Newer
Older
[MODULE_PARAMETERS]
# This section shall contain the values of all parameters that are defined in your TTCN-3 modules.
# Enable Security support
LibItsGeoNetworking_Pics.PICS_GN_SECURITY := true
# Root path to access certificate stored in files, identified by certficate ID
LibItsSecurity_Pixits.PX_CERTIFICATE_POOL_PATH := "/home/yann/tmp"
# Configuration sub-directory to access certificate stored in files
LibItsSecurity_Pixits.PX_IUT_SEC_CONFIG_NAME := "asn1c_cert"
# Use this certificate if the RSU simulator act as IUT
LibItsCommon_Pixits.PX_CERT_FOR_TS := "CERT_IUT_A_AT"
LibItsHttp_Pics.PICS_HEADER_CONTENT_TYPE := "application/x-its-request"
LibItsHttp_Pics.PICS_HEADER_CTL_CONTENT_TYPE := "application/x-its-crl"
LibItsPki_Pics.PICS_HEADER_HOST_EC := "0.atos-ea.l0.c-its-pki.eu"
LibItsPki_Pics.PICS_HEADER_HOST_ATV := "0.atos-ea.l0.c-its-pki.eu"
LibItsPki_Pics.PICS_HEADER_HOST_AT := "0.atos-aa.l0.c-its-pki.eu"
LibItsPki_Pics.PICS_HEADER_HOST_CA := "0.atos-dc.l0.c-its-pki.eu"
LibItsPki_Pics.PICS_HEADER_HOST_TLM := "0.atos-dc.l0.c-its-pki.eu"
LibItsPki_Pics.PICS_HTTP_POST_URI_EC := "/"
LibItsPki_Pics.PICS_HTTP_POST_URI_AT := "/"
LibItsPki_Pics.PICS_HTTP_POST_URI_ATV := "/"
LibItsPki_Pics.PICS_HTTP_GET_URI_CTL := "/103600/3-1/getctl/347A3B143C94C298"
LibItsPki_Pics.PICS_HTTP_GET_URI_CRL := "/103600/3-1/getcrl/347A3B143C94C298"
LibItsPki_Pics.PICS_HTTP_GET_URI_ECTL := "/103600/1-1/getctl/0DA3EE9ACF7F9F14"
LibItsPki_Pics.PICS_ITS_S_CANONICAL_ID := '455453492D4954532D303031'O # Nist-P256
#LibItsPki_Pics.PICS_ITS_S_CANONICAL_ID := '455453492D4954532D303032'O # Brainpool-P256 r1
#LibItsPki_Pics.PICS_ITS_S_CANONICAL_ID := '455453492D4954532D303033'O # Brainpool-P384 r1
LibItsPki_Pics.PICS_TS_EA_CERTIFICATE_ID := "CERT_TS_A_EA"#"CERT_IDNOMIC_PKI_EA"
LibItsPki_Pics.PICS_TS_AA_CERTIFICATE_ID := "CERT_TS_A_AA"
LibItsPki_Pics.PICS_IUT_AA_CERTIFICATE_ID := "CERT_IDNOMIC_PKI_AA"
LibItsPki_Pics.PICS_TS_CA_CERTIFICATE_ID := "CERT_IDNOMIC_PKI_RCA"
#LibItsPki_Pics.PICS_PKI_AUTH_POP := false # Do not use Signed for PoP in Authorization requet
# Required for SECPKI_AA_AUTH_RCV_02_BV
#LibItsPki_Pics.PICS_SECPKI_REENROLMENT := false # Check in logs the pattern '==> EC ' to find the required information for re-enrolment
#LibItsPki_Pixits.PX_INCLUDE_ENCRYPTION_KEYS := false # No encryption key in Authorization request
#LibItsPki_Pixits.PX_VE_ALG := e_brainpool_p256_r1 # e_nist_p256, e_brainpool_p256_r1 or e_brainpool_p384_r1
#LibItsPki_Pixits.PX_EC_ALG_FOR_EC := e_brainpool_p256_r1 # e_nist_p256, e_brainpool_p256_r1
#LibItsPki_Pixits.PX_EC_ALG_FOR_ATV := e_brainpool_p256_r1 # e_nist_p256, e_brainpool_p256_r1
#LibItsPki_Pixits.PX_EC_ALG_FOR_EC_SIGN := e_brainpool_p256_r1 # e_nist_p256, e_brainpool_p256_r1
#LibItsPki_Pixits.PX_EC_ALG_FOR_AT := e_brainpool_p256_r1 # e_nist_p256, e_brainpool_p256_r1
#LibItsPki_Pixits.PX_EC_PRIVATE_KEY := '170D1EA638C300BD16F0025768C0F1FAA6BE23963E46AD10F79103914265D294'O
#LibItsPki_Pixits.PX_EC_HASH := 'DFEFC2A74C8ADD0C8B74B958EE072229D25DEAAAE30D134193D091890E8F3C2C'O
#LibItsPki_Pixits.PX_EC_HASHED_ID8 := '93D091890E8F3C2C'O
LibItsSecurity_Pics.PICS_SEC_CIRCULAR_REGION := false
LibItsSecurity_Pics.PICS_SEC_RECTANGULAR_REGION := true
[LOGGING]
# In this section you can specify the name of the log file and the classes of events
# you want to log into the file or display on console (standard error).
FileMask := LOG_ALL | USER | DEBUG | MATCHING
ConsoleMask := LOG_ALL | USER | DEBUG | MATCHING
