Commit 42b97d23 authored by YannGarcia's avatar YannGarcia
Browse files

Update after ETSI ITS CMS-7

parent 005cddbf
......@@ -106,18 +106,19 @@ NOTE The user password is vagrant.
### Using Docker
Pre-requisites on your host machine:
- Install Virtualbox
- Install Virtualbox (For Windows host only)
- Install Docker
Procedure for a Windows host machine:
- On your host machine, open a the Docker Quickstart Terminal
- On your host machine, open a the Docker Quickstart Terminal and change to a working folder such as ./temp/docker_its
Procedure for a Linux host machine:
- On your host machine, open a terminal and change to a working folder such as $HOME/temp
- On your host machine, open a terminal and change to a working folder such as $HOME/temp/docker_its
On your host machine, clone the following items from ETSI ITS protocols project:
- The docket folder
- The .jenkins.sh script file (hidden file)
On your host machine, download the following items from ETSI ITS protocols project:
- The docker folder
- The .jenkins.sh script file (hidden file) and add the execution rights on it
- Check the rights of the script files and the folders
From the your current directory, execute the following commands:
......
......@@ -587,7 +587,8 @@ namespace LibItsSecurity__Functions
* \return The HMAC value resized to 16-byte
*/
OCTETSTRING fx__hmac__sha256(const OCTETSTRING& p__k, const OCTETSTRING& p__m) {
loggers::get_instance().log(">>> fx__hmac__sha256");
loggers::get_instance().log_msg(">>> fx__hmac__sha256: p__k=", p__k);
loggers::get_instance().log_msg(">>> fx__hmac__sha256: p__m=", p__m);
hmac h(hash_algorithms::sha_256); // TODO Use ec_encryption_algorithm
OCTETSTRING t;
......@@ -595,8 +596,8 @@ namespace LibItsSecurity__Functions
loggers::get_instance().warning("fx__hmac__sha256: Failed to generate HMAC");
return OCTETSTRING(0, nullptr);
}
loggers::get_instance().log_msg("fx__hmac__sha256: HMAC: ", t);
loggers::get_instance().log_msg("<<< fx__hmac__sha256: HMAC: ", t);
return t;
}
......@@ -1183,7 +1184,7 @@ namespace LibItsSecurity__Functions
return TRUE;
}
BOOLEAN fx__store__certificate(const CHARSTRING& p__cert__id, const OCTETSTRING& p__cert, const OCTETSTRING& p__private__key, const OCTETSTRING& p__public__key__x, const OCTETSTRING& p__public__key__y, const OCTETSTRING& p__public__key__compressed, const INTEGER& p__public__key__compressed__mode, const OCTETSTRING& p__hash, const OCTETSTRING& p__hashid8, const OCTETSTRING& p__issuer, const OCTETSTRING_template& p__private__enc__key, const OCTETSTRING_template& p__public__enc__key__x, const OCTETSTRING_template& p__public__enc__key__y, const OCTETSTRING_template& p__public__enc__compressed__key, const INTEGER_template& p__public__enc__key__compressed__mode) {
BOOLEAN fx__store__certificate(const CHARSTRING& p__cert__id, const OCTETSTRING& p__cert, const OCTETSTRING& p__private__key, const OCTETSTRING& p__public__key__x, const OCTETSTRING& p__public__key__y, const OCTETSTRING& p__public__key__compressed, const INTEGER& p__public__key__compressed__mode, const OCTETSTRING& p__hash, const OCTETSTRING& p__hash__256, const OCTETSTRING& p__hashid8, const OCTETSTRING& p__issuer, const OCTETSTRING_template& p__private__enc__key, const OCTETSTRING_template& p__public__enc__key__x, const OCTETSTRING_template& p__public__enc__key__y, const OCTETSTRING_template& p__public__enc__compressed__key, const INTEGER_template& p__public__enc__key__compressed__mode) {
loggers::get_instance().log(">>> fx__store__certificate: '%s'", static_cast<const char*>(p__cert__id));
int result;
......@@ -1191,9 +1192,9 @@ namespace LibItsSecurity__Functions
const OCTETSTRING private_enc_key = p__private__enc__key.valueof();
const OCTETSTRING public_enc_key_x = p__public__enc__key__x.valueof();
const OCTETSTRING public_enc_key_y = p__public__enc__key__y.valueof();
result = security_services::get_instance().store_certificate(p__cert__id, p__cert, p__private__key, p__public__key__x, p__public__key__y, p__public__key__compressed, p__public__key__compressed__mode, p__hash, p__hashid8, p__issuer, p__private__enc__key.valueof(), p__public__enc__key__x.valueof(), p__public__enc__key__y.valueof(), p__public__enc__compressed__key.valueof(), p__public__enc__key__compressed__mode.valueof());
result = security_services::get_instance().store_certificate(p__cert__id, p__cert, p__private__key, p__public__key__x, p__public__key__y, p__public__key__compressed, p__public__key__compressed__mode, p__hash, p__hash__256, p__hashid8, p__issuer, p__private__enc__key.valueof(), p__public__enc__key__x.valueof(), p__public__enc__key__y.valueof(), p__public__enc__compressed__key.valueof(), p__public__enc__key__compressed__mode.valueof());
} else {
result = security_services::get_instance().store_certificate(p__cert__id, p__cert, p__private__key, p__public__key__x, p__public__key__y, p__public__key__compressed, p__public__key__compressed__mode, p__hash, p__hashid8, p__issuer, OCTETSTRING(0, nullptr), OCTETSTRING(0, nullptr), OCTETSTRING(0, nullptr), OCTETSTRING(0, nullptr), INTEGER(-1));
result = security_services::get_instance().store_certificate(p__cert__id, p__cert, p__private__key, p__public__key__x, p__public__key__y, p__public__key__compressed, p__public__key__compressed__mode, p__hash, p__hash__256, p__hashid8, p__issuer, OCTETSTRING(0, nullptr), OCTETSTRING(0, nullptr), OCTETSTRING(0, nullptr), OCTETSTRING(0, nullptr), INTEGER(-1));
}
return (result == 0);
......@@ -1293,6 +1294,25 @@ namespace LibItsSecurity__Functions
return TRUE;
}
/**
* \brief Read the whole-hash of the certificate using SHA 256
* \param p_certificate_id the certificate identifier
* \param p_hash the expected certificate
* \return true on success, false otherwise
*/
BOOLEAN fx__readCertificateHash256(
const CHARSTRING& p__certificateId,
OCTETSTRING& p__hash
) {
loggers::get_instance().log(">>> fx__readCertificateHash256: '%s'", static_cast<const char*>(p__certificateId));
if (security_services::get_instance().read_certificate_hash_sha_256(p__certificateId, p__hash) == -1) {
return FALSE;
}
return TRUE;
}
/**
* \brief Read the private keys for the specified certificate
* \param p_certificate_id the keys identifier
......
