diff --git a/npa/src/npa.c b/npa/src/npa.c index 42079b7..4271361 100644 --- a/npa/src/npa.c +++ b/npa/src/npa.c @@ -216,8 +216,6 @@ IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R) /** NPA secure messaging context */ struct npa_sm_ctx { - /** Send sequence counter */ - BIGNUM *ssc; /** EAC context */ EAC_CTX *ctx; /** Certificate Description given on initialization of PACE */ @@ -254,10 +252,6 @@ static int npa_sm_finish(sc_card_t *card, const struct sm_ctx *ctx, sc_apdu_t *apdu); static void npa_sm_clear_free(const struct sm_ctx *ctx); -static int increment_ssc(struct npa_sm_ctx *eacsmctx); -static int decrement_ssc(struct npa_sm_ctx *eacsmctx); -static int reset_ssc(struct npa_sm_ctx *eacsmctx); - char npa_default_flags = 0; @@ -271,10 +265,6 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description, if (!out) goto err; - out->ssc = BN_new(); - if (!out->ssc || reset_ssc(out) < 0) - goto err; - out->ctx = ctx; if (certificate_description && certificate_description_length) { @@ -300,11 +290,7 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description, return out; err: - if (out) { - if (out->ssc) - BN_clear_free(out->ssc); - free(out); - } + free(out); return NULL; } @@ -1959,18 +1945,8 @@ increment_ssc(struct npa_sm_ctx *eacsmctx) if (!eacsmctx) return SC_ERROR_INVALID_ARGUMENTS; - BN_add_word(eacsmctx->ssc, 1); - - return SC_SUCCESS; -} - -int -decrement_ssc(struct npa_sm_ctx *eacsmctx) -{ - if (!eacsmctx) - return SC_ERROR_INVALID_ARGUMENTS; - - BN_sub_word(eacsmctx->ssc, 1); + if (!EAC_increment_ssc(eacsmctx->ctx)) + return SC_ERROR_INTERNAL; return SC_SUCCESS; } @@ -1981,7 +1957,8 @@ reset_ssc(struct npa_sm_ctx *eacsmctx) if (!eacsmctx) return SC_ERROR_INVALID_ARGUMENTS; - BN_zero(eacsmctx->ssc); + if (!EAC_reset_ssc(eacsmctx->ctx)) + return SC_ERROR_INTERNAL; return SC_SUCCESS; } @@ -2001,7 +1978,7 @@ npa_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx, struct npa_sm_ctx *eacsmctx = ctx->priv_data; databuf = BUF_MEM_create_init(data, datalen); - encbuf = EAC_encrypt(eacsmctx->ctx, eacsmctx->ssc, databuf); + encbuf = EAC_encrypt(eacsmctx->ctx, databuf); if (!databuf || !encbuf) { sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encrypt data."); ssl_error(card->ctx); @@ -2042,7 +2019,7 @@ npa_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx, struct npa_sm_ctx *eacsmctx = ctx->priv_data; encbuf = BUF_MEM_create_init(enc, enclen); - databuf = EAC_decrypt(eacsmctx->ctx, eacsmctx->ssc, encbuf); + databuf = EAC_decrypt(eacsmctx->ctx, encbuf); if (!encbuf || !databuf) { sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not decrypt data."); ssl_error(card->ctx); @@ -2073,7 +2050,7 @@ npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx, const u8 *data, size_t datalen, u8 **macdata) { BUF_MEM *inbuf = NULL, *macbuf = NULL; - u8 *p = NULL, *ssc = NULL; + u8 *p = NULL; int r; if (!card || !ctx || !ctx->priv_data || !macdata) { @@ -2088,7 +2065,7 @@ npa_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx, goto err; } - macbuf = EAC_authenticate(eacsmctx->ctx, eacsmctx->ssc, inbuf); + macbuf = EAC_authenticate(eacsmctx->ctx, inbuf); if (!macbuf) { sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute message authentication code (MAC)."); @@ -2112,7 +2089,6 @@ err: BUF_MEM_free(inbuf); if (macbuf) BUF_MEM_free(macbuf); - free(ssc); return r; } @@ -2138,7 +2114,7 @@ npa_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, goto err; } - my_mac = EAC_authenticate(eacsmctx->ctx, eacsmctx->ssc, inbuf); + my_mac = EAC_authenticate(eacsmctx->ctx, inbuf); if (!my_mac) { sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute message authentication code (MAC) for verification."); @@ -2462,8 +2438,6 @@ npa_sm_clear_free(const struct sm_ctx *ctx) if (ctx) { struct npa_sm_ctx *eacsmctx = ctx->priv_data; EAC_CTX_clear_free(eacsmctx->ctx); - if (eacsmctx->ssc) - BN_clear_free(eacsmctx->ssc); if (eacsmctx->certificate_description) BUF_MEM_free(eacsmctx->certificate_description); if (eacsmctx->id_icc) diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py b/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py index eff2bea..33e9432 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py @@ -105,7 +105,6 @@ class nPA_SE(Security_Environment): self.eac_step = 0 self.sec = None self.eac_ctx = None - self.ssc = 0 self.car = "DECVCAeID00102" self.cvca = None self.ca_key = None @@ -380,7 +379,7 @@ class nPA_SE(Security_Environment): raise SwError(SW["ERR_CONDITIONNOTSATISFIED"]) def compute_cryptographic_checksum(self, p1, p2, data): - checksum = pace.EAC_authenticate(self.eac_ctx, self.ssc, data) + checksum = pace.EAC_authenticate(self.eac_ctx, data) if not checksum: pace.print_ossl_err() raise SwError(SW["ERR_NOINFO69"]) @@ -389,7 +388,7 @@ class nPA_SE(Security_Environment): def encipher(self, p1, p2, data): padded = vsCrypto.append_padding(self.cct.blocklength, data) - cipher = pace.EAC_encrypt(self.eac_ctx, self.ssc, padded) + cipher = pace.EAC_encrypt(self.eac_ctx, padded) if not cipher: pace.print_ossl_err() raise SwError(SW["ERR_NOINFO69"]) @@ -397,7 +396,7 @@ class nPA_SE(Security_Environment): return cipher def decipher(self, p1, p2, data): - plain = pace.EAC_decrypt(self.eac_ctx, self.ssc, data) + plain = pace.EAC_decrypt(self.eac_ctx, data) if not plain: pace.print_ossl_err() raise SwError(SW["ERR_NOINFO69"]) @@ -555,14 +554,13 @@ class nPA_SAM(SAM): print "switching to new encryption context established in %s:" % protocol pace.EAC_CTX_print_private(self.current_SE.eac_ctx, 4) - self.current_SE.ssc = 0 pace.EAC_CTX_set_encryption_ctx(self.current_SE.eac_ctx, self.current_SE.new_encryption_ctx) delattr(self.current_SE, "new_encryption_ctx") - self.current_SE.ssc += 1 + pace.EAC_increment_ssc(self.current_SE.eac_ctx) return SAM.parse_SM_CAPDU(self, CAPDU, 1) def protect_result(self, sw, unprotected_result): - self.current_SE.ssc += 1 + pace.EAC_increment_ssc(self.current_SE.eac_ctx) return SAM.protect_result(self, sw, unprotected_result)