LibItsPki_Functions.ttcn 168 KB
Newer Older
Yann Garcia's avatar
Yann Garcia committed
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
/**
 *  @author   ETSI / STF544
 *  @version  $URL$
 *            $Id$
 *  @desc     Module containing functions for ITS PKI ATS
 *  @copyright   ETSI Copyright Notification
 *               No part may be reproduced except as authorized by written permission.
 *               The copyright and the foregoing restriction extend to reproduction in all media.
 *               All rights reserved.
 *
 */
module LibItsPki_Functions {
    
  // LibCommon
  import from LibCommon_Time all;
  import from LibCommon_VerdictControl all;
  import from LibCommon_Sync all;
  import from LibCommon_BasicTypesAndValues all;
  import from LibCommon_DataStrings all;
  
  // LibIts
  import from IEEE1609dot2BaseTypes language "ASN.1:1997" all;
  import from IEEE1609dot2 language "ASN.1:1997" all;
  import from EtsiTs102941BaseTypes language "ASN.1:1997" all;
  import from EtsiTs102941TypesEnrolment language "ASN.1:1997" all;
26
27
  import from EtsiTs102941TypesAuthorization language "ASN.1:1997" all;
  import from EtsiTs102941TypesAuthorizationValidation language "ASN.1:1997" all;
28
  import from EtsiTs102941MessagesCa language "ASN.1:1997" all;
Yann Garcia's avatar
Yann Garcia committed
29
30
31
32
33
  import from EtsiTs103097Module language "ASN.1:1997" all;
  import from ITS_Container language "ASN.1:1997" all;
  import from CAM_PDU_Descriptions language "ASN.1:1997" all;
  
  // LibItsCommon
garciay's avatar
garciay committed
34
  import from LibItsCommon_TypesAndValues all;
Yann Garcia's avatar
Yann Garcia committed
35
36
37
  import from LibItsCommon_Functions all;
  import from LibItsCommon_ASN1_NamedNumbers all;
  import from LibItsCommon_Pixits all;
garciay's avatar
garciay committed
38
  
39
  // LibItsGeoNetworking
Yann Garcia's avatar
Yann Garcia committed
40
41
  import from LibItsGeoNetworking_TypesAndValues all;
  import from LibItsGeoNetworking_TestSystem all;
42
43
  import from LibItsGeoNetworking_Pixits all;
  
Yann Garcia's avatar
Yann Garcia committed
44
45
46
47
  // LibItsSecurity
  import from LibItsSecurity_TypesAndValues all;
  import from LibItsSecurity_Templates all;
  import from LibItsSecurity_Functions all;
48
  import from LibItsSecurity_Pics all;
Yann Garcia's avatar
Yann Garcia committed
49
  import from LibItsSecurity_Pixits all;
50
  import from LibItsSecurity_TestSystem all;
garciay's avatar
garciay committed
51
  
Yann Garcia's avatar
Yann Garcia committed
52
53
  // LibItsHttp
  import from LibItsHttp_TypesAndValues all;
54
  import from LibItsHttp_Templates all;
Yann Garcia's avatar
Yann Garcia committed
55
56
  import from LibItsHttp_BinaryTemplates all;
  import from LibItsHttp_Functions all;
Yann Garcia's avatar
Yann Garcia committed
57
  import from LibItsHttp_TestSystem all;
garciay's avatar
garciay committed
58
  
Yann Garcia's avatar
Yann Garcia committed
59
  // LibItsPki
garciay's avatar
garciay committed
60
  import from LibItsPki_TypesAndValues all;
Yann Garcia's avatar
Yann Garcia committed
61
  import from LibItsPki_Templates all;
garciay's avatar
garciay committed
62
  import from LibItsPki_Pics all;
garciay's avatar
garciay committed
63
  import from LibItsPki_Pixits all;
Yann Garcia's avatar
Yann Garcia committed
64
  import from LibItsPki_TestSystem all;
garciay's avatar
garciay committed
65
66
  
  group pkiConfigurationFunctions {
Yann Garcia's avatar
Yann Garcia committed
67
68
69
70
71
72
73
74
75
76
77
78
79
80

    function f_cfMtcUp(
                       out ