ItsPkiItss_TestCases.ttcn

       *             the IUT sends a EtsiTs103097Data to the AA
       *	                containing EtsiTs102941Data
       *		                 containing authorizationRequest
       *			                  containing ecSignature
       *                           containing structure of type EtsiTs103097Data-SignedExternalPayload
       *                               containing tbsData
       *                                  containing payload
       *                                     containing extDataHash
       *                                        indicating supported hash algorithm 
			 *                                        and indicating hash of sharedATRequest
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_11_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
       testcase TC_SECPKI_ITSS_AUTH_11_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_11_BV_pki_check_authRequest)));

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_11_BV
      
      group f_TC_SECPKI_ITSS_AUTH_11_BV {
   
        function f_TC_SECPKI_ITSS_AUTH_11_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var EtsiTs103097Data v_ecSignature;
          var octetstring      v_aes_enc_key;

          if(ischosen(p_value.content.authorizationRequest.ecSignature.encryptedEcSignature)){
            // contains encrypted signature
            if( not f_decrypt(vc_eaPrivateEncKey, // EA private encryption key
                              p_value.content.authorizationRequest.ecSignature.encryptedEcSignature,
                               vc_eaWholeHash, // salt
                               v_ecSignature, // decrypted message
                               v_aes_enc_key)) {
              return false;
            }
          } else {
            v_ecSignature := p_value.content.authorizationRequest.ecSignature.ecSignature;
          }
          
          var template (present) EtsiTs103097Data mw := 
                        mw_etsiTs103097Data_signed(
                                                   mw_signedData( -,
                                                                  mw_toBeSignedData(
                                                                                    mw_signedDataPayload_ext(mw_etsiTs103097SupportedAlgHashedData)
                                                                  )
                                                   )
                        );

          if(not match (v_ecSignature, mw)){
            log("*** " & testcasename() & "_pki: FAIL: Wrong ecSignature format ***");
            log(match(v_ecSignature, mw));
            return false;
          }
          var HashedData v_extDataHash := v_ecSignature.content.signedData.tbsData.payload.extDataHash;

          // check that the hash is calculated well
          var template (value) HashedData mw_hashedData;

          if(ischosen(v_extDataHash.sha256HashedData)){
            mw_hashedData.sha256HashedData := f_hashWithSha256(bit2oct(encvalue(p_value.content.authorizationRequest.sharedAtRequest)));
          }else if(ischosen(v_extDataHash.sha384HashedData)){
            mw_hashedData.sha384HashedData := f_hashWithSha384(bit2oct(encvalue(p_value.content.authorizationRequest.sharedAtRequest)));
          }else{
            return false;
          }
          if( not match(v_extDataHash, mw_hashedData)){
            log("*** " & testcasename() & "_pki: FAIL: SharedAtRequest hash mismatch ***");
            log(match(v_extDataHash, mw_hashedData));
            return false;
          }
          
          return true;
        }
/*
        function f_TC_SECPKI_ITSS_AUTH_11_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {

          // Test component configuration
          var SECPKI_ITSS_TestData v_data;
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);
          f_TC_SECPKI_ITSS_AUTH_pki(v_data, null, null,
                                    refers(f_TC_SECPKI_ITSS_AUTH_11_BV_pki_check_authRequest));
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_10_BV_pki
*/
      } // End of group f_TC_SECPKI_ITSS_AUTH_11_BV 

      /**
       * @desc Check that the ecSignature psid is set to the proper ITS_AID
       *       Check that the ecSignature generation time is present
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
       *	                containing EtsiTs102941Data
       *		                 containing authorizationRequest
       *			                  containing ecSignature
       *                            containing structure of type EtsiTs103097Data-SignedExternalPayload
       *                                containing tbsData
       *                                    containing headerInfo
       *                                        containing psid
       *                                            indicating AID_PKI_CERT_REQUEST
       *                                         and containing generationTime
       *					                               and not containing any other headers
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_12_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_12_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_12_BV_pki_check_authRequest))
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);

