPE(
ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION,
0x1c, PACE_GEN_AUTH_R, PACE_GEN_AUTH_R_BODY) 0x1c, NPA_GEN_AUTH_R, NPA_GEN_AUTH_R_BODY)
ASN1_ITEM_TEMPLATE_END(PACE_GEN_AUTH_R) ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_R)
IMPLEMENT_ASN1_FUNCTIONS(PACE_GEN_AUTH_R) IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_R)
const size_t maxresp = SC_MAX_APDU_BUFFER_SIZE - 2; const size_t maxresp = SC_MAX_APDU_BUFFER_SIZE - 2;
static int pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **enc); const u8 *data, size_t datalen, u8 **enc);
static int pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *enc, size_t enclen, u8 **data); const u8 *enc, size_t enclen, u8 **data);
static int pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **outdata); const u8 *data, size_t datalen, u8 **outdata);
static int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *mac, size_t maclen, const u8 *mac, size_t maclen,
const u8 *macdata, size_t macdatalen); const u8 *macdata, size_t macdatalen);
static int pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *apdu); sc_apdu_t *apdu);
static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *sm_apdu); sc_apdu_t *sm_apdu);
static int increment_ssc(struct pace_sm_ctx *psmctx); static int increment_ssc(struct npa_sm_ctx *psmctx);
static int decrement_ssc(struct pace_sm_ctx *psmctx); static int decrement_ssc(struct npa_sm_ctx *psmctx);
static int reset_ssc(struct pace_sm_ctx *psmctx); static int reset_ssc(struct npa_sm_ctx *psmctx);
int GetReadersPACECapabilities(u8 *bitmap) int GetReadersPACECapabilities(u8 *bitmap)
@@ -173,7 +173,7 @@ int GetReadersPACECapabilities(u8 *bitmap)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
/* BitMap */ /* BitMap */
*bitmap = PACE_BITMAP_PACE|PACE_BITMAP_EID|PACE_BITMAP_ESIGN; *bitmap = NPA_BITMAP_PACE|NPA_BITMAP_EID|NPA_BITMAP_ESIGN;
return SC_SUCCESS; return SC_SUCCESS;
} }
@@ -256,12 +256,12 @@ err:
return r; return r;
} }
static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card, static int npa_mse_set_at(struct sm_ctx *oldnpactx, sc_card_t *card,
int protocol, int secret_key, const CVC_CHAT *chat, u8 *sw1, u8 *sw2) int protocol, int secret_key, const CVC_CHAT *chat, u8 *sw1, u8 *sw2)
{ {
sc_apdu_t apdu; sc_apdu_t apdu;
unsigned char *d = NULL; unsigned char *d = NULL;
PACE_MSE_SET_AT_C *data = NULL; NPA_MSE_SET_AT_C *data = NULL;
int r, tries; int r, tries;
if (!sw1 || !sw2) { if (!sw1 || !sw2) {
@@ -277,7 +277,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL; apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
data = PACE_MSE_SET_AT_C_new(); data = NPA_MSE_SET_AT_C_new();
if (!data) { if (!data) {
r = SC_ERROR_OUT_OF_MEMORY; r = SC_ERROR_OUT_OF_MEMORY;
goto err; goto err;
@@ -301,7 +301,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
data->chat = (CVC_CHAT *) chat; data->chat = (CVC_CHAT *) chat;
r = i2d_PACE_MSE_SET_AT_C(data, &d); r = i2d_NPA_MSE_SET_AT_C(data, &d);
if (r < 0) { if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding MSE:Set AT APDU data"); sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding MSE:Set AT APDU data");
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
@@ -315,8 +315,8 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "MSE:Set AT command data", apdu.data, apdu.datalen); bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "MSE:Set AT command data", apdu.data, apdu.datalen);
if (oldpacectx) if (oldnpactx)
r = sm_transmit_apdu(oldpacectx, card, &apdu); r = sm_transmit_apdu(oldnpactx, card, &apdu);
else else
r = sc_transmit_apdu(card, &apdu); r = sc_transmit_apdu(card, &apdu);
if (r < 0) if (r < 0)
@@ -338,7 +338,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card,
if (tries <= 1) { if (tries <= 1) {
/* this is only a warning... */ /* this is only a warning... */
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Remaining tries: %d (%s must be %s)\n", sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Remaining tries: %d (%s must be %s)\n",
tries, pace_secret_name(secret_key), tries, npa_secret_name(secret_key),
tries ? "resumed" : "unblocked"); tries ? "resumed" : "unblocked");
} }
r = SC_SUCCESS; r = SC_SUCCESS;
@@ -362,7 +362,7 @@ err:
if (data) { if (data) {
/* do not free the functions parameter chat */ /* do not free the functions parameter chat */
data->chat = NULL; data->chat = NULL;
PACE_MSE_SET_AT_C_free(data); NPA_MSE_SET_AT_C_free(data);
} }
if (d) if (d)
free(d); free(d);
@@ -370,12 +370,12 @@ err:
return r; return r;
} }
static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx, static int npa_gen_auth_1_encrypted_nonce(struct sm_ctx *oldnpactx,
sc_card_t *card, u8 **enc_nonce, size_t *enc_nonce_len) sc_card_t *card, u8 **enc_nonce, size_t *enc_nonce_len)
{ {
