ItsPki_TestCases.ttcn

       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_02_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_02_BV

      group f_TC_SECPKI_AA_AUTH_02_BV {

        function f_TC_SECPKI_AA_AUTH_02_BV_itss() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct16 v_authentication_vector;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key;
          var InnerAtRequest v_inner_at_request;
          var InnerAtResponse v_inner_at_response;
          var HashedId8 v_ec_certificate_hashed_id8;

          // Test component configuration
          f_cfHttpUp_itss(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          // Generate EC certificate
          f_generate_inner_ec_request(v_private_key_ec, v_public_compressed_key_ec, v_compressed_key_mode_ec, v_inner_ec_request);
          f_generate_ec_certificate_for_inner_ec_response(v_inner_ec_request, v_private_key_ec, vc_eaWholeHash, v_ec_certificate, v_ec_certificate_hashed_id8);
          // Send AuthorizationRequest
          f_http_build_authorization_request(v_ec_certificate, v_private_key_ec, v_private_key_at, v_public_compressed_key_at, v_compressed_mode_at, v_private_enc_key_at, v_public_compressed_enc_key_at, v_compressed_enc_mode_at, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
          v_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
          f_init_default_headers_list(-, "inner_at_request", v_headers);
          f_http_send(
                      v_headers,
                      m_http_request(
                                     m_http_request_post(
                                                         PICS_HTTP_POST_URI_AT,
                                                         v_headers,
                                                         m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          f_selfOrClientSyncAndVerdict(c_prDone, e_success);

          // Test body
          tc_ac.start;
          alt {
            [] a_await_at_http_response_from_iut(
                                                 mw_http_response(
                                                                  mw_http_response_ok(
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_pskRecipInfo, * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_response
                                                 ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_response_from_iut_aa(v_response.response, v_private_key_at, v_aes_sym_key, v_authentication_vector, v_request_hash, v_inner_at_response, v_result);
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: PASS: Received exptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: FAIL: Unexptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_itss();
        } // End of function f_TC_SECPKI_AA_AUTH_02_BV_itss

        function f_TC_SECPKI_AA_AUTH_02_BV_ea() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key := int2oct(0, 16);
          var SharedAtRequest v_shared_at_request;
          var AuthorizationValidationResponse v_authorization_validation_response;

          // Test component configuration
          f_cfHttpUp_ea(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          tc_ac.start;
          alt {
            [] a_await_atv_http_request_from_iut( // Wait for authorizationValidation Request from IUT to EA
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      -, //FIXME: Use another PIXIT than PICS_HTTP_POST_URI_ATV,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_eaHashedId8)), * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_request
                                                  ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_request_from_iut_atv(v_request.request, v_aes_sym_key, v_request_hash, v_shared_at_request, v_result);
              // Set verdict
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: IUT has sent AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, ok, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_response(
                                            m_http_response_ok(
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                          )),
                                                               v_headers
                            )));
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INCONC: Failed to verify AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, deniedpermissions, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_request(
                                           m_http_request_post(
                                                               PICS_HTTP_POST_URI_AT,
                                                               v_headers,
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                          )))));
                f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_prDone, e_timeout);
            }
          } // End of 'alt' statement

          // Test body
          f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);

          // Postamble
          // TODO Wait for AuthorizationResponse
          f_cfHttpDown_ea();

        } // End of function f_TC_SECPKI_AA_AUTH

      } // End of group f_TC_SECPKI_AA_AUTH_02_BV

      /**
       * @desc Check that the AA sends signed authorization response with signature properly calculated using approved hash algorithm.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *              authorized with CERT_AA certificate
       *                  containing verificationKey (AA_PUB_V_KEY)
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing hashId
       *                            indicating supported hash algorithm (HASH_ALG)
       *                        and containing signature
       *                            calculated using the HASH_ALG and private key correspondent to the AA_PUB_V_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_03_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_03_BV