      } // End of testcase TC_SECPKI_ITSS_AUTH_11_BV
      
      group f_TC_SECPKI_ITSS_AUTH_12_BV {

        function f_TC_SECPKI_ITSS_AUTH_12_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var EtsiTs103097Data v_ecSignature;
          var octetstring      v_aes_enc_key;

          if(ischosen(p_value.content.authorizationRequest.ecSignature.encryptedEcSignature)){
            // contains encrypted signature
            if( not f_decrypt(vc_eaPrivateEncKey, // EA private encryption key
                              p_value.content.authorizationRequest.ecSignature.encryptedEcSignature,
                               vc_eaWholeHash, // salt
                               v_ecSignature, // decrypted message
                               v_aes_enc_key)) {
              return false;
            }
          } else {
            v_ecSignature := p_value.content.authorizationRequest.ecSignature.ecSignature;
          }
          var template (present) EtsiTs103097Data mw := 
                        mw_etsiTs103097Data_signed(
                                                   mw_signedData( -,
                                                                  mw_toBeSignedData( -,
                                                                                     mw_headerInfo_ecSignature
                                                                  )
                                                   )
                        );
          if(not match (v_ecSignature, mw)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid header info in ecSignature received ***");
            log(match (v_ecSignature, mw));
            return false;
          }
          return true;
        }
/*
        function f_TC_SECPKI_ITSS_AUTH_12_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {

          // Test component configuration
          var SECPKI_ITSS_TestData v_data;
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);
          f_TC_SECPKI_ITSS_AUTH_pki(v_data, null, null,
                                    refers(f_TC_SECPKI_ITSS_AUTH_12_BV_pki_check_authRequest));
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_10_BV_pki
*/
      } // End of group f_TC_SECPKI_ITSS_AUTH_11_BV 

      /**
       * @desc Check that ITS-S sends Authorization request containing EC signature
       *        with supported hash algorithm
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends a EtsiTs103097Data to the AA
       *	                containing EtsiTs102941Data
       *		                 containing authorizationRequest
       *			                  containing ecSignature
       *                           containing structure of type EtsiTs103097Data-SignedExternalPayload
       *                              containing hashId
       *                                 indicating supported hash algorithm
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_13_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */

       testcase TC_SECPKI_ITSS_AUTH_13_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_ea);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_ea.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null, refers(f_TC_SECPKI_ITSS_AUTH_13_BV_pki_check_authRequest)));

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_ea);

      } // End of testcase TC_SECPKI_ITSS_AUTH_13_BV

      group f_TC_SECPKI_ITSS_AUTH_13_BV {
        function f_TC_SECPKI_ITSS_AUTH_13_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var EtsiTs103097Data v_ecSignature;
          var octetstring      v_aes_enc_key;

          if(ischosen(p_value.content.authorizationRequest.ecSignature.encryptedEcSignature)){
            // contains encrypted signature
            if( not f_decrypt(vc_eaPrivateEncKey, // EA private encryption key
                              p_value.content.authorizationRequest.ecSignature.encryptedEcSignature,
                               vc_eaWholeHash, // salt
                               v_ecSignature, // decrypted message
                               v_aes_enc_key)) {
              return false;
            }
          } else {
            v_ecSignature := p_value.content.authorizationRequest.ecSignature.ecSignature;
          }

          var template (present) EtsiTs103097Data mw := mw_etsiTs103097Data_signed( mw_signedData( mw_validEtsiTs103097HashAlgorithm) );

          if(not match (v_ecSignature, mw)) {
            log("*** " & testcasename() & "_pki: FAIL: Unsupported ecSignature hash algorithm ***");
            log(match (v_ecSignature, mw));
            return false;
          }
          return true;
        }
/*
        function f_TC_SECPKI_ITSS_AUTH_13_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {

          // Test component configuration
          var SECPKI_ITSS_TestData v_data;
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);
          f_TC_SECPKI_ITSS_AUTH_pki(v_data, null, null,
                                    refers(f_TC_SECPKI_ITSS_AUTH_13_BV_pki_check_authRequest));
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_10_BV_pki
*/
      } // End of group f_TC_SECPKI_ITSS_AUTH_11_BV 

      /**
       * @desc Check that the ecSignature of the Authorization request is signed with EC certificate
       *        Check that the signature over tbsData computed using the private key corresponding to
       *        the EC's verification public key.
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION
       * Initial conditions: 
       *     with {
       *         the IUT is enrolled with CERT_EC certificate
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                containing EtsiTs102941Data
       *                  containing authorizationRequest
       *                    containing ecSignature
       *                      containing structure of type EtsiTs103097Data-SignedExternalPayload
       *                        containing signer
       *                          indicating HashedId8 of the CERT_EC certificate
       *                        containing signature
       *                          indicating signature over sharedATRequest calculated with CERT_EC verificationKey 
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_14_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_14_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss(1, true)); // force enrollment
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_14_BV_pki_check_authRequest),
                                                    -, true // force enrollment
                                                    )
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);
      }  // End of testcase TC_SECPKI_ITSS_AUTH_14_BV

      group f_TC_SECPKI_ITSS_AUTH_14_BV {
        function f_TC_SECPKI_ITSS_AUTH_14_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var EtsiTs103097Data v_ecSignature;
          var octetstring      v_aes_enc_key;

          if(ischosen(p_value.content.authorizationRequest.ecSignature.encryptedEcSignature)){
            // contains encrypted signature
            if( not f_decrypt(vc_eaPrivateEncKey, // EA private encryption key
                              p_value.content.authorizationRequest.ecSignature.encryptedEcSignature,
                               vc_eaWholeHash, // salt
                               v_ecSignature, // decrypted message
                               v_aes_enc_key)) {
              return false;
            }
          } else {
            v_ecSignature := p_value.content.authorizationRequest.ecSignature.ecSignature;
          }
          var template (present) EtsiTs103097Data mw := mw_etsiTs103097Data_signed(
                                                                                    mw_signedData(-, -, 
                                                                                                  mw_signerIdentifier_digest( (all from(vc_ec_hashed_id8)) )
                                                                                  )
                                                        );
          if(not match (v_ecSignature, mw)){
            log("*** " & testcasename() & "_pki: FAIL: EC digest mismatch.***");
            log(match (v_ecSignature, mw));
            return false;
          }

          // check signature
          for(var integer v_i := 0; v_i < vc_ec_counter; v_i := v_i + 1){
            if(vc_ec_hashed_id8[v_i] == v_ecSignature.content.signedData.signer.digest){
              var EtsiTs103097Certificate v_ec_cert := vc_ec_certificates[v_i];
              if(not f_verifySignedMessageECDSA(v_ecSignature, vc_ec_certificates[v_i])){
                log("*** " & testcasename() & "_pki: FAIL: EC signature verification failed.***");
                return false;
              }
              break;
            }
          }
          return true;
        }

      } // End of group f_TC_SECPKI_ITSS_AUTH_14_BV

      /**
       * @desc Check that the encrypted ecSignature of the Authorization request is encrypted using the EA encryptionKey
       *        Check that the encrypted ecSignature of the Authorization request was done from the 
       *          EtsiTs103097Data-SignedExternalPayload structure
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE, PICS_SECPKI_AUTHORIZATION and PICS_SECPKI_AUTH_PRIVACY
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *         and the EA in 'operational' state
       *         authorized with CERT_EA certificate
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                containing EtsiTs102941Data
       *                  containing authorizationRequest
       *                    containing ecSignature
       *                      containing encryptedEcSignature
       *                        containing recipients
       *                        containing only one element of type RecipientInfo
       *                          containing certRecipInfo
       *                            containing recipientId
       *                              indicating HashedId8 of the CERT_EA
       *                            and containing encKey
       *                              indicating encryption key of supported type
       *                       and containing cyphertext
       *                        containing encrypted representation of structure EtsiTs103097Data-SignedExternalPayload
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_15_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_15_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION or not PICS_SECPKI_AUTH_PRIVACY) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE, PICS_SECPKI_AUTHORIZATION are required for executing the TC ***");
          setverdict(inconc);
          stop;
        }
        if (not PICS_SECPKI_AUTH_PRIVACY) {
          log("*** " & testcasename() & ": PICS_SECPKI_AUTH_PRIVACY is required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_15_BV_pki_check_authRequest)
                                                   )
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);
      }

      group f_TC_SECPKI_ITSS_AUTH_15_BV {

        function f_TC_SECPKI_ITSS_AUTH_15_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var EtsiTs103097Data v_ecSignature;
          var octetstring      v_aes_enc_key;

          template (present) EcSignature mw1 := 
              mw_ec_signature ( // strange, but this is a signature with privace template
                                mw_etsiTs103097Data_encrypted(
                                                              mw_encryptedData(
                                                                                { 
                                                                                  mw_recipientInfo_certRecipInfo( 
                                                                                                                  mw_pKRecipientInfo(vc_eaHashedId8)
                                                                                  )
                                                                                },
                                                                                mw_symmetricCiphertext_aes128ccm
                                                              )
                                )
              );
          if(not match(p_value.content.authorizationRequest.ecSignature, mw1)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid EC signature with mandatory privacy.***");
            log(match(p_value.content.authorizationRequest.ecSignature, mw1));
            return false;
          }

          if( not f_decrypt(vc_eaPrivateEncKey, // EA private encryption key
                            p_value.content.authorizationRequest.ecSignature.encryptedEcSignature,
                            vc_eaWholeHash, // salt
                            v_ecSignature, // decrypted message
                            v_aes_enc_key)) {
            return false;
          }

          var template (present) EtsiTs103097Data mw2 := 
                        mw_etsiTs103097Data_signed(
                                                   mw_signedData( -,
                                                                  mw_toBeSignedData(
                                                                                    mw_signedDataPayload_ext(mw_etsiTs103097SupportedAlgHashedData)
                                                                  )
                                                   )
                        );
          if(not match (v_ecSignature, mw2)){
            log("*** " & testcasename() & "_pki: FAIL: Wrong ecSignature format ***");
            log(match(v_ecSignature, mw2));
            return false;
          }
          return true;
        }

      } // End of group f_TC_SECPKI_ITSS_AUTH_15_BV

      /**
       * @desc Check that the ecSignature of the Authorization request is not encrypted
       * <pre>
       * Pics Selection: PICS_IUT_ITS_S_ROLE, PICS_SECPKI_AUTHORIZATION and not PICS_SECPKI_AUTH_PRIVACY
       * Initial conditions: 
       *     with {
       *         the IUT in 'enrolled' state
       *         and the AA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to request new Authorization Ticket (AT)
       *         }
       *         then {
       *             the IUT sends EtsiTs103097Data to the AA
       *                containing EtsiTs102941Data
       *                  containing authorizationRequest
       *                    containing ecSignature
       *                      containing ecSignature
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_ITSS_AUTH_16_BV
       * @reference ETSI TS 102 941 [2], clause 6.2.3.3.1
       */
      testcase TC_SECPKI_ITSS_AUTH_16_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_aa;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }
        if (PICS_SECPKI_AUTH_PRIVACY) {
          log("*** " & testcasename() & ": PICS_SECPKI_AUTH_PRIVACY should not be set for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_aa);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_itss());
        v_aa.start(f_TC_SECPKI_ITSS_AUTH_pki_simple(-, null, null,
                                                    refers(f_TC_SECPKI_ITSS_AUTH_16_BV_pki_check_authRequest)
                                                   )
        );

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_aa);
      }  // End of testcase TC_SECPKI_ITSS_AUTH_16_BV

      group f_TC_SECPKI_ITSS_AUTH_16_BV {

        function f_TC_SECPKI_ITSS_AUTH_16_BV_pki_check_authRequest (inout SECPKI_ITSS_TestData p_data, in EtsiTs102941Data p_value) runs on ItsPkiHttp return boolean {
          
          var EtsiTs103097Data v_ecSignature;
          var octetstring      v_aes_enc_key;

          template (present) EcSignature mw := 
              mw_ec_signature_ext_payload ( 
                                          mw_etsiTs103097Data_signed(
                                                                    mw_signedData( -,
                                                                                    mw_toBeSignedData(
                                                                                                      mw_signedDataPayload_ext(mw_etsiTs103097SupportedAlgHashedData)
                                                                                    )
                                                                    )
                                          )
          );
          if(not match(p_value.content.authorizationRequest.ecSignature, mw)){
            log("*** " & testcasename() & "_pki: FAIL: Invalid EC signature in no-privacy mode.***");
            log(match(p_value.content.authorizationRequest.ecSignature, mw));
            return false;
          }
          return true;
        }

      } // End of group f_TC_SECPKI_ITSS_AUTH_16_BV

    } // End of group itss_authorization_request

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.2.3.2  Authorization response handling
    group itss_authorization_response {
      // Void
    } // End of group itss_authorization_response

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.2.3.3  Authorization request repetition
    group itss_authorization_request_repetition {

      /**
       * @desc Check that IUT repeats an authorization request when response has not been received
       * <pre>
       * Pics Selection: PICS_SECPKI_AUTHORIZATION_RETRY
       * Initial conditions: {
       *     the IUT being in the 'enrolled' state
       *     and the IUT already sent the Authorization Request at the time T1
       *     and the IUT has not yet received the Authorization Response
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT local time is reached the T1 + PIXIT_AUTH_TIMEOUT_TH1 
       *         }
       *         then {
       *             the IUT sends to EA an AuthorizationRequestMessage
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP SECPKI_ITSS_AUTH_REP_01_BV
       * @reference ETSI TS 103 601, clause 5.2
       */
      testcase TC_SECPKI_ITSS_AUTH_REP_01_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION or not PICS_SECPKI_AUTHORIZATION_RETRY) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_ea);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_REP_01_BV_itss());
        v_ea.start(f_TC_SECPKI_ITSS_AUTH_REP_01_BV_pki());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_ea);

      } // End of testcase TC_SECPKI_ITSS_AUTH_REP_01_BV

      group f_TC_SECPKI_ITSS_AUTH_REP_01_BV {

        function f_TC_SECPKI_ITSS_AUTH_REP_01_BV_itss() runs on ItsPkiItss system ItsPkiItssSystem {
          // Local variables
          var HashedId8               v_certificate_digest;
          var EtsiTs103097Certificate v_certificate;
          var InfoPortData            v_info_port_data;
          var boolean                 v_start_awaiting := false;

          // Test component configuration
          vc_hashedId8ToBeUsed := PX_IUT_DEFAULT_CERTIFICATE;
          f_cfUp_itss();

          // Test adapter configuration

          // Preamble
          // Initial state: No CAM shall be emitted
          geoNetworkingPort.clear;
          tc_noac.start;
          alt {
            [] geoNetworkingPort.receive {
              log("No CA message expected");
              f_selfOrClientSyncAndVerdict(c_prDone, e_error);
            }
            [] tc_noac.timeout {
              f_sendUtTriggerEnrolmentRequestPrimitive();
              log("*** " & testcasename() & "_itss: : INFO: No CA message received ***");
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              }
            } // End of 'alt' statement

          // Test Body
          f_sendUtTriggerAuthorizationRequestPrimitive();
          tc_ac.start;
          alt {
            [v_start_awaiting == true] a_await_cam_with_current_cert(
                                                                     v_info_port_data.at_certificate
            ) {
              log("*** " & testcasename() & ": PASS: IUT started to send CA message using new AT certificate ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
            }
            [] geoNetworkingPort.receive { 
              log("*** " & testcasename() & ": FAIL: IUT started to send CA message using wrong AT certificate ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
            }
            [] infoPort.receive(InfoPortData:?) -> value v_info_port_data {
              log("*** " & testcasename() & ": INFO: Received new AT certificate ***");
              v_start_awaiting := true;
              repeat;
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & "_itss: : PASS: No CA message received ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfDown_itss();
        } // End of function f_TC_SECPKI_ITSS_AUTH_REP_01_BV_itss

        function f_TC_SECPKI_ITSS_AUTH_REP_01_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {
          // Local variable
          var Headers v_headers;
          var HttpMessage v_request;
          var InnerEcRequest v_inner_ec_request;
          var InnerEcResponse v_inner_ec_response;

          // Test component configuration
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_init_default_headers_list(-, "inner_at_response", v_headers);
          if (PX_TRIGGER_EC_BEFORE_AT) {
            f_await_ec_request_send_error_response(v_request);
            log("*** " & testcasename() & ": INFO: Reply with 400 Bad Request error message ***");
          }
          // Wait for the repetition
          if (PX_TRIGGER_EC_BEFORE_AT) {
            if (f_await_ec_request_send_response(v_inner_ec_request, v_inner_ec_response, v_request) == true) {
              log("*** " & testcasename() & ": INFO: Enrolment succeed ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            } else {
              log("*** " & testcasename() & ": INCONC: Enrolment failed ***");
              f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
            }
          } else {
            f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            v_inner_ec_response.certificate := omit;
          }

          // Test Body
          tc_ac.start;
          alt {
            [] a_await_at_http_response_from_iut(
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      PICS_HTTP_POST_URI_EC,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_enrolmentRequestMessage(
                                                                                                                                                                              mw_encryptedData(
                                                                                                                                                                                               { *, mw_recipientInfo_pskRecipInfo(vc_aaHashedId8), * },
                                                                                                                                                                                               mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                               )))))),
                                                 v_request
                                                 ) {
              var HttpMessage v_response;
              var integer v_result;
              var InnerAtRequest v_inner_at_request;
              var InnerAtResponse v_inner_at_response;

              tc_ac.stop;

              // Verify IUT response
              f_verify_http_at_request_from_iut_itss(v_request.request, v_headers, v_inner_ec_response.certificate, v_inner_at_request, v_inner_at_response, v_response, v_result);
              // Send response
              if (isvalue(v_response)) {
                httpPort.send(v_response);
              }
              // Set verdict
              if (v_result == 0) {
                var octetstring v_msg;
                var octetstring v_hashed_id8;

                log("*** " & testcasename() & ": PASS: InnerEcRequest received ***");
                v_msg := bit2oct(encvalue(v_inner_at_response.certificate));
                if (ischosen(v_inner_at_response.certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaBrainpoolP384r1)) {
                  v_hashed_id8 := f_hashedId8FromSha384(f_hashWithSha384(v_msg));
                } else {
                  v_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256(v_msg));
                }
                infoPort.send(InfoPortData : { hashed_id8 := v_hashed_id8, at_certificate := v_inner_at_response.certificate });
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Failed to verify EA an EnrolmentRequestMessage ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
              }
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown();
        } // End of function f_TC_SECPKI_ITSS_AUTH_REP_01_BV_pki

      } // End of group f_TC_SECPKI_ITSS_AUTH_REP_01_BV

      /**
       * @desc Check that IUT uses the same message to perform authorization retry
       * <pre>
       * Pics Selection: PICS_SECPKI_AUTHORIZATION_RETRY
       * Initial conditions: {
       *     the IUT being in the 'enrolled' state
       *     and the IUT already sent the Authorization Request at the time T1
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the IUT is triggered to re-send an AuthorizationRequestMessage to AA
       *         }
       *         then {
       *             the IUT sends M to AA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP SECPKI_ITSS_AUTH_REP_02_BV
       * @reference ETSI TS 103 601, clause 5.1.2
       */
      testcase TC_SECPKI_ITSS_AUTH_REP_02_BV() runs on ItsMtc system ItsPkiItssSystem {
        // Local variables
        var ItsPkiItss v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_ITS_S_ROLE or not PICS_SECPKI_AUTHORIZATION or not PICS_SECPKI_AUTHORIZATION_RETRY) {
          log("*** " & testcasename() & ": PICS_IUT_ITS_S_ROLE and PICS_SECPKI_AUTHORIZATION required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp01(v_itss, v_ea);

        // Start component
        v_itss.start(f_TC_SECPKI_ITSS_AUTH_REP_02_BV_itss());
        v_ea.start(f_TC_SECPKI_ITSS_AUTH_REP_02_BV_pki());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        // Cleanup
        f_cfMtcDown01(v_itss, v_ea);

      } // End of testcase TC_SECPKI_ITSS_AUTH_REP_02_BV

      group f_TC_SECPKI_ITSS_AUTH_REP_02_BV {

        function f_TC_SECPKI_ITSS_AUTH_REP_02_BV_itss() runs on ItsPkiItss system ItsPkiItssSystem {
          // Local variables
          var HashedId8               v_certificate_digest;
          var EtsiTs103097Certificate v_certificate;
          var InfoPortData            v_info_port_data;
          var boolean                 v_start_awaiting := false;

          // Test component configuration
          vc_hashedId8ToBeUsed := PX_IUT_DEFAULT_CERTIFICATE;
          f_cfUp_itss();

          // Test adapter configuration

          // Preamble
          // Initial state: No CAM shall be emitted
          geoNetworkingPort.clear;
          tc_noac.start;
          alt {
            [] geoNetworkingPort.receive {
              log("No CA message expected");
              f_selfOrClientSyncAndVerdict(c_prDone, e_error);
            }
            [] tc_noac.timeout {
              f_sendUtTriggerEnrolmentRequestPrimitive();
              log("*** " & testcasename() & "_itss: : INFO: No CA message received ***");
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              }
            } // End of 'alt' statement

          // Test Body
          f_sendUtTriggerAuthorizationRequestPrimitive();
          tc_ac.start;
          alt {
            [v_start_awaiting == true] a_await_cam_with_current_cert(
                                                                     v_info_port_data.at_certificate
            ) {
              log("*** " & testcasename() & ": PASS: IUT started to send CA message using new AT certificate ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
            }
            [] geoNetworkingPort.receive { 
              log("*** " & testcasename() & ": FAIL: IUT started to send CA message using wrong AT certificate ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
            }
            [] infoPort.receive(InfoPortData:?) -> value v_info_port_data {
              log("*** " & testcasename() & ": INFO: Received new AT certificate ***");
              v_start_awaiting := true;
              repeat;
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & "_itss: : PASS: No CA message received ***");
              f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfDown_itss();
        } // End of function f_TC_SECPKI_ITSS_AUTH_REP_02_BV_itss

        function f_TC_SECPKI_ITSS_AUTH_REP_02_BV_pki() runs on ItsPkiHttp system ItsPkiItssSystem {
          // Local variable
          var Headers v_headers;
          var HttpMessage v_initial_request;
          var HttpMessage v_request;
          var InnerEcRequest v_inner_ec_request;
          var InnerEcResponse v_inner_ec_response;

          // Test component configuration
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_init_default_headers_list(-, "inner_at_response", v_headers);
          if (PX_TRIGGER_EC_BEFORE_AT) {
            f_await_ec_request_send_error_response(v_initial_request);
            log("*** " & testcasename() & ": INFO: Reply with 400 Bad Request error message ***");
          }
          // Wait for the repetition
          if (PX_TRIGGER_EC_BEFORE_AT) {
            if (f_await_ec_request_send_response(v_inner_ec_request, v_inner_ec_response, v_request) == true) {
              log("*** " & testcasename() & ": INFO: Enrolment succeed ***");
              f_selfOrClientSyncAndVerdict(c_prDone, e_success);
            } else {
              log("*** " & testcasename() & ": INCONC: Enrolment failed ***");
              f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_timeout);
            }
          } else {
            f_selfOrClientSyncAndVerdict(c_prDone, e_success);
          }

          // Test Body
          if (f_verify_repeated_request(v_request, v_initial_request) == false) {
            log("*** " & testcasename() & ": FAIL: Repeatition request are different ***");