sc_apdu_t apdu; sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL; NPA_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL; NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p; unsigned char *d = NULL, *p;
int r, l; int r, l;
@@ -385,12 +385,12 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
apdu.cse = SC_APDU_CASE_4_SHORT; apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL; apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new(); c_data = NPA_GEN_AUTH_C_new();
if (!c_data) { if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY; r = SC_ERROR_OUT_OF_MEMORY;
goto err; goto err;
} }
r = i2d_PACE_GEN_AUTH_C(c_data, &d); r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) { if (r < 0) {
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
@@ -403,8 +403,8 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
apdu.resplen = maxresp; apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen); apdu.resp = malloc(apdu.resplen);
if (oldpacectx) if (oldnpactx)
r = sm_transmit_apdu(oldpacectx, card, &apdu); r = sm_transmit_apdu(oldnpactx, card, &apdu);
else else
r = sc_transmit_apdu(card, &apdu); r = sc_transmit_apdu(card, &apdu);
if (r < 0) if (r < 0)
@@ -416,7 +416,7 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen); bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data, if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) { (const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
@@ -455,7 +455,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key); ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token) if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/ ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data); NPA_GEN_AUTH_C_free(c_data);
} }
if (d) if (d)
free(d); free(d);
@@ -467,7 +467,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key); ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token) if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/ ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data); NPA_GEN_AUTH_R_free(r_data);
} }
/* XXX */ /* XXX */
/*if (apdu.resp)*/ /*if (apdu.resp)*/
@@ -475,13 +475,13 @@ err:
return r; return r;
} }
static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx, static int npa_gen_auth_2_map_nonce(struct sm_ctx *oldnpactx,
sc_card_t *card, const u8 *in, size_t in_len, u8 **map_data_out, sc_card_t *card, const u8 *in, size_t in_len, u8 **map_data_out,
size_t *map_data_out_len) size_t *map_data_out_len)
{ {
sc_apdu_t apdu; sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL; NPA_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL; NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p; unsigned char *d = NULL, *p;
int r, l; int r, l;
@@ -491,7 +491,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
apdu.cse = SC_APDU_CASE_4_SHORT; apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL; apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new(); c_data = NPA_GEN_AUTH_C_new();
if (!c_data) { if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY; r = SC_ERROR_OUT_OF_MEMORY;
goto err; goto err;
@@ -503,7 +503,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = i2d_PACE_GEN_AUTH_C(c_data, &d); r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) { if (r < 0) {
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
@@ -516,8 +516,8 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
apdu.resplen = maxresp; apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen); apdu.resp = malloc(apdu.resplen);
if (oldpacectx) if (oldnpactx)
r = sm_transmit_apdu(oldpacectx, card, &apdu); r = sm_transmit_apdu(oldnpactx, card, &apdu);
else else
r = sc_transmit_apdu(card, &apdu); r = sc_transmit_apdu(card, &apdu);
if (r < 0) if (r < 0)
@@ -529,7 +529,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen); bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data, if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) { (const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
@@ -568,7 +568,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key); ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token) if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/ ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data); NPA_GEN_AUTH_C_free(c_data);
} }
if (d) if (d)
free(d); free(d);
@@ -580,7 +580,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key); ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token) if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/ ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data); NPA_GEN_AUTH_R_free(r_data);
} }
/* XXX */ /* XXX */
/*if (apdu.resp)*/ /*if (apdu.resp)*/
@@ -588,13 +588,13 @@ err:
return r; return r;
} }
static int pace_gen_auth_3_perform_key_agreement( static int npa_gen_auth_3_perform_key_agreement(
struct sm_ctx *oldpacectx, sc_card_t *card, struct sm_ctx *oldnpactx, sc_card_t *card,
const u8 *in, size_t in_len, u8 **eph_pub_key_out, size_t *eph_pub_key_out_len) const u8 *in, size_t in_len, u8 **eph_pub_key_out, size_t *eph_pub_key_out_len)
{ {
sc_apdu_t apdu; sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL; NPA_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL; NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p; unsigned char *d = NULL, *p;
int r, l; int r, l;
@@ -604,7 +604,7 @@ static int pace_gen_auth_3_perform_key_agreement(
apdu.cse = SC_APDU_CASE_4_SHORT; apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL; apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new(); c_data = NPA_GEN_AUTH_C_new();
if (!c_data) { if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY; r = SC_ERROR_OUT_OF_MEMORY;
goto err; goto err;
@@ -616,7 +616,7 @@ static int pace_gen_auth_3_perform_key_agreement(
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = i2d_PACE_GEN_AUTH_C(c_data, &d); r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) { if (r < 0) {
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
@@ -629,8 +629,8 @@ static int pace_gen_auth_3_perform_key_agreement(
apdu.resplen = maxresp; apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen); apdu.resp = malloc(apdu.resplen);
if (oldpacectx) if (oldnpactx)
r = sm_transmit_apdu(oldpacectx, card, &apdu); r = sm_transmit_apdu(oldnpactx, card, &apdu);
else else
r = sc_transmit_apdu(card, &apdu); r = sc_transmit_apdu(card, &apdu);
if (r < 0) if (r < 0)
@@ -642,7 +642,7 @@ static int pace_gen_auth_3_perform_key_agreement(
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data, if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) { (const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
@@ -681,7 +681,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key); ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token) if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/ ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data); NPA_GEN_AUTH_C_free(c_data);
} }
if (d) if (d)
free(d); free(d);
@@ -693,7 +693,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key); ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token) if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/ ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data); NPA_GEN_AUTH_R_free(r_data);
} }
/* XXX */ /* XXX */
/*if (apdu.resp)*/ /*if (apdu.resp)*/
@@ -701,15 +701,15 @@ err:
return r; return r;
} }
static int pace_gen_auth_4_mutual_authentication( static int npa_gen_auth_4_mutual_authentication(
struct sm_ctx *oldpacectx, sc_card_t *card, struct sm_ctx *oldnpactx, sc_card_t *card,
const u8 *in, size_t in_len, u8 **auth_token_out, const u8 *in, size_t in_len, u8 **auth_token_out,
size_t *auth_token_out_len, u8 **recent_car, size_t *recent_car_len, size_t *auth_token_out_len, u8 **recent_car, size_t *recent_car_len,
u8 **prev_car, size_t *prev_car_len) u8 **prev_car, size_t *prev_car_len)
{ {
sc_apdu_t apdu; sc_apdu_t apdu;
PACE_GEN_AUTH_C *c_data = NULL; NPA_GEN_AUTH_C *c_data = NULL;
PACE_GEN_AUTH_R *r_data = NULL; NPA_GEN_AUTH_R *r_data = NULL;
unsigned char *d = NULL, *p; unsigned char *d = NULL, *p;
int r, l; int r, l;
@@ -719,7 +719,7 @@ static int pace_gen_auth_4_mutual_authentication(
apdu.cse = SC_APDU_CASE_4_SHORT; apdu.cse = SC_APDU_CASE_4_SHORT;
apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL; apdu.flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL;
c_data = PACE_GEN_AUTH_C_new(); c_data = NPA_GEN_AUTH_C_new();
if (!c_data) { if (!c_data) {
r = SC_ERROR_OUT_OF_MEMORY; r = SC_ERROR_OUT_OF_MEMORY;
goto err; goto err;
@@ -732,7 +732,7 @@ static int pace_gen_auth_4_mutual_authentication(
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = i2d_PACE_GEN_AUTH_C(c_data, &d); r = i2d_NPA_GEN_AUTH_C(c_data, &d);
if (r < 0) { if (r < 0) {
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
@@ -745,8 +745,8 @@ static int pace_gen_auth_4_mutual_authentication(
apdu.resplen = maxresp; apdu.resplen = maxresp;
apdu.resp = malloc(apdu.resplen); apdu.resp = malloc(apdu.resplen);
if (oldpacectx) if (oldnpactx)
r = sm_transmit_apdu(oldpacectx, card, &apdu); r = sm_transmit_apdu(oldnpactx, card, &apdu);
else else
r = sc_transmit_apdu(card, &apdu); r = sc_transmit_apdu(card, &apdu);
if (r < 0) if (r < 0)
@@ -758,7 +758,7 @@ static int pace_gen_auth_4_mutual_authentication(
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen);
if (!d2i_PACE_GEN_AUTH_R(&r_data, if (!d2i_NPA_GEN_AUTH_R(&r_data,
(const unsigned char **) &apdu.resp, apdu.resplen)) { (const unsigned char **) &apdu.resp, apdu.resplen)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data.");
