Major security bugs fixed for signature. Encryption to do. (ed130f9a) · Commits · ITS - Intelligent Transport Systems / ITS

ttcn/AtsGenCert/ItsGenCert_Functions.ttcn

+69 −15

Original line number	Diff line number	Diff line
		@@ -22,11 +22,11 @@ module ItsGenCert_Functions {
		inout certificate_details p_certificate_details
		) return integer {
		if (p_certificate_params.curve == e_nist_p256) {
		f_generate_key_pair_nistp256(p_certificate_details.private_key, p_certificate_details.public_key_x, p_certificate_details.public_key_y);
		f_generate_key_pair_nistp256(p_certificate_details.private_key, p_certificate_details.public_key_x, p_certificate_details.public_key_y, p_certificate_details.public_key_compressed, p_certificate_details.public_key_compressed_mode);
		} else if (p_certificate_params.curve == e_brainpool_p256) {
		f_generate_key_pair_brainpoolp256(p_certificate_details.private_key, p_certificate_details.public_key_x, p_certificate_details.public_key_y);
		f_generate_key_pair_brainpoolp256(p_certificate_details.private_key, p_certificate_details.public_key_x, p_certificate_details.public_key_y, p_certificate_details.public_key_compressed, p_certificate_details.public_key_compressed_mode);
		} else if (p_certificate_params.curve == e_brainpool_p384) {
		f_generate_key_pair_brainpoolp384(p_certificate_details.private_key, p_certificate_details.public_key_x, p_certificate_details.public_key_y);
		f_generate_key_pair_brainpoolp384(p_certificate_details.private_key, p_certificate_details.public_key_x, p_certificate_details.public_key_y, p_certificate_details.public_key_compressed, p_certificate_details.public_key_compressed_mode);
		} else {
		log("f_generate_signing_keys: Unsupported curve");
		return -1;
		@@ -34,9 +34,9 @@ module ItsGenCert_Functions {

		if (p_certificate_params.encryption_key == true) {
		if (p_certificate_params.encryption_curve == e_nist_p256) {
		f_generate_key_pair_nistp256(p_certificate_details.private_enc_key, p_certificate_details.public_enc_key_x, p_certificate_details.public_enc_key_y);
		f_generate_key_pair_nistp256(p_certificate_details.private_enc_key, p_certificate_details.public_enc_key_x, p_certificate_details.public_enc_key_y, p_certificate_details.public_key_compressed, p_certificate_details.public_key_compressed_mode);
		} else if (p_certificate_params.encryption_curve == e_brainpool_p256) {
		f_generate_key_pair_brainpoolp256(p_certificate_details.private_enc_key, p_certificate_details.public_enc_key_x, p_certificate_details.public_enc_key_y);
		f_generate_key_pair_brainpoolp256(p_certificate_details.private_enc_key, p_certificate_details.public_enc_key_x, p_certificate_details.public_enc_key_y, p_certificate_details.public_key_compressed, p_certificate_details.public_key_compressed_mode);
		} else {
		log("f_generate_signing_keys: Unsupported encryption curve");
		return -1;
		@@ -50,17 +50,62 @@ module ItsGenCert_Functions {
		in certificate_params p_certificate_params,
		inout certificate_details p_certificate_details
		) return integer {
		var VerificationKeyIndicator v_publicVerificationKey;
		if (p_certificate_params.curve == e_nist_p256) {
		if (p_certificate_details.public_key_compressed_mode == 0) {
		v_publicVerificationKey := valueof(
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaNistP256(
		m_eccP256CurvePoint_compressed_y_0(
		p_certificate_details.public_key_compressed
		))));
		} else {
		v_publicVerificationKey := valueof(
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaNistP256(
		m_eccP256CurvePoint_compressed_y_1(
		p_certificate_details.public_key_compressed
		))));
		}
		} else if (p_certificate_params.curve == e_brainpool_p256) {
		if (p_certificate_details.public_key_compressed_mode == 0) {
		v_publicVerificationKey := valueof(
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaBrainpoolP256r1(
		m_eccP256CurvePoint_compressed_y_0(
		p_certificate_details.public_key_compressed
		))));
		} else {
		v_publicVerificationKey := valueof(
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaBrainpoolP256r1(
		m_eccP256CurvePoint_compressed_y_1(
		p_certificate_details.public_key_compressed
		))));
		}
		} else {
		if (p_certificate_details.public_key_compressed_mode == 0) {
		v_publicVerificationKey := valueof(
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaBrainpoolP384r1(
		m_eccP384CurvePoint_compressed_y_0(
		p_certificate_details.public_key_compressed
		))));
		} else {
		v_publicVerificationKey := valueof(
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaBrainpoolP384r1(
		m_eccP384CurvePoint_compressed_y_1(
		p_certificate_details.public_key_compressed
		))));
		}
		}
		p_certificate_details.certificate := valueof(
		m_etsiTs103097Certificate(
		m_issuerIdentifier_self(p_certificate_params.hash_algorithm),
		m_toBeSignedCertificate(
		{ name := p_certificate_params.certificate_id },
		m_verificationKeyIndicator_verificationKey(
		m_publicVerificationKey_ecdsaNistP256(
		m_eccP256CurvePoint_uncompressed(
		p_certificate_details.public_key_x,
		p_certificate_details.public_key_y
		))),
		v_publicVerificationKey,
		p_certificate_params.validity_period,
		p_certificate_params.region,
		p_certificate_params.app_permissions,
		@@ -99,14 +144,19 @@ module ItsGenCert_Functions {
		inout certificate_details p_certificate_details
		) return integer {
		var bitstring v_enc_msg;
		var octetstring v_raw_to_be_signed;
		var octetstring v_signature;

		// Encode it ==> Get octetstring
		v_enc_msg := encvalue(p_certificate_details.certificate.toBeSigned);
		v_raw_to_be_signed := bit2oct(v_enc_msg);
		if (p_issuer_certificate_details.issuer != p_issuer_certificate_details.hashid8) { // This is not a CA certificate
		v_raw_to_be_signed := v_raw_to_be_signed & p_issuer_certificate_details.issuer;
		}

		// Sign the certificate using ECDSA/SHA-256 (NIST p-256)
		if (p_certificate_params.curve == e_nist_p256) {
		v_signature := f_signWithEcdsaNistp256WithSha256(bit2oct(v_enc_msg), p_issuer_certificate_details.private_key);
		v_signature := f_signWithEcdsaNistp256WithSha256(v_raw_to_be_signed, p_issuer_certificate_details.private_key);
		if (lengthof(v_signature) != 64) {
		setverdict(fail, "Wrong signature size, shall be 64 instead of ", lengthof(v_signature));
		stop;
		@@ -121,7 +171,7 @@ module ItsGenCert_Functions {
		)
		));
		} else if (p_certificate_params.curve == e_brainpool_p256) {
		v_signature := f_signWithEcdsaBrainpoolp256WithSha256(bit2oct(v_enc_msg), p_issuer_certificate_details.private_key);
		v_signature := f_signWithEcdsaBrainpoolp256WithSha256(v_raw_to_be_signed, p_issuer_certificate_details.private_key);
		if (lengthof(v_signature) != 64) {
		setverdict(fail, "Wrong signature size, shall be 64 instead of ", lengthof(v_signature));
		stop;
		@@ -136,7 +186,7 @@ module ItsGenCert_Functions {
		)
		));
		} else if (p_certificate_params.curve == e_brainpool_p384) {
		v_signature := f_signWithEcdsaBrainpoolp384WithSha384(bit2oct(v_enc_msg), p_issuer_certificate_details.private_key);
		v_signature := f_signWithEcdsaBrainpoolp384WithSha384(v_raw_to_be_signed, p_issuer_certificate_details.private_key);
		if (lengthof(v_signature) != 96) {
		setverdict(fail, "Wrong signature size, shall be 96 instead of ", lengthof(v_signature));
		stop;
		@@ -217,6 +267,8 @@ module ItsGenCert_Functions {
		p_certificate_details_list[v_counter].private_key,
		p_certificate_details_list[v_counter].public_key_x,
		p_certificate_details_list[v_counter].public_key_y,
		p_certificate_details_list[v_counter].public_key_compressed,
		p_certificate_details_list[v_counter].public_key_compressed_mode,
		p_certificate_details_list[v_counter].hashid8,
		p_certificate_details_list[v_counter].issuer,
		p_certificate_details_list[v_counter].private_enc_key,
		@@ -229,6 +281,8 @@ module ItsGenCert_Functions {
		p_certificate_details_list[v_counter].private_key,
		p_certificate_details_list[v_counter].public_key_x,
		p_certificate_details_list[v_counter].public_key_y,
		p_certificate_details_list[v_counter].public_key_compressed,
		p_certificate_details_list[v_counter].public_key_compressed_mode,
		p_certificate_details_list[v_counter].hashid8,
		p_certificate_details_list[v_counter].issuer,
		''O,

ttcn/AtsGenCert/ItsGenCert_TestCases.ttcn

+1 −1

Original line number	Diff line number	Diff line
		@@ -42,7 +42,7 @@ module ItsGencert_TestCases {

