ItsPki_TestCases.ttcn

                                                 mw_http_response(
                                                                  mw_http_response_ok(
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_pskRecipInfo, * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_response
                                                 ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_response_from_iut_aa(v_response.response, v_private_key_at, v_aes_sym_key, v_authentication_vector, v_request_hash, v_inner_at_response, v_result);
              if ((v_result != -2) and (v_result != -3)) { // Additinal shecks where done by TC_SECPKI_AA_AUTH_01_BV
                log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_itss: PASS: Received exptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_itss: FAIL: Unexptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_itss: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_itss();
        } // End of function f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_itss

        function f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key := int2oct(0, 16);
          var SharedAtRequest v_shared_at_request;
          var AuthorizationValidationResponse v_authorization_validation_response;

          // Test component configuration
          f_cfHttpUp_ea(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_selfOrClientSyncAndVerdict(c_prDone, e_success);

          // Test body
          tc_ac.start;
          alt {
            [] a_await_atv_http_request_from_iut( // Wait for authorizationValidation Request from IUT to EA
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      -, //FIXME: Use another PIXIT than PICS_HTTP_POST_URI_ATV,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_eaHashedId8)), * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_request
                                                  ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_request_from_iut_atv(v_request.request, v_aes_sym_key, v_request_hash, v_shared_at_request, v_result);
              // Set verdict
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea: PASS: IUT has sent AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, ok, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_response(
                                            m_http_response_ok(
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                          )),
                                                               v_headers
                            )));
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea: FAIL: Failed to verify AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, deniedpermissions, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_request(
                                           m_http_request_post(
                                                               PICS_HTTP_POST_URI_AT,
                                                               v_headers,
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                          )))));
                f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_ea();

        } // End of function f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV_ea

      } // End of group f_TC_SECPKI_AA_AUTHVAL_RCV_01_BV

      /**
       * @desc Check that AA doesn't accept Authorization Validation Response message when  this message is 
       *       signed with certificate without appropriate permissions
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITSS in "enrolled" state
       *          the EA in "operational" state
       *          and the IUT(AA) in "operational" state
       *          and the IUT had received the AuthorizationRequest from the ITSS
       *          and the IUT sent the AuthorizationValidationRequest
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT receives the AuthorizationValidationResponseMessage
       *                containing signer
       *                    containing digest
       *                        indicating HashedId8 of the certificate
       *                    containing appPermissions
       *                        not containing an item of type PsidSsp
       *                        containing psid
       *                            indicating AID_CERT_REQ
       *                        or containing an item of type PsidSsp
       *                            containing psid
       *                                indicating AID_CERT_REQ
       *                        and containing ssp
       *                             containing opaque[0] (version) 
       *                                 indicating other value than 1
       *                        or containing opaque[1] (value) 
       *                            indicating "AuthorizationValidationResponse" (bit 4) set to 0
       *         }
       *         then {
       *            the IUT answers with an AuthorisationValidationResponseMessage
       *                containing responseCode
       *                    indicating non-zero value
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTHVAL_RCV_02_BI
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTHVAL_RCV_02_BI() runs on ItsPkiHttp system ItsPkiHttpSystem {} // End of testcase TC_SECPKI_AA_AUTHVAL_RCV_02_BI

    } // End of group aa_authorization_validation_response

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.4  Authorization response
    group aa_authorization_response {

      /**
       * @desc Check that the AA sends encrypted authorization response.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the ITS-S has sent the AuthorizationRequestMessage
       *              containing encrypted enkKey
       *                  containing AES symmetric key (SYM_KEY) and
       *          the EA in "operational" state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing content.encryptedData
       *                    containing recipients of size 1
       *                        containing the instance of RecipientInfo
       *                            containing pskRecipInfo
       *                                indicating HashedId8 of the SYM_KEY
       *                and containing cyphertext
       *                    encrypted using SYM_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_01_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_01_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_01_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_01_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_01_BV

      group f_TC_SECPKI_AA_AUTH_01_BV {

        function f_TC_SECPKI_AA_AUTH_01_BV_itss() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct16 v_authentication_vector;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key;
          var InnerAtRequest v_inner_at_request;
          var InnerAtResponse v_inner_at_response;
          var HashedId8 v_ec_certificate_hashed_id8;

          // Test component configuration
          f_cfHttpUp_itss(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          // Generate EC certificate
          f_generate_inner_ec_request(v_private_key_ec, v_public_compressed_key_ec, v_compressed_key_mode_ec, v_inner_ec_request);
          f_generate_ec_certificate_for_inner_ec_response(v_inner_ec_request, v_private_key_ec, vc_eaWholeHash, v_ec_certificate, v_ec_certificate_hashed_id8);
          // Send AuthorizationRequest
          f_http_build_authorization_request(v_ec_certificate, v_private_key_ec, v_private_key_at, v_public_compressed_key_at, v_compressed_mode_at, v_private_enc_key_at, v_public_compressed_enc_key_at, v_compressed_enc_mode_at, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
          v_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
          f_init_default_headers_list(-, "inner_at_request", v_headers);
          f_http_send(
                      v_headers,
                      m_http_request(
                                     m_http_request_post(
                                                         PICS_HTTP_POST_URI_AT,
                                                         v_headers,
                                                         m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          f_selfOrClientSyncAndVerdict(c_prDone, e_success);

          // Test body
          tc_ac.start;
          alt {
            [] a_await_at_http_response_from_iut(
                                                 mw_http_response(
                                                                  mw_http_response_ok(
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_pskRecipInfo, * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_response
                                                 ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_response_from_iut_aa(v_response.response, v_private_key_at, v_aes_sym_key, v_authentication_vector, v_request_hash, v_inner_at_response, v_result);
              if ((v_result != -2) and (v_result != -3)){
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_itss: PASS: Received exptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_itss: FAIL: Unexptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_01_BV_itss: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_itss();
        } // End of function f_TC_SECPKI_AA_AUTH_01_BV_itss

        function f_TC_SECPKI_AA_AUTH_01_BV_ea() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key := int2oct(0, 16);
          var SharedAtRequest v_shared_at_request;
          var AuthorizationValidationResponse v_authorization_validation_response;

          // Test component configuration
          f_cfHttpUp_ea(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          tc_ac.start;
          alt {
            [] a_await_atv_http_request_from_iut( // Wait for authorizationValidation Request from IUT to EA
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      -, //FIXME: Use another PIXIT than PICS_HTTP_POST_URI_ATV,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_eaHashedId8)), * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_request
                                                  ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_request_from_iut_atv(v_request.request, v_aes_sym_key, v_request_hash, v_shared_at_request, v_result);
              // Set verdict
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INFO: IUT has sent AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, ok, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_response(
                                            m_http_response_ok(
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                          )),
                                                               v_headers
                            )));
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INCONC: Failed to verify AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, deniedpermissions, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_request(
                                           m_http_request_post(
                                                               PICS_HTTP_POST_URI_AT,
                                                               v_headers,
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                          )))));
                f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_prDone, e_timeout);
            }
          } // End of 'alt' statement

          // Test body
          f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);

          // Postamble
          // TODO Wait for AuthorizationResponse
          f_cfHttpDown_ea();

        } // End of function f_TC_SECPKI_AA_AUTH

      } // End of group f_TC_SECPKI_AA_AUTH_01_BV

      /**
       * @desc Check that the AA sends signed authorization response.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *              authorized with CERT_AA certificate
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing signer
       *                            containing digest
       *                                indicating HashedId8 value of the CERT_AA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_02_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_02_BV

      group f_TC_SECPKI_AA_AUTH_02_BV {

        function f_TC_SECPKI_AA_AUTH_02_BV_itss() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct16 v_authentication_vector;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key;
          var InnerAtRequest v_inner_at_request;
          var InnerAtResponse v_inner_at_response;
          var HashedId8 v_ec_certificate_hashed_id8;

          // Test component configuration
          f_cfHttpUp_itss(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          // Generate EC certificate
          f_generate_inner_ec_request(v_private_key_ec, v_public_compressed_key_ec, v_compressed_key_mode_ec, v_inner_ec_request);
          f_generate_ec_certificate_for_inner_ec_response(v_inner_ec_request, v_private_key_ec, vc_eaWholeHash, v_ec_certificate, v_ec_certificate_hashed_id8);
          // Send AuthorizationRequest
          f_http_build_authorization_request(v_ec_certificate, v_private_key_ec, v_private_key_at, v_public_compressed_key_at, v_compressed_mode_at, v_private_enc_key_at, v_public_compressed_enc_key_at, v_compressed_enc_mode_at, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
          v_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
          f_init_default_headers_list(-, "inner_at_request", v_headers);
          f_http_send(
                      v_headers,
                      m_http_request(
                                     m_http_request_post(
                                                         PICS_HTTP_POST_URI_AT,
                                                         v_headers,
                                                         m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          f_selfOrClientSyncAndVerdict(c_prDone, e_success);