......@@ -240,41 +240,51 @@ int certificates_loader::build_certificates_cache(std::set<std::experimental::fi
public_enc_comp_key = OCTETSTRING(0, nullptr);
}
OCTETSTRING hash_sha_256; // Whole-certificate hash using SHA-256
sha256 sha;
sha.generate(certificate, hash_sha_256);
loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: Whole-certificate SHA-256 hash for encryption: ", hash_sha_256);
OCTETSTRING hash; // Whole-certificate hash
OCTETSTRING hashed_id; // Whole-certificate hashedid-8
OCTETSTRING issuer; // Certificate issuer
if (decoded_certificate.issuer().ischosen(IEEE1609dot2::IssuerIdentifier::ALT_sha256AndDigest)) {
sha256 sha;
sha.generate(certificate, hash);
if (public_key_x.lengthof() == 32) {
hash = hash_sha_256;
loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: Whole-certificate SHA-256 hash: ", hash);
hashed_id = OCTETSTRING(8, static_cast<const unsigned char*>(hash) + hash.lengthof() - 8);
issuer = decoded_certificate.issuer().sha256AndDigest();
} else if (decoded_certificate.issuer().ischosen(IEEE1609dot2::IssuerIdentifier::ALT_sha384AndDigest)) {
} else if (public_key_x.lengthof() == 48) {
sha384 sha;
sha.generate(certificate, hash);
loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: Whole-certificate SHA-384 hash: ", hash);
hashed_id = OCTETSTRING(8, static_cast<const unsigned char*>(hash) + hash.lengthof() - 8);
} else {
hash = OCTETSTRING(0, nullptr);
hash_sha_256 = OCTETSTRING(0, nullptr);
hashed_id = int2oct(0, 8);
}
loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: hash: ", hash);
loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: hashed_id: ", hashed_id);
if (decoded_certificate.issuer().ischosen(IEEE1609dot2::IssuerIdentifier::ALT_sha256AndDigest)) {
issuer = decoded_certificate.issuer().sha256AndDigest();
} else if (decoded_certificate.issuer().ischosen(IEEE1609dot2::IssuerIdentifier::ALT_sha384AndDigest)) {
issuer = decoded_certificate.issuer().sha384AndDigest();
} else if (decoded_certificate.issuer().ischosen(IEEE1609dot2::IssuerIdentifier::ALT_self__)) {
OCTETSTRING h;
if (decoded_certificate.issuer().self__() == IEEE1609dot2BaseTypes::HashAlgorithm::sha256) {
sha256 sha;
sha.generate(certificate, hash);
sha.generate(certificate, h);
//loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: Whole-certificate SHA-256 hash: ", hash);
} else {
sha384 sha;
sha.generate(certificate, hash);
sha.generate(certificate, h);
//loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: Whole-certificate SHA-384 hash: ", hash);
}
hashed_id = OCTETSTRING(8, static_cast<const unsigned char*>(hash) + hash.lengthof() - 8);
issuer = hashed_id;
issuer = OCTETSTRING(8, static_cast<const unsigned char*>(h) + h.lengthof() - 8);
} else {
hash = OCTETSTRING(0, nullptr);
hashed_id = int2oct(0, 8);
issuer = int2oct(0, 8);
}
//loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: hash: ", hash);
//loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: hashed_id: ", hashed_id);
//loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: issuer: ", issuer);
loggers::get_instance().log_msg("certificates_loader::build_certificates_cache: issuer: ", issuer);
// Create new record
security_db_record* p = new security_db_record(
......@@ -283,6 +293,7 @@ int certificates_loader::build_certificates_cache(std::set<std::experimental::fi
decoded_certificate,
issuer, // Hashed ID fo the issuer
hash,
hash_sha_256,
hashed_id, // Hashed ID
private_key, // Private key
public_key_x, // public keys X-coordinate
......