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
@@ -822,7 +822,7 @@ err:
ASN1_OCTET_STRING_free(c_data->eph_pub_key); ASN1_OCTET_STRING_free(c_data->eph_pub_key);
if (c_data->auth_token) if (c_data->auth_token)
ASN1_OCTET_STRING_free(c_data->auth_token);*/ ASN1_OCTET_STRING_free(c_data->auth_token);*/
PACE_GEN_AUTH_C_free(c_data); NPA_GEN_AUTH_C_free(c_data);
} }
if (d) if (d)
free(d); free(d);
@@ -834,7 +834,7 @@ err:
ASN1_OCTET_STRING_free(r_data->eph_pub_key); ASN1_OCTET_STRING_free(r_data->eph_pub_key);
if (r_data->auth_token) if (r_data->auth_token)
ASN1_OCTET_STRING_free(r_data->auth_token);*/ ASN1_OCTET_STRING_free(r_data->auth_token);*/
PACE_GEN_AUTH_R_free(r_data); NPA_GEN_AUTH_R_free(r_data);
} }
/* XXX */ /* XXX */
/*if (apdu.resp)*/ /*if (apdu.resp)*/
@@ -844,7 +844,7 @@ err:
} }
int int
pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card, npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
enum s_type pin_id, int ask_for_secret, enum s_type pin_id, int ask_for_secret,
const char *new, size_t new_len) const char *new, size_t new_len)
{ {
@@ -906,19 +906,19 @@ get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id
if (!length_pin || !pin) { if (!length_pin || !pin) {
if (0 > snprintf(buf, sizeof buf, "Please enter your %s: ", if (0 > snprintf(buf, sizeof buf, "Please enter your %s: ",
pace_secret_name(pin_id))) { npa_secret_name(pin_id))) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create password prompt.\n"); sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create password prompt.\n");
return NULL; return NULL;
} }
p = malloc(MAX_MRZ_LEN); p = malloc(MAX_MRZ_LEN);
if (!p) { if (!p) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for %s.\n", sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for %s.\n",
pace_secret_name(pin_id)); npa_secret_name(pin_id));
return NULL; return NULL;
} }
if (0 > EVP_read_pw_string_min(p, 0, MAX_MRZ_LEN, buf, 0)) { if (0 > EVP_read_pw_string_min(p, 0, MAX_MRZ_LEN, buf, 0)) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read %s.\n", sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read %s.\n",
pace_secret_name(pin_id)); npa_secret_name(pin_id));
return NULL; return NULL;
} }
length_pin = strnlen(p, MAX_MRZ_LEN); length_pin = strnlen(p, MAX_MRZ_LEN);
@@ -944,7 +944,7 @@ void ssl_error(sc_context_t *ctx) {
ERR_free_strings(); ERR_free_strings();
} }
int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, int EstablishPACEChannel(struct sm_ctx *oldnpactx, sc_card_t *card,
struct establish_pace_channel_input pace_input, struct establish_pace_channel_input pace_input,
struct establish_pace_channel_output *pace_output, struct establish_pace_channel_output *pace_output,
struct sm_ctx *sctx) struct sm_ctx *sctx)
@@ -1086,7 +1086,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
} }
pctx->tr_version = pace_input.tr_version; pctx->tr_version = pace_input.tr_version;
r = pace_mse_set_at(oldpacectx, card, info->protocol, pace_input.pin_id, r = npa_mse_set_at(oldnpactx, card, info->protocol, pace_input.pin_id,
chat, &pace_output->mse_set_at_sw1, &pace_output->mse_set_at_sw2); chat, &pace_output->mse_set_at_sw1, &pace_output->mse_set_at_sw2);
if (r < 0) { if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties " sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties "
@@ -1098,7 +1098,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = pace_gen_auth_1_encrypted_nonce(oldpacectx, card, (u8 **) &enc_nonce->data, r = npa_gen_auth_1_encrypted_nonce(oldnpactx, card, (u8 **) &enc_nonce->data,
&enc_nonce->length); &enc_nonce->length);
if (r < 0) { if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get encrypted nonce from card " sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get encrypted nonce from card "
@@ -1127,7 +1127,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = pace_gen_auth_2_map_nonce(oldpacectx, card, (u8 *) mdata->data, mdata->length, r = npa_gen_auth_2_map_nonce(oldnpactx, card, (u8 *) mdata->data, mdata->length,
(u8 **) &mdata_opp->data, &mdata_opp->length); (u8 **) &mdata_opp->data, &mdata_opp->length);
if (r < 0) { if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange mapping data with card " sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange mapping data with card "
@@ -1147,7 +1147,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = pace_gen_auth_3_perform_key_agreement(oldpacectx, card, (u8 *) pub->data, pub->length, r = npa_gen_auth_3_perform_key_agreement(oldnpactx, card, (u8 *) pub->data, pub->length,
(u8 **) &pub_opp->data, &pub_opp->length); (u8 **) &pub_opp->data, &pub_opp->length);
if (r < 0) { if (r < 0) {
sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange ephemeral public key with card " sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange ephemeral public key with card "