          // Test body
          tc_ac.start;
          alt {
            [] a_await_at_http_response_from_iut(
                                                 mw_http_response(
                                                                  mw_http_response_ok(
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_pskRecipInfo, * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_response
                                                 ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_response_from_iut_aa(v_response.response, v_private_key_at, v_aes_sym_key, v_authentication_vector, v_request_hash, v_inner_at_response, v_result);
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: PASS: Received exptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: FAIL: Unexptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_itss();
        } // End of function f_TC_SECPKI_AA_AUTH_02_BV_itss

        function f_TC_SECPKI_AA_AUTH_02_BV_ea() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key := int2oct(0, 16);
          var SharedAtRequest v_shared_at_request;
          var AuthorizationValidationResponse v_authorization_validation_response;

          // Test component configuration
          f_cfHttpUp_ea(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          tc_ac.start;
          alt {
            [] a_await_atv_http_request_from_iut( // Wait for authorizationValidation Request from IUT to EA
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      -, //FIXME: Use another PIXIT than PICS_HTTP_POST_URI_ATV,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_eaHashedId8)), * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_request
                                                  ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_request_from_iut_atv(v_request.request, v_aes_sym_key, v_request_hash, v_shared_at_request, v_result);
              // Set verdict
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: IUT has sent AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, ok, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_response(
                                            m_http_response_ok(
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                          )),
                                                               v_headers
                            )));
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INCONC: Failed to verify AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, deniedpermissions, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_request(
                                           m_http_request_post(
                                                               PICS_HTTP_POST_URI_AT,
                                                               v_headers,
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                          )))));
                f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_prDone, e_timeout);
            }
          } // End of 'alt' statement

          // Test body
          f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);

          // Postamble
          // TODO Wait for AuthorizationResponse
          f_cfHttpDown_ea();

        } // End of function f_TC_SECPKI_AA_AUTH

      } // End of group f_TC_SECPKI_AA_AUTH_02_BV

      /**
       * @desc Check that the AA sends signed authorization response with signature properly calculated using approved hash algorithm.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *              authorized with CERT_AA certificate
       *                  containing verificationKey (AA_PUB_V_KEY)
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing hashId
       *                            indicating supported hash algorithm (HASH_ALG)
       *                        and containing signature
       *                            calculated using the HASH_ALG and private key correspondent to the AA_PUB_V_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_03_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_03_BV

      /**
       * @desc Check that the AA sends signed AuthorizationResponseMessage using valid ITS AID and only allowed headers.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing tbsData
       *                            containing psid
       *                                indicating AID_PKI_CERT_REQUEST
       *                        and containing generationTime
       *                        and not containing any other headers
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_04_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_04_BV

    } // End of group aa_authorization_response

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.5  CA Certificate Request
    group aa_ca_certificates_request {
      // TODO
    } // End of group aa_ca_certificates_request

    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.6  Authorization using butterfly key expansion mechanism
    group aa_authorization_with_bfk {

      group bfk_cert_request_helpers {

          function f_trigger_butterfly_cert_request(
                                                    out HashedId8 p_aes_sym_key_hashed_id8,
                                                    out RaAcaCertRequest p_ra_aca_cert_request
                                                    ) runs on ItsPkiHttp {
            // Local variables
            var octetstring v_caterpillar_private_key
            var octetstring v_caterpillar_public_key_compressed;
            var integer v_caterpillar_compressed_mode;
            var octetstring v_caterpillar_enc_private_key
            var octetstring v_caterpillar_enc_public_key_compressed;
            var integer v_caterpillar_enc_compressed_mode;
            var EeRaCertRequest v_ee_ra_cert_request;
            var octetstring v_private_key;
            var Oct16 v_encrypted_sym_key;
            var Oct16 v_aes_sym_key;
            var Oct16 v_authentication_vector;
            var Oct12 v_nonce;
            var Oct32 v_request_hash;
            var octetstring v_salt;
            var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
            var Headers v_headers;
            var HttpMessage v_response;
            var EtsiTs102941Data v_etsi_ts_102941_data;


            // Generate EeRaCertRequest
            if (f_generate_ee_ra_cert_request(v_caterpillar_private_key, v_caterpillar_public_key_compressed, v_caterpillar_compressed_mode, v_caterpillar_enc_private_key, v_caterpillar_enc_public_key_compressed, v_caterpillar_enc_compressed_mode, v_ee_ra_cert_request) == false) {
              log("*** f_trigger_butterfly_cert_request: ERROR: Failed to generate InnerEcRequest ***");
              f_selfOrClientSyncAndVerdict("error", e_error);
            }
            log ("f_trigger_butterfly_cert_request: p_ee_ra_cert_request: ", v_ee_ra_cert_request);
            // Buikd theHTTP request
            f_http_build_butterfly_cert_request(v_ee_ra_cert_request, vc_eaPrivateKey, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, p_ra_aca_cert_request, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
            p_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
            f_init_default_headers_list(-, "bfk_cert_request", v_headers);
            f_http_send(
                        v_headers,
                        m_http_request(
                                      m_http_request_post(
                                                          PICS_HTTP_POST_URI_BFK_AA,
                                                          v_headers,
                                                          m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          } // End of function f_trigger_butterfly_cert_request

          function f_verify_http_butterfly_cert_request_message_to_ea(
                                                                      in Request p_request,
                                                                      in Headers p_headers,
                                                                      out integer p_result,
                                                                      out AcaRaCertResponse p_aca_ra_cert_response
                                                                      ) runs on ItsPkiHttp {

            // Local variables
            var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
            var EtsiTs102941Data v_etsi_ts_102941_data;
            var template (value) HttpMessage v_response;
            var Oct16 v_request_hash;
            var HashedId8 v_bfk_hashed_id8;
            var Oct16 v_aes_enc_key;

            log(">>> f_verify_http_butterfly_cert_request_message_to_ea: ", p_request);

            p_result := 0;

            if (f_verify_pki_request_message(vc_aaPrivateEncKey, vc_aaWholeHash/*salt*/, ''O,
                                             omit,
                                             p_request.body.binary_body.ieee1609dot2_data, true, v_request_hash, v_bfk_hashed_id8, v_etsi_ts_102941_data, v_aes_enc_key) == false) { // Cannot decrypt the message
              // Send error message
              v_response := m_http_response(m_http_response_ko_no_body(p_headers, 400, "Bad request")); // Initialize v_reponse with an error message
              // Set verdict
              p_result := -1;
            } else {
              var UInt64 v_current_time := f_getCurrentTimeUtc();
              var UInt64 v_delta_time := 30;

              log("f_verify_http_butterfly_cert_request_message_to_ea: match ", match(v_etsi_ts_102941_data, mw_etsiTs102941Data_ra_aca_cert_request(mw_ra_aca_cert_request))); // TODO In TITAN, this is the only way to get the unmatching in log
              if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_ra_aca_cert_request(mw_ra_aca_cert_request((v_current_time - v_delta_time .. v_current_time + v_delta_time), explicit, '00000000'B/*butterflyExplicit*/, mw_bfk_to_be_signed_certificate))) == false) {
                // Send error message
                v_response := m_http_response(m_http_response_ko_no_body(p_headers, 400, "Bad request")); // Initialize v_reponse with an error message
                // Set verdict
                p_result := -2;
              } else {
                // TODO Add checked ???
              }
            }

            log("<<< f_verify_http_butterfly_cert_request_message_to_ea: p_result: ", p_result);
          } // End of function f_verify_http_butterfly_cert_request_message_to_ea

      } // End of group bfk_cert_request_helpers

      /**
       * @desc Check that the AA sends the butterfly certificate response message after receiving of the butterfly certificate request
       *       Check that this message is encrypted using the same symmetric encryption key as the butterfly certificate request message
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *         the EA in "operational" state
       *             authorized with CERT_AA certificate
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT received the ButterflyCertificateRequestMessage
       *              containing content.encryptedData.recipients
       *                containing the instance of RecipientInfo
       *                  containing certRecipInfo
       *                    containing recipientId
       *                      indicating HashedId8 of the CERT_AA
       *                    and containing encKey
       *                      containing encrypted symmetric encryption key (ENC_KEY)
       *         }
       *         then {
       *           the IUT sends to the EA a EtsiTs103097Data-Encrypted
       *             containing content.encryptedData.recipients
       *               indicating size 1
       *             and containing the instance of RecipientInfo
       *               containing pskRecipInfo
       *                 indicating HashedId8 of the ENC_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTHVAL_01_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_BFK_AUTH_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
          // Local variables
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Headers v_headers;
          var HttpMessage v_request;
          var integer v_result;
          var RaAcaCertRequest v_ra_aca_cert_request;
          var AcaRaCertResponse v_aca_ra_cert_response;

          // Test control
          if (not PICS_IUT_AA_ROLE) {
            log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
            setverdict(inconc);
            stop;
          }

          // Test component configuration
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_trigger_butterfly_cert_request(v_aes_sym_key_hashed_id8, v_ra_aca_cert_request);
          f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

          // Test Body
          tc_ac.start;
          alt {
            [] httpAtVPort.receive(