      /**
       * @desc Check that the AA sends signed AuthorizationResponseMessage using valid ITS AID and only allowed headers.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing tbsData
       *                            containing psid
       *                                indicating AID_PKI_CERT_REQUEST
       *                        and containing generationTime
       *                        and not containing any other headers
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_04_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_04_BV

    } // End of group aa_authorization_response

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.5  CA Certificate Request
    group aa_ca_certificates_request {
      // TODO
    } // End of group aa_ca_certificates_request

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.6  Authorization using butterfly key expansion mechanism
    group aa_authorization_with_bfk {

      group bfk_cert_request_helpers {

          function f_trigger_butterfly_cert_request(
                                                    out HashedId8 p_aes_sym_key_hashed_id8,
                                                    out RaAcaCertRequest p_ra_aca_cert_request
                                                    ) runs on ItsPkiHttp {
            // Local variables
            var octetstring v_caterpillar_private_key
            var octetstring v_caterpillar_public_key_compressed;
            var integer v_caterpillar_compressed_mode;
            var octetstring v_caterpillar_enc_private_key
            var octetstring v_caterpillar_enc_public_key_compressed;
            var integer v_caterpillar_enc_compressed_mode;
            var EeRaCertRequest v_ee_ra_cert_request;
            var octetstring v_private_key;
            var Oct16 v_encrypted_sym_key;
            var Oct16 v_aes_sym_key;
            var Oct16 v_authentication_vector;
            var Oct12 v_nonce;
            var Oct32 v_request_hash;
            var octetstring v_salt;
            var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
            var Headers v_headers;
            var HttpMessage v_response;
            var EtsiTs102941Data v_etsi_ts_102941_data;


            // Generate EeRaCertRequest
            if (f_generate_ee_ra_cert_request(v_caterpillar_private_key, v_caterpillar_public_key_compressed, v_caterpillar_compressed_mode, v_caterpillar_enc_private_key, v_caterpillar_enc_public_key_compressed, v_caterpillar_enc_compressed_mode, v_ee_ra_cert_request) == false) {
              log("*** f_trigger_butterfly_cert_request: ERROR: Failed to generate InnerEcRequest ***");
              f_selfOrClientSyncAndVerdict("error", e_error);
            }
            log ("f_trigger_butterfly_cert_request: p_ee_ra_cert_request: ", v_ee_ra_cert_request);
            // Buikd theHTTP request
            f_http_build_butterfly_cert_request(v_ee_ra_cert_request, vc_eaPrivateKey, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, p_ra_aca_cert_request, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
            p_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
            f_init_default_headers_list(-, "bfk_cert_request", v_headers);
            f_http_send(
                        v_headers,
                        m_http_request(
                                      m_http_request_post(
                                                          PICS_HTTP_POST_URI_BFK_AA,
                                                          v_headers,
                                                          m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          } // End of function f_trigger_butterfly_cert_request

          function f_verify_http_butterfly_cert_request_message_to_ea(
                                                                      in Request p_request,
                                                                      in Headers p_headers,
                                                                      out integer p_result,
                                                                      out AcaRaCertResponse p_aca_ra_cert_response
                                                                      ) runs on ItsPkiHttp {

            // Local variables
            var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
            var EtsiTs102941Data v_etsi_ts_102941_data;
            var template (value) HttpMessage v_response;
            var Oct16 v_request_hash;
            var HashedId8 v_bfk_hashed_id8;
            var Oct16 v_aes_enc_key;

            log(">>> f_verify_http_butterfly_cert_request_message_to_ea: ", p_request);

            p_result := 0;

            if (f_verify_pki_request_message( vc_aaPrivateEncKey, vc_aaWholeHash/*salt*/, ''O,
                                              omit,
                                              p_request.body.binary_body.ieee1609dot2_data, true, v_request_hash, v_bfk_hashed_id8, v_etsi_ts_102941_data, v_aes_enc_key) == false) { // Cannot decrypt the message
              // Send error message
              v_response := m_http_response(m_http_response_ko_no_body(p_headers, 400, "Bad request")); // Initialize v_reponse with an error message
              // Set verdict
              p_result := -1;
            } else {
              var UInt64 v_current_time := f_getCurrentTimeUtc();
              var UInt64 v_delta_time := 30;

              log("f_verify_http_butterfly_cert_request_message_to_ea: match ", match(v_etsi_ts_102941_data, mw_etsiTs102941Data_ra_aca_cert_request(mw_ra_aca_cert_request))); // TODO In TITAN, this is the only way to get the unmatching in log
              if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_ra_aca_cert_request(mw_ra_aca_cert_request((v_current_time - v_delta_time .. v_current_time + v_delta_time), explicit, '00000000'B/*butterflyExplicit*/, mw_bfk_to_be_signed_certificate))) == false) {
                // Send error message
                v_response := m_http_response(m_http_response_ko_no_body(p_headers, 400, "Bad request")); // Initialize v_reponse with an error message
                // Set verdict
                p_result := -2;
              } else {
                // TODO Add checked ???
              }
            }

            log("<<< f_verify_http_butterfly_cert_request_message_to_ea: p_result: ", p_result);
          } // End of function f_verify_http_butterfly_cert_request_message_to_ea

      } // End of group bfk_cert_request_helpers

      /**
       * @desc Check that the AA sends the butterfly certificate response message after receiving of the butterfly certificate request
       *       Check that this message is encrypted using the same symmetric encryption key as the butterfly certificate request message
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *         the EA in "operational" state
       *             authorized with CERT_AA certificate
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT received the ButterflyCertificateRequestMessage
       *              containing content.encryptedData.recipients
       *                containing the instance of RecipientInfo
       *                  containing certRecipInfo
       *                    containing recipientId
       *                      indicating HashedId8 of the CERT_AA
       *                    and containing encKey
       *                      containing encrypted symmetric encryption key (ENC_KEY)
       *         }
       *         then {
       *           the IUT sends to the EA a EtsiTs103097Data-Encrypted
       *             containing content.encryptedData.recipients
       *               indicating size 1
       *             and containing the instance of RecipientInfo
       *               containing pskRecipInfo
       *                 indicating HashedId8 of the ENC_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTHVAL_01_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_BFK_AUTH_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
          // Local variables
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Headers v_headers;
          var HttpMessage v_request;
          var integer v_result;
          var RaAcaCertRequest v_ra_aca_cert_request;
          var AcaRaCertResponse v_aca_ra_cert_response;

          // Test control
          if (not PICS_IUT_AA_ROLE) {
            log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
            setverdict(inconc);
            stop;
          }

          // Test component configuration
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_trigger_butterfly_cert_request(v_aes_sym_key_hashed_id8, v_ra_aca_cert_request);
          f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

          // Test Body
          tc_ac.start;
          alt {
            [] httpAtVPort.receive(
                                   mw_http_request(
                                                   mw_http_request_post(
                                                                        -, // URI
                                                                        v_headers, // Headers
                                                                        mw_http_message_body_binary(
                                                                                                    mw_binary_body_ieee1609dot2_data(
                                                                                                                                     mw_butterflyCertResponseMessage(
                                                                                                                                                                     mw_encryptedData
                                  )))))) -> value v_request {
              tc_ac.stop;

              f_verify_http_butterfly_cert_request_message_to_ea(v_request.request, v_headers, v_result, v_aca_ra_cert_response);
              // Set verdict
              if (v_result == 0) {
                log("*** " & testcasename() & ": PASS: ButterflyCertResponsetMessage received ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Failed to verify ButterflyCertResponsetMessage ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
              }
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown();

        } // End of testcase TC_SECPKI_AA_BFK_AUTH_01_BV

    } // End of group aa_authorization_with_bfk

  } // End of group aa_beavior

  // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.6  RootCA behaviour
  group ca_behavior {

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.6.1  CTL generation
    group ca_ctl_generation {

