ItsPkiItss_TestCases.ttcn

              if( p_data.counter < p_execution_count ) {
                f_clientSync(c_nextTry, e_success);
                log("*** " & testcasename() & ": Wait for Auth message " & int2str(p_data.counter) & " ***");
                tc_ac.start;
                repeat;
              }

              log("*** " & testcasename() & ": PASS: Everything OK ***");
            }

            [] a_await_at_http_request_from_iut(?, v_request) {
              log("*** " & testcasename() & ": ERROR: Strange message received ***");
              f_selfOrClientSyncAndVerdict(c_interSyncPoint, e_error);
            }

            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdict(c_interSyncPoint, e_timeout);
            }
          } // End of 'alt' statement

          f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
        } // End of function f_TC_SECPKI_ITSS_AUTH_pki


      /**
       * @desc Check that the ITS-S send the Authorization HttpRequest message to the Authorization Authority (AA) to request an authorization ticket.
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to requested a new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_01_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.0
       */
      testcase TC_SECPKI_ITSS_AUTH_01_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_01_BV_pki());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_01_BV

      group f_TC_SECPKI_ITSS_AUTH_01_BV {

        function f_TC_SECPKI_ITSS_AUTH_01_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {
          // Local variable
          var Headers v_headers;
          var HttpMessage v_request;
          var InnerEcRequest v_inner_ec_request;
          var InnerEcResponse v_inner_ec_response;
          var template (omit) EtsiTs103097Certificate v_ec_cert := omit;

          // Test component configuration
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_init_default_headers_list(-, "inner_at_response", v_headers);
          if (PX_TRIGGER_EC_BEFORE_AT) {
            if (f_await_ec_request_send_response(v_inner_ec_request, v_inner_ec_response, v_request) == true) {
              v_ec_cert := v_inner_ec_response.certificate;
              log("*** " & testcasename() & ": INFO: Enrolment succeed ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            } else {
              log("*** " & testcasename() & ": INCONC: Enrolment failed ***");
              f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
            }
          } else {
            f_selfOrClientSyncAndVerdict(c_prDone, e_success);
          }

          // Test Body
          tc_ac.start;
          alt {
            [] a_await_at_http_request_from_iut(
                                                mw_http_request(
                                                                mw_http_request_post(
                                                                                     PICS_HTTP_POST_URI_AT,
                                                                                     -,
                                                                                     mw_http_message_body_binary(
                                                                                                                 mw_binary_body_ieee1609dot2_data(
                                                                                                                                                  mw_authorizationRequestMessage(
                                                                                                                                                                                 mw_encryptedData(
                                                                                                                                                                                                  { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_aaHashedId8)), * },
                                                                                                                                                                                                  mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                 )))))),
                                                v_request
                                                ) {
              var HttpMessage v_response;
              var integer v_result;
              var InnerAtRequest v_inner_at_request;
              var InnerAtResponse v_inner_at_response;

              tc_ac.stop;

              // Verify IUT response
              f_verify_http_at_request_from_iut_itss(v_request.request, v_headers, v_ec_cert, v_inner_at_request, v_inner_at_response, v_response, v_result);
              log("f_TC_SECPKI_ITSS_AUTH_01_BV_pki: v_result: ", v_result);
              log("f_TC_SECPKI_ITSS_AUTH_01_BV_pki: v_response: ", v_response);
              // Send response
              if (isvalue(v_response)) {
                httpPort.send(v_response);
              }
              // Set verdict
              if (v_result == 0) {
                var octetstring v_msg;
                var octetstring v_hashed_id8;

                log("*** " & testcasename() & ": PASS: InnerAtResponse received ***");
                v_msg := bit2oct(encvalue(v_inner_at_response.certificate));
                if (ischosen(v_inner_at_response.certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaBrainpoolP384r1)) {
                  v_hashed_id8 := f_hashedId8FromSha384(f_hashWithSha384(v_msg));
                } else {
                  v_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256(v_msg));
                }
                infoPort.send(InfoPortData : { hashed_id8 := v_hashed_id8, at_certificate := v_inner_at_response.certificate });
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Failed to verify EA an EnrolmentRequestMessage ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
              }
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_01_BV_pki

      } // End of group f_TC_SECPKI_ITSS_AUTH_01_BV

      /**
       * @desc Check that the AuthorizationRequest message is encrypted and sent to only one Authorization Authority.
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT being in the "operational state"
       *             authorized with CERT_AA certificate
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to requested a new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                 containing content.encryptedData.recipients
       *                     indicating size 1
       *                     and containing the instance of RecipientInfo
       *                         containing certRecipInfo
       *                             containing recipientId
       *                                 indicating HashedId8 of the CERT_AA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_02_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_02_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_02_BV_pki());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_02_BV

      group f_TC_SECPKI_ITSS_AUTH_02_BV {

        function f_TC_SECPKI_ITSS_AUTH_02_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {

          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          var SECPKI_ITSS_TestData v_data;
          f_TC_SECPKI_ITSS_AUTH_pki(
                  v_data, -, -, -, -, -,
                  mw_http_request(
                                  mw_http_request_post(
                                                      PICS_HTTP_POST_URI_AT,
                                                      -,
                                                      mw_http_message_body_binary(
                                                                                    mw_binary_body_ieee1609dot2_data(
                                                                                                                    mw_authorizationRequestMessage(
                                                                                                                                                    mw_encryptedData(
                                                                                                                                                                    { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_aaHashedId8)), * },
                                                                                                                                                                    ?
                                                                                                                                                                    )))))),
                  ok
          );

          // Postamble
          f_cfHttpDown();
        } // end of function f_TC_SECPKI_ITSS_AUTH_02_BV_pki
      } // end of group f_TC_SECPKI_ITSS_AUTH_02_BV

      /**
       * @desc Check that the AuthorizationRequest message is encrypted using the encryptionKey found in the AA certificate referenced in recipientId.
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the AA being in the "operational state"
       *             authorized with AA certificate
       *                 containing encryptionKey (AA_ENC_PUB_KEY)
       *         and the IUT being in the "enrolled" state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to requested a new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                 containing content.encryptedData
       *                     containing ciphertext
       *                         containing data
       *                             encrypted using AA_ENC_PUB_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_03_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_03_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_03_BV_pki_check_encryptedData),
                                                    refers(f_TC_SECPKI_ITSS_AUTH_03_BV_pki_check_signedData)));
        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_03_BV
      
      group f_TC_SECPKI_ITSS_AUTH_03_BV {

        function f_TC_SECPKI_ITSS_AUTH_03_BV_pki_check_encryptedData (inout SECPKI_ITSS_TestData p_data, in Ieee1609Dot2Data p_value) runs on ItsPkiHttp return boolean {
          var template (present) EtsiTs103097Data mw :=
                m_etsiTs103097Data_encrypted(
                                             mw_encryptedData(
                                                              {
                                                                [0] := mw_recipientInfo_certRecipInfo(
                                                                                                      mw_pKRecipientInfo(
                                                                                                                          vc_aaHashedId8
                                                                                                      )
                                                                )
                                                              }
                                             )
                );
/*
                                Ieee1609Dot2Data :  {
                                                      protocolVersion := ?,
                                                      content := {
                                                                  encryptedData := {
                                                                                    recipients := {
                                                                                                  [0] := {
                                                                                                          certRecipInfo := {
                                                                                                                            recipientId := vc_aaHashedId8,
                                                                                                                            encKey := ?
                                                                                                          }
                                                                                                  }
                                                                                    },
                                                                                    ciphertext := ?
                                                                  }
                                                      }
                                };
*/                                
          if(not match (p_value, mw)){
            log("*** " & testcasename() & ": FAIL: Not an encrypted message or wrong encryption target used (not an AA digest) ***");
            log(match(p_value, mw));
            return false;
          }
          return true;
        } // end of function f_TC_SECPKI_ITSS_AUTH_03_BV_pki_check_encryptedData
        function f_TC_SECPKI_ITSS_AUTH_03_BV_pki_check_signedData ( inout SECPKI_ITSS_TestData p_data, in Ieee1609Dot2Data p_value) runs on ItsPkiHttp return boolean {
          // need for this function to check an actual decryption
          return true;
        }
      } // end of group f_TC_SECPKI_ITSS_AUTH_03_BV