		// Setup
		v_certificate_params := PICS_CERTFICATES[v_counter];
		v_details := { v_certificate_params.certificate_id, {}, ''O, ''O, ''O, ''O, '0000000000000000'O, '0000000000000000'O, omit, omit, omit };
		v_details := { v_certificate_params.certificate_id, {}, ''O, ''O, ''O, ''O, ''O, 0, '0000000000000000'O, '0000000000000000'O, omit, omit, omit };

		// Generate Private/Public signing and encryption keys for the certificate
		if (f_generate_signing_keys(v_certificate_params, v_details) == -1) {

ttcn/AtsGenCert/ItsGenCert_TypeAndValues.ttcn

+2 −0

Original line number	Diff line number	Diff line
		@@ -95,6 +95,8 @@ module ItsGenCert_TypeAndValues {
		octetstring private_key,
		octetstring public_key_x,
		octetstring public_key_y,
		octetstring public_key_compressed,
		integer public_key_compressed_mode,
		HashedId8 hashid8,
		HashedId8 issuer,
		octetstring private_enc_key optional,

ttcn/AtsPki/ItsPki_Functions.ttcn

0 → 100644

+95 −0

Original line number	Diff line number	Diff line
		/**
		* @author ETSI / STF544
		* @version $URL$
		* $Id$
		* @desc Module containing functions for ITS PKI ATS
		* @copyright ETSI Copyright Notification
		* No part may be reproduced except as authorized by written permission.
		* The copyright and the foregoing restriction extend to reproduction in all media.
		* All rights reserved.
		*
		*/
		module ItsPki_Functions {

		// LibCommon
		import from LibCommon_BasicTypesAndValues all;
		import from LibCommon_Time all;

		// LibIts
		import from IEEE1609dot2BaseTypes language "ASN.1:1997" all;
		import from IEEE1609dot2 language "ASN.1:1997" all;
		import from EtsiTs102941BaseTypes language "ASN.1:1997" all;
		import from EtsiTs102941TypesEnrolment language "ASN.1:1997" all;
		import from EtsiTs102941MessagesItss language "ASN.1:1997" all;
		import from EtsiTs103097Module language "ASN.1:1997" all;

		// LibItsCommon
		import from LibItsCommon_TestSystem all;
		import from LibItsCommon_Functions all;
		import from LibItsCommon_ASN1_NamedNumbers all;

		// LibItsDenm
		import from LibItsDenm_Templates all;
		import from LibItsDenm_Functions all;
		import from LibItsDenm_TestSystem all;

		// LibItsCam
		import from LibItsCam_Templates all;
		import from LibItsCam_Functions all;
		import from LibItsCam_TestSystem all;

		// LibItsGeoNetworking
		import from LibItsGeoNetworking_TestSystem all;
		import from LibItsGeoNetworking_Functions all;
		import from LibItsGeoNetworking_Templates all;
		import from LibItsGeoNetworking_TypesAndValues all;

		// LibItsSecurity
		import from LibItsSecurity_TypesAndValues all;
		import from LibItsSecurity_Templates all;
		import from LibItsSecurity_Functions all;

		function f_prepareEnrollmentRequest(
		in charstring p_configId,
		in template (value) InnerEcRequest p_innerEcRequest
		) runs on ItsGeoNetworking return GeoNetworkingPdu {
		// Local variables
		var GnNonSecuredPacket v_gnNonSecuredPacket;
		var octetstring v_gnPayload;
		var LongPosVector v_longPosVectorNodeB := f_getPosition(c_compNodeB); // Use NodeB
		var template (value) Ieee1609Dot2Data v_securedMessage := {};

		// Build signed Ieee1609Dot2Data
		v_gnNonSecuredPacket := valueof(
		m_geoNwUnicastPacket(
		v_longPosVectorNodeB,
		f_getIutShortPosVector(),
		vc_localSeqNumber
		));

		// Encode it
		v_gnPayload := bit2oct(
		encvalue(
		v_gnNonSecuredPacket
		)
		);
		/*f_buildGnSecuredOtherMessage(
		v_securedMessage,
		m_payload_signed(v_gnPayload),
		p_issuerIdentifier,
		valueof(m_threeDLocation(
		v_longPosVectorNodeB.latitude,
		v_longPosVectorNodeB.longitude,
		0
		)),
		p_headerFields,
		p_configId,
		p_addMissingHeaders
		);*/

		// Return secured Gn packet
		return valueof(m_geoNwSecPdu(v_gnNonSecuredPacket, v_securedMessage));