#FileMask := ERROR | WARNING | USER | MATCHING | EXECUTOR_RUNTIME | VERDICTOP
#ConsoleMask := ERROR | WARNING | USER | MATCHING | EXECUTOR_RUNTIME | VERDICTOP
LogSourceInfo := Stack
LogEntityName:= Yes
LogEventTypes:= Yes
#TimeStampFormat := DateTime
[TESTPORT_PARAMETERS]
# Multiple HTTP component ports
system.httpEcPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(server=90.84.188.76)"
system.httpAtVPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(server=90.84.188.76)"
#system.httpAtVPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(debug=1,server_mode=1,server=192.168.1.25,local_port=80)" # Multiple HTTP component ports specific to TC_SECPKI_AA_AUTHVAL_xx
system.httpAtPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(server=90.84.188.76)"
system.httpCaPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(debug=1,server=90.84.188.76,use_ssl=1)"
system.httpTlmPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(debug=1,server=90.84.188.76,use_ssl=1)"
[EXECUTE]
# The EnrolmentResponse message shall be sent by the EA to the ITS-S across the interface at reference point S3 in response to a received EnrolmentRequest message
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_01_BV
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate (not containing an item of type PsidSsp)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI_01
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate (containing opaque[0] (version) indicating other value than 1)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI_02
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate (containing opaque[1] (value) indicating "Enrolment Request" (bit 1) set to 0)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI_03
# Enroll an ITS-Station, but with a canonical-ID, that is not registered.
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_05_BI
# Enroll the ITS-Station, but the CSR re-quests more permissions than the issuer allows, i.e. request for security management SSP bit which is not set in the EA SSP
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_06_BI
# Enroll the ITS-Station, but the CSR requests a AID permission that the issuer does not allow, i.e. request for CAM AID
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_07_BI
# Enroll the ITS-Station, but the expiring date of the CSR is before the start date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_08_BI
# Enroll the ITS-Station, but the start date of the CSR is before the start date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_09_BI
# Enroll the ITS-Station, but the expiring date of the CSR is after the expiring date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_10_BI
# Enroll the ITS-Station, but the start date of the CSR is after the expiring date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_11_BI
# Enroll the ITS-Station, but the lifetime of the EC would be grater than allowed (considering values in C-ITS CP)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_12_BI
# Enroll the ITS-Station, but the inner PoP signature in the CSR, created with the EC private key, can not be verified with the provided public key
##ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_13_BI
# The EnrolmentResponse message shall be encrypted using an ETSI TS 103 097 approved algorithm and the encryption shall be done with the same AES key as the one used by the ITS-S requestor for the encryption of the EnrolmentRequest message.
#ItsPki_TestCases.TC_SECPKI_EA_ENR_01_BV
# The EnrolmentResponse message shall be encrypted using an ETSI TS 103 097 approved algorithm and the encryption shall be done with the same AES key as the one used by the ITS-S requestor for the encryption of the EnrolmentRequest message.
# The outermost structure is an EtsiTs103097Data-Encrypted structure containing the component recipients containing one instance of RecipientInfo of choice pskRecipInfo, which contains the HashedId8 of the symmetric key used by the ITS-S to encrypt the EnrolmentRequest message to which the response is built and containing the component ciphertext, once decrypted, contains an EtsiTs103097Data-Signed structure
# If the ITS-S has been able to decrypt the content, this expected EtsiTs103097Data-Signed structure shall contain hashId, tbsData, signer and signature. The hashId shall indicate the hash algorithm to be used as specified in ETSI TS 103 097, the signer shall be declared as a digest, containing the HashedId8 of the EA certificate and the signature over tbsData shall be computed using the EA private key corresponding to its publicVerificationKey found in the referenced EA certificate
# Within the headerInfo of the tbsData, the psid shall be set to secured certificate request as assigned in ETSI TS 102 965 and the generationTime shall be present
# Within the headerInfo of the tbsData, aside from psid and generationTime, all other components of the component tbsData.headerInfo not used and absent
# The EtsiTS102941Data shall contain the version set to v1 (integer value set to 1) and the content set to InnerECResponse
# The InnerECResponse shall contain the requestHash, which is the left-most 16 octets of the SHA256 digest of the EtsiTs103097Data - Signed structure received in the request and a responseCode indicating the result of the request
# If the responseCode is 0, the InnerECResponse shall also contain an (enrolment) certificate
# If the responseCode is different than 0, the InnerECResponse shall not contain a certificate
# Check that signing of Enrolment response message is permitted by the EA certificate
# Check that generated EC certificate contains only allowed permissions
# The AuthorizationValidationResponse message shall be sent by the EA to the AA across the interface at reference point S4 in response to a received AuthorizationValidationRequest message
# Check that EA doesn't accept Authorization Validation Request when SharedAtRequest is signed with certificate without appropriate permissions
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_RCV_02_BI
# The EtsiTs103097Data-Encrypted is build with the component recipients containing one instance of RecipientInfo of choice pskRecipInfo, which contains the HashedId8 of the symmetric key used by the ITS-S to encrypt the AuthorizationRequest message to which the response is built and the component ciphertext containing the encrypted representation of the EtsiTs103097Data-Signed. The encryption uses a ETSI TS 103 097 [3] approved algorithm
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_01_BV
# To read an authorization validation response, the AA shall receive an EtsiTs103097Data-Encrypted structure, containing a EtsiTs103097Data-Signed structure, containing a EtsiTs102941Data structure, containing an AuthorizationValidationResponse structure
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_02_BV
# The AuthorizationValidationResponse structure contains the requestHash being the left-most 16 octets of the SHA256 digest of the EtsiTs103097Data-Signed structure received in the AuthorizationValidationRequest and a responseCode
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_03_BV
# If the responseCode is 0, the AuthorizationValidationResponse structure contains the component confirmedSubjectAttributes with the attributes the EA wishes to confirm, except for certIssuePermissions which is not allowed to be present
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_04_BV
# If the responseCode is different than 0, the AuthorizationValidationResponse structure does not contain the component confirmedSubjectAttributes
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_05_BV
# The component version of the EtsiTs102941Data structure is set to v1 (integer value set to 1)
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_06_BV
# Check that the EA/AA is able to decrypt the AuthorizationRequest message using the encryption private key corresponding to the recipient certificate...
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_01_BV
# Check that the AA is able to decrypt the AuthorizationRequest message using the encryption private key corresponding to the recipient certificate...
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_02_BV
# Check that the AA skips the AuthorizationRequest message if it is not addressed to this AA
# Check that the AA skips the AuthorizationRequest message if it unable to decrypt the encKey
# Check that the AA skips the AuthorizationRequest message if it unable to decrypt the cyphertext
# Check that the AA rejects the AuthorizationRequest message if it unable to verify the POP signature
# Check that the AA rejects the AuthorizationRequest message if it unable to verify the integrity of the request using hmacKey
# Send a correctly encoded AT request, but the ITS-Station is not enrolled at the EA
# Send an AT request, but the inner signer (valid EC) is not issued by the EA which is known / trusted by the AA. The AA trusts only EAs listet on the RCA-CTL
# Send an AT request, but the generation time of the CSR is in the past
# Send an AT request, but the generation time of the CSR is in the future
# Send an AT request, but the expiry date of the CSR is before the start date of the EC
# Send an AT request, but the start date of the CSR is before the start date of the EC
# Send an AT request, but the expiry date of the CSR is after the expiry date of the EC
# Send an AT request, but the start date of the CSR is after the expiring date of the EC
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_15_BI
# Send an AT request, but the expiry date of the CSR is after now + maximum pre-loading period (considering values in C-ITS CP)
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_16_BI
# Check that the AA sends AuthorizationValidationRequest after receiving of the AuthorizationRequest
# Check that the RootCA generates the Full CTL when new EA is about to be added to the Root CTL
# Check that the RootCA generates the CRL signed with appropriate certificate.
#ItsPki_TestCases.TC_RCA_CRLGEN_01_BV
# Check that the TLM generates the ECTL when new RootCA is about to be added
#ItsPki_TestCases.TC_TLM_ECTLGEN_01_BV
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
#ItsPki_TestCases.TC_RCA_CTLGEN_xx_BV
# Check that the issuing certificate has version 3
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_01_BV
# Check that the issuing certificate has type explicit
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_02_BV_01
# Check that the CA, been authorized using explicit certificate, is able to issue an implicit certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_02_BV_02
# Check that the CA, been authorized using explicit certificate, is able to issue an implicit certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_02_BV_03
# Check that the CA, been authorized using implicit certificate, does not issue an explicit certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_02_BO_01
# Check that CA issues certificate conformed to ETSI TS 103 097 [1], clause 6
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_03_BV
# Check that the certificate issuer of certificates is referenced using digest. Check that right digest field is used to reference to the certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_04_BV
# Check that the CA is able to issue the certificate with the well-formed circular region validity restriction
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_05_BV
# Check that the CA is able to issue the certificate with the well-formed rectangular region validity restriction
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_06_BV
# Check that the CA is able to issue the certificate with the well-formed polygonal region validity restriction
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_07_BV
# Check that the CA is able to issue the certificate with identified region validity restriction contains values that correspond to numeric country codes as defined by United Nations Statistics Division [5]
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_08_BV
# Check that the identified region validity restriction of the subordinate certificate is included in the identified region validity restriction of the issuing certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_09_BV
# Check that the certificate signature contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or x_coordinate_only
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_10_BV
# Check that the certificate verification key contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or uncompressed
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_11_BV
# Check that the certificate encryption key contains ECC point of type set to either compressed_lsb_y_0, compressed_lsb_y_1 or uncompressed
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_12_BV
# Check the explicit certificate signature
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_13_BV_01
# Check the explicit certificate signature
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_13_BV_02
# Check that all PSID entries of the appPermissions component of the certificate are unique
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_14_BV
# Check that all PSID entries of the appPermissions component of the certificate are also contained in the certIssuePermissions component in the issuing certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_15_BV
# Check that all PSID entries of the certIssuePermissions component of the certificate are unique
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_16_BV
# Check that SSP field in each entry of the appPermissions component of the AT certificate is equal to or a subset of the SSP Range in the corresponding issuing entry
ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_17_BV
# Check that the validityPeriod of the subordinate certificate is inside the validityPeriod of the issuing certificate
#ItsPki_TestCases.TC_SECPKI_CA_CERTGEN_18_BV
[MAIN_CONTROLLER]
# The options herein control the behavior of MC.
KillTimer := 10.0
LocalAddress := 127.0.0.1
TCPPort := 12000
NumHCs := 1