......@@ -12,6 +12,8 @@
#include "hmac.hh"
#include "loggers.hh"
int hmac::generate(const OCTETSTRING p_buffer, const OCTETSTRING p_secret_key, OCTETSTRING& p_hmac) {
// Sanity check
if (p_buffer.lengthof() == 0) {
......@@ -40,6 +42,7 @@ int hmac::generate(const unsigned char* p_buffer, const size_t p_buffer_length,
::HMAC_Update(_ctx, p_buffer, p_buffer_length);
unsigned int length = p_hmac.lengthof();
::HMAC_Final(_ctx, (unsigned char*)static_cast<const unsigned char*>(p_hmac), &length);
loggers::get_instance().log_to_hexa("hmac::generate: ", (unsigned char*)static_cast<const unsigned char*>(p_hmac), length);
// Resize the hmac
if (_hash_algorithms == hash_algorithms::sha_256) {
p_hmac = OCTETSTRING(16, static_cast<const unsigned char*>(p_hmac));
......
......@@ -200,6 +200,19 @@ int security_cache::get_hash(const std::string& p_certificate_id, OCTETSTRING& p
return 0;
}
int security_cache::get_hash_sha_256(const std::string& p_certificate_id, OCTETSTRING& p_hash) const {
loggers::get_instance().log(">>> security_cache::get_hash_sha_256: '%s'", p_certificate_id.c_str());
std::map<std::string, std::unique_ptr<security_db_record> >::const_iterator it = _certificates.find(p_certificate_id);
if (it == _certificates.cend()) {
loggers::get_instance().warning("security_cache::get_hash_sha_256: record not found");
return -1;
}
p_hash = it->second.get()->hash_sha_256();
return 0;
}
int security_cache::get_private_key(const std::string& p_certificate_id, OCTETSTRING& p_private_key) const {
loggers::get_instance().log(">>> security_cache::get_private_key: '%s'", p_certificate_id.c_str());
......@@ -293,11 +306,11 @@ bool security_cache::fill_vector(OCTETSTRING& p_vector, const OCTETSTRING& p_org
return false;
}
int security_cache::store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashed_id8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_compressed_key_mode) {
int security_cache::store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashed_id8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_compressed_key_mode) {
loggers::get_instance().log_msg(">>> security_cache::store_certificate: ", p_cert_id);
std::string key(static_cast<const char*>(p_cert_id));
OCTETSTRING cert, private_key, public_key_x, public_key_y, public_comp_key, hash, hashed_id8, issuer;
OCTETSTRING cert, private_key, public_key_x, public_key_y, public_comp_key, hash, hash_sha_256, hashed_id8, issuer;
OCTETSTRING private_enc_key, public_enc_key_x, public_enc_key_y, public_enc_comp_key;
security_cache::fill_vector(cert, p_cert);
......@@ -311,6 +324,7 @@ int security_cache::store_certificate(const CHARSTRING& p_cert_id, const OCTETST
}
security_cache::fill_vector(hash, p_hash);
security_cache::fill_vector(hash_sha_256, p_hash_sha_256);
security_cache::fill_vector(hashed_id8, p_hashed_id8);
security_cache::fill_vector(issuer, p_issuer);
......@@ -332,6 +346,7 @@ int security_cache::store_certificate(const CHARSTRING& p_cert_id, const OCTETST
decoded_certificate,
issuer, // Hashed ID for the issuer
hash, // Whole-certificate hash
hash_sha_256, // Whole-certificate hash using SHA-256
hashed_id8, // Whole-certificate hashed ID
private_key, // Private key
public_key_x, // Public key X-coordinate
......@@ -379,6 +394,7 @@ void security_cache::dump() const {
loggers::get_instance().log_msg("security_cache::dump: issuer = ", p->issuer());
loggers::get_instance().log_msg("security_cache::dump: hashed_id = ", p->hashed_id());
loggers::get_instance().log_msg("security_cache::dump: hash = ", p->hash());
loggers::get_instance().log_msg("security_cache::dump: hash_sha_256 = ", p->hash_sha_256());
loggers::get_instance().log_msg("security_cache::dump: private_key = ", p->private_key());
loggers::get_instance().log_msg("security_cache::dump: public_key_x = ", p->public_key_x());
loggers::get_instance().log_msg("security_cache::dump: public_key_y = ", p->public_key_y());
......
......@@ -57,6 +57,7 @@ public: /*! \publicsection */
int get_issuer(const std::string& p_certificate_id, OCTETSTRING& p_hashed_id_issuer) const;
int get_hashed_id(const std::string& p_certificate_id, OCTETSTRING& p_hashed_id) const;
int get_hash(const std::string& p_certificate_id, OCTETSTRING& p_hash) const;
int get_hash_sha_256(const std::string& p_certificate_id, OCTETSTRING& p_hash) const;
int get_private_key(const std::string& p_certificate_id, OCTETSTRING& p_private_key) const;
int get_public_keys(const std::string& p_certificate_id, OCTETSTRING& p_public_key_x, OCTETSTRING& p_public_key_y) const;
int get_public_comp_key(const std::string& p_certificate_id, OCTETSTRING& p_public_comp_key, INTEGER& p_comp_mode) const;
......@@ -64,7 +65,7 @@ public: /*! \publicsection */
int get_public_enc_keys(const std::string& p_certificate_id, OCTETSTRING& p_public_enc_key_x, OCTETSTRING& p_public_enc_key_y) const;
int get_public_enc_comp_key(const std::string& p_certificate_id, OCTETSTRING& p_public_enc_comp_key, INTEGER& p_enc_comp_mode) const;
virtual int store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_compressed_key_mode);
virtual int store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_compressed_key_mode);
virtual int clear();
......
......@@ -40,10 +40,10 @@ int security_db::load_from_files(const std::string& p_db_path) {
return 0;
}
int security_db::store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashed_id8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressd_key, const INTEGER& p_public_enc_compressed_key_mode) {
int security_db::store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashed_id8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressd_key, const INTEGER& p_public_enc_compressed_key_mode) {
loggers::get_instance().log_msg(">>> security_db::store_certificate: ", p_cert_id);
if (security_cache::store_certificate(p_cert_id, p_cert, p_private_key, p_public_key_x, p_public_key_y, p_public_compressed_key, p_public_compressed_key_mode, p_hash, p_hashed_id8, p_issuer, p_private_enc_key, p_public_enc_key_x, p_public_enc_key_y, p_public_enc_compressd_key, p_public_enc_compressed_key_mode) != 0) {
if (security_cache::store_certificate(p_cert_id, p_cert, p_private_key, p_public_key_x, p_public_key_y, p_public_compressed_key, p_public_compressed_key_mode, p_hash, p_hash_sha_256, p_hashed_id8, p_issuer, p_private_enc_key, p_public_enc_key_x, p_public_enc_key_y, p_public_enc_compressd_key, p_public_enc_compressed_key_mode) != 0) {
return -1;
}
......
......@@ -38,7 +38,7 @@ public: /*! \publicsection */
* \param[in] p_cert_id The certificate identifier
* \return 0 on success, -1 otherwise
*/
int store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_compressed_key_mode);
int store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_compressed_key, const INTEGER& p_public_compressed_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_compressed_key_mode);
private: /*! \privatesection */
/*!
......
......@@ -20,6 +20,7 @@ security_db_record::security_db_record(
const IEEE1609dot2::CertificateBase& p_decoded_certificate,
const OCTETSTRING& p_hashed_id_issuer,
const OCTETSTRING& p_hash,
const OCTETSTRING& p_hash_sha_256,
const OCTETSTRING& p_hashed_id,
const OCTETSTRING& p_pr_key,
const OCTETSTRING& p_pu_key_x,
......@@ -30,7 +31,7 @@ security_db_record::security_db_record(
const OCTETSTRING& p_pu_enc_key_y,
const OCTETSTRING& p_pu_enc_comp_key,
const bool p_to_be_saved
): _algorithm{ec_elliptic_curves::nist_p_256}, _certificate_id(p_certificate_id), _certificate(p_certificate), _hashed_id_issuer(p_hashed_id_issuer), _hash(p_hash), _hashed_id(p_hashed_id), _pr_key(p_pr_key), _pu_key_x(p_pu_key_x), _pu_key_y(p_pu_key_y), _pu_comp_key(p_pu_comp_key), _pr_enc_key(p_pr_enc_key), _pu_enc_key_x(p_pu_enc_key_x), _pu_enc_key_y(p_pu_enc_key_y), _pu_enc_comp_key(p_pu_enc_comp_key), _to_be_saved(p_to_be_saved), _decoded_certificate(static_cast<IEEE1609dot2::CertificateBase*>(p_decoded_certificate.clone())) {
): _algorithm{ec_elliptic_curves::nist_p_256}, _certificate_id(p_certificate_id), _certificate(p_certificate), _hashed_id_issuer(p_hashed_id_issuer), _hash(p_hash), _hash_sha_256(p_hash_sha_256), _hashed_id(p_hashed_id), _pr_key(p_pr_key), _pu_key_x(p_pu_key_x), _pu_key_y(p_pu_key_y), _pu_comp_key(p_pu_comp_key), _pr_enc_key(p_pr_enc_key), _pu_enc_key_x(p_pu_enc_key_x), _pu_enc_key_y(p_pu_enc_key_y), _pu_enc_comp_key(p_pu_enc_comp_key), _to_be_saved(p_to_be_saved), _decoded_certificate(static_cast<IEEE1609dot2::CertificateBase*>(p_decoded_certificate.clone())) {
}
security_db_record::~security_db_record() {
......
......@@ -30,7 +30,8 @@ class security_db_record {
std::string _certificate_id; /*!< Certificate storage*/
OCTETSTRING _certificate; /*!< COER storage */
OCTETSTRING _hashed_id_issuer; /*!< Hash id 8 of the issuer certificate */
OCTETSTRING _hash; /*!< Certificate hash storage */ // TODO Check if it's usefull, otherwise remove it
OCTETSTRING _hash; /*!< Certificate hash storage */
OCTETSTRING _hash_sha_256; /*!< Certificate hash SHA 256 storage, for encryption (IEEE 1609.2 Clause 5.3.5 Public key encryption algorithms: ECIES */
OCTETSTRING _hashed_id; /*!< Certificate hash id 8 storage */
OCTETSTRING _pr_key; /*!< Private key storage */
OCTETSTRING _pu_key_x; /*!< Public key X-coordinate storage */
......@@ -47,7 +48,7 @@ public: /*! \publicsection */
/*!
* \brief Default ctor
*/
explicit security_db_record(): _algorithm{ec_elliptic_curves::nist_p_256}, _certificate_id(), _certificate(), _hashed_id_issuer(), _hash(), _hashed_id(), _pr_key(), _pu_key_x(), _pu_key_y(), _pu_comp_key(), _pr_enc_key(), _pu_enc_key_x(), _pu_enc_key_y(), _pu_enc_comp_key(), _to_be_saved(false), _decoded_certificate(nullptr) { };
explicit security_db_record(): _algorithm{ec_elliptic_curves::nist_p_256}, _certificate_id(), _certificate(), _hashed_id_issuer(), _hash(), _hash_sha_256(), _hashed_id(), _pr_key(), _pu_key_x(), _pu_key_y(), _pu_comp_key(), _pr_enc_key(), _pu_enc_key_x(), _pu_enc_key_y(), _pu_enc_comp_key(), _to_be_saved(false), _decoded_certificate(nullptr) { };
/*!
* \brief Specialised ctor
* \param[in] p_certificate_id The certificate identifier
......@@ -55,6 +56,7 @@ public: /*! \publicsection */
* \param[in] p_decoded_certificate The decoded certificate
* \param[in] p_hashed_id_issuer The HashedId of the certificate issuer
* \param[in] p_hash The whole-certificate hash
* \param[in] p_hash_sha_256 The whole-certificate hash using SHA-256
* \param[in] p_hashed_id The whole-certificate hashed id
* \param[in] p_pr_key The private signature key
* \param[in] p_pu_key_x The public X-coordinate signature key
......@@ -66,7 +68,7 @@ public: /*! \publicsection */
* \param[in] p_pu_enc_comp_key_y The public compressed coordinate encryption key
* \param[in] p_to_be_saved Set to true to save on disk this certificate.Default: true
*/
security_db_record(const std::string& p_certificate_id, const OCTETSTRING& p_certificate, const IEEE1609dot2::CertificateBase& p_decoded_certificate, const OCTETSTRING& p_hashed_id_issuer, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashed_id, const OCTETSTRING& p_pr_key, const OCTETSTRING& p_pu_key_x, const OCTETSTRING& p_pu_key_y, const OCTETSTRING& p_pu_comp_key, const OCTETSTRING& p_pr_enc_key, const OCTETSTRING& p_pu_enc_key_x, const OCTETSTRING& p_pu_enc_key_y, const OCTETSTRING& p_pu_enc_comp_key_y, const bool p_to_be_saved = true);
security_db_record(const std::string& p_certificate_id, const OCTETSTRING& p_certificate, const IEEE1609dot2::CertificateBase& p_decoded_certificate, const OCTETSTRING& p_hashed_id_issuer, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashed_id, const OCTETSTRING& p_pr_key, const OCTETSTRING& p_pu_key_x, const OCTETSTRING& p_pu_key_y, const OCTETSTRING& p_pu_comp_key, const OCTETSTRING& p_pr_enc_key, const OCTETSTRING& p_pu_enc_key_x, const OCTETSTRING& p_pu_enc_key_y, const OCTETSTRING& p_pu_enc_comp_key_y, const bool p_to_be_saved = true);
/*!
* \brief Default dtor
......@@ -108,6 +110,13 @@ public: /*! \publicsection */
* \return The whole-certificate hashed id
*/
inline const OCTETSTRING& hash() const { return _hash; };
/*!
* \inline
* \fn const OCTETSTRING& hash_sha_256() const;
* \brief Retrieve the whole-certificate hashed id
* \return The whole-certificate hashed id
*/
inline const OCTETSTRING& hash_sha_256() const { return _hash_sha_256; };
inline const OCTETSTRING& issuer() const { return _hashed_id_issuer; };
inline const OCTETSTRING& private_key() const { return _pr_key; };
inline const OCTETSTRING& public_key_x() const { return _pu_key_x; };
......
......@@ -68,7 +68,7 @@ int security_services::setup(params& p_params) { // FIXME Rename this method
return 0;
}
int security_services::store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_comp_key, const INTEGER& p_public_comp_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_key_compressed_mode) {
int security_services::store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_comp_key, const INTEGER& p_public_comp_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_key_compressed_mode) {
loggers::get_instance().log_msg(">>> security_services::store_certificate: ", p_cert_id);
// Sanity checks
......@@ -76,7 +76,7 @@ int security_services::store_certificate(const CHARSTRING& p_cert_id, const OCTE
loggers::get_instance().warning("security_services::store_certificate: Not initialised");
return -1;
}
return _security_db.get()->store_certificate(p_cert_id, p_cert, p_private_key, p_public_key_x, p_public_key_y, p_public_comp_key, p_public_comp_key_mode, p_hash, p_hashid8, p_issuer, p_private_enc_key, p_public_enc_key_x, p_public_enc_key_y, p_public_enc_compressed_key, p_public_enc_key_compressed_mode);
return _security_db.get()->store_certificate(p_cert_id, p_cert, p_private_key, p_public_key_x, p_public_key_y, p_public_comp_key, p_public_comp_key_mode, p_hash, p_hash_sha_256, p_hashid8, p_issuer, p_private_enc_key, p_public_enc_key_x, p_public_enc_key_y, p_public_enc_compressed_key, p_public_enc_key_compressed_mode);
}
int security_services::verify_and_extract_gn_payload(const OCTETSTRING& p_secured_gn_payload, const bool p_verify, IEEE1609dot2::Ieee1609Dot2Data& p_ieee_1609dot2_data, OCTETSTRING& p_unsecured_gn_payload, params& p_params) {
......@@ -1234,11 +1234,13 @@ int security_services::extract_encryption_keys(const IEEE1609dot2::CertificateBa
return -1;
}
loggers::get_instance().log_msg("security_services::extract_and_store_certificate: Encoded certificate=", enc_cert);
OCTETSTRING hash_cert_sha_256;
hash_sha256(enc_cert, hash_cert_sha_256);
loggers::get_instance().log_msg("security_services::extract_and_store_certificate: hash_cert_sha_256= ", hash_cert_sha_256);
int result = -1;
if (p_certificate.issuer().ischosen(IEEE1609dot2::IssuerIdentifier::ALT_sha256AndDigest)) {
// Calculate the hash according to the hashId
OCTETSTRING hash_cert;
hash_sha256(enc_cert, hash_cert);
OCTETSTRING hash_cert(hash_cert_sha_256);
loggers::get_instance().log_msg("security_services::extract_and_store_certificate: hash_cert= ", hash_cert);
const OCTETSTRING hashed_id8 = substr(hash_cert, hash_cert.lengthof() - 8, 8);
// Retrieve the certificate identifier from digest
......@@ -1274,6 +1276,7 @@ int security_services::extract_encryption_keys(const IEEE1609dot2::CertificateBa
public_comp_key,
public_comp_key_mode,
hash_cert,
hash_cert_sha_256,
hashed_id8,
p_certificate.issuer().sha256AndDigest(),
OCTETSTRING(0, nullptr), // Encryption private not used
......@@ -1323,6 +1326,7 @@ int security_services::extract_encryption_keys(const IEEE1609dot2::CertificateBa
public_comp_key,
public_comp_key_mode,
hash_cert,
hash_cert_sha_256,
hashed_id8,
p_certificate.issuer().sha384AndDigest(),
OCTETSTRING(0, nullptr), // Encryption private not used
......@@ -1353,6 +1357,10 @@ int security_services::read_certificate_hash(const CHARSTRING& p_certificate_id,
return _security_db.get()->get_hash(std::string(static_cast<const char*>(p_certificate_id)), p_hash);
}
int security_services::read_certificate_hash_sha_256(const CHARSTRING& p_certificate_id, OCTETSTRING& p_hash) const {
return _security_db.get()->get_hash_sha_256(std::string(static_cast<const char*>(p_certificate_id)), p_hash);
}
int security_services::read_certificate_from_digest(const OCTETSTRING& p_digest, CHARSTRING& p_certificate_id) const {
std::string certificate_id;
if (_security_db.get()->get_certificate_id(p_digest, certificate_id) != -1) {
......
......@@ -102,13 +102,14 @@ public: /*! \publicsection */
int setup(params &p_params);
int store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_comp_key, const INTEGER& p_public_comp_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_key_compressed_mode);
int store_certificate(const CHARSTRING& p_cert_id, const OCTETSTRING& p_cert, const OCTETSTRING& p_private_key, const OCTETSTRING& p_public_key_x, const OCTETSTRING& p_public_key_y, const OCTETSTRING& p_public_comp_key, const INTEGER& p_public_comp_key_mode, const OCTETSTRING& p_hash, const OCTETSTRING& p_hash_sha_256, const OCTETSTRING& p_hashid8, const OCTETSTRING& p_issuer, const OCTETSTRING& p_private_enc_key, const OCTETSTRING& p_public_enc_key_x, const OCTETSTRING& p_public_enc_key_y, const OCTETSTRING& p_public_enc_compressed_key, const INTEGER& p_public_enc_key_compressed_mode);
inline void set_position(const int p_latitude, const int p_longitude, const int p_elevation = 0) { _latitude = p_latitude; _longitude = p_longitude; _elevation = p_elevation; };
int read_certificate(const CHARSTRING& p_certificate_id, OCTETSTRING& p_certificate) const;
int read_certificate_digest(const CHARSTRING& p_certificate_id, OCTETSTRING& p_digest) const;
int read_certificate_hash(const CHARSTRING& p_certificate_id, OCTETSTRING& p_hash) const;
int read_certificate_hash_sha_256(const CHARSTRING& p_certificate_id, OCTETSTRING& p_hash) const;
int read_certificate_from_digest(const OCTETSTRING& p_digest, CHARSTRING& p_certificate_id) const;
int read_certificate_from_hashed_id3(const OCTETSTRING& p_digest, CHARSTRING& p_certificate_id) const;
int read_private_key(const CHARSTRING& p_certificate_id, OCTETSTRING& p_private_key) const;
......