      /**
       * @desc Check that the AuthorizationRequest message is never reused the same encryption key and nonce.
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to requested a new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                 containing content.encryptedData
       *                     containing ciphertext.aes128Ccm.nonce
       *                         indicating value not equal to the nonce in N previous messages
       *                 and containing recipients[0].certRecipInfo.encKey
       *                     containing encrypted symmetric key (S_KEY)
       *                         indicating symmetric key not equal to the key was used in N previous messages
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_04_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_04_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;
        var SECPKI_ITSS_TestData v_data := SECPKI_ITSS_TestData_init_value;
        v_data.anyData.tc04 := {{},{}};

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss(PX_RE_AUTHORIZATION_COUNTER));
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(v_data,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_04_BV_pki_check_encryptedData),
                                                    refers(f_TC_SECPKI_ITSS_AUTH_04_BV_pki_check_signedData),
                                                    null,
                                                    PX_RE_AUTHORIZATION_COUNTER
        ));

        // Synchronization
        f_serverSyncClientsTimed (2, c_prDone, PX_TSYNC_TIME_LIMIT );

        for (var integer v_i := 1; v_i < PX_RE_AUTHORIZATION_COUNTER; v_i := v_i + 1) {
          f_serverSyncClientsTimed (2, c_nextTry, PX_TSYNC_TIME_LIMIT );
        }
        
        f_serverSyncClientsTimed (2, c_tbDone, PX_TSYNC_TIME_LIMIT );
        f_serverWaitForAllClientsToStop();

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_04_BV

      group f_TC_SECPKI_ITSS_AUTH_04_BV {

        function f_TC_SECPKI_ITSS_AUTH_04_BV_pki_check_encryptedData (inout SECPKI_ITSS_TestData p_data,  in Ieee1609Dot2Data p_value) runs on ItsPkiHttp return boolean {
          if( not isbound (p_value.content.encryptedData.ciphertext.aes128ccm.nonce)){
            log("*** " & testcasename() & ": FAIL: At step " & int2str(p_data.counter) &": nonce not found in a message ***");
            return false;
          }
          var octetstring v_nonce := p_value.content.encryptedData.ciphertext.aes128ccm.nonce;
          if (isbound(p_data.anyData.tc04.nonces) and match(p_data.anyData.tc04.nonces, superset(v_nonce))) {
            log("*** " & testcasename() & ": FAIL: At step " & int2str(p_data.counter) & " duplicate nonce found ***");
            log("    nonce is: ", v_nonce);
            return false;
          }
          log("*** " & testcasename() & ": LOG: At step " & int2str(p_data.counter) &" nonces are unique ***");
          p_data.anyData.tc04.nonces[p_data.counter] := v_nonce;
          return true;
        }

        function f_TC_SECPKI_ITSS_AUTH_04_BV_pki_check_signedData (inout SECPKI_ITSS_TestData p_data,  in Ieee1609Dot2Data p_value) runs on ItsPkiHttp return boolean {
          if (isbound(p_data.anyData.tc04.symmKeys) and match(p_data.anyData.tc04.symmKeys, superset(p_data.aesKey))) {
            log("*** " & testcasename() & ": FAIL: At step " & int2str(p_data.counter) &": duplicate symmetric encryption keys found ***");
            log("    key is: ", p_data.aesKey);
            return false;
          }
          log("*** " & testcasename() & ": LOG: At step " & int2str(p_data.counter) &": symmetric encryption keys are unique ***");
          p_data.anyData.tc04.symmKeys[p_data.counter] := p_data.aesKey;

          return true;
        }
      } // End of group f_TC_SECPKI_ITSS_AUTH_04_BV

      /**
       * @desc Check that the Authozation request protocol version is set to 1.
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to requested a new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                 containing version
       *                     indicating value 1
       *                 and containing content
       *                     containing autihorizationRequest
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_05_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_05_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_ea);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_ea.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_05_BV_pki_check_authRequest)));

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_ea);

      } // End of testcase TC_SECPKI_ITSS_AUTH_05_BV

      group f_TC_SECPKI_ITSS_AUTH_05_BV {

        function f_TC_SECPKI_ITSS_AUTH_05_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          if(not match (p_value, mw_etsiTs102941Data_authorization_request)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid message received ***");
            return false;
          }
          return true;
        }
      } // End of group f_TC_SECPKI_ITSS_AUTH_05_BV_pki

      /**
       * @desc Check that for each authorization request the ITS-S generates a new verification key pair
       *       Check that for each authorization request the ITS-S generates a new encryption key pair
       *       Check that for each authorization request the ITS-S generates a new hmac-key
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
	     *	            containing EtsiTs102941Data
	     *		            containing authorizationRequest
	     *			            containing publicKeys
       *                    containing verificationKey
	     *					            indicating value not equal to the field verificationKey of N previous messages
	     *				            and not containing encryptionKey
	     *				            or containing encryptionKey
	     *					            indicating value not equal to the field encryptionKey of N previous messages
	     *			            and containing hmacKey
	     *				            indicating value not equal to the field hmacKey of N previous messages
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_06_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_06_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;
        var SECPKI_ITSS_TestData v_data := SECPKI_ITSS_TestData_init_value;
        v_data.anyData.tc06 := {{},{},{}};

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss(PX_RE_AUTHORIZATION_COUNTER));
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(v_data, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_05_BV_pki_check_authRequest),
                                                    PX_RE_AUTHORIZATION_COUNTER
        ));

        // Synchronization
        f_serverSyncClientsTimed ( 2, c_prDone, PX_TSYNC_TIME_LIMIT );

        for (var integer v_i := 1; v_i < PX_RE_AUTHORIZATION_COUNTER; v_i := v_i + 1) {
          f_serverSyncClientsTimed ( 2, c_nextTry, PX_TSYNC_TIME_LIMIT );
        }
        
        f_serverSyncClientsTimed ( 2, c_tbDone, PX_TSYNC_TIME_LIMIT );
        f_serverWaitForAllClientsToStop();

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_06_BV

      group f_TC_SECPKI_ITSS_AUTH_06_BV {

        function f_TC_SECPKI_ITSS_AUTH_06_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          if (not isvalue(p_value.content.authorizationRequest)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid message received ***");
            return false;
          }
          if (isbound(p_data.anyData.tc06.vKeys) and match(p_data.anyData.tc06.vKeys, superset(p_value.content.authorizationRequest.publicKeys.verificationKey))) {
            log("*** " & testcasename() & "_pki: FAIL: At step " & int2str(p_data.counter) & " duplicate verification key found ***");
            return false;
          }
          log("*** " & testcasename() & "_pki: LOG: At step " & int2str(p_data.counter) &" verification keys are unique ***");
          p_data.anyData.tc06.vKeys[p_data.counter] := p_value.content.authorizationRequest.publicKeys.verificationKey;

