Newer
Older
log("f_generate_inner_at_request_with_wrong_parameters: Wrong encryption variant");
return false;
}
log("f_generate_inner_at_request_with_wrong_parameters: v_encrypted_data_encryption_key= ", v_encrypted_data_encryption_key);
v_recipientId := p_ea_hashed_id8; // RecipientId is the HashedId8 of the EA certificate
log("f_generate_inner_at_request_with_wrong_parameters: v_recipientId= ", v_recipientId);
// Fill Certificate template with the public compressed keys (canonical form)
p_inner_at_request.ecSignature := valueof(
m_ec_signature(
m_etsiTs103097Data_encrypted(
m_encryptedData(
{
m_recipientInfo_certRecipInfo(
m_pKRecipientInfo(
v_recipientId,
v_encrypted_data_encryption_key ))
},
m_symmetricCiphertext_aes128ccm(
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
m_aesCcmCiphertext(
v_nonce,
v_enc_signed_ec_signature
)
)
)
)
)
);
} else { // Skip the encryption, alowed to be re-identified by the AA
p_inner_at_request.ecSignature := valueof(m_ec_signature_ext_payload(v_signed_at_signature));
}
// Build the InnerAtRequest, EcSignature field is already set
if (ischosen(p_ec_certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaNistP256)) {
if (p_compressed_key_mode == 0) {
v_eccP256_curve_point := valueof(m_eccP256CurvePoint_compressed_y_0(v_public_key_x));
} else {
v_eccP256_curve_point := valueof(m_eccP256CurvePoint_compressed_y_1(v_public_key_x));
}
v_public_verification_key := valueof(m_publicVerificationKey_ecdsaNistP256(v_eccP256_curve_point));
} else if (ischosen(p_ec_certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaBrainpoolP256r1)) {
if (p_compressed_key_mode == 0) {
v_eccP256_curve_point := valueof(m_eccP256CurvePoint_compressed_y_0(v_public_key_x));
} else {
v_eccP256_curve_point := valueof(m_eccP256CurvePoint_compressed_y_1(v_public_key_x));
}
v_public_verification_key := valueof(m_publicVerificationKey_ecdsaBrainpoolP256r1(v_eccP256_curve_point));
} else {
var EccP384CurvePoint v_eccP384_curve_point;
if (p_compressed_key_mode == 0) {
v_eccP384_curve_point := valueof(m_eccP384CurvePoint_compressed_y_0(v_public_key_x));
} else {
v_eccP384_curve_point := valueof(m_eccP384CurvePoint_compressed_y_1(v_public_key_x));
}
v_public_verification_key := valueof(m_publicVerificationKey_ecdsaBrainpoolP384r1(v_eccP384_curve_point));
}
if (PX_INCLUDE_ENCRYPTION_KEYS) {
if (p_compressed_enc_key_mode == 0) {
v_enc_eccP256_curve_point := m_eccP256CurvePoint_compressed_y_0(v_public_enc_key_x);
} else {
v_enc_eccP256_curve_point := m_eccP256CurvePoint_compressed_y_1(v_public_enc_key_x);
}
if (p_enc_algo == e_nist_p256) {
v_public_encryption_key := valueof(m_publicEncryptionKey_eciesNistP256(v_enc_eccP256_curve_point));
} else {
v_public_encryption_key := valueof(m_publicEncryptionKey_eciesBrainpoolP256r1(v_enc_eccP256_curve_point));
}
p_inner_at_request.publicKeys := valueof( // The freshly generated public verification & encrypition keys to be used for the requested AT certificate
m_publicKeys(
v_public_verification_key,
m_encryptionKey( // FIXME Encryption keys could be optional
-,
v_public_encryption_key
)
)
);
} else {
p_inner_at_request.publicKeys := valueof( // The freshly generated public verification keys to be used for the requested AT certificate
m_publicKeys(
v_public_verification_key
)
);
}
p_inner_at_request.hmacKey := v_hmac_key;
log("f_generate_inner_at_request_with_wrong_parameters: p_inner_at_request= ", p_inner_at_request);
return true;
} // End of function f_generate_inner_at_request_with_wrong_parameters
function f_verify_inner_at_request_signed_for_pop(
in EtsiTs102941Data p_etsi_ts_102941_data,
in EtsiTs103097Certificate p_ec_certificate,
out InnerAtRequest p_inner_at_request
) return boolean {
var bitstring v_msg_bit;
log(">>> f_verify_inner_at_request_signed_for_pop: p_etsi_ts_102941_data=", p_etsi_ts_102941_data);
log(">>> f_verify_inner_at_request_signed_for_pop: p_ec_certificate=", p_ec_certificate);
// 1. Extract content
p_inner_at_request := p_etsi_ts_102941_data.content.authorizationRequest;
// 2. Verify the InnerEcRequestSignedForPop signature
// TODO
log("<<< f_verify_inner_at_request_signed_for_pop: ", p_inner_at_request);
return true;
} // End of function f_verify_inner_at_request_signed_for_pop
function f_generate_inner_at_response(
in octetstring p_authorization_request_hash,
in EtsiTs103097Certificate p_certificate,
out InnerAtResponse p_authorization_response
) return boolean {
// Local variables
// Build the Proof of Possession InnerEcResponse
p_authorization_response := valueof(
m_innerAtResponse_ok(
substr(p_authorization_request_hash, 0, 16),
p_certificate
)
);
return true;
} // End of function f_generate_inner_at_response
} // End of group inner_at_xxx
group dc {
function f_build_dc(
in charstring p_rca_certificate_id,
out EtsiTs103097Certificate p_rca_certificate
) {
log(">>> f_build_dc");
// Load certificate
f_readCertificate(p_rca_certificate_id, p_rca_certificate);