......@@ -9,19 +9,28 @@ LibItsSecurity_Pixits.PX_CERTIFICATE_POOL_PATH := "/home/vagrant/tmp"
LibItsSecurity_Pixits.PX_IUT_SEC_CONFIG_NAME := "asn1c_cert"
LibItsHttp_Pics.PICS_HEADER_CONTENT_TYPE := "application/x-its-request"
LibItsHttp_Pics.PICS_HEADER_HOST := "etsi-dc-noes.labtlclivorno.it" #192.168.171.18
LibItsPki_Pics.PICS_HTTP_POST_URI_EC :="/dc/ea/validate"
LibItsPki_Pics.PICS_HTTP_POST_URI_AT :="/dc/aa"
LibItsPki_Pics.PICS_HTTP_POST_URI_ATV :="/dc"
LibItsHttp_Pics.PICS_HEADER_HOST := "etsi-dc-noes.labtlclivorno.it"
LibItsPki_Pics.PICS_ITS_S_SIGN_NITSP256_PRIVATE_KEY := '5C25F97607DFC62972A147FAD8B7A7C939569F0F95ECD4C641724A68B51836E5'O
LibItsPki_Pics.PICS_ITS_S_SIGN_NISTP256_PUBLIC_KEY := '020144E5174B0AFDA86BDB8B643B68D40030F5BDB9A9F090C64852CC3C20C9D5AD'O
LibItsPki_Pics.PICS_ITS_S_CANONICAL_ID := '1B4CA1210123AE900BBE6C3EBAE7E87DA20DBDAB1E7B2EC0691C51C1021900AA'O
LibItsPki_Pics.PICS_TS_EA_CERTIFICATE_ID := "CERT_CNIT_EA"
LibItsPki_Pics.PICS_TS_AA_CERTIFICATE_ID := "CERT_CNIT_AA"
LibItsPki_Pics.PICS_HTTP_POST_URI_EC :="/dc/ea"
LibItsPki_Pics.PICS_HTTP_POST_URI_AT :="/dc/aa"
LibItsPki_Pics.PICS_HTTP_POST_URI_ATV :="/dc/ea/validate"
LibItsPki_Pixits.PICS_PKI_AUTH_POP := false # Not private key available
#LibItsPki_Pics.PICS_ITS_S_WITH_PRIVACY := false
LibItsPki_Pics.PICS_ITS_S_SIGN_NITSP256_PRIVATE_KEY := '5C25F97607DFC62972A147FAD8B7A7C939569F0F95ECD4C641724A68B51836E5'O
LibItsPki_Pics.PICS_ITS_S_SIGN_NISTP256_PUBLIC_KEY := '020144E5174B0AFDA86BDB8B643B68D40030F5BDB9A9F090C64852CC3C20C9D5AD'O
LibItsPki_Pics.PICS_ITS_S_CANONICAL_ID := '455453492D4954532D303031'O
LibItsPki_Pics.PICS_TS_EA_CERTIFICATE_ID := "CERT_CNIT_EA"
LibItsPki_Pics.PICS_TS_AA_CERTIFICATE_ID := "CERT_TS_A_AA"
LibItsPki_Pics.PICS_IUT_AA_CERTIFICATE_ID := "CERT_CNIT_AA"
LibItsPki_Pics.PICS_TS_CA_CERTIFICATE_ID := "CERT_CNIT_RCA"
#LibItsPki_Pics.PICS_PKI_AUTH_POP := false # Do not use Signed for PoP in Authorization requet
# Required for SECPKI_AA_AUTH_RCV_02_BV
#LibItsPki_Pics.PICS_SECPKI_REENROLMENT := false # Check in logs the pattern '==> EC ' to find the required information for re-enrolment
#LibItsPki_Pixits.PX_INCLUDE_ENCRYPTION_KEYS := false # No encryption key in Authorization request
LibItsPki_Pics.PICS_SECPKI_REENROLMENT := false
LibItsPki_Pixits.PX_EC_PRIVATE_KEY := '73AD688448117EFF50BCB044AA9CFD7932023B7A2C62887A1D3B99FED2B5237C'O
......@@ -46,32 +55,113 @@ LogEventTypes:= Yes
system.httpPort.params := "HTTP(codecs=http_its:http_etsi_ieee1609dot2_codec)/TCP(debug=1,server=etsi-dc-noes.labtlclivorno.it)"
[EXECUTE]
# The EnrolmentResponse message shall be sent by the EA to the ITS-S across the interface at reference point S3 in response
# to a received EnrolmentRequest message
# The EnrolmentResponse message shall be sent by the EA to the ITS-S across the interface at reference point S3 in response to a received EnrolmentRequest message
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_01_BV
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI
# The EnrolmentResponse message shall be encrypted using an ETSI TS 103 097 approved algorithm and the encryption shall be
#done with the same AES key as the one used by the ITS-S requestor for the encryption of the EnrolmentRequest message.
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate (not containing an item of type PsidSsp)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI_01
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate (containing opaque[0] (version) indicating other value than 1)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI_02
# Check that EA doesn't accept Enrolment rekeying request when enrolment is not permitted by signing certificate (containing opaque[1] (value) indicating "Enrolment Request" (bit 1) set to 0)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_02_BI_03
# Enroll an ITS-Station, but with a canonical-ID, that is not registered.
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_05_BI
# Enroll the ITS-Station, but the CSR re-quests more permissions than the issuer allows, i.e. request for security management SSP bit which is not set in the EA SSP
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_06_BI
# Enroll the ITS-Station, but the CSR requests a AID permission that the issuer does not allow, i.e. request for CAM AID
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_07_BI
# Enroll the ITS-Station, but the expiring date of the CSR is before the start date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_08_BI
# Enroll the ITS-Station, but the start date of the CSR is before the start date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_09_BI
# Enroll the ITS-Station, but the expiring date of the CSR is after the expiring date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_10_BI
# Enroll the ITS-Station, but the start date of the CSR is after the expiring date of the EA
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_11_BI
# Enroll the ITS-Station, but the lifetime of the EC would be grater than allowed (considering values in C-ITS CP)
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_12_BI
# Enroll the ITS-Station, but the inner PoP signature in the CSR, created with the EC private key, can not be verified with the provided public key
#ItsPki_TestCases.TC_SECPKI_EA_ENR_RCV_13_BI
# The EnrolmentResponse message shall be encrypted using an ETSI TS 103 097 approved algorithm and the encryption shall be done with the same AES key as the one used by the ITS-S requestor for the encryption of the EnrolmentRequest message.
