adapted to latest changes of openpace

works with openpace 702cf84aaa01ef5dc490d32208067a89a33102c1

npa/src/npa.c

@@ -1857,7 +1857,7 @@ int perform_chip_authentication(struct sm_ctx *ctx, sc_card_t *card)
         sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get EF.CardSecurity.");
         goto err;
     }
-    picc_pubkey = CA_get_pubkey(ef_cardsecurity, ef_cardsecurity_len);
+    picc_pubkey = CA_get_pubkey(eacsmctx->ctx, ef_cardsecurity, ef_cardsecurity_len);
     if (!picc_pubkey) {
         sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not verify EF.CardSecurity.");
         ssl_error(card->ctx);

npa/test_vicc_with_npa-tool.sh

@@ -1,8 +1,5 @@
 #! /bin/sh
 
-ECDH_CAR=DECVCAAT00001
-DH_CAR=DETESTCVCA00003
-
 CVCA=cvca.cvcert
 DVCA=dvca.cvcert
 TERMINAL=at.cvcert
@@ -50,21 +47,9 @@ fi
 
 for KA in ecdh dh
 do
-    CAR=
-    if test $KA = ecdh
-    then
-        CAR=$ECDH_CAR
-    elif test $KA = dh
-    then
-        CAR=$DH_CAR
-    else
-        echo "CAR not found"
-        exit 1
-    fi
-
     $VICC --type nPA --ef-cardsecurity=$DATA/$KA/$SECURITY \
         --ef-cardaccess=$DATA/$KA/$ACCESS --ca-key=$DATA/$KA/$NPA_KEY \
-        --car=$CAR --cvca=$DATA/$KA/$CVCA --disable-checks &
+        --cvca=$DATA/$KA/$CVCA --disable-checks &
     VICC_PID=$!
     if test $? -ne 0
     then

virtualsmartcard/src/vpicc/vicc.in

@@ -73,10 +73,6 @@ npa.add_argument("-k", "--ca-key",
         action="store",
         type=argparse.FileType('rb'),
         help="CA private key.")
-npa.add_argument("-c", "--car",
-        action="store",
-        type=str,
-        help="certificate authority reference (CHR of the CVCA)")
 npa.add_argument("-C", "--cvca",
         action="store",
         type=argparse.FileType('rb'),
@@ -110,5 +106,5 @@ if (args.cvca):
 vicc = VirtualICC(args.file, args.type,
         args.hostname, args.port, readernum=args.reader,
         ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data,
-        ca_key=ca_key_data, car=args.car, cvca=cvca, disable_checks=args.disable_checks)
+        ca_key=ca_key_data, cvca=cvca, disable_checks=args.disable_checks)
 vicc.run()

virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py

@@ -501,7 +501,7 @@ class RelayOS(SmartcardOS):
 
 
 class NPAOS(Iso7816OS):
-    def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, car=None, cvca=None, disable_checks=False):
+    def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, cvca=None, disable_checks=False):
         Iso7816OS.__init__(self, mf, sam, ins2handler, maxle)
         self.ins2handler[0x86] = self.SAM.general_authenticate
         self.ins2handler[0x2c] = self.SAM.reset_retry_counter
@@ -513,8 +513,6 @@ class NPAOS(Iso7816OS):
         if ef_cardaccess:
             ef = self.mf.select('fid', 0x011c)
             ef.data = ef_cardaccess
-        if car:
-            self.SAM.current_SE.car = car
         if cvca:
             self.SAM.current_SE.cvca = cvca
         if ca_key:
@@ -559,7 +557,7 @@ class VirtualICC(object):
     the vpcd, which forwards it to the application.
     """ 
     
-    def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, car=None, cvca=None, disable_checks=False):
+    def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, cvca=None, disable_checks=False):
         from os.path import exists
         
         logging.basicConfig(level = logging.INFO, 
@@ -584,7 +582,7 @@ class VirtualICC(object):
         if card_type == "iso7816" or card_type == "ePass":
             self.os = Iso7816OS(MF, SAM)
         elif card_type == "nPA":
-            self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, car=car, cvca=cvca, disable_checks=disable_checks)
+            self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, cvca=cvca, disable_checks=disable_checks)
         elif card_type == "cryptoflex":
             self.os = CryptoflexOS(MF, SAM)
         elif card_type == "relay":

virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py

@@ -24,7 +24,7 @@ from virtualsmartcard.TLVutils import unpack, bertlv_pack
 from virtualsmartcard.SmartcardFilesystem import make_property
 from virtualsmartcard.utils import inttostring
 import virtualsmartcard.CryptoUtils as vsCrypto
-from chat import CHAT
+from chat import CHAT, CVC
 import pace
 
 class nPA_AT_CRT(ControlReferenceTemplate):
@@ -105,8 +105,8 @@ class nPA_SE(Security_Environment):
         self.eac_step = 0
         self.sec = None
         self.eac_ctx = None
-        self.car = "DECVCAeID00102"
         self.cvca = None
+        self.car = None
         self.ca_key = None
         self.disable_checks = False
 
@@ -203,7 +203,7 @@ class nPA_SE(Security_Environment):
         pace.EAC_CTX_init_ef_cardaccess(ef_card_access_data, self.eac_ctx)
         ef_card_security = self.mf.select('fid', 0x011d)
         ef_card_security_data = ef_card_security.data
-        ca_pubkey = pace.CA_get_pubkey(ef_card_security_data)
+        ca_pubkey = pace.CA_get_pubkey(self.eac_ctx, ef_card_security_data)
         pace.EAC_CTX_init_ca(self.eac_ctx, 0, 0, self.ca_key, ca_pubkey)
 
         if not self.ca_key:
@@ -301,6 +301,8 @@ class nPA_SE(Security_Environment):
 
         result = [[0x86, len(my_token), my_token]]
         if self.at.chat:
+            if self.cvca:
+                self.car = CVC(self.cvca).get_chr()
             result.append([0x87, len(self.car), self.car])
             if (self.disable_checks):
                 pace.TA_disable_checks(self.eac_ctx)