}
YannGarcia
committed
function f_verify_rca_ctl_response_message(
in EtsiTs103097Data p_etsi_ts_103097_signed_data,
in boolean p_check_security := true,
out ToBeSignedRcaCtl p_to_be_signed_rca_ctl
) return boolean {
var bitstring v_etsi_ts_102941_data_msg;
var bitstring v_tbs;
var Certificate v_certificate;
var charstring v_certificate_id;
var octetstring v_issuer;
var EtsiTs102941Data v_etsi_ts_102941_data;
log(">>> f_verify_rca_ctl_response_message: p_etsi_ts_103097_signed_data= ", p_etsi_ts_103097_signed_data);
// 1. Verify signature
log("f_verify_rca_ctl_response_message: p_etsi_ts_103097_signed_data.content.signedData.tbsData= ", p_etsi_ts_103097_signed_data.content.signedData.tbsData);
v_tbs := encvalue(p_etsi_ts_103097_signed_data.content.signedData.tbsData);
YannGarcia
committed
if (ispresent(p_etsi_ts_103097_signed_data.content.signedData.signer.digest)) {
if (f_getCertificateFromDigest(p_etsi_ts_103097_signed_data.content.signedData.signer.digest, v_certificate, v_certificate_id) == false) {
log("f_verify_rca_ctl_response_message: Failed to retrieve certificate from ", p_etsi_ts_103097_signed_data.content.signedData.signer.digest);
if (p_check_security == true) {
return false;
}
}
log("f_verify_rca_ctl_response_message (1): v_certificate: ", v_certificate);
YannGarcia
committed
f_getCertificateHash(v_certificate_id, v_issuer);
} else {
v_certificate := p_etsi_ts_103097_signed_data.content.signedData.signer.certificate[0];
log("f_verify_rca_ctl_response_message (2): v_certificate: ", v_certificate);
YannGarcia
committed
if (ispresent(v_certificate.issuer.sha256AndDigest)) {
v_issuer := v_certificate.issuer.sha256AndDigest;
} if (ispresent(v_certificate.issuer.sha384AndDigest)) {
YannGarcia
committed
v_issuer := v_certificate.issuer.sha384AndDigest;
} else { // self_
if (v_certificate.issuer.self_ == sha256) {
v_issuer := int2oct(0, 32);
} else {
v_issuer := int2oct(0, 48);
}
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
}
}
if (f_verifyEcdsa(bit2oct(v_tbs), v_issuer, p_etsi_ts_103097_signed_data.content.signedData.signature_, v_certificate.toBeSigned.verifyKeyIndicator.verificationKey) == false) {
log("f_verify_rca_ctl_response_message: Failed to verify signature");
if (p_check_security == true) {
return false;
}
}
v_etsi_ts_102941_data_msg := oct2bit(p_etsi_ts_103097_signed_data.content.signedData.tbsData.payload.data.content.unsecuredData);
if (decvalue(v_etsi_ts_102941_data_msg, v_etsi_ts_102941_data) != 0) {
log("f_verify_rca_ctl_response_message: Failed to decode EtsiTs102941Data");
return false;
} else {
log("f_verify_rca_ctl_response_message: v_etsi_ts_102941_data= ", v_etsi_ts_102941_data);
log("f_verify_pki_response_message: RcaCertificateTrustListMessage matching= ", match(v_etsi_ts_102941_data, mw_etsiTs102941Data_to_be_signed_rca_ctl));
if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_to_be_signed_rca_ctl) == false) {
log("f_verify_rca_ctl_response_message: Failed to decode certificateTrustListRca");
return false;
} else {
var Time32 v_time := (f_getCurrentTime()/* - 1072915200000*/) / 1000;
p_to_be_signed_rca_ctl := v_etsi_ts_102941_data.content.certificateTrustListRca;
log("f_verify_rca_ctl_response_message: p_to_be_signed_rca_ctl= ", p_to_be_signed_rca_ctl);
if (p_to_be_signed_rca_ctl.nextUpdate <= v_time) {
log("f_verify_rca_ctl_response_message: Invalid nextUpdate value: compared values=", p_to_be_signed_rca_ctl.nextUpdate, "/", v_time);
return false;
}
// TODO Verify RCA certificate & signature
}
}
return true;
}
function f_verify_rca_crl_response_message(
in EtsiTs103097Data p_etsi_ts_103097_signed_data,
in boolean p_check_security := true,
out ToBeSignedCrl p_to_be_signed_crl
) return boolean {
var bitstring v_etsi_ts_102941_data_msg;
var bitstring v_tbs;
var Certificate v_certificate;
var charstring v_certificate_id;
var octetstring v_issuer;
var EtsiTs102941Data v_etsi_ts_102941_data;
log(">>> f_verify_rca_crl_response_message: p_etsi_ts_103097_signed_data= ", p_etsi_ts_103097_signed_data);
// 1. Verify signature
log("f_verify_rca_crl_response_message: p_etsi_ts_103097_signed_data.content.signedData.tbsData= ", p_etsi_ts_103097_signed_data.content.signedData.tbsData);
v_tbs := encvalue(p_etsi_ts_103097_signed_data.content.signedData.tbsData);
if (f_getCertificateFromDigest(p_etsi_ts_103097_signed_data.content.signedData.signer.digest, v_certificate, v_certificate_id) == false) {
log("f_verify_rca_crl_response_message: Failed to retrieve certificate from ", p_etsi_ts_103097_signed_data.content.signedData.signer.digest);
if (p_check_security == true) {
return false;
}
}
f_getCertificateHash(v_certificate_id, v_issuer);
if (f_verifyEcdsa(bit2oct(v_tbs), v_issuer, p_etsi_ts_103097_signed_data.content.signedData.signature_, v_certificate.toBeSigned.verifyKeyIndicator.verificationKey) == false) {
log("f_verify_rca_crl_response_message: Failed to verify signature");
if (p_check_security == true) {
return false;
}
}
v_etsi_ts_102941_data_msg := oct2bit(p_etsi_ts_103097_signed_data.content.signedData.tbsData.payload.data.content.unsecuredData);
if (decvalue(v_etsi_ts_102941_data_msg, v_etsi_ts_102941_data) != 0) {
log("f_verify_rca_crl_response_message: Failed to decode EtsiTs102941Data");
return false;
} else {
log("f_verify_rca_crl_response_message: v_etsi_ts_102941_data= ", v_etsi_ts_102941_data);
log("f_verify_pki_response_message: CertificateRevocationList matching= ", match(v_etsi_ts_102941_data, mw_etsiTs102941Data_to_be_signed_crl));
if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_to_be_signed_crl) == false) {
log("f_verify_rca_crl_response_message: Failed to decode certificateRevocationList");
return false;
} else {
var Time32 v_time := (f_getCurrentTime()/* - 1072915200000*/) / 1000;
p_to_be_signed_crl := v_etsi_ts_102941_data.content.certificateRevocationList;
log("f_verify_rca_crl_response_message: p_to_be_signed_crl= ", p_to_be_signed_crl);
if (p_to_be_signed_crl.thisUpdate >= v_time) {
log("f_verify_rca_crl_response_message: Invalid thisUpdate value");
return false;
}
if (p_to_be_signed_crl.nextUpdate <= v_time) {
log("f_verify_rca_crl_response_message: Invalid nextUpdate value");
return false;
}
// TODO Verify RCA certificate & signature
}
}
return true;
}
/**
* @desc this function is used to retrieve the root certificate from SubCA entity
* @param p_certificate The root certificate
* @return 0 on success, -1 otherwise
*/
function f_get_root_ca_certificate(
in charstring p_iut_certificate := "CERT_IUT_A_CA",
in boolean p_explicit_type := false,
out Certificate p_certificate
) runs on ItsPkiHttp return integer {
var Headers v_headers;
var HttpMessage v_response;
var octetstring v_os;
var bitstring v_msg_bit;
log(">>> f_get_root_ca_certificate");
// Get root certificate
f_cfHttpUp_ca();
f_init_default_headers_list(PICS_HEADER_CTL_CONTENT_TYPE, "ca_request", v_headers);
// Test Body
f_http_send(
v_headers,
m_http_request(
m_http_request_get(
PICS_HTTP_GET_URI_DC,
v_headers
)));
tc_ac.start;
alt {
[not(PICS_MULTIPLE_END_POINT)] httpPort.receive(
mw_http_response(
mw_http_response_ok(
mw_http_message_body_binary(
mw_binary_body_ieee1609dot2_certificate
)))) -> value v_response {
tc_ac.stop;
[PICS_MULTIPLE_END_POINT] httpCaPort.receive(
mw_http_response(
mw_http_response_ok(
mw_http_message_body_binary(
mw_binary_body_ieee1609dot2_certificate
)))) -> value v_response {
tc_ac.stop;
}
[] tc_ac.timeout {
}
} // End of 'alt' statement
f_cfHttpDown_ca();
if (not(isvalue(v_response))) {
log("f_get_root_ca_certificate: fail to get certificate");
return -1;
log("v_response.response.body.binary_body.ieee1609dot2_certificate: ", v_response.response.body.binary_body.ieee1609dot2_certificate);
p_certificate := v_response.response.body.binary_body.ieee1609dot2_certificate;
log("<<< f_get_root_ca_certificate: ", p_certificate);
return 0;
function f_verify_rca_certificate(
in charstring p_authorized_certificate := "CERT_IUT_A_RCA",//"CERT_IUT_A_RCA",
in Certificate p_certificate,
in boolean p_check_implicit := false,
in boolean p_check_reconstruction_value := false,
in boolean p_check_no_signature := false,
in boolean p_check_region_restriction := false,
in boolean p_check_signature_content := false,
in boolean p_check_app_permissions := false,
in boolean p_check_app_ssps := false,
in boolean p_check_app_validity_period := false
) return boolean {
var CertificateType v_type_ := explicit;
var template Signature v_signature_ := ?;
var template IssuerIdentifier v_issuer := ?;
var template PublicVerificationKey v_public_verification_key := ?;
log(">>> f_verify_rca_certificate: p_authorized_certificate= ", p_authorized_certificate);
log(">>> f_verify_rca_certificate: p_certificate= ", p_certificate);
if (p_check_implicit == true) {
v_type_ := implicit;
}
if (p_check_no_signature == true) {
v_signature_ := omit;
}
if (match(p_certificate, mw_etsiTs103097Certificate(-, -, v_signature_, v_type_)) == false) {
log("f_verify_rca_certificate: version/explicit mismatch");
YannGarcia
committed
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
return false;
}
if (p_check_reconstruction_value == false) {
if (match(p_certificate, mw_etsiTs103097Certificate(
-,
mw_toBeSignedCertificate_ca(
(mw_certificateId_none, mw_certificateId_name),
-,
-,
mw_verificationKeyIndicator_verificationKey
),
v_signature_
)) == false) {
log("f_verify_rca_certificate: verificationKey mismatch");
return false;
}
if (p_check_signature_content) {
var template PublicVerificationKey v_publicVerificationKey;
if (PICS_SEC_SHA256) {
v_signature_ := mw_signature_ecdsaNistP256;
v_issuer := (mw_issuerIdentifier_self(sha256), mw_issuerIdentifier_sha256AndDigest);
v_public_verification_key := mw_publicVerificationKey_ecdsaNistP256;
} else if (PICS_SEC_BRAINPOOL_P256R1) {
v_signature_ := mw_signature_ecdsaBrainpoolP256r1;
v_issuer := (mw_issuerIdentifier_self(sha256), mw_issuerIdentifier_sha256AndDigest);
v_public_verification_key := mw_publicVerificationKey_ecdsaBrainpoolP256r1;
} else if (PICS_SEC_BRAINPOOL_P384R1) {
v_signature_ := mw_signature_ecdsaBrainpoolP384r1;
v_issuer := (mw_issuerIdentifier_self(sha384), mw_issuerIdentifier_sha384AndDigest);
v_public_verification_key := mw_publicVerificationKey_ecdsaBrainpoolP384r1;
}
if (match(p_certificate, mw_etsiTs103097Certificate(
v_issuer,
mw_toBeSignedCertificate_ca(
(mw_certificateId_none, mw_certificateId_name),
-,
-,
mw_verificationKeyIndicator_verificationKey(v_public_verification_key),
-, -, -, -,
-//mw_encryptionKey
),
v_signature_
)) == false) {
log("f_verify_rca_certificate: signature mismatch");
return false;
}
// Verify Signature
if (ischosen(p_certificate.issuer.self_)) {
v_publicVerificationKey := p_certificate.toBeSigned.verifyKeyIndicator.verificationKey;
} else {
var HashedId8 v_digest;
var Certificate v_authorized_certificate;
var charstring v_cert;
if (ischosen(p_certificate.issuer.sha256AndDigest)) {
v_digest := p_certificate.issuer.sha256AndDigest;
} else if (ischosen(p_certificate.issuer.sha384AndDigest)) {
v_digest := p_certificate.issuer.sha384AndDigest;
} else {
log("f_verify_rca_certificate: Invalid certificate issuer ", p_certificate.issuer);
return false;
}
if (f_getCertificateFromDigest(v_digest, v_authorized_certificate, v_cert) == false) {
log("f_verify_rca_certificate: Fail to load p_authorized_certificate");
return false;
}
v_publicVerificationKey := v_authorized_certificate.toBeSigned.verifyKeyIndicator.verificationKey
}
log("f_verify_rca_certificate: v_publicVerificationKey= ", v_publicVerificationKey);
if (f_verifyCertificateSignatureWithPublicKey(p_certificate, v_publicVerificationKey) == false) {
log("f_verify_rca_certificate: signature not verified");
return false;
}
}
} else {
if (match(p_certificate, mw_etsiTs103097Certificate(
-,
mw_toBeSignedCertificate_ca(
(mw_certificateId_none, mw_certificateId_name),
-,
-,
mw_verificationKeyIndicator_reconstructionValue
),
v_signature_
)) == false) {
log("f_verify_rca_certificate: verificationKey mismatch");
return false;
}
// TODO Verify Signature
}
if (p_check_region_restriction == true) {
var Certificate v_authorized_certificate;
var template GeographicRegion v_geographic_region := ?;
if (f_readCertificate(p_authorized_certificate, v_authorized_certificate) == false) {
log("f_verify_rca_certificate: Fail to load p_authorized_certificate");
return false;
}
log("f_verify_rca_certificate: v_authorized_certificate=", v_authorized_certificate);
if (PICS_SEC_CIRCULAR_REGION == true) {
v_geographic_region := mw_geographicRegion_circle;
} else if (PICS_SEC_RECTANGULAR_REGION == true) {
v_geographic_region := mw_geographicRegion_rectangular;
} else if (PICS_SEC_POLYGONAL_REGION == true) {
v_geographic_region := mw_geographicRegion_polygonal;
} else if (PICS_SEC_IDENTIFIED_REGION == true) {
v_geographic_region := mw_geographicRegion_identified(
{
(mw_identifiedRegion_country_only, mw_identifiedRegion_country_and_region)
}
);
}
if (match(p_certificate, mw_etsiTs103097Certificate(
-,
mw_toBeSignedCertificate_ca(
-,
-,
-,
-,
-,
-,
v_geographic_region
)
)) == false) {
log("f_verify_rca_certificate: Geographical region mismatch");
return false;
}
// Check interception of area
if (f_checkRegionValidityRestiction(v_authorized_certificate, p_certificate) == false) {
log("f_verify_rca_certificate: Geographical region intersection mismatch");
return false;
}
}
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
// Check appPermissions
if (p_check_app_permissions == true) {
var integer v_idx, v_jdx;
var charstring v_psid := ""; // 'psid' currently processed
var charstring v_psidsFound := ";"; // Used to build the list of the 'psid' already processed
var template charstring m_found_pattern; // Used in regex to verify that 'psid' was not found before
var Certificate v_authorized_certificate;
if (f_readCertificate(p_authorized_certificate, v_authorized_certificate) == false) {
log("f_verify_rca_certificate: Fail to load p_authorized_certificate");
return false;
}
log("f_verify_rca_certificate: v_authorized_certificate=", v_authorized_certificate);
if (match(v_authorized_certificate.toBeSigned.certIssuePermissions, { mw_psidGroupPermissions }) == false) {
log("f_verify_rca_certificate: eeType mismatch");
return false;
}
for (v_idx := 0; v_idx < lengthof(p_certificate.toBeSigned.appPermissions); v_idx := v_idx + 1) {
log("f_verify_rca_certificate: Processing ", p_certificate.toBeSigned.appPermissions[v_idx]);
if (match(p_certificate.toBeSigned.appPermissions[v_idx], mw_appPermissions) == false) {
log("f_verify_rca_certificate: PsidSsp mismatch");
return false;
}
// Check uniqueness of PSIDs
v_psid := int2str(p_certificate.toBeSigned.appPermissions[v_idx].psid);
m_found_pattern := pattern "*({v_psid})*";
if (regexp(v_psidsFound, m_found_pattern, 0) == v_psid) {
log("f_verify_rca_certificate: Psid uniqueness is not verified");
return false; // v_psid exist at least 2 times, uniqueness is not verified
}
// v_psid non found, add it into the built list
v_psidsFound := v_psidsFound & v_psid & ";";
// Check that 'psid' is in the certIssuePermissions component in the issuing certificate
if (match(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions, mw_subjectPermissions_explicit) == false) {
for (v_jdx := 0; v_jdx < lengthof(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit); v_jdx := v_jdx + 1) {
if (int2str(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit[v_jdx].psid) == v_psid) {
break;
}
} // End of 'for'statement
if (v_jdx == lengthof(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit)) {
log("f_verify_rca_certificate: Psid is not in the list of the issuing certificate");
return false;
}
}
} // End of 'for'statement
}
if (p_check_app_ssps == true) {
var integer v_idx, v_jdx;
var Certificate v_authorized_certificate;
if (f_readCertificate(p_authorized_certificate, v_authorized_certificate) == false) {
log("f_verify_rca_certificate: Fail to load p_authorized_certificate");
return false;
}
log("f_verify_rca_certificate: v_authorized_certificate=", v_authorized_certificate);
for (v_idx := 0; v_idx < lengthof(p_certificate.toBeSigned.appPermissions); v_idx := v_idx + 1) {
log("f_verify_rca_certificate: Processing ", p_certificate.toBeSigned.appPermissions[v_idx]);
if (match(p_certificate.toBeSigned.appPermissions[v_idx], mw_appPermissions(-, ?)) == false) {
log("f_verify_rca_certificate: appPermissions mismatch");
return false;
}
// Check that 'ssp' is in the certIssuePermissions component in the issuing certificate
for (v_jdx := 0; v_jdx < lengthof(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit); v_jdx := v_jdx + 1) {
log("f_verify_rca_certificate: compare psid ", v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit[v_jdx].psid, " - ", p_certificate.toBeSigned.appPermissions[v_idx].psid);
if (v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit[v_jdx].psid == p_certificate.toBeSigned.appPermissions[v_idx].psid) {
break;
}
} // End of 'for'statement
if (v_jdx == lengthof(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit)) {
log("f_verify_rca_certificate: Psid is not in the list of the issuing certificate");
return false;
} else {
var BitmapSsp v_ssp_ca := substr(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit[v_jdx].sspRange.bitmapSspRange.sspValue, 1, -1 + lengthof(v_authorized_certificate.toBeSigned.certIssuePermissions[0].subjectPermissions.explicit[v_jdx].sspRange.bitmapSspRange.sspValue));
log("f_verify_rca_certificate: v_ssp_ca= ", v_ssp_ca, " - ssp= ", p_certificate.toBeSigned.appPermissions[v_idx].ssp.bitmapSsp);
if (v_ssp_ca != p_certificate.toBeSigned.appPermissions[v_idx].ssp.bitmapSsp) {
log("f_verify_rca_certificate: SSPs mismatch: CA");
return false;
}
}
} // End of 'for'statement
}
if (p_check_app_validity_period == true) {
var integer v_idx, v_jdx;
var Certificate v_authorized_certificate;
var UInt32 v_duration, v_duration_ca;
if (f_readCertificate(p_authorized_certificate, v_authorized_certificate) == false) {
log("f_verify_rca_certificate: Fail to load p_authorized_certificate");
return false;
}
log("f_verify_rca_certificate: v_authorized_certificate=", v_authorized_certificate);
// Check start date (indicating X_START_VALIDITY ( X_START_VALIDITY >= X_START_VALIDITY_CA ))
if (p_certificate.toBeSigned.validityPeriod.start_ < v_authorized_certificate.toBeSigned.validityPeriod.start_) {
log("f_verify_rca_certificate: validityPeriod.start_ mismatch");
return false;
}
// Check duration (value <= X_START_VALIDITY_CA + X_DURATION_CA - X_START_VALIDITY)
v_duration := duration_to_uint32(p_certificate.toBeSigned.validityPeriod.duration);
v_duration_ca := duration_to_uint32(v_authorized_certificate.toBeSigned.validityPeriod.duration);
if (v_duration > (v_authorized_certificate.toBeSigned.validityPeriod.start_ + v_duration_ca - p_certificate.toBeSigned.validityPeriod.start_)) {
log("f_verify_rca_certificate: validityPeriod.duration mismatch");
return false;
}
}
return true;
}
function duration_to_uint32(
in Duration p_duration
) return UInt32 {
if (ischosen(p_duration.microseconds)) {
return p_duration.microseconds * 1000000;
}
else if (ischosen(p_duration.milliseconds)) {
return p_duration.milliseconds * 1000;
}
else if (ischosen(p_duration.seconds)) {
return p_duration.seconds;
}
else if (ischosen(p_duration.minutes)) {
return p_duration.minutes * 60;
}
else if (ischosen(p_duration.hours)) {
return p_duration.hours * 3600;
}
else if (ischosen(p_duration.sixtyHours)) {
return p_duration.sixtyHours * 60 * 3600;
}
else if (ischosen(p_duration.sixtyHours)) {
return p_duration.sixtyHours * 60 * 3600;
}
// No choice!
return p_duration.years * 31536000; // One calendar common year has 365 days
}
} // End of group dc
group ctl {
function f_build_ctl(
in charstring p_ea_certificate_id,
in charstring p_aa_certificate_id,
in charstring p_rca_certificate_id,
out ToBeSignedRcaCtl p_to_be_signed_rca_ctl
) {
// Local variables
var EtsiTs103097Certificate v_ea_certificate;
var EtsiTs103097Certificate v_aa_certificate;
var Oct32 v_rca_hash;
var CtlCommands v_ctl_commands;
var Time32 v_time;
log(">>> f_build_ctl");
// Load certificates
f_readCertificate(p_ea_certificate_id, v_ea_certificate);
f_readCertificate(p_aa_certificate_id, v_aa_certificate);
f_getCertificateHash256(p_rca_certificate_id, v_rca_hash);
v_ctl_commands := {
{ add := { ea := valueof(m_ea_entry(v_ea_certificate, PICS_EA_ENDPOINT)) } },
{ add := { aa := valueof(m_aa_entry(v_aa_certificate, PICS_AA_ENDPOINT)) } },
{ add := { dc := valueof(m_dc_entry(PICS_DC_ENDPOINT, { f_hashedId8FromSha256(v_rca_hash) })) } }
};
log("f_build_ctl: v_ctl_commands= ", v_ctl_commands);
// Build the main data structure
v_time := f_getCurrentTime() / 1000;/*in seconds*/
p_to_be_signed_rca_ctl := valueof(m_to_be_signed_rca_full_ctl(v_time + 30 * 86400/*30 days in seconds*/, PX_CTL_SEQUENCE_NUMBER, v_ctl_commands));
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
log("<<< f_build_ctl: p_to_be_signed_rca_ctl= ", p_to_be_signed_rca_ctl);
} // End of function f_build_ctl
function f_sign_dc_ctl(
in charstring p_signer_certificate_id,
in ToBeSignedRcaCtl p_to_be_signed_rca_ctl,
out Ieee1609Dot2Data p_ieee_1609Dot2_signed_data
) {
// Local variables
var EtsiTs103097Certificate v_certificate;
var EtsiTs102941Data v_etsi_ts_102941_data;
var octetstring v_pki_message;
var ToBeSignedData v_tbs;
var octetstring v_private_key;
var octetstring v_issuer;
var bitstring v_tbs_encoded;
var octetstring v_sig;
var Signature v_signature;
log(">>> f_sign_dc_ctl");
f_readSigningKey(p_signer_certificate_id, v_private_key);
f_getCertificateHash(p_signer_certificate_id, v_issuer);
f_readCertificate(p_signer_certificate_id, v_certificate);
// Encode the main data structure
v_etsi_ts_102941_data := valueof(m_etsiTs102941Data_to_be_signed_rca_ctl(p_to_be_signed_rca_ctl));
v_pki_message := bit2oct(encvalue(v_etsi_ts_102941_data));
// Signed the encoded PKI message
v_tbs := valueof(
m_toBeSignedData(
m_signedDataPayload(
m_etsiTs103097Data_unsecured(v_pki_message)
),
m_headerInfo_inner_pki_ctl_response(-, (f_getCurrentTime() * 1000)/*us*/)
)
);
v_tbs_encoded := encvalue(v_tbs);
// Sign the certificate
v_sig := f_signWithEcdsa(bit2oct(v_tbs_encoded), v_issuer, v_private_key);
if ((PX_VE_ALG == e_nist_p256) or (PX_VE_ALG == e_brainpool_p256_r1)) {
v_signature := valueof(
m_signature_ecdsaNistP256(
m_ecdsaP256Signature(
m_eccP256CurvePoint_x_only(
substr(v_sig, 0, 32)
),
substr(v_sig, 32, 32)
)
));
p_ieee_1609Dot2_signed_data := valueof(
m_etsiTs103097Data_signed(
m_signedData(
sha256,
v_tbs,
m_signerIdentifier_certificates({v_certificate}),
v_signature
)
)
);
} else if (PX_VE_ALG == e_brainpool_p384_r1) {
v_signature := valueof(
m_signature_ecdsaBrainpoolP384r1(
m_ecdsaP384Signature(
m_eccP384CurvePoint_x_only(
substr(v_sig, 0, 48)
),
substr(v_sig, 48, 48)
)
));
p_ieee_1609Dot2_signed_data := valueof(
m_etsiTs103097Data_signed(
m_signedData(
sha384,
v_tbs,
m_signerIdentifier_certificates({v_certificate}),
v_signature
)
)
);
}
log("<<< f_sign_dc_ctl: p_ieee_1609Dot2_signed_data= ", p_ieee_1609Dot2_signed_data);
} // End of function f_sign_dc_ctl
function f_verify_full_ctl(
in ToBeSignedRcaCtl p_to_be_signed_rca_ctl
) return boolean {
log(">>> f_verify_full_ctl: p_to_be_signed_rca_ctl= ", p_to_be_signed_rca_ctl);
// 1. Check mandatory fields