#ItsPki_TestCases.TC_SECPKI_EA_ENR_01_BV
# The EnrolmentResponse message shall be encrypted using an ETSI TS 103 097 approved algorithm and the encryption shall be done with the same AES key as the one used by the ITS-S requestor for the encryption of the EnrolmentRequest message.
#ItsPki_TestCases.TC_SECPKI_EA_ENR_02_BV
# The outermost structure is an EtsiTs103097Data-Encrypted structure containing the component recipients containing one instance of RecipientInfo of choice pskRecipInfo, which contains the HashedId8 of the symmetric key used by the ITS-S to encrypt the EnrolmentRequest message to which the response is built and containing the component ciphertext, once decrypted, contains an EtsiTs103097Data-Signed structure
#ItsPki_TestCases.TC_SECPKI_EA_ENR_03_BV
# If the ITS-S has been able to decrypt the content, this expected EtsiTs103097Data-Signed structure shall contain hashId, tbsData, signer and signature. The hashId shall indicate the hash algorithm to be used as specified in ETSI TS 103 097, the signer shall be declared as a digest, containing the HashedId8 of the EA certificate and the signature over tbsData shall be computed using the EA private key corresponding to its publicVerificationKey found in the referenced EA certificate
#ItsPki_TestCases.TC_SECPKI_EA_ENR_04_BV
# Within the headerInfo of the tbsData, the psid shall be set to secured certificate request as assigned in ETSI TS 102 965 and the generationTime shall be present
#ItsPki_TestCases.TC_SECPKI_EA_ENR_05_BV
# Within the headerInfo of the tbsData, aside from psid and generationTime, all other components of the component tbsData.headerInfo not used and absent
#ItsPki_TestCases.TC_SECPKI_EA_ENR_06_BV
# The EtsiTS102941Data shall contain the version set to v1 (integer value set to 1) and the content set to InnerECResponse
#ItsPki_TestCases.TC_SECPKI_EA_ENR_07_BV
#ItsPki_TestCases.TC_SECPKI_EA_ENR_01_BV
# The InnerECResponse shall contain the requestHash, which is the left-most 16 octets of the SHA256 digest of the EtsiTs103097Data - Signed structure received in the request and a responseCode indicating the result of the request
#ItsPki_TestCases.TC_SECPKI_EA_ENR_08_BV
# If the responseCode is 0, the InnerECResponse shall also contain an (enrolment) certificate
#ItsPki_TestCases.TC_SECPKI_EA_ENR_09_BV
# If the responseCode is different than 0, the InnerECResponse shall not contain a certificate
#ItsPki_TestCases.TC_SECPKI_EA_ENR_10_BV
# Check that signing of Enrolment response message is permitted by the EA certificate
#ItsPki_TestCases.TC_SECPKI_EA_ENR_11_BV
# Check that generated EC certificate contains only allowed permissions
#ItsPki_TestCases.TC_SECPKI_EA_ENR_12_BV
# The AuthorizationValidationResponse message shall be sent by the EA to the AA across the interface at reference point S4
#in response to a received AuthorizationValidationRequest message
ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_RCV_01_BV
# The AuthorizationValidationResponse message shall be sent by the EA to the AA across the interface at reference point S4 in response to a received AuthorizationValidationRequest message
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_RCV_01_BV
# Check that EA doesn't accept Authorization Validation Request when SharedAtRequest is signed with certificate without appropriate permissions
ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_RCV_02_BI
# The EtsiTs103097Data-Encrypted is build with the component recipients containing one instance of RecipientInfo of choice pskRecipInfo, which contains the HashedId8 of the symmetric key used by the ITS-S to encrypt the AuthorizationRequest message to which the response is built and the component ciphertext containing the encrypted representation of the EtsiTs103097Data-Signed. The encryption uses a ETSI TS 103 097 [3] approved algorithm
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_01_BV
# To read an authorization validation response, the AA shall receive an EtsiTs103097Data-Encrypted structure, containing a EtsiTs103097Data-Signed structure, containing a EtsiTs102941Data structure, containing an AuthorizationValidationResponse structure
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_02_BV
# The AuthorizationValidationResponse structure contains the requestHash being the left-most 16 octets of the SHA256 digest of the EtsiTs103097Data-Signed structure received in the AuthorizationValidationRequest and a responseCode
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_03_BV
# If the responseCode is 0, the AuthorizationValidationResponse structure contains the component confirmedSubjectAttributes with the attributes the EA wishes to confirm, except for certIssuePermissions which is not allowed to be present
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_04_BV
# If the responseCode is different than 0, the AuthorizationValidationResponse structure does not contain the component confirmedSubjectAttributes
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_05_BV
# The component version of the EtsiTs102941Data structure is set to v1 (integer value set to 1)
#ItsPki_TestCases.TC_SECPKI_EA_AUTHVAL_06_BV
# Check that the EA/AA is able to decrypt the AuthorizationRequest message using the encryption private key corresponding to the recipient certificate...
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_01_BV
# Check that the AA is able to decrypt the AuthorizationRequest message using the encryption private key corresponding to the recipient certificate...
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_02_BV
# Check that the AA skips the AuthorizationRequest message if it is not addressed to this AA
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_03_BI
# Check that the AA skips the AuthorizationRequest message if it unable to decrypt the encKey
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_04_BI
# Check that the AA skips the AuthorizationRequest message if it unable to decrypt the encKey
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_05_BI
# Check that the AA rejects the AuthorizationRequest message if it unable to verify the POP signature
#ItsPki_TestCases.TC_SECPKI_AA_AUTH_RCV_06_BI