      /**
       * @desc Check that the RootCA generates the Full CTL when new EA is about to be added to the Root CTL
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE
       * Initial conditions: 
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the RootCA is triggered to add new EA certificate (CERT_EA) in the CTL
       *         }
       *         then {
       *             the IUT issue a new CTL of type CtlFormat
       *                 containing isFullCtl
       *                     indicating TRUE
       *                 and containing ctlCommands
       *                     containing CtlCommand
       *                         containing add
       *                             containing ea
       *                                 containing eaCertificate
       *                                     indicating CERT_EA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP RCA_CTLGEN_01_BV
       * @reference ETSI TS 102 941, clause 6.3.2 and 6.3.4
       */
      testcase TC_RCA_CTLGEN_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Headers v_headers;
        var HttpMessage v_response;

        // Test control
        if (not PICS_IUT_CA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfHttpUp_ca();

        // Test adapter configuration

        // Preamble
        f_init_default_headers_list(PICS_HEADER_CTL_CONTENT_TYPE, "ca_request", v_headers);
        action("The RootCA is triggered to add new EA certificate (CERT_EA) in the CTL");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_get(
                                                      PICS_HTTP_GET_URI_CTL,
                                                      v_headers
                                                      )));
        tc_ac.start;
        alt {
          [not(PICS_MULTIPLE_END_POINT)] httpPort.receive(
                                                          mw_http_response(
                                                                           mw_http_response_ok(
                                                                                               mw_http_message_body_binary(
                                                                                                                           mw_binary_body_ieee1609dot2_data(
                                                                                                                                                            mw_etsiTs103097Data_signed(
                                                                                                                                                                                       mw_signedData(
                                                                                                                                                                                                     -,
                                                                                                                                                                                                     mw_toBeSignedData(
                                                                                                                                                                                                                       mw_signedDataPayload
                                                                                                                                                                                                                       ),
                                                                                                                                                                                                     ?
                                                                                                                                                                                                     ))))))) -> value v_response {
            var charstring_list v_etag;
            var ToBeSignedRcaCtl v_to_be_signed_rca_ctl;

            tc_ac.stop;

            // Check ETag header
            if (f_check_headers(v_response.response.header, c_etag_http_header) == false) {
              log("*** " & testcasename() & ": INFO: 'ETag' HTTP header not set ***");
              //f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
            } else {
              f_get_header(v_response.response.header, c_etag_http_header, v_etag);
              log("*** " & testcasename() & ": INFO: ETag= ", v_etag[0]);
            }

            if (f_verify_rca_ctl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, true, v_to_be_signed_rca_ctl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_ctl(v_to_be_signed_rca_ctl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [PICS_MULTIPLE_END_POINT] httpCaPort.receive(
                                                       mw_http_response(
                                                                        mw_http_response_ok(
                                                                                            mw_http_message_body_binary(
                                                                                                                        mw_binary_body_ieee1609dot2_data(
                                                                                                                                                         mw_etsiTs103097Data_signed(
                                                                                                                                                                                    mw_signedData(
                                                                                                                                                                                                  -,
                                                                                                                                                                                                  mw_toBeSignedData(
                                                                                                                                                                                                                    mw_signedDataPayload
                                                                                                                                                                                                                    ),
                                                                                                                                                                                                  ?
                                                                                                                                                                                                  ))))))) -> value v_response {
            var charstring_list v_etag;
            var ToBeSignedRcaCtl v_to_be_signed_rca_ctl;

            tc_ac.stop;

            // Check ETag header
            if (f_check_headers(v_response.response.header, c_etag_http_header) == false) {
              log("*** " & testcasename() & ": INCONC: 'ETag' HTTP header not set ***");
              //f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
            } else {
              f_get_header(v_response.response.header, c_etag_http_header, v_etag);
              log("*** " & testcasename() & ": INFO: ETag= ", v_etag[0]);
            }

            if (f_verify_rca_ctl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, true, v_to_be_signed_rca_ctl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_ctl(v_to_be_signed_rca_ctl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [] tc_ac.timeout {
            log("*** " & testcasename() & ": INCONC: Expected message not received ***");
            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
          }
        } // End of 'alt' statement

        // Postamble
        f_cfHttpDown_ca();

      } // End of testcase TC_RCA_CTLGEN_01_BV

    } // End of ca_group ctl_generation

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.6.2  CRL generation
    group ca_crl_generation {

      /**
       * @desc Check that the RootCA generates the CRL signed with appropriate certificate
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE
       * Initial conditions: 
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the RootCA is triggered to add new CA certificate (CERT_CA) to the revocation list
       *         }
       *         then {
       *             the IUT issue a new CRL of type ToBeSignedCrl
       *                 containing emtries
       *                     containing item of type CrlEntry
       *                         indicating HashedId8 of CERT_CA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP RCA_CRLGEN_01_BV
       * @reference ETSI TS 102 941, clause 6.3.3
       */
      testcase TC_RCA_CRLGEN_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Headers v_headers;
        var HttpMessage v_response;

        // Test control
        if (not PICS_IUT_CA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfHttpUp_ca();

        // Test adapter configuration

        // Preamble
        f_init_default_headers_list(PICS_HEADER_CRL_CONTENT_TYPE, "ca_request", v_headers);
        action("the RootCA is triggered to generate new CRL");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_get(
                                                      PICS_HTTP_GET_URI_CRL,
                                                      v_headers
                                                      )));
        tc_ac.start;
        alt {
          [not(PICS_MULTIPLE_END_POINT)] httpPort.receive(
                                                          mw_http_response(
                                                                           mw_http_response_ok(
                                                                                               mw_http_message_body_binary(
                                                                                                                           mw_binary_body_ieee1609dot2_data(
                                                                                                                                                            mw_etsiTs103097Data_signed(
                                                                                                                                                                                       mw_signedData(
                                                                                                                                                                                                     -,
                                                                                                                                                                                                     mw_toBeSignedData(                                                                                                                                                            mw_signedDataPayload                                                                                                                                        ),
                                                                                                                                                                                                     mw_signerIdentifier_digest
                                                                                                                                                                                                     ))))))) -> value v_response {
            var ToBeSignedCrl v_to_be_signed_crl;

            tc_ac.stop;

            if (f_verify_rca_crl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, true, v_to_be_signed_crl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_crl(v_to_be_signed_crl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedCrl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [PICS_MULTIPLE_END_POINT] httpCaPort.receive(
                                                       mw_http_response(
                                                                        mw_http_response_ok(
                                                                                            mw_http_message_body_binary(
                                                                                                                        mw_binary_body_ieee1609dot2_data(
                                                                                                                                                         mw_etsiTs103097Data_signed(
                                                                                                                                                                                    mw_signedData(
                                                                                                                                                                                                  -,
                                                                                                                                                                                                  mw_toBeSignedData(                                                                                                                                                            mw_signedDataPayload                                                                                                                                        ),
                                                                                                                                                                                                  mw_signerIdentifier_digest
                                                                                                                                                                                                  ))))))) -> value v_response {
            var ToBeSignedCrl v_to_be_signed_crl;

            tc_ac.stop;

            if (f_verify_rca_crl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, true, v_to_be_signed_crl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_crl(v_to_be_signed_crl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedCrl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [] tc_ac.timeout {
            log("*** " & testcasename() & ": INCONC: Expected message not received ***");
            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
          }
        } // End of 'alt' statement

        // Postamble
        f_cfHttpDown_ca();

      } // End of testcase TC_RCA_CRLGEN_01_BV

    } // End of group ca_crl_generation

  } // End of group ca_behavior

  // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.7  DC behaviour
  group dc_behavior {
    // TODO
  } // End of group dc_behavior

  // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.8  TLM behaviour
  group tlm_behavior {

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.8.1  CTL generation
    group tlm_ctl_generation {