          if( ispresent (p_value.content.authorizationRequest.publicKeys.encryptionKey)){
            if (isbound(p_data.anyData.tc06.eKeys) and match(p_data.anyData.tc06.eKeys, superset(p_value.content.authorizationRequest.publicKeys.encryptionKey.publicKey))) {
              log("*** " & testcasename() & "_pki: FAIL: At step " & int2str(p_data.counter) & " duplicate encryption key found ***");
              return false;
            }
            log("*** " & testcasename() & "_pki: LOG: At step " & int2str(p_data.counter) &" encryption keys are unique ***");
            p_data.anyData.tc06.eKeys[p_data.counter] := p_value.content.authorizationRequest.publicKeys.encryptionKey.publicKey;
          }

          if (isbound(p_data.anyData.tc06.hmacKeys) and match(p_data.anyData.tc06.hmacKeys, superset(p_value.content.authorizationRequest.hmacKey))) {
            log("*** " & testcasename() & "_pki: FAIL: At step " & int2str(p_data.counter) & " duplicate HMAC key found ***");
            return false;
          }
          log("*** " & testcasename() & "_pki: LOG: At step " & int2str(p_data.counter) &" HMAC keys are unique ***");
          p_data.anyData.tc06.hmacKeys[p_data.counter] := p_value.content.authorizationRequest.hmacKey;

          return true;
        }
      } // End of group f_TC_SECPKI_ITSS_AUTH_06_BV

      /**
       * @desc Check that ITS-S sends Authorization request with a keyTag field computed as described in ETSI TS 102 941 [1], clause 6.2.3.3.1
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         the IUT being in the "operational state"
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request a new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
       *	            containing EtsiTs102941Data
       *		            containing authorizationRequest
       *			            containing sharedAtRequest
       *                    containing keyTag
       *					            indicating properly calculated value
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_07_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_07_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_ea);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_ea.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_07_BV_pki_check_authRequest))
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_ea);

      } // End of testcase TC_SECPKI_ITSS_AUTH_07_BV

      group f_TC_SECPKI_ITSS_AUTH_07_BV {

        function f_TC_SECPKI_ITSS_AUTH_07_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          // calculate keyTag
          
          var octetstring v_encoded_tag;
          var octetstring v_key_tag;

          v_encoded_tag := bit2oct(encvalue(p_value.content.authorizationRequest.publicKeys.verificationKey));
          if (ispresent(p_value.content.authorizationRequest.publicKeys.encryptionKey)) {
            v_encoded_tag := v_encoded_tag & bit2oct(encvalue(p_value.content.authorizationRequest.publicKeys.encryptionKey));
          }
          v_key_tag := substr(
                            fx_hmac_sha256( // TODO Rename and use a wrapper function
                                            p_value.content.authorizationRequest.hmacKey,
                                            v_encoded_tag
                                            ),
                            0,
                            16); // Leftmost 128 bits of the HMAC-SHA256 tag computed previously

          var template (present) EtsiTs102941Data mw := 
                        mw_etsiTs102941Data_authorization_request(
                                                                  mw_innerAtRequest(
                                                                                    -,
                                                                                    -,
                                                                                    mw_shared_at_request(
                                                                                                          -,
                                                                                                          v_key_tag,
                                                                                                          -
                                                                                    ),
                                                                                    -
                                                                  )
                        );
          if(not match (p_value, mw)){
            log("*** " & testcasename() & "_pki: FAIL: Wrong keyTag value ***");
            log(match (p_value, mw));
            return false;
          }
          return true;
        }
/*
        function f_TC_SECPKI_ITSS_AUTH_07_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {
          // Test component configuration
          var SECPKI_ITSS_TestData v_data;
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);
          f_TC_SECPKI_ITSS_AUTH_pki(v_data, null, null,
                                    refers(f_TC_SECPKI_ITSS_AUTH_07_BV_pki_check_authRequest));
          f_cfHttpDown();
        }
*/        
      } // End of group f_TC_SECPKI_ITSS_AUTH_07_BV_pki