log("f_verify_full_ctl matching= ", match(p_to_be_signed_rca_ctl, mw_to_be_signed_rca_full_ctl));
if (match(p_to_be_signed_rca_ctl, mw_to_be_signed_rca_full_ctl) == false) {
return false;
}
log("f_verify_full_ctl: ctlCommands length: ", lengthof(p_to_be_signed_rca_ctl.ctlCommands));
for (var integer v_i := 0; v_i < lengthof(p_to_be_signed_rca_ctl.ctlCommands); v_i := v_i + 1) {
var CtlCommand v_ctl_command := p_to_be_signed_rca_ctl.ctlCommands[v_i];
if (ischosen(v_ctl_command.delete)) {
log("f_verify_full_ctl: ctlCommands shall not contains 'delete' variant");
return false;
} else {
if (f_verify_ctl_entry(v_ctl_command.add) == false) {
log("f_verify_full_ctl: ctlCommands contains invalid entries");
return false;
}
}
} // End of 'for' statements
return true;
} // End of function f_verify_full_ctl
function f_verify_ctl_entry(
in CtlEntry p_ctl_entry
) return boolean {
log(">>> f_verify_ctl_entry: p_ctl_entry=", p_ctl_entry);
if (ischosen(p_ctl_entry.rca)) {
if (match(p_ctl_entry.rca, mw_root_ca_entry(mw_etsiTs103097Certificate)) == false) {
return false;
} else {
// TODO Verify RCA certificate & signature
}
} else if (ischosen(p_ctl_entry.ea)) {
if (match(p_ctl_entry.ea, mw_ea_entry(mw_etsiTs103097Certificate)) == false) {
return false;
} else {
// TODO Verify RCA certificate & signature
}
} else if (ischosen(p_ctl_entry.aa)) {
if (match(p_ctl_entry.aa, mw_aa_entry(mw_etsiTs103097Certificate)) == false) {
return false;
} else {
// TODO Verify RCA certificate & signature
}
} else if (ischosen(p_ctl_entry.dc)) {
if (match(p_ctl_entry.dc, mw_dc_entry) == false) {
return false;
} else {
// TODO Verify RCA certificate & signature
}
} else {
return false;
}
return true;
} // End of function f_verify_ctl_entry
} // End of group ctl
group crl {
function f_build_crl(
in template (omit) charstring p_ea_certificate_id := omit,
in template (omit) charstring p_aa_certificate_id := omit,
out ToBeSignedCrl p_to_be_signed_crl
) {
// Local variables
var HashedId8 v_hashed_id8;
var CrlEntries v_crl_entries := {}; // Empty list
var integer v_counter := 0;
var Time32 v_time;
log(">>> f_build_crl");
if (ispresent(p_ea_certificate_id)) {
f_getCertificateHash(valueof(p_ea_certificate_id), v_hashed_id8);
v_crl_entries[v_counter] := v_hashed_id8;
v_counter := v_counter + 1;
}
if (ispresent(p_aa_certificate_id)) {
f_getCertificateHash(valueof(p_aa_certificate_id), v_hashed_id8);
v_crl_entries[v_counter] := v_hashed_id8;
v_counter := v_counter + 1;
}
log("f_build_crl: v_crl_entries= ", v_crl_entries);
// Build the main data structure
v_time := f_getCurrentTime() / 1000; /*in seconds*/
p_to_be_signed_crl := valueof(m_to_be_signed_crl(v_time, v_time + 30 * 86400/*30 days in seconds*/, v_crl_entries));
log("<<< f_build_crl: p_to_be_signed_crl= ", p_to_be_signed_crl);
} // End of function f_build_crl
function f_sign_dc_crl(
in charstring p_signer_certificate_id,
in ToBeSignedCrl p_to_be_signed_crl,
out Ieee1609Dot2Data p_ieee_1609Dot2_signed_data
) {
// Local variables
var EtsiTs103097Certificate v_certificate;
var EtsiTs102941Data v_etsi_ts_102941_data;
var octetstring v_pki_message;
var ToBeSignedData v_tbs;
var octetstring v_private_key;
var octetstring v_issuer;
var bitstring v_tbs_encoded;
var octetstring v_sig;
var Signature v_signature;
log(">>> f_sign_dc_crl");
f_readSigningKey(p_signer_certificate_id, v_private_key);
f_getCertificateHash(p_signer_certificate_id, v_issuer);
f_readCertificate(p_signer_certificate_id, v_certificate);
// Encode the main data structure
v_etsi_ts_102941_data := valueof(m_etsiTs102941Data_to_be_signed_crl(p_to_be_signed_crl));
v_pki_message := bit2oct(encvalue(v_etsi_ts_102941_data));
// Signed the encoded PKI message
v_tbs := valueof(
m_toBeSignedData(
m_signedDataPayload(
m_etsiTs103097Data_unsecured(v_pki_message)
),
m_headerInfo_inner_pki_crl_response(-, (f_getCurrentTime() * 1000)/*us*/)
)
);
v_tbs_encoded := encvalue(v_tbs);
// Sign the certificate
v_sig := f_signWithEcdsa(bit2oct(v_tbs_encoded), v_issuer, v_private_key);
if ((PX_VE_ALG == e_nist_p256) or (PX_VE_ALG == e_brainpool_p256_r1)) {
v_signature := valueof(
m_signature_ecdsaNistP256(
m_ecdsaP256Signature(
m_eccP256CurvePoint_x_only(
substr(v_sig, 0, 32)
),
substr(v_sig, 32, 32)
)
));
p_ieee_1609Dot2_signed_data := valueof(
m_etsiTs103097Data_signed(
m_signedData(
sha256,
v_tbs,
m_signerIdentifier_certificates({v_certificate}),
v_signature
)
)
);
} else if (PX_VE_ALG == e_brainpool_p384_r1) {
v_signature := valueof(
m_signature_ecdsaBrainpoolP384r1(
m_ecdsaP384Signature(
m_eccP384CurvePoint_x_only(
substr(v_sig, 0, 48)
),
substr(v_sig, 48, 48)
)
));
p_ieee_1609Dot2_signed_data := valueof(
m_etsiTs103097Data_signed(
m_signedData(
sha384,
v_tbs,
m_signerIdentifier_certificates({v_certificate}),
v_signature
)
)
);
}
log("<<< f_sign_dc_crl: p_ieee_1609Dot2_signed_data= ", p_ieee_1609Dot2_signed_data);
} // End of function f_sign_dc_crl
YannGarcia
committed
function f_verify_full_crl(
in ToBeSignedCrl p_to_be_signed_crl
) return boolean {
log(">>> f_verify_full_crl: p_to_be_signed_crl= ", p_to_be_signed_crl);
YannGarcia
committed
// 1. Check mandatory fields
log("f_verify_full_crl matching= ", match(p_to_be_signed_crl, mw_to_be_signed_crl));
if (match(p_to_be_signed_crl, mw_to_be_signed_crl) == false) {
return false;
YannGarcia
committed
}
log("f_verify_full_crl: entries length: ", lengthof(p_to_be_signed_crl.entries));
for (var integer v_i := 0; v_i < lengthof(p_to_be_signed_crl.entries); v_i := v_i + 1) {
var CrlEntry v_crl_entry := p_to_be_signed_crl.entries[v_i];
YannGarcia
committed
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
log("f_verify_full_crl: crlEntry: v_crl_entry");
} // End of 'for' statements
return true;
} // End of function f_verify_full_crl
} // End of group crl
group tlm {
function f_build_tlm(
in charstring p_tlm_certificate_id,
in charstring p_rca_certificate_id,
out ToBeSignedTlmCtl p_to_be_signed_tlm_crl
) {
// Local variables
var EtsiTs103097Certificate v_tlm_certificate;
var EtsiTs103097Certificate v_rca_certificate;
var CtlCommands v_ctl_commands; // Empty list
var Oct32 v_rca_hash;
var Time32 v_time;
log(">>> f_build_tlm");
// Load certificates
f_readCertificate(p_tlm_certificate_id, v_tlm_certificate);
f_readCertificate(p_rca_certificate_id, v_rca_certificate);
f_getCertificateHash256(p_rca_certificate_id, v_rca_hash);
// Create ctlCommnand list
v_ctl_commands := {
{ add := { tlm := valueof(m_tlm_entry(v_tlm_certificate, PICS_TLM_ENDPOINT)) } },
{ add := { rca := valueof(m_root_ca_entry(v_rca_certificate)) } },
{ add := { dc := valueof(m_dc_entry(PICS_DC_ENDPOINT, { f_hashedId8FromSha256(v_rca_hash) })) } }
};
log("f_build_tlm: v_ctl_commands= ", v_ctl_commands);
// Build the main data structure
v_time := f_getCurrentTimeUtc() / 1000/*in s*/;
//log("f_build_ctl: v_time= ", v_time);
//log("f_build_ctl: v_time + 86400= ", v_time + 86400);
p_to_be_signed_tlm_crl := valueof(mw_to_be_signed_tlm_full_ctl(v_time + 86400/*1days*/, 7, v_ctl_commands));
log("<<< f_build_tlm: p_to_be_signed_tlm_crl= ", p_to_be_signed_tlm_crl);
} // End of function f_buif_build_tlmld_Tlm
function f_verify_full_ectl(
in ToBeSignedRcaCtl p_to_be_signed_tlm_ectl
) return boolean {
log(">>> f_verify_full_ectl: p_to_be_signed_tlm_ectl= ", p_to_be_signed_tlm_ectl);
// 1. Check mandatory fields
log("f_verify_full_ectl matching= ", match(p_to_be_signed_tlm_ectl, mw_to_be_signed_rca_full_ctl));