      /**
       * @desc Check that the TLM generates the ECTL when new RootCA is about to be added
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE
       * Initial conditions: 
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the TLM is triggered to add new RootCA certificate (CERT_RCA) in the CTL
       *         }
       *         then {
       *             the IUT issue a new CTL of type CtlFormat
       *                 containing isFullCtl
       *                     indicating TRUE
       *                 and containing ctlCommands
       *                     containing CtlCommand
       *                         containing add
       *                             containing rca
       *                                 containing selfsignedRootCa
       *                                     indicating CERT_RCA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP TLM_ECTLGEN_01_BV
       * @reference ETSI TS 102 941, clause 6.3.1
       */
      testcase TC_TLM_ECTLGEN_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Headers v_headers;
        var HttpMessage v_response;

        // Test control
        if (not PICS_IUT_CA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfHttpUp_tlm();

        // Test adapter configuration

        // Preamble
        f_init_default_headers_list(PICS_HEADER_CTL_CONTENT_TYPE, "tlm_request", v_headers);
        action("The TLM is triggered to add new RootCA certificate (CERT_RCA) in the CTL");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_get(
                                                      PICS_HTTP_GET_URI_TLM,
                                                      v_headers
                                                      )));
        tc_ac.start;
        alt {
          [not(PICS_MULTIPLE_END_POINT)] httpPort.receive(
                                                          mw_http_response(
                                                                           mw_http_response_ok(
                                                                                               mw_http_message_body_binary(
                                                                                                                           mw_binary_body_ieee1609dot2_data(
                                                                                                                                                            mw_etsiTs103097Data_signed(
                                                                                                                                                                                       mw_signedData(
                                                                                                                                                                                                     -,
                                                                                                                                                                                                     mw_toBeSignedData(                                                                                                                                                            mw_signedDataPayload                                                                                                                                        ),
                                                                                                                                                                                                     - // Certificate or HasedId8
                                                                                                                                                                                                     ))))))) -> value v_response {
            var ToBeSignedTlmCtl v_to_be_signed_tlm_ectl;

            tc_ac.stop;

            // FIXME Can not verify signature, to be checked
            if (f_verify_tlm_ectl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, false, v_to_be_signed_tlm_ectl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_ectl(v_to_be_signed_tlm_ectl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [PICS_MULTIPLE_END_POINT] httpTlmPort.receive(
                                                        mw_http_response(
                                                                         mw_http_response_ok(
                                                                                             mw_http_message_body_binary(
                                                                                                                         mw_binary_body_ieee1609dot2_data(
                                                                                                                                                          mw_etsiTs103097Data_signed(
                                                                                                                                                                                     mw_signedData(
                                                                                                                                                                                                   -,
                                                                                                                                                                                                   mw_toBeSignedData(                                                                                                                                                            mw_signedDataPayload                                                                                                                                        ),
                                                                                                                                                                                                   - // Certificate or HasedId8
                                                                                                                                                                                                   ))))))) -> value v_response {
            var ToBeSignedTlmCtl v_to_be_signed_tlm_ectl;

            tc_ac.stop;

            // FIXME Can not verify signature, to be checked
            if (f_verify_tlm_ectl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, false, v_to_be_signed_tlm_ectl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_ectl(v_to_be_signed_tlm_ectl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [] tc_ac.timeout {
            log("*** " & testcasename() & ": INCONC: Expected message not received ***");
            f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
          }
        } // End of 'alt' statement

        // Postamble
        f_cfHttpDown_tlm();

      } // End of testcase TC_TLM_ECTLGEN_01_BV

    } // End of group tlm_ctl_generation

  } // End of group tlm_behavior

  // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.9  CPOC behaviour
  group cpoc_behavior {

    /**
     * @desc Check that the TLM CTL is published and accessible when issued
     * <pre>
     * Pics Selection: 
     * Initial conditions: 
     *         the TLM issued a new CTL
     *     }
     * Expected behaviour:
     *     ensure that {