      /**
       * @desc Check that ITS-S sends Authorization request with eaId of EA certificate
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT is enrolled by the EC, signed with the CERT_EA certificate
       *         the IUT being in the "operational" state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
       *	                containing EtsiTs102941Data
       *		                 containing authorizationRequest
       *			                  containing sharedAtRequest
       *                          containing eaId
       *					                  indicating HashedId8 of CERT_EA certificate
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_08_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_08_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss()); // force enrolment
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_08_BV_pki_check_authRequest))
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_08_BV

      group f_TC_SECPKI_ITSS_AUTH_08_BV {
        
        function f_TC_SECPKI_ITSS_AUTH_08_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          var template (present) EtsiTs102941Data mw := 
                        mw_etsiTs102941Data_authorization_request(
                                                                  mw_innerAtRequest(
                                                                                    -,
                                                                                    -,
                                                                                    mw_shared_at_request(vc_eaHashedId8)
                                                                  )
                        );
          if(not match (p_value, mw)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid message received ***");
            log(match(p_value, mw));
            return false;
          }
          return true;
        }
/*
        function f_TC_SECPKI_ITSS_AUTH_08_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {

          // Test component configuration
          var SECPKI_ITSS_TestData v_data;
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);
          f_TC_SECPKI_ITSS_AUTH_pki(v_data, null, null,
                                    refers(f_TC_SECPKI_ITSS_AUTH_08_BV_pki_check_authRequest));
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_08_BV_pki
*/
      } // End of group f_TC_SECPKI_ITSS_AUTH_08_BV  

      /**
       * @desc Check that ITS-S sends Authorization request with the certificateFormat equal to 1
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
       *	                containing EtsiTs102941Data
       *		                 containing authorizationRequest
       *			                  containing sharedAtRequest
       *                          containing certificateFormat
       *					                     indicating 1
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_09_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_09_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_09_BV_pki_check_authRequest))
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_09_BV

      group f_TC_SECPKI_ITSS_AUTH_09_BV {

        function f_TC_SECPKI_ITSS_AUTH_09_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          if(not match (p_value, mw_etsiTs102941Data_authorization_request)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid message received ***");
            log(match(p_value, mw_etsiTs102941Data_authorization_request));
            return false;
          }
          return true;
        }
      } // End of group f_TC_SECPKI_ITSS_AUTH_09_BV  

      /**
       * @desc Check that ITS-S sends Authorization request certificate attributes are properly set
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
       *	              containing EtsiTs102941Data
       *		               containing authorizationRequest
       *			                containing sharedAtRequest
       *                          containing requestedSubjectAttributes
       *					                   containing appPermissions
       *                             and not containing certIssuePermissions
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_10_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_10_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_10_BV_pki_check_authRequest))
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_08_BV

      group f_TC_SECPKI_ITSS_AUTH_10_BV {

        function f_TC_SECPKI_ITSS_AUTH_10_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var template (present) EtsiTs102941Data mw := 
                        mw_etsiTs102941Data_authorization_request(
                                                                  mw_innerAtRequest( -, -,
                                                                                    mw_shared_at_request( -, -, 
                                                                                                          mw_certificate_subject_attributes
                                                                                    )
                                                                  )
                        );
  
          if(not match (p_value, mw)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid message received ***");
            log(match (p_value, mw));
            return false;
          }
          return true;
        }
/*
        function f_TC_SECPKI_ITSS_AUTH_10_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {

          // Test component configuration
          var SECPKI_ITSS_TestData v_data;
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);
          f_TC_SECPKI_ITSS_AUTH_pki(v_data, null, null,
                                    refers(f_TC_SECPKI_ITSS_AUTH_10_BV_pki_check_authRequest));
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_10_BV_pki
*/
      } // End of group f_TC_SECPKI_ITSS_AUTH_10_BV  

      /**
       * @desc Check that ITS-S sends Authorization request containing EC signature calculated over the
       *       sharedATRequest using supported hash algorithm
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {