Skip to content
LibItsSecurity_Functions.ttcn 175 KiB
Newer Older
garciay's avatar
garciay committed
                                                                           )
                                                              );
                // Prepare mandatory headers
                if (ischosen(p_signerIdentifierType.certificate)) { // Add the AT certificate
garciay's avatar
garciay committed
                    log("*** " & testcasename() & ": TODO ***");
                    stop;
garciay's avatar
garciay committed
                    /* TODO
                     * v_signerInfo := valueof(
                        m_header_info_signer_info(
                            m_signerIdentifier_certificate(
                                v_atCertificate
                    )));
                } else if (valueof(p_signerIdentifierType) == e_certificate_chain) { // Add the AT certificate + AA EtsiTs103097Certificate
                    v_signerInfo := valueof(
                        m_header_info_signer_info(
                            m_signerIdentifier_certificates(
                                {
                                    v_aaCertificate,
garciay's avatar
garciay committed
                                }
                            )
                    ));*/
                } else if (ischosen(p_signerIdentifierType.digest)) { // Add the AT certificate digest
                    if (ischosen(v_atCertificate.issuer.sha256AndDigest)) {
                        p_securedMessage.content.signedData.hashId := sha256;
                        p_securedMessage.content.signedData.signer := m_signerIdentifier_digest(
                                                                                                f_calculateDigestSha256FromCertificate(v_atCertificate)
                                                                                               );
                    } else if (ischosen(v_atCertificate.issuer.sha384AndDigest)) {
                        p_securedMessage.content.signedData.hashId := sha384;
                        p_securedMessage.content.signedData.signer := m_signerIdentifier_digest(
                                                                                                f_calculateDigestSha384FromCertificate(v_atCertificate)
                                                                                               );
berge's avatar
berge committed
                    }
garciay's avatar
garciay committed
                } else {
                    log("*** " & testcasename() & ": TODO ***");
                    stop;
garciay's avatar
garciay committed
                }
                if (ispresent(v_atCertificate.signature_)) {
                    if (ischosen(v_atCertificate.signature_.ecdsaBrainpoolP256r1Signature)) {
                        p_securedMessage.content.signedData.signature_ := m_signature_ecdsaBrainpoolP256r1(
                                                                                                            m_ecdsaP256Signature(
                                                                                                                                 m_eccP256CurvePoint_x_only(int2oct(0, 32)),
                                                                                                                                 int2oct(0, 32)
                                                                                                                                 )
                                                                                                            );
                    } else if (ischosen(v_atCertificate.signature_.ecdsaBrainpoolP384r1Signature)) {
                        p_securedMessage.content.signedData.signature_ := m_signature_ecdsaBrainpoolP384r1(
                                                                                                            m_ecdsaP384Signature(
                                                                                                                                 m_eccP384CurvePoint_x_only(int2oct(0, 48)),
                                                                                                                                 int2oct(0, 48)
                                                                                                                                 )
                                                                                                            );
                                        } // else, m_signature_ecdsaNistP256 already chosen by default
                }
                log("p_securedMessage = ", p_securedMessage);
garciay's avatar
garciay committed
                return f_buildGnSecuredMessage(p_securedMessage, p_certificateName, p_payloadField/*, v_mandatoryHeaders*/);
garciay's avatar
garciay committed
            } // End of function f_buildGnSecuredCam
berge's avatar
berge committed
            /**
            * @desc This function build and sign the SecureMessage part covered by the signature process including wrong elements of protocols. It is used for BO test cases
garciay's avatar
garciay committed
            * @param p_securedMessage               The signed  SecureMessage part
            * @param  p_protocolVersion             The protocol version to be set. Default: 2
            * @param  p_trailerStatus               The Traile behaviour:
            *                                       <li>0 for no trailer</li>
            *                                       <li>1 for invalid trailer</li>
            *                                       <li>2 for duplicated trailer</li>
            * @param p_payloadField                 Payloads to be included in the message
            * @param p_signerIdentifierType               Add digest or AT certificate or certificate chain
garciay's avatar
garciay committed
            * @param p_threeDLocation               The 3D location
            * @param p_headerInfo                 HeaderInfo to be inserted in the message
garciay's avatar
garciay committed
            * @param p_certificateName              The certificate identifier to be used. Default: TA_CERT_A
            * @param p_addMissingHeaders            Whether to add mandatory headers not present in p_headerInfo
garciay's avatar
garciay committed
            * @param p_alterATCertificateSignature  Set to true to alter the AT certificate signature
            * @param p_alterAACertificateSignature  Set to true to alter the AA certificate signature
berge's avatar
berge committed
            * @return true on success, false otherwise
            * 
            * @see Draft ETSI TS 103 097 V1.1.14 Clause 7.1  Security profile for CAMs
berge's avatar
berge committed
            */
            function f_buildGnSecuredCam_Bo(
garciay's avatar
garciay committed
                                            out template (value) EtsiTs103097Data p_securedMessage,
garciay's avatar
garciay committed
                                            in UInt8 p_protocolVersion := c_protocol_version,
                                            in integer p_trailerStatus := 0,
garciay's avatar
garciay committed
                                            in ToBeSignedData p_payloadField,
                                            in SignerIdentifier p_signerIdentifierType, // FIXME To be reviewed
                                            in template (omit) HeaderInfo p_headerInfo := omit,
garciay's avatar
garciay committed
                                            in charstring p_certificateName := "",
garciay's avatar
garciay committed
                                            in boolean p_addMissingHeaders := true,
                                            in boolean p_alterATCertificateSignature := false,
                                            in boolean p_alterAACertificateSignature := false
            ) runs on ItsSecurityBaseComponent return boolean {
                
                // Local variables
                var EtsiTs103097Certificate v_aaCertificate, v_atCertificate;
                var HeaderInfo v_mandatoryHeaders := {};
                var HeaderInfo v_signerInfo;
                 
                // Load certificates if required
                if (f_prepareCertificates(p_certificateName, v_aaCertificate, v_atCertificate) == false) {
                    return false;
                }
                
garciay's avatar
garciay committed
                if (p_alterATCertificateSignature == true) {
                    v_atCertificate.signature_.ecdsaNistP256Signature.sSig := not4b(v_atCertificate.signature_.ecdsaNistP256Signature.sSig);
garciay's avatar
garciay committed
                }
                
                if (p_alterAACertificateSignature == true) {
                    v_aaCertificate.signature_.ecdsaNistP256Signature.sSig := not4b(v_aaCertificate.signature_.ecdsaNistP256Signature.sSig);
garciay's avatar
garciay committed
                }
                
                /* FIXME To be reviewed if (p_addMissingHeaders == true) {
                    // Prepare mandatory headers
                    if (valueof(p_signerIdentifierType) == e_certificate) { // Add the AT certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificate(
                    } else if (valueof(p_signerIdentifierType) == e_certificate_chain) { // Add the AT certificate + AA EtsiTs103097Certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificates(
                    } else if (valueof(p_signerIdentifierType) == e_certificate_digest_with_sha256) { // Add the AT certificate digest
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_issuerIdentifier_sha256AndDigest(
                                    f_calculateDigestFromCertificate(v_atCertificate)
                        )));
                    }
                    v_mandatoryHeaders := {
                        v_signerInfo,
                        valueof(m_header_info_generation_time(1000 * f_getCurrentTime())), // In us
                        valueof(m_header_info_its_aid(c_its_aid_CAM))
                return f_buildGnSecuredMessage_Bo(p_securedMessage, p_certificateName, p_protocolVersion, p_trailerStatus, p_payloadField, v_mandatoryHeaders, p_headerInfo);
                
            } // End of function f_buildGnSecuredCam_Bo
            
            /**
             * @desc This function build and sign the SecureMessage part covered by the signature process
             * @param p_securedMessage       The signed  SecureMessage part
             * @param p_payloadField        Payloads to be included in the message
             * @param p_signerIdentifierType       Add digest or AT certificate or certificate chain
             * @param p_threeDLocation       The 3D location
             * @param p_headerInfo         HeaderInfo to be inserted in the message
             * @param p_certificateName      The certificate identifier to be used. Default: TA_CERT_A
             * @param p_addMissingHeaders    Whether to add mandatory headers not present in p_headerInfo
             * @return true on success, false otherwise
             */
berge's avatar
berge committed
            function f_buildGnSecuredDenm(
garciay's avatar
garciay committed
                                          out template (value) EtsiTs103097Data p_securedMessage,
                                          in ToBeSignedData p_payloadField,
                                          in SignerIdentifier p_signerIdentifierType,
garciay's avatar
garciay committed
                                          in ThreeDLocation p_threeDLocation,
                                          in template (omit) HeaderInfo p_headerInfo := omit,
garciay's avatar
garciay committed
                                          in charstring p_certificateName := "",
garciay's avatar
garciay committed
                                          in boolean p_addMissingHeaders := true
berge's avatar
berge committed
            ) runs on ItsSecurityBaseComponent return boolean {
berge's avatar
berge committed
                // Local variables
                var EtsiTs103097Certificate v_aaCertificate, v_atCertificate;
                var HeaderInfo v_mandatoryHeaders := {};
                var HeaderInfo v_signerInfo;
                // Load certificates if required
                if (f_prepareCertificates(p_certificateName, v_aaCertificate, v_atCertificate) == false) {
                    return false;
berge's avatar
berge committed
                }
                // Add additional headers if required
                /* FIXME To be reviewed if (p_addMissingHeaders == true) {
berge's avatar
berge committed
                    // Prepare mandatory headers
                    if (valueof(p_signerIdentifierType) == e_certificate) { // Add the AT certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificate(
                    } else if (valueof(p_signerIdentifierType) == e_certificate_chain) { // Add the AT certificate + AA EtsiTs103097Certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificates(
berge's avatar
berge committed
                        ));
                    } else if (valueof(p_signerIdentifierType) == e_certificate_digest_with_sha256) { // Add the AT certificate digest
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_issuerIdentifier_sha256AndDigest(
                                    v_atCertificate.cracaId
berge's avatar
berge committed
                    }
                    v_mandatoryHeaders := {
                        v_signerInfo,
                        valueof(m_header_info_generation_time(1000 * f_getCurrentTime())), // In us
                        valueof(m_header_info_generation_location(p_threeDLocation)),
                        valueof(m_header_info_its_aid(c_its_aid_DENM))
berge's avatar
berge committed
                    }
                // Build the secured message and return it
garciay's avatar
garciay committed
                return f_buildGnSecuredMessage(p_securedMessage, p_certificateName, p_payloadField/*, v_mandatoryHeaders*/);
garciay's avatar
garciay committed
            } // End of function f_buildGnSecuredDenm
            /**
             * @desc This function build and sign the SecureMessage part covered by the signature process including wrong elements of protocols. It is used for BO test cases
             * @param p_securedMessage       The signed  SecureMessage part
             * @param  p_protocolVersion     The protocol version to be set. Default: 2
             * @param  p_trailerStatus       The Traile behaviour:
             *                               <li>0 for no trailer</li>
             *                               <li>1 for invalid trailer</li>
             *                               <li>2 for duplicated trailer</li>
             * @param p_payloadField        Payloads to be included in the message
             * @param p_signerIdentifierType       Add digest or AT certificate or certificate chain
             * @param p_threeDLocation       The 3D location
             * @param p_headerInfo         HeaderInfo to be inserted in the message
             * @param p_certificateName      The certificate identifier to be used. Default: TA_CERT_A
             * @param p_addMissingHeaders    Whether to add mandatory headers not present in p_headerInfo
             * @return true on success, false otherwise
             */
            function f_buildGnSecuredDenm_Bo(
garciay's avatar
garciay committed
                                             out template (value) EtsiTs103097Data p_securedMessage,
garciay's avatar
garciay committed
                                             in UInt8 p_protocolVersion := c_protocol_version,
                                             in integer p_trailerStatus := 0,
garciay's avatar
garciay committed
                                             in ToBeSignedData p_payloadField,
                                             in SignerIdentifier p_signerIdentifierType, // FIXME To be reviewed
                                             in ThreeDLocation p_threeDLocation,
                                             in template (omit) HeaderInfo p_headerInfo := omit,
garciay's avatar
garciay committed
                                             in charstring p_certificateName := "",
                                             in boolean p_addMissingHeaders := true
            ) runs on ItsSecurityBaseComponent return boolean {
                
                // Local variables
                var EtsiTs103097Certificate v_aaCertificate, v_atCertificate;
                var HeaderInfo v_mandatoryHeaders := {};
                var HeaderInfo v_signerInfo;
                 
                // Load certificates if required
                if (f_prepareCertificates(p_certificateName, v_aaCertificate, v_atCertificate) == false) {
                    return false;
                }
                
                // Add additional headers if required
                /* FIXME To be reviewed if (p_addMissingHeaders == true) {
                    // Prepare mandatory headers
                    if (valueof(p_signerIdentifierType) == e_certificate) { // Add the AT certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificate(
                    } else if (valueof(p_signerIdentifierType) == e_certificate_chain) { // Add the AT certificate + AA EtsiTs103097Certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificates(
                    } else if (valueof(p_signerIdentifierType) == e_certificate_digest_with_sha256) { // Add the AT certificate digest
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_issuerIdentifier_sha256AndDigest(
                                    v_atCertificate.cracaId
                        )));
                    }
                    v_mandatoryHeaders := {
                        v_signerInfo,
                        valueof(m_header_info_generation_time(1000 * f_getCurrentTime())), // In us
                        valueof(m_header_info_generation_location(p_threeDLocation)),
                        valueof(m_header_info_its_aid(c_its_aid_DENM))
                
                // Build the secured message and return it
                return f_buildGnSecuredMessage_Bo(p_securedMessage, p_certificateName, p_protocolVersion, p_trailerStatus, p_payloadField, v_mandatoryHeaders, p_headerInfo);
                
            } // End of function f_buildGnSecuredDenm_Bo
            
            * @desc This function build and sign the SecureMessage part covered by the signature process
berge's avatar
berge committed
            * @param p_securedMessage       The signed  SecureMessage part
            * @param p_payloadField         Payloads to be included in the message
            * @param p_signerIdentifierType       Add digest or AT certificate or certificate chain
berge's avatar
berge committed
            * @param p_threeDLocation       The 3D location
            * @param p_headerInfo         HeaderInfo to be inserted in the message
berge's avatar
berge committed
            * @param p_certificateName      The certificate identifier to be used. Default: TA_CERT_A
            * @param p_addMissingHeaders    Whether to add mandatory headers not present in p_headerInfo
            * @return true on success, false otherwise
            */
            function f_buildGnSecuredOtherMessage(
garciay's avatar
garciay committed
                                                  out template (value) EtsiTs103097Data p_securedMessage,
                                                  in ToBeSignedData p_payloadField,
                                                  in SignerIdentifier p_signerIdentifierType, // FIXME To be reviewed
garciay's avatar
garciay committed
                                                  in ThreeDLocation p_threeDLocation,
                                                  in template (omit) HeaderInfo p_headerInfo := omit,
garciay's avatar
garciay committed
                                                  in charstring p_certificateName := "",
garciay's avatar
garciay committed
                                                  in boolean p_addMissingHeaders := true
            ) runs on ItsSecurityBaseComponent return boolean {
                
                // Local variables
                var EtsiTs103097Certificate v_aaCertificate, v_atCertificate;
                var HeaderInfo v_mandatoryHeaders := {};
                var HeaderInfo v_signerInfo;
                // Load certificates if required
                if (f_prepareCertificates(p_certificateName, v_aaCertificate, v_atCertificate) == false) {
                    return false;
                // Add additional headers if required
                /* FIXME To be reviewed if (p_addMissingHeaders == true) {
berge's avatar
berge committed
                    // Prepare mandatory headers
                    if (valueof(p_signerIdentifierType) == e_certificate) { // Add the AT certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificate(
                    } else if (valueof(p_signerIdentifierType) == e_certificate_chain) { // Add the AT certificate + AA EtsiTs103097Certificate
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificates(
berge's avatar
berge committed
                        ));
                    } else if (valueof(p_signerIdentifierType) == e_certificate_digest_with_sha256) { // Add the AT certificate digest
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_issuerIdentifier_sha256AndDigest(
                                    v_atCertificate.cracaId
berge's avatar
berge committed
                    v_mandatoryHeaders := {
                        v_signerInfo,
                        valueof(m_header_info_generation_time(1000 * f_getCurrentTime())), // In us
                        valueof(m_header_info_generation_location(p_threeDLocation))
berge's avatar
berge committed
                    }
                // Build the secured message and return it
garciay's avatar
garciay committed
                return f_buildGnSecuredMessage(p_securedMessage, p_certificateName, p_payloadField/*, v_mandatoryHeaders*/);
            } // End of function f_buildGnSecuredOtherMessage
garciay's avatar
garciay committed
            /**
             * @desc This function build and sign the SecureMessage part covered by the signature process including wrong elements of protocols. It is used for BO test cases
             * @param p_securedMessage       The signed  SecureMessage part
             * @param  p_protocolVersion     The protocol version to be set. Default: 2
             * @param  p_trailerStatus       The Traile behaviour:
             *                               <li>0 for no trailer</li>
             *                               <li>1 for invalid trailer</li>
             *                               <li>2 for duplicated trailer</li>
             * @param p_payloadField        Payloads to be included in the message
             * @param p_signerIdentifierType       Add digest or AT certificate or certificate chain
garciay's avatar
garciay committed
             * @param p_threeDLocation       The 3D location
             * @param p_headerInfo         HeaderInfo to be inserted in the message
garciay's avatar
garciay committed
             * @param p_certificateName      The certificate identifier to be used. Default: TA_CERT_A
             * @param p_addMissingHeaders    Whether to add mandatory headers not present in p_headerInfo
garciay's avatar
garciay committed
             * @return true on success, false otherwise
             */
            function f_buildGnSecuredOtherMessage_Bo(
garciay's avatar
garciay committed
                                                     out template (value) EtsiTs103097Data p_securedMessage,
garciay's avatar
garciay committed
                                                     in UInt8 p_protocolVersion := c_protocol_version,
garciay's avatar
garciay committed
                                                     in integer p_trailerStatus := 0,
garciay's avatar
garciay committed
                                                     in ToBeSignedData p_payloadField,
                                                     in SignerIdentifier p_signerIdentifierType, // FIXME To be reviewed
garciay's avatar
garciay committed
                                                     in ThreeDLocation p_threeDLocation,
                                                     in template (omit) HeaderInfo p_headerInfo := omit,
garciay's avatar
garciay committed
                                                     in charstring p_certificateName := "",
garciay's avatar
garciay committed
                                                     in boolean p_addMissingHeaders := true
            ) runs on ItsSecurityBaseComponent return boolean {
                
                // Local variables
                var EtsiTs103097Certificate v_aaCertificate, v_atCertificate;
                var HeaderInfo v_mandatoryHeaders := {};
                var HeaderInfo v_signerInfo;
garciay's avatar
garciay committed
                
                // Load certificates if required
                if (f_prepareCertificates(p_certificateName, v_aaCertificate, v_atCertificate) == false) {
                    return false;
                }
                
                // Add additional headers if required
                /* FIXME To be reviewed if (p_addMissingHeaders == true) {
garciay's avatar
garciay committed
                    // Prepare mandatory headers
                    if (valueof(p_signerIdentifierType) == e_certificate) { // Add the AT certificate
garciay's avatar
garciay committed
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificate(
garciay's avatar
garciay committed
                                    v_atCertificate
                        )));
                    } else if (valueof(p_signerIdentifierType) == e_certificate_chain) { // Add the AT certificate + AA EtsiTs103097Certificate
garciay's avatar
garciay committed
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_signerIdentifier_certificates(
garciay's avatar
garciay committed
                                    {
                                        v_aaCertificate,
                                        v_atCertificate
                                    }
                                )
                        ));
                    } else if (valueof(p_signerIdentifierType) == e_certificate_digest_with_sha256) { // Add the AT certificate digest
garciay's avatar
garciay committed
                        v_signerInfo := valueof(
                            m_header_info_signer_info(
                                m_issuerIdentifier_sha256AndDigest(
                                    v_atCertificate.cracaId
garciay's avatar
garciay committed
                        )));
                    }
                    v_mandatoryHeaders := {
                        v_signerInfo,
                        valueof(m_header_info_generation_time(1000 * f_getCurrentTime())), // In us
                        valueof(m_header_info_generation_location(p_threeDLocation))
garciay's avatar
garciay committed
                    }
garciay's avatar
garciay committed
                
                // FIXME To be done 
                
                // Build the secured message and return it
garciay's avatar
garciay committed
                return f_buildGnSecuredMessage(p_securedMessage, p_certificateName, p_payloadField/*, v_mandatoryHeaders*/);
garciay's avatar
garciay committed
            } // End of function f_buildGnSecuredOtherMessage_Bo
            
        } // End of group hostSignatureHelpers
        
        group deviceSignatureHelpers {
            
            /**
             * @desc Retrieve the HashedId8 to be sent to the IUT, based on the provided certificate identifier
             * @param p_certificateName The certificate the IUT shall use
             * @return The HashedId8 to be sent to the IUT in the UtInitialize command
             * @verdict Unchanged
             * @remark Component variable vc_hashedId8ToBeUsed shall be set with the IUT certificate to be used
             */
garciay's avatar
garciay committed
            function f_setupIutCertificate(
                                           in charstring p_certificateName
            ) runs on ItsSecurityBaseComponent return HashedId8 {
                // Local variables
filatov's avatar
filatov committed
// FIXME (DF) UNUSED
//                var EtsiTs103097Certificate v_atCertificate;
garciay's avatar
garciay committed
                var HashedId8   v_hashedId8 := '0000000000000000'O;
                
                // Sanity check
                if (lengthof(p_certificateName) == 0) {
                    return v_hashedId8;
                }
                
                // Load certificates
                if(f_getCertificateDigest(p_certificateName, v_hashedId8) == false) {
                    v_hashedId8 := '0000000000000000'O;
garciay's avatar
garciay committed
                }
                
                return v_hashedId8;
            } // End of function f_setupIutCertificate
             
garciay's avatar
garciay committed
            /**
            * @desc Verify the signature of the provided certificate
            * @param p_certificateToBeVerified EtsiTs103097Certificate to be verified
            * @param p_publicKey               Public key to verify the certificate signature
            * @return true on success, false otherwise
            * @verdict
            */
garciay's avatar
garciay committed
            function f_verifyCertificateSignatureWithPublicKey(
                                                               in template (value) EtsiTs103097Certificate p_certificateToBeVerified,
                                                               in template (value) PublicVerificationKey p_publicVerificationKey
            ) return boolean {
                var ToBeSignedCertificate v_toBeSignedCertificate;
                var octetstring v_enc_msg;
                var octetstring v_signature;
                
                log("f_verifyCertificateSignatureWithPublicKey: p_publicVerificationKey=", p_publicVerificationKey);
                
                // Create ToBeSignedCertificate payload to be signed
                v_toBeSignedCertificate := valueof(p_certificateToBeVerified.toBeSigned);
                log("f_verifyCertificateSignatureWithPublicKey: v_toBeSignedCertificate=", v_toBeSignedCertificate);
                
                v_enc_msg := bit2oct(encvalue(v_toBeSignedCertificate));
                log("f_verifyCertificateSignatureWithPublicKey: v_enc_msg=", v_enc_msg);
                
                // Verify payload
                if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP256r1)) {
                    v_signature := valueof(p_certificateToBeVerified.signature_.ecdsaBrainpoolP256r1Signature.rSig.x_only) & valueof(p_certificateToBeVerified.signature_.ecdsaBrainpoolP256r1Signature.sSig);
                    log("f_verifyCertificateSignatureWithPublicKey: v_signedData=", v_signature);
                    if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP256r1.uncompressedP256)) {
                      return f_verifyWithEcdsaBrainpoolp256WithSha256_1(
                                                                        v_enc_msg, 
                                                                        valueof(p_certificateToBeVerified.issuer.sha256AndDigest),
                                                                        v_signature,
                                                                        valueof(p_publicVerificationKey.ecdsaBrainpoolP256r1.uncompressedP256.x),
                                                                        valueof(p_publicVerificationKey.ecdsaBrainpoolP256r1.uncompressedP256.y)
                                                                        );
                    } else if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP256r1.compressed_y_0)) {
                      return f_verifyWithEcdsaBrainpoolp256WithSha256(
                                                                      v_enc_msg,  
                                                                      valueof(p_certificateToBeVerified.issuer.sha256AndDigest),
                                                                      v_signature,
                                                                      valueof(p_publicVerificationKey.ecdsaBrainpoolP256r1.compressed_y_0),
                                                                      0 // Latest bit of the Y-coordinate is 0
                                                                      );
                    } else if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP256r1.compressed_y_1)) {
                      return f_verifyWithEcdsaBrainpoolp256WithSha256(
                                                                      v_enc_msg, 
                                                                      valueof(p_certificateToBeVerified.issuer.sha256AndDigest),
                                                                      v_signature,
                                                                      valueof(p_publicVerificationKey.ecdsaBrainpoolP256r1.compressed_y_1),
                                                                      1 // Latest bit of the Y-coordinate is 1
                                                                      );
                    } else {
                      log("f_verifyCertificateSignatureWithPublicKey: Unknown PublicVerificationKey value");
                      return false;
                } else if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP384r1)) {
                    v_signature := valueof(p_certificateToBeVerified.signature_.ecdsaBrainpoolP384r1Signature.rSig.x_only) & valueof(p_certificateToBeVerified.signature_.ecdsaBrainpoolP384r1Signature.sSig);
                    log("f_verifyCertificateSignatureWithPublicKey: v_signedData=", v_signature);
                    if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP384r1.uncompressedP384)) {
                      return f_verifyWithEcdsaBrainpoolp384WithSha384_1(
                                                                        v_enc_msg, 
                                                                        valueof(p_certificateToBeVerified.issuer.sha384AndDigest),
                                                                        v_signature,
                                                                        valueof(p_publicVerificationKey.ecdsaBrainpoolP384r1.uncompressedP384.x),
                                                                        valueof(p_publicVerificationKey.ecdsaBrainpoolP384r1.uncompressedP384.y)
                                                                        );
                    } else if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP384r1.compressed_y_0)) {
                      return f_verifyWithEcdsaBrainpoolp384WithSha384(
                                                                      v_enc_msg, 
                                                                      valueof(p_certificateToBeVerified.issuer.sha384AndDigest),
                                                                      v_signature,
                                                                      valueof(p_publicVerificationKey.ecdsaBrainpoolP384r1.compressed_y_0),
                                                                      0 // Latest bit of the Y-coordinate is 0
                                                                      );
                    } else if (ischosen(p_publicVerificationKey.ecdsaBrainpoolP384r1.compressed_y_1)) {
                      return f_verifyWithEcdsaBrainpoolp384WithSha384(
                                                                      v_enc_msg, 
                                                                      valueof(p_certificateToBeVerified.issuer.sha384AndDigest),
                                                                      v_signature,
                                                                      valueof(p_publicVerificationKey.ecdsaBrainpoolP384r1.compressed_y_1),
                                                                      1 // Latest bit of the Y-coordinate is 1
                                                                      );
                    } else {
                      log("f_verifyCertificateSignatureWithPublicKey: Unknown PublicVerificationKey value");
                      return false;
                } else if (ischosen(p_publicVerificationKey.ecdsaNistP256)) {
                    v_signature := valueof(p_certificateToBeVerified.signature_.ecdsaNistP256Signature.rSig.x_only) & valueof(p_certificateToBeVerified.signature_.ecdsaNistP256Signature.sSig);
                    log("f_verifyCertificateSignatureWithPublicKey: v_signedData=", v_signature);
                    if (ischosen(p_publicVerificationKey.ecdsaNistP256.uncompressedP256)) {
                      return f_verifyWithEcdsaNistp256WithSha256_1(
                                                                   v_enc_msg, 
                                                                   valueof(p_certificateToBeVerified.issuer.sha256AndDigest),
                                                                   v_signature,
                                                                   valueof(p_publicVerificationKey.ecdsaNistP256.uncompressedP256.x),
                                                                   valueof(p_publicVerificationKey.ecdsaNistP256.uncompressedP256.y)
                                                                   );
                    } else if (ischosen(p_publicVerificationKey.ecdsaNistP256.compressed_y_0)) {
                      return f_verifyWithEcdsaNistp256WithSha256(
                                                                      v_enc_msg, 
                                                                      valueof(p_certificateToBeVerified.issuer.sha256AndDigest),
                                                                      v_signature,
                                                                      valueof(p_publicVerificationKey.ecdsaNistP256.compressed_y_0),
                                                                      0 // Latest bit of the Y-coordinate is 0
                                                                      );
                    } else if (ischosen(p_publicVerificationKey.ecdsaNistP256.compressed_y_1)) {
                      return f_verifyWithEcdsaNistp256WithSha256(
                                                                      v_enc_msg, 
                                                                      valueof(p_certificateToBeVerified.issuer.sha256AndDigest),
                                                                      v_signature,
                                                                      valueof(p_publicVerificationKey.ecdsaNistP256.compressed_y_1),
                                                                      1 // Latest bit of the Y-coordinate is 1
                                                                      );
                    } else {
                      log("f_verifyCertificateSignatureWithPublicKey: Unknown PublicVerificationKey value");
                      return false;
            } // End of finction f_verifyCertificateSignatureWithPublicKey
            * @desc Verify the signature of the provided secured message
            * @param p_certificateToBeVerified EtsiTs103097Certificate to be verified
            * @param p_issuingCertificate      Issuing certificate
            * @return true on success, false otherwise
            * @verdict
            */
            function f_verifyCertificateSignatureWithIssuingCertificate(
                                                                        in template (value) EtsiTs103097Certificate p_certificateToBeVerified,
                                                                        in template (value) EtsiTs103097Certificate p_issuingCertificate
                // Sanity checks
                if (not(ischosen(p_issuingCertificate.toBeSigned.verifyKeyIndicator.verificationKey))) {
                    return false;
                }
                return f_verifyCertificateSignatureWithPublicKey(
                                                                 p_certificateToBeVerified,
                                                                 p_issuingCertificate.toBeSigned.verifyKeyIndicator.verificationKey
                                                                 );
            } // End of function f_verifyCertificateSignatureWithIssuingCertificate
            
             * @desc Verify the signature of the provided secured message for ECDSA Nist-P256 algorithm
             * @param p_securedMessage  The message to be verified
             * @param p_publicKey       The ECDSA public key to verify a signature
             * @param p_certificate     EtsiTs103097Certificate to be used to verify the message
             * @return true on success, false otherwise
             * @verdict Unchanged
             */
            function f_verifyGnSecuredMessageSignature_ecdsaNistP256(
                                                                     in template (value) Ieee1609Dot2Data p_securedMessage,
                                                                     in template (value) HashedId8 p_certificateIssuer,
                                                                     in template (value) EccP256CurvePoint p_publicKey
            ) return boolean {
                
                // Local variables
                var octetstring v_secPayload;
                var octetstring v_signedData;
                var boolean v_result := false;
                var template (value) ToBeSignedData v_toBeSignedData;
                
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaNistP256: p_securedMessage= ", p_securedMessage);
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaNistP256: p_certificateIssuer= ", p_certificateIssuer);
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaNistP256: p_publicKey= ", p_publicKey);
                
                // Create Ieee1609Dot2Data payload to be signed
                v_toBeSignedData := valueof(p_securedMessage.content.signedData.tbsData);
                log("f_verifyGnSecuredMessageSignature_ecdsaNistP256: v_toBeSignedData=", p_securedMessage.content.signedData.tbsData);
                
                v_secPayload := bit2oct(encvalue(v_toBeSignedData));
                log("f_verifyGnSecuredMessageSignature_ecdsaNistP256: v_secPayload=", v_secPayload);
                
                // Verify payload
                v_signedData := valueof(p_securedMessage.content.signedData.signature_.ecdsaNistP256Signature.rSig.x_only) & valueof(p_securedMessage.content.signedData.signature_.ecdsaNistP256Signature.sSig);
                log("f_verifyGnSecuredMessageSignature_ecdsaNistP256: v_signedData=", v_signedData);
                if (ischosen(p_publicKey.uncompressedP256)) {
                    v_result := f_verifyWithEcdsaNistp256WithSha256_1(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.uncompressedP256.x),
                        valueof(p_publicKey.uncompressedP256.y)
                    );
                } else if (ischosen(p_publicKey.compressed_y_0)) {
                    v_result := f_verifyWithEcdsaNistp256WithSha256(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.compressed_y_0),
                        0
                    );
                } else if (ischosen(p_publicKey.compressed_y_1)) {
                    v_result := f_verifyWithEcdsaNistp256WithSha256(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.compressed_y_1),
                        1
                    );
                }
                
                log("f_verifyGnSecuredMessageSignature_ecdsaNistP256: v_result=", v_result);
                return v_result;
            } // End of function f_verifyGnSecuredMessageSignature_ecdsaNistP256
            
            /**
             * @desc Verify the signature of the provided secured message for ECDSA Brainpool-P256 algorithm
             * @param p_securedMessage  The message to be verified
             * @param p_publicKey       The ECDSA public key to verify a signature
             * @param p_certificate     EtsiTs103097Certificate to be used to verify the message
             * @return true on success, false otherwise
             * @verdict Unchanged
             */
            function f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1(
                                                                            in template (value) Ieee1609Dot2Data p_securedMessage,
                                                                            in template (value) HashedId8 p_certificateIssuer,
                                                                            in template (value) EccP256CurvePoint p_publicKey
            ) return boolean {
                
                // Local variables
                var octetstring v_secPayload;
                var octetstring v_signedData;
                var boolean v_result := false;
                var template (value) ToBeSignedData v_toBeSignedData;
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: p_securedMessage= ", p_securedMessage);
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: p_certificateIssuer= ", p_certificateIssuer);
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: p_publicKey= ", p_publicKey);
                // Create Ieee1609Dot2Data payload to be signed
                v_toBeSignedData := valueof(p_securedMessage.content.signedData.tbsData);
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: v_toBeSignedData=", p_securedMessage.content.signedData.tbsData);
                
                v_secPayload := bit2oct(encvalue(v_toBeSignedData));
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: v_secPayload=", v_secPayload);
                
                // Verify payload
                v_signedData := valueof(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP256r1Signature.rSig.x_only) & valueof(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP256r1Signature.sSig);
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: v_signedData=", v_signedData);
                if (ischosen(p_publicKey.uncompressedP256)) {
                    v_result := f_verifyWithEcdsaBrainpoolp256WithSha256_1(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.uncompressedP256.x),
                        valueof(p_publicKey.uncompressedP256.y)
                    );
                } else if (ischosen(p_publicKey.compressed_y_0)) {
                    v_result := f_verifyWithEcdsaBrainpoolp256WithSha256(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.compressed_y_0),
                        0
                    );
                } else if (ischosen(p_publicKey.compressed_y_1)) {
                    v_result := f_verifyWithEcdsaBrainpoolp256WithSha256(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.compressed_y_1),
                        1
                    );
                }
                
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1: v_result=", v_result);
                return v_result;
            } // End of function f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1
            
            /**
             * @desc Verify the signature of the provided secured message for ECDSA Brainpool-P384 algorithm
             * @param p_securedMessage  The message to be verified
             * @param p_publicKey       The ECDSA public key to verify a signature
             * @param p_certificate     EtsiTs103097Certificate to be used to verify the message
             * @return true on success, false otherwise
             * @verdict Unchanged
             */
            function f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1(
                                                                            in template (value) Ieee1609Dot2Data p_securedMessage,
                                                                            in template (value) HashedId8 p_certificateIssuer,
                                                                            in template (value) EccP384CurvePoint p_publicKey
            ) return boolean {
                
                // Local variables
                var octetstring v_secPayload;
                var octetstring v_signedData;
                var boolean v_result := false;
                var template (value) ToBeSignedData v_toBeSignedData;
                
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: p_securedMessage= ", p_securedMessage);
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: p_certificateIssuer= ", p_certificateIssuer);
                log(">>> f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: p_publicKey= ", p_publicKey);
                
                // Create Ieee1609Dot2Data payload to be signed
                v_toBeSignedData := valueof(p_securedMessage.content.signedData.tbsData);
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: v_toBeSignedData=", p_securedMessage.content.signedData.tbsData);
                v_secPayload := bit2oct(encvalue(v_toBeSignedData));
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: v_secPayload=", v_secPayload);
                
                // Verify payload
                v_signedData := valueof(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP384r1Signature.rSig.x_only) & valueof(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP384r1Signature.sSig);
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: v_signedData=", v_signedData);
                if (ischosen(p_publicKey.uncompressedP384)) {
                    v_result := f_verifyWithEcdsaBrainpoolp384WithSha384_1(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.uncompressedP384.x),
                        valueof(p_publicKey.uncompressedP384.y)
                    );
                } else if (ischosen(p_publicKey.compressed_y_0)) {
                    v_result := f_verifyWithEcdsaBrainpoolp384WithSha384(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.compressed_y_0),
                        0
                    );
                } else if (ischosen(p_publicKey.compressed_y_1)) {
                    v_result := f_verifyWithEcdsaBrainpoolp384WithSha384(
                        v_secPayload, 
                        valueof(p_certificateIssuer),
                        v_signedData,
                        valueof(p_publicKey.compressed_y_1),
                        1
                    );
                }
                log("f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1: v_result=", v_result);
                return v_result;
            } // End of function f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1
            * @desc Verify the signature of the provided secured message
            * @param p_securedMessage
            * @param p_certificate     EtsiTs103097Certificate to be used to verify the message
            * @return true on success, false otherwise
            * @verdict
            */
            function f_verifyGnSecuredMessageSignatureWithCertificate(
                                                                      in template (value) Ieee1609Dot2Data p_securedMessage,
                                                                      in template (value) EtsiTs103097Certificate p_certificate
                if (ischosen(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP256r1Signature)) {
                    return f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP256r1(p_securedMessage, p_certificate.issuer.sha256AndDigest, p_certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaBrainpoolP256r1);
                } else if (ischosen(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP384r1Signature)) {
                    return f_verifyGnSecuredMessageSignature_ecdsaBrainpoolP384r1(p_securedMessage, p_certificate.issuer.sha384AndDigest, p_certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaBrainpoolP384r1);
                } else if (ischosen(p_securedMessage.content.signedData.signature_.ecdsaNistP256Signature)) {
                    return f_verifyGnSecuredMessageSignature_ecdsaNistP256(p_securedMessage, p_certificate.issuer.sha256AndDigest, p_certificate.toBeSigned.verifyKeyIndicator.verificationKey.ecdsaNistP256);
                return false;
            } // End of function f_verifyGnSecuredOtherMessageWithDeviceCertificate
        } // End of group deviceSignatureHelpers
filatov's avatar
filatov committed
        group messageGetters {
            * @desc    return Ieee1609Dot2Data header field of given type or null if none
            * @param   p_msg the Ieee1609Dot2Data
            * @param   p_type header field type
            * @return  HeaderInfo of given type if any or null
garciay's avatar
garciay committed
            function f_getMsgHeaderInfo(
garciay's avatar
garciay committed
                                        in template(omit) Ieee1609Dot2Data p_securedMessage,
                                        out HeaderInfo p_return
garciay's avatar
garciay committed
                var integer v_length;
                var Ieee1609Dot2Data v_securedMessage;
garciay's avatar
garciay committed
                
garciay's avatar
garciay committed
                if (not isvalue(p_securedMessage)) {
                    testcase.stop(__SCOPE__ & " can not handle omitted secured message values");
                }
                v_securedMessage := valueof(p_securedMessage);
garciay's avatar
garciay committed
                if (ispresent(v_securedMessage.content.signedData)) {
                    p_return := v_securedMessage.content.signedData.tbsData.headerInfo;
                    return true;
                }

                log("f_getMsgHeaderField: return false");
            * @desc    return SignerIdentifier Ieee1609Dot2Data field
            function f_getMsgSignerIdentifier (
garciay's avatar
garciay committed
                                               in template(omit) Ieee1609Dot2Data p_securedMessage,
                                               out SignerIdentifier p_signerIdentifier
garciay's avatar
garciay committed
                if (not isvalue(p_securedMessage)) {
                    testcase.stop(__SCOPE__ & " can not handle omitted secured message values");
                }
                
                if (ischosen(p_securedMessage.content.signedData)) {
garciay's avatar
garciay committed
                    p_signerIdentifier := valueof(p_securedMessage.content.signedData.signer);
                    return true;
                }
                log("f_getMsgSignerIdentifier: return false");
garciay's avatar
garciay committed
            
garciay's avatar
garciay committed
        } // End of group messageGetters
filatov's avatar
filatov committed
        
        group certificateGetters {
             * @desc Set the generation location as defined in Draft ETSI TS 103 097 V1.1.14 Clause 7.2 Security profile for DENMs
             * @param p_latitude    The latitude value of the ITS-S position
             * @param p_longitude   The longitude value of the ITS-S position
             * @param p_elevation   The elevation value of the ITS-S position
             * @verdict Unchanged
             */
            function f_setGenerationLocation(
                                             in SecLatitude p_latitude,
                                             in SecLongitude p_longitude,
                                             in SecElevation p_elevation := 0
            ) runs on ItsSecurityBaseComponent {
                vc_location := {
                    p_latitude,
                    p_longitude,
                    p_elevation
                }
            } // End of function f_setGenerationLocation
            * @desc    Load in memory cache the certificates available
            * @param   p_configId      A configuration identifier
            * @remark  This method SHALL be call before any usage of certificates
            * @return  true on success, false otherwise
            */
            function f_loadCertificates(
garciay's avatar
garciay committed
                                        in charstring p_configId
            ) runs on ItsSecurityBaseComponent return boolean {
                // Setup certificates memory cache
garciay's avatar
garciay committed
                if (fx_loadCertificates(PX_CERTIFICATE_POOL_PATH, p_configId) == true) {
                  // Setup security component variables
                  if (f_readCertificate(cc_taCert_A, vc_atCertificate) == true) {
garciay's avatar
garciay committed
                    var HashedId8 v_issuer;
                    log("Issuer: ", vc_atCertificate.issuer);
                    if (ischosen(vc_atCertificate.issuer.sha256AndDigest)) {
                      v_issuer := vc_atCertificate.issuer.sha256AndDigest;
                    } else if (ischosen(vc_atCertificate.issuer.sha384AndDigest)) {
                      v_issuer := vc_atCertificate.issuer.sha384AndDigest;
                    } else {
                      log("AT certificate cannot be issued by CA");
                      return false;
                    }
                    log("Selected issuer: ", v_issuer);
                    if (f_getCertificateFromDigest(v_issuer, vc_aaCertificate)) {
                      if (f_readSigningKey(cc_taCert_A, vc_signingPrivateKey) == true) {
                        f_readEncryptingKey(cc_taCert_A, vc_encryptPrivateKey);
                        return true;
                      }
                      log("f_loadCertificates: Failed to load signing key for ", cc_taCert_A);
                    } else {
                      log("f_loadCertificates: Failed to load AA certificate for ", cc_taCert_A);
                    }
                  } else {
                    log("f_loadCertificates: Failed to load AT certificate for ", cc_taCert_A);
                  }
garciay's avatar
garciay committed
                } else {
                  log("f_loadCertificates: Failed to load certificates from ", PX_CERTIFICATE_POOL_PATH);
garciay's avatar
garciay committed
                }
                return false;
            } // End of function f_loadCertificates
            
            /**
            * @desc    Unload from memory cache the certificates available
            * @return  true on success, false otherwise
            */
            function f_unloadCertificates() runs on ItsSecurityBaseComponent return boolean {
                // Reset security component variables
                vc_signingPrivateKey := ''O;
                vc_encryptPrivateKey := ''O;
                // Clear certificates memory cache
                return fx_unloadCertificates();
            } // End of function f_unloadCertificates
            * @desc    Read the specified certificate
            * @param   p_certificateId the certificate identifier
            * @param   p_certificate   the expected certificate
            * @return  true on success, false otherwise
            */
            function f_readCertificate(
garciay's avatar
garciay committed
                                       in charstring p_certificateId,
                                       out EtsiTs103097Certificate p_certificate
            ) runs on ItsSecurityBaseComponent return boolean {
                var octetstring v_certificate;
                
                if (fx_readCertificate(p_certificateId, v_certificate) == true) {
garciay's avatar
garciay committed
                    var bitstring v_oct2bit;
                    var integer v_result;
                    
                    v_oct2bit := oct2bit(v_certificate);
                    v_result := decvalue(v_oct2bit, p_certificate);
                    if (v_result == 0) {
                        return true;
                    }
                }
                
                log("f_readCertificate: Failed to retrieve ", p_certificateId);
                return false;
            } // End of function f_readCertificate

            /**
            * @desc    Read the specified certificate
            * @param   p_certificateId the certificate identifier
            * @param   p_certificate   the expected certificate
            * @return  true on success, false otherwise
            */
            function f_getCertificateDigest(
garciay's avatar
garciay committed
                                            in charstring p_certificateId,
                                            out HashedId8 p_digest
            ) runs on ItsSecurityBaseComponent return boolean {
                if (not fx_readCertificateDigest(p_certificateId, p_digest)){
                    log("f_getCertificateDigest: Failed to retrieve digest for ", p_certificateId);
                    return false;
                }