# The EnrolmentResponse message shall be encrypted using an ETSI TS 103 097 approved algorithm and the encryption shall be done with the same AES key as the one used by the ITS-S requestor for the encryption of the EnrolmentRequest message.
# Check that IUT sends an enrolment request when triggered.
#ItsPki_TestCases.TC_SECPKI_ITSS_ENR_01_BV
# If the enrolment request of the IUT is an initial enrolment request, the itsId (contained in the InnerECRequest) shall be set to the canonical identifier, the signer (contained in the outer EtsiTs1030971Data-Signed) shall be set to self and the outer signature shall be computed using the canonical private key.
#ItsPki_TestCases.TC_SECPKI_ITSS_ENR_02_BV
# In presence of a valid EC, the enrolment request of the IUT is a rekeying enrolment request with the itsId (contained in the InnerECRequest) and the SignerIdentifier (contained in the outer EtsiTs1030971Data-Signed) both declared as digest containing the HashedId8 of the EC and the outer signature computed using the current valid EC private key corresponding to the verification public key.
#system.geoNetworkingPort.params := "GN(ll_address=4C5E0C14D2EB,latitude=43551050,longitude=10298730,distanceA=1500,distanceB=1500,angle=0,device_mode=0,secured_mode=1,its_aid=36,certificate=CERT_TS_A_AT,sec_db_path=/home/vagrant/tmp/asn1c_cert)/COMMSIGNIA(mac_src=000000000011,target_host=10.8.0.1)/UDP_PCAP(dst_ip=10.8.0.1,dst_port=7943,src_ip=192.168.0.154,src_port=39474)/ETH(mac_src=0800275c4959,eth_type=0800)/PCAP(mac_src=0800275c4959,nic=tap0,filter=and (udp port 39474 or udp port 7943))"
if(f_verify_pki_request_message(vc_eaPrivateEncKey,vc_eaWholeHash/*salt*/,vc_eaWholeHash,p_request.body.binary_body.ieee1609dot2_data,true,v_request_hash,v_etsi_ts_102941_data,v_aes_enc_key)==false){// Cannot decrypt the message
if(f_verify_pki_request_message(vc_eaPrivateEncKey,vc_eaWholeHash/*salt*/,''O,p_request.body.binary_body.ieee1609dot2_data,true,v_request_hash,v_etsi_ts_102941_data,v_aes_enc_key)==false){// Cannot decrypt the message
// Send error message
v_response:=m_http_response(m_http_response_ko(m_http_message_body_binary(m_binary_body_ieee1609dot2_data(v_ieee1609dot2_signed_and_encrypted_data)),p_headers,400,"Bad request"));// Initialize v_reponse with an error message
// Set verdict
...
...
@@ -119,14 +119,15 @@ module ItsPki_TestCases {
// Set verdict
p_result:=-3;
}else{
log("f_verify_http_ec_request_from_iut_itss: match ",match(p_inner_ec_request,mw_innerEcRequest(p_its_id,-,mw_certificate_subject_attributes({mw_appPermissions(c_its_aid_SCR,?)}))));// TODO In TITAN, this is the only way to get the unmatching in log
log("f_verify_http_ec_request_from_iut_itss: matching: ",match(p_inner_ec_request,mw_innerEcRequest(p_its_id,-,mw_certificate_subject_attributes({mw_appPermissions(c_its_aid_SCR,?)}))));// TODO In TITAN, this is the only way to get the unmatching in log
if(f_verify_pki_request_message(vc_eaPrivateEncKey,vc_eaWholeHash/*salt*/,vc_eaWholeHash,p_request.body.binary_body.ieee1609dot2_data,true,v_request_hash,v_etsi_ts_102941_data,v_aes_enc_key)==false){// Cannot decrypt the message
if(f_verify_pki_request_message(vc_eaPrivateEncKey,vc_eaWholeHash/*salt*/,''O,p_request.body.binary_body.ieee1609dot2_data,true,v_request_hash,v_etsi_ts_102941_data,v_aes_enc_key)==false){// Cannot decrypt the message
// Send error message
v_response:=m_http_response(m_http_response_ko(m_http_message_body_binary(m_binary_body_ieee1609dot2_data(v_ieee1609dot2_signed_and_encrypted_data)),p_headers,400,"Bad request"));// Initialize v_reponse with an error message
// Set verdict
p_result:=-1;
}else{
log("f_verify_http_at_request_from_iut_itss: match ",match(v_etsi_ts_102941_data.content,mw_authorizationRequest(mw_innerAtRequest)));// TODO In TITAN, this is the only way to get the unmatching in log
log("f_verify_http_at_request_from_iut_itss: matching: ",match(v_etsi_ts_102941_data.content,mw_authorizationRequest(mw_innerAtRequest)));// TODO In TITAN, this is the only way to get the unmatching in log
log("f_verify_http_at_request_from_iut_itss: match ",match(p_inner_at_request,mw_innerAtRequest(mw_publicKeys,-,mw_shared_at_request,mw_ec_signature)));// TODO In TITAN, this is the only way to get the unmatching in log
if(match(p_inner_at_request,mw_innerAtRequest(mw_publicKeys,-,mw_shared_at_request,mw_ec_signature))==false){// TODO To be refined