@@ -1175,7 +1175,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
r = SC_ERROR_INTERNAL; r = SC_ERROR_INTERNAL;
goto err; goto err;
} }
r = pace_gen_auth_4_mutual_authentication(oldpacectx, card, (u8 *) token->data, token->length, r = npa_gen_auth_4_mutual_authentication(oldnpactx, card, (u8 *) token->data, token->length,
(u8 **) &token_opp->data, &token_opp->length, (u8 **) &token_opp->data, &token_opp->length,
&pace_output->recent_car, &pace_output->recent_car_length, &pace_output->recent_car, &pace_output->recent_car_length,
&pace_output->previous_car, &pace_output->previous_car_length); &pace_output->previous_car, &pace_output->previous_car_length);
@@ -1227,7 +1227,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID PCD", pace_output->id_pcd, bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID PCD", pace_output->id_pcd,
pace_output->id_pcd_length); pace_output->id_pcd_length);
sctx->authentication_ctx = pace_sm_ctx_create(k_mac, sctx->authentication_ctx = npa_sm_ctx_create(k_mac,
k_enc, pctx); k_enc, pctx);
if (!sctx->authentication_ctx) { if (!sctx->authentication_ctx) {
r = SC_ERROR_OUT_OF_MEMORY; r = SC_ERROR_OUT_OF_MEMORY;
@@ -1237,12 +1237,12 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
if (r < 0) if (r < 0)
goto err; goto err;
sctx->cipher_ctx = sctx->authentication_ctx; sctx->cipher_ctx = sctx->authentication_ctx;
sctx->authenticate = pace_sm_authenticate; sctx->authenticate = npa_sm_authenticate;
sctx->encrypt = pace_sm_encrypt; sctx->encrypt = npa_sm_encrypt;
sctx->decrypt = pace_sm_decrypt; sctx->decrypt = npa_sm_decrypt;
sctx->verify_authentication = pace_sm_verify_authentication; sctx->verify_authentication = npa_sm_verify_authentication;
sctx->pre_transmit = pace_sm_pre_transmit; sctx->pre_transmit = npa_sm_pre_transmit;
sctx->post_transmit = pace_sm_post_transmit; sctx->post_transmit = npa_sm_post_transmit;
sctx->padding_indicator = SM_ISO_PADDING; sctx->padding_indicator = SM_ISO_PADDING;
sctx->block_length = EVP_CIPHER_block_size(pctx->cipher); sctx->block_length = EVP_CIPHER_block_size(pctx->cipher);
sctx->active = 1; sctx->active = 1;
@@ -1299,7 +1299,7 @@ err:
if (pctx) if (pctx)
PACE_CTX_clear_free(pctx); PACE_CTX_clear_free(pctx);
if (sctx->authentication_ctx) if (sctx->authentication_ctx)
pace_sm_ctx_free(sctx->authentication_ctx); npa_sm_ctx_free(sctx->authentication_ctx);
} }
return r; return r;
@@ -1310,7 +1310,7 @@ static const char *PIN_name = "PIN";
static const char *PUK_name = "PUK"; static const char *PUK_name = "PUK";
static const char *CAN_name = "CAN"; static const char *CAN_name = "CAN";
static const char *UNDEF_name = "UNDEF"; static const char *UNDEF_name = "UNDEF";
const char *pace_secret_name(enum s_type pin_id) { const char *npa_secret_name(enum s_type pin_id) {
switch (pin_id) { switch (pin_id) {
case PACE_MRZ: case PACE_MRZ:
return MRZ_name; return MRZ_name;
@@ -1326,7 +1326,7 @@ const char *pace_secret_name(enum s_type pin_id) {
} }
int int
increment_ssc(struct pace_sm_ctx *psmctx) increment_ssc(struct npa_sm_ctx *psmctx)
{ {
if (!psmctx) if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
@@ -1337,7 +1337,7 @@ increment_ssc(struct pace_sm_ctx *psmctx)
} }
int int
decrement_ssc(struct pace_sm_ctx *psmctx) decrement_ssc(struct npa_sm_ctx *psmctx)
{ {
if (!psmctx) if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
@@ -1348,7 +1348,7 @@ decrement_ssc(struct pace_sm_ctx *psmctx)
} }
int int
reset_ssc(struct pace_sm_ctx *psmctx) reset_ssc(struct npa_sm_ctx *psmctx)
{ {
if (!psmctx) if (!psmctx)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
@@ -1359,7 +1359,7 @@ reset_ssc(struct pace_sm_ctx *psmctx)
} }
static int static int
pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx, npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **enc) const u8 *data, size_t datalen, u8 **enc)
{ {
BUF_MEM *encbuf = NULL, *databuf = NULL; BUF_MEM *encbuf = NULL, *databuf = NULL;
@@ -1370,7 +1370,7 @@ pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS; r = SC_ERROR_INVALID_ARGUMENTS;
goto err; goto err;
} }
struct pace_sm_ctx *psmctx = ctx->cipher_ctx; struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
databuf = BUF_MEM_create_init(data, datalen); databuf = BUF_MEM_create_init(data, datalen);
encbuf = PACE_encrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, databuf); encbuf = PACE_encrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, databuf);
@@ -1403,7 +1403,7 @@ err:
} }
static int static int
pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx, npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *enc, size_t enclen, u8 **data) const u8 *enc, size_t enclen, u8 **data)
{ {