		}

		} // End of module ItsPki_Functions
		No newline at end of file

ttcn/AtsPki/ItsPki_TestCases.ttcn

0 → 100644

+123 −0

Original line number	Diff line number	Diff line
		/**
		* @author ETSI / STF545
		* @version $URL$
		* $Id$
		* @desc Testcases file for Security Protocol
		* @reference ETSI TS 103 097 v1.2.1
		* @copyright ETSI Copyright Notification
		* No part may be reproduced except as authorized by written permission.
		* The copyright and the foregoing restriction extend to reproduction in all media.
		* All rights reserved.
		*/
		module ItsPki_TestCases {
		// Libcommon
		import from LibCommon_Time all;
		import from LibCommon_VerdictControl all;
		import from LibCommon_Sync all;
		import from LibCommon_BasicTypesAndValues all;

		// LibIts
		import from IEEE1609dot2BaseTypes language "ASN.1:1997" all;
		import from IEEE1609dot2 language "ASN.1:1997" all;
		import from EtsiTs102941BaseTypes language "ASN.1:1997" all;
		import from EtsiTs102941TypesEnrolment language "ASN.1:1997" all;
		import from EtsiTs102941MessagesItss language "ASN.1:1997" all;
		import from EtsiTs103097Module language "ASN.1:1997" all;

		// LibItsCommon
		import from LibItsCommon_TypesAndValues all;
		import from LibItsCommon_Functions all;
		import from LibItsCommon_TypesAndValues all;
		import from LibItsCommon_ASN1_NamedNumbers all;

		// LibItsGeoNetworking
		import from LibItsGeoNetworking_TestSystem all;
		import from LibItsGeoNetworking_Functions all;
		import from LibItsGeoNetworking_Templates all;
		import from LibItsGeoNetworking_TypesAndValues all;
		import from LibItsGeoNetworking_Pics all;

		// LibItsCam
		import from LibItsCam_Templates all;
		import from LibItsCam_Functions all;
		import from LibItsCam_Templates all;
		import from LibItsCam_Functions all;
		import from LibItsCam_TestSystem all;

		// LibItsDenm
		import from LibItsDenm_Templates all;
		import from LibItsDenm_TestSystem all;

		// LibItsSecurity
		import from LibItsSecurity_TypesAndValues all;
		import from LibItsSecurity_Templates all;
		import from LibItsSecurity_Functions all;
		import from LibItsSecurity_Pixits all;
		import from LibItsSecurity_Pics all;

		// LibItsPki
		import from LibItsPki_Templates all;

		// AtsPki
		import from ItsPki_Functions all;
		import from ItsPki_TestSystem all;

		testcase TC_SEC_PKI_SND_EA_01_BV() runs on ItsGeoNetworking system ItsPkiSystem {

		// Local variables
		var LongPosVector v_longPosVectorIut;
		var GeoNetworkingPdu v_securedGnPdu;
		var GnRawPayload v_sentRawPayload;

		// Test control
		if (not(PICS_GN_SECURITY)) {
		log("* " & testcasename() & ":ERROR: 'PICS_GN_SECURITY' required for executing the TC *");
		stop;
		}

		// Test component configuration
		f_cf01Up();
		v_longPosVectorIut := f_getPosition(c_compIut);

		// Test adapter configuration

		// Preamble
		f_prNeighbour();
		f_acTriggerEvent(m_startPassBeaconing(m_beaconHeader(v_longPosVectorIut).beaconHeader)); // Authorize the TA to forward the received beacons
		f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

		// Test Body
		/*v_securedGnPdu := f_prepareEnrollmentRequest(
		cc_taCert_A,
		m_InnerEcRequest(
		in template (value) charstring p_itsId,
		in template (value) PublicKeys p_publicKeys,
		in template (value) CertificateSubjectAttributes p_requestedSubjectAttributes //(WITH COMPONENTS{certIssuePermissions ABSENT}),

		));
		f_sendGeoNetMessage(valueof(m_geoNwReq_linkLayerBroadcast(v_securedGnPdu)));*/
		tc_ac.start;
		alt {
		[] geoNetworkingPort.receive(
		mw_geoNwInd(
		mw_geoNwSecPdu(
		mw_etsiTs103097Data_signed
		))) {
		tc_ac.stop;
		log("* " & testcasename() & ": PASS: Security protocol version set to 3 *");
		f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
		}
		[] tc_ac.timeout {
		log("* " & testcasename() & ": INCONC: Expected message not received *");
		f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
		}
		} // End of 'alt' statement

		// Postamble
		f_acTriggerEvent(m_stopPassBeaconing);
		f_poNeighbour();
		f_cf01Down();

		} // End of testcase TC_SEC_ITSS_SND_MSG_01_BV

		} // End of module ItsPki_TestCases
		No newline at end of file