From c92d923fc89bd39331351301e153bf251d9bd125 Mon Sep 17 00:00:00 2001 From: Frank Morgner Date: Mon, 1 Oct 2012 23:40:18 +0200 Subject: [PATCH] nPA: removed --ca-pubkey command line option The public key is extracted from the EF.CardSecurity instead. --- virtualsmartcard/src/vpicc/vicc.in | 10 +--------- .../src/vpicc/virtualsmartcard/VirtualSmartcard.py | 8 +++----- .../src/vpicc/virtualsmartcard/cards/nPA.py | 6 ++++-- 3 files changed, 8 insertions(+), 16 deletions(-) diff --git a/virtualsmartcard/src/vpicc/vicc.in b/virtualsmartcard/src/vpicc/vicc.in index ee4906b..60cf535 100644 --- a/virtualsmartcard/src/vpicc/vicc.in +++ b/virtualsmartcard/src/vpicc/vicc.in @@ -73,10 +73,6 @@ npa.add_argument("-k", "--ca-key", action="store", type=argparse.FileType('rb'), help="CA private key.") -npa.add_argument("-p", "--ca-pubkey", - action="store", - type=argparse.FileType('rb'), - help="CA public key.") npa.add_argument("-c", "--ca", action="store", type=str, @@ -93,7 +89,6 @@ from virtualsmartcard.VirtualSmartcard import VirtualICC ef_cardsecurity_data = None ef_cardaccess_data = None ca_key_data = None -ca_pubkey_data = None if (args.ef_cardsecurity): ef_cardsecurity_data = args.ef_cardsecurity.read() args.ef_cardsecurity.close() @@ -103,12 +98,9 @@ if (args.ef_cardaccess): if (args.ca_key): ca_key_data = args.ca_key.read() args.ca_key.close() -if (args.ca_pubkey): - ca_pubkey_data = args.ca_pubkey.read() - args.ca_pubkey.close() vicc = VirtualICC(args.file, args.type, args.hostname, args.port, readernum=args.reader, - ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data, ca_pubkey=ca_pubkey_data, + ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data, ca_key=ca_key_data, ca=args.ca, disable_checks=args.disable_checks) vicc.run() diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py b/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py index e997412..753976a 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py @@ -499,7 +499,7 @@ class RelayOS(SmartcardOS): class NPAOS(Iso7816OS): - def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False): + def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca=None, disable_checks=False): Iso7816OS.__init__(self, mf, sam, ins2handler, maxle) self.ins2handler[0x86] = self.SAM.general_authenticate self.ins2handler[0x2c] = self.SAM.reset_retry_counter @@ -515,8 +515,6 @@ class NPAOS(Iso7816OS): self.SAM.current_SE.ca = ca if ca_key: self.SAM.current_SE.ca_key = ca_key - if ca_pubkey: - self.SAM.current_SE.ca_pubkey = ca_pubkey def formatResult(self, seekable, le, data, sw, sm): @@ -557,7 +555,7 @@ class VirtualICC(object): the vpcd, which forwards it to the application. """ - def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False): + def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca=None, disable_checks=False): from os.path import exists logging.basicConfig(level = logging.INFO, @@ -582,7 +580,7 @@ class VirtualICC(object): if card_type == "iso7816" or card_type == "ePass": self.os = Iso7816OS(MF, SAM) elif card_type == "nPA": - self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca, disable_checks=disable_checks) + self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca=ca, disable_checks=disable_checks) elif card_type == "cryptoflex": self.os = CryptoflexOS(MF, SAM) elif card_type == "relay": diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py b/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py index 50f8c1d..b900b68 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py @@ -108,7 +108,6 @@ class nPA_SE(Security_Environment): self.ssc = 0 self.ca = "DECVCAeID00102" self.ca_key = None - self.ca_pubkey = None self.disable_checks = False def _set_SE(self, p2, data): @@ -202,7 +201,10 @@ class nPA_SE(Security_Environment): ef_card_access = self.mf.select('fid', 0x011c) ef_card_access_data = ef_card_access.data pace.EAC_CTX_init_ef_cardaccess(ef_card_access_data, self.eac_ctx) - pace.EAC_CTX_init_ca(self.eac_ctx, pace.id_CA_ECDH_AES_CBC_CMAC_128, 13, self.ca_key, self.ca_pubkey) + ef_card_security = self.mf.select('fid', 0x011d) + ef_card_security_data = ef_card_security.data + ca_pubkey = pace.CA_get_pubkey(ef_card_security_data) + pace.EAC_CTX_init_ca(self.eac_ctx, pace.id_CA_ECDH_AES_CBC_CMAC_128, 13, self.ca_key, ca_pubkey) if not self.ca_key: # we don't have a good CA key, so we simply generate an ephemeral one