BUF_MEM *encbuf = NULL, *databuf = NULL; BUF_MEM *encbuf = NULL, *databuf = NULL;
@@ -1414,7 +1414,7 @@ pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS; r = SC_ERROR_INVALID_ARGUMENTS;
goto err; goto err;
} }
struct pace_sm_ctx *psmctx = ctx->cipher_ctx; struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
encbuf = BUF_MEM_create_init(enc, enclen); encbuf = BUF_MEM_create_init(enc, enclen);
databuf = PACE_decrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, encbuf); databuf = PACE_decrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, encbuf);
@@ -1447,7 +1447,7 @@ err:
} }
static int static int
pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx, npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *data, size_t datalen, u8 **macdata) const u8 *data, size_t datalen, u8 **macdata)
{ {
BUF_MEM *macbuf = NULL; BUF_MEM *macbuf = NULL;
@@ -1458,7 +1458,7 @@ pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS; r = SC_ERROR_INVALID_ARGUMENTS;
goto err; goto err;
} }
struct pace_sm_ctx *psmctx = ctx->cipher_ctx; struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
macbuf = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac, macbuf = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac,
data, datalen); data, datalen);
@@ -1490,7 +1490,7 @@ err:
} }
static int static int
pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
const u8 *mac, size_t maclen, const u8 *mac, size_t maclen,
const u8 *macdata, size_t macdatalen) const u8 *macdata, size_t macdatalen)
{ {
@@ -1502,7 +1502,7 @@ pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
r = SC_ERROR_INVALID_ARGUMENTS; r = SC_ERROR_INVALID_ARGUMENTS;
goto err; goto err;
} }
struct pace_sm_ctx *psmctx = ctx->cipher_ctx; struct npa_sm_ctx *psmctx = ctx->cipher_ctx;
my_mac = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac, my_mac = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac,
macdata, macdatalen); macdata, macdatalen);
@@ -1534,14 +1534,14 @@ err:
} }
static int static int
pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx, npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *apdu) sc_apdu_t *apdu)
{ {
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL,
increment_ssc(ctx->cipher_ctx)); increment_ssc(ctx->cipher_ctx));
} }
static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx, static int npa_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx,
sc_apdu_t *sm_apdu) sc_apdu_t *sm_apdu)
{ {
SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL,

110
npa/src/pace/pace.h → npa/src/npa/npa.h
View File

@@ -19,11 +19,11 @@
/** /**
* @file * @file
*/ */
#ifndef _CCID_PACE_H #ifndef _CCID_NPA_H
#define _CCID_PACE_H #define _CCID_NPA_H
#include <pace/pace_lib.h> #include <npa/npa_lib.h>
#include <pace/sm.h> #include <npa/sm.h>
#include <libopensc/opensc.h> #include <libopensc/opensc.h>
#include <openssl/bn.h> #include <openssl/bn.h>
#include <openssl/pace.h> #include <openssl/pace.h>
@@ -32,49 +32,49 @@
extern "C" { extern "C" {
#endif #endif
/** PACE capabilities (TR-03119): PACE */ /** NPA capabilities (TR-03119): PACE */
#define PACE_BITMAP_PACE 0x40 #define NPA_BITMAP_PACE 0x40
/** PACE capabilities (TR-03119): EPA: eID */ /** NPA capabilities (TR-03119): EPA: eID */
#define PACE_BITMAP_EID 0x20 #define NPA_BITMAP_EID 0x20
/** PACE capabilities (TR-03119): EPA: eSign */ /** NPA capabilities (TR-03119): EPA: eSign */
#define PACE_BITMAP_ESIGN 0x10 #define NPA_BITMAP_ESIGN 0x10
/** PACE result (TR-03119): Kein Fehler */ /** NPA result (TR-03119): Kein Fehler */
#define PACE_SUCCESS 0x00000000 #define NPA_SUCCESS 0x00000000
/** PACE result (TR-03119): Längen im Input sind inkonsistent */ /** NPA result (TR-03119): Längen im Input sind inkonsistent */
#define PACE_ERROR_LENGTH_INCONSISTENT 0xD0000001 #define NPA_ERROR_LENGTH_INCONSISTENT 0xD0000001
/** PACE result (TR-03119): Unerwartete Daten im Input */ /** NPA result (TR-03119): Unerwartete Daten im Input */
#define PACE_ERROR_UNEXPECTED_DATA 0xD0000002 #define NPA_ERROR_UNEXPECTED_DATA 0xD0000002
/** PACE result (TR-03119): Unerwartete Kombination von Daten im Input */ /** NPA result (TR-03119): Unerwartete Kombination von Daten im Input */
#define PACE_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003 #define NPA_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003
/** PACE result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */ /** NPA result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */
#define PACE_ERROR_CARD_NOT_SUPPORTED 0xE0000001 #define NPA_ERROR_CARD_NOT_SUPPORTED 0xE0000001
/** PACE result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */ /** NPA result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */
#define PACE_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002 #define NPA_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002
/** PACE result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */ /** NPA result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */
#define PACE_ERROR_PINID_NOT_SUPPORTED 0xE0000003 #define NPA_ERROR_PINID_NOT_SUPPORTED 0xE0000003
/** PACE result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_SELECT_EF_CARDACCESS 0xF0000000 #define NPA_ERROR_SELECT_EF_CARDACCESS 0xF0000000
/** PACE result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_READ_BINARY 0xF0010000 #define NPA_ERROR_READ_BINARY 0xF0010000
/** PACE result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_MSE_SET_AT 0xF0020000 #define NPA_ERROR_MSE_SET_AT 0xF0020000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000 #define NPA_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000 #define NPA_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000 #define NPA_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000
/** PACE result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */ /** NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */
#define PACE_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000 #define NPA_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000
/** PACE result (TR-03119): Kommunikationsabbruch mit Karte. */ /** NPA result (TR-03119): Kommunikationsabbruch mit Karte. */
#define PACE_ERROR_COMMUNICATION 0xF0100001 #define NPA_ERROR_COMMUNICATION 0xF0100001
/** PACE result (TR-03119): Keine Karte im Feld. */ /** NPA result (TR-03119): Keine Karte im Feld. */
#define PACE_ERROR_NO_CARD 0xF0100002 #define NPA_ERROR_NO_CARD 0xF0100002
/** PACE result (TR-03119): Benutzerabbruch. */ /** NPA result (TR-03119): Benutzerabbruch. */
#define PACE_ERROR_ABORTED 0xF0200001 #define NPA_ERROR_ABORTED 0xF0200001
/** PACE result (TR-03119): Benutzer – Timeout */ /** NPA result (TR-03119): Benutzer – Timeout */
#define PACE_ERROR_TIMEOUT 0xF0200002 #define NPA_ERROR_TIMEOUT 0xF0200002
//#define PACE_MRZ 0x01 //#define PACE_MRZ 0x01
//#define PACE_CAN 0x02 //#define PACE_CAN 0x02
@@ -93,7 +93,7 @@ extern "C" {
/** Minimum length of MRZ */ /** Minimum length of MRZ */
#define MAX_MRZ_LEN 128 #define MAX_MRZ_LEN 128
const char *pace_secret_name(enum s_type pin_id); const char *npa_secret_name(enum s_type pin_id);
/** /**
@@ -213,7 +213,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
* operation to be authorized either by an established PACE channel or by the * operation to be authorized either by an established PACE channel or by the
* effective authorization of the terminal's certificate. * effective authorization of the terminal's certificate.
* *
* @param[in] ctx (optional) PACE SM context * @param[in] ctx (optional) NPA SM context
* @param[in] card * @param[in] card
* @param[in] pin_id Type of secret (usually PIN or CAN). You may use <tt>enum s_type</tt> from \c <openssl/pace.h>. * @param[in] pin_id Type of secret (usually PIN or CAN). You may use <tt>enum s_type</tt> from \c <openssl/pace.h>.
* @param[in] ask_for_secret whether to ask the user for the secret (\c 1) or not (\c 0) * @param[in] ask_for_secret whether to ask the user for the secret (\c 1) or not (\c 0)
@@ -222,26 +222,26 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card,
* *
* @return \c SC_SUCCESS or error code if an error occurred * @return \c SC_SUCCESS or error code if an error occurred
*/ */
int pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card, int npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
enum s_type pin_id, int ask_for_secret, enum s_type pin_id, int ask_for_secret,
const char *new, size_t new_len); const char *new, size_t new_len);
/** /**
* @brief Send APDU to unblock the PIN * @brief Send APDU to unblock the PIN
* *
* @param[in] ctx (optional) PACE SM context * @param[in] ctx (optional) NPA SM context
* @param[in] card * @param[in] card
*/ */
#define pace_unblock_pin(ctx, card) \ #define npa_unblock_pin(ctx, card) \
pace_reset_retry_counter(ctx, card, PACE_PIN, 0, NULL, 0) npa_reset_retry_counter(ctx, card, PACE_PIN, 0, NULL, 0)
/** Send APDU to set a new PIN /** Send APDU to set a new PIN
* *
* @param[in] ctx (optional) PACE SM context * @param[in] ctx (optional) NPA SM context
* @param[in] card * @param[in] card
* @param[in] new (optional) new PIN * @param[in] new (optional) new PIN
* @param[in] new_len (optional) length of \a new * @param[in] new_len (optional) length of \a new
*/ */
#define pace_change_pin(ctx, card, newp, newplen) \ #define npa_change_pin(ctx, card, newp, newplen) \
pace_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen) npa_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
#ifdef __cplusplus #ifdef __cplusplus
} }

24
npa/src/pace/pace_lib.h → npa/src/npa/npa_lib.h
View File

@@ -19,8 +19,8 @@
/** /**
* @file * @file
*/ */
#ifndef _CCID_PACE_LIB_H #ifndef _CCID_NPA_LIB_H
#define _CCID_PACE_LIB_H #define _CCID_NPA_LIB_H
#include <openssl/pace.h> #include <openssl/pace.h>
@@ -28,8 +28,8 @@
extern "C" { extern "C" {
#endif #endif
/** PACE secure messaging context */ /** NPA secure messaging context */
struct pace_sm_ctx { struct npa_sm_ctx {
/** Send sequence counter */ /** Send sequence counter */
BIGNUM *ssc; BIGNUM *ssc;
/** Key for message authentication code */ /** Key for message authentication code */
@@ -42,34 +42,34 @@ struct pace_sm_ctx {
/** /**
* @brief Creates a PACE SM object * @brief Creates a NPA SM object
* *
* @param[in] key_mac Key for message authentication code * @param[in] key_mac Key for message authentication code
* @param[in] key_enc Key for encryption and decryption * @param[in] key_enc Key for encryption and decryption
* @param[in] ctx PACE context * @param[in] ctx NPA context
* *
* @return Initialized PACE SM object or NULL, if an error occurred * @return Initialized NPA SM object or NULL, if an error occurred
*/ */
struct pace_sm_ctx * pace_sm_ctx_create(const BUF_MEM *key_mac, struct npa_sm_ctx * npa_sm_ctx_create(const BUF_MEM *key_mac,
const BUF_MEM *key_enc, PACE_CTX *ctx); const BUF_MEM *key_enc, PACE_CTX *ctx);
/** /**
* @brief Frees a PACE SM object * @brief Frees a NPA SM object
* *
* Frees memory allocated for \a ctx and its send sequence counter * Frees memory allocated for \a ctx and its send sequence counter
* *
* @param[in] ctx object to be freed * @param[in] ctx object to be freed
*/ */
void pace_sm_ctx_free(struct pace_sm_ctx *ctx); void npa_sm_ctx_free(struct npa_sm_ctx *ctx);
/** /**
* @brief Frees a PACE SM object and all its components * @brief Frees a NPA SM object and all its components
* *
* Frees memory allocated for \a ctx and its send sequence counter, keys and PACE context * Frees memory allocated for \a ctx and its send sequence counter, keys and PACE context
* *
* @param[in] ctx object to be freed * @param[in] ctx object to be freed
*/ */
void pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx); void npa_sm_ctx_clear_free(struct npa_sm_ctx *ctx);
#ifdef __cplusplus #ifdef __cplusplus
} }

0
npa/src/pace/scutil.h → npa/src/npa/scutil.h
View File

0
npa/src/pace/sm.h → npa/src/npa/sm.h
View File

14
npa/src/pace_lib.c → npa/src/npa_lib.c
View File

@@ -16,15 +16,15 @@
* You should have received a copy of the GNU General Public License along with * You should have received a copy of the GNU General Public License along with
* ccid. If not, see <http://www.gnu.org/licenses/>. * ccid. If not, see <http://www.gnu.org/licenses/>.
*/ */
#include "pace_lib.h" #include "npa_lib.h"
#include <openssl/buffer.h> #include <openssl/buffer.h>
#include <openssl/pace.h> #include <openssl/pace.h>
struct pace_sm_ctx * struct npa_sm_ctx *
pace_sm_ctx_create(const BUF_MEM *key_mac, npa_sm_ctx_create(const BUF_MEM *key_mac,
const BUF_MEM *key_enc, PACE_CTX *ctx) const BUF_MEM *key_enc, PACE_CTX *ctx)
{ {
struct pace_sm_ctx *out = malloc(sizeof *out); struct npa_sm_ctx *out = malloc(sizeof *out);
if (!out) if (!out)
return NULL; return NULL;
@@ -42,7 +42,7 @@ pace_sm_ctx_create(const BUF_MEM *key_mac,
} }
void void
pace_sm_ctx_free(struct pace_sm_ctx *ctx) npa_sm_ctx_free(struct npa_sm_ctx *ctx)
{ {
if (ctx) { if (ctx) {
if (ctx->ssc) if (ctx->ssc)
@@ -52,7 +52,7 @@ pace_sm_ctx_free(struct pace_sm_ctx *ctx)
} }
void void
pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx) npa_sm_ctx_clear_free(struct npa_sm_ctx *ctx)
{ {
if (ctx) { if (ctx) {
if (ctx->key_mac) { if (ctx->key_mac) {
@@ -64,6 +64,6 @@ pace_sm_ctx_clear_free(struct pace_sm_ctx *ctx)
BUF_MEM_free((BUF_MEM *) ctx->key_enc); BUF_MEM_free((BUF_MEM *) ctx->key_enc);
} }
PACE_CTX_clear_free(ctx->ctx); PACE_CTX_clear_free(ctx->ctx);
pace_sm_ctx_free(ctx); npa_sm_ctx_free(ctx);
} }
} }

4
npa/src/scutil.c
View File

@@ -29,7 +29,7 @@ int initialize(int reader_id, const char *cdriver, int verbose,
if (!ctx || !reader) if (!ctx || !reader)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
int r = sc_context_create(ctx, NULL); int r = sc_establish_context(ctx, "");
if (r < 0) { if (r < 0) {
fprintf(stderr, "Failed to create initial context: %s", sc_strerror(r)); fprintf(stderr, "Failed to create initial context: %s", sc_strerror(r));
return r; return r;
@@ -257,7 +257,7 @@ int print_avail(int verbose)
sc_context_t *ctx = NULL; sc_context_t *ctx = NULL;
int r; int r;
r = sc_context_create(&ctx, NULL); r = sc_establish_context(&ctx, "");
if (r) { if (r) {
fprintf(stderr, "Failed to establish context: %s\n", sc_strerror(r)); fprintf(stderr, "Failed to establish context: %s\n", sc_strerror(r));
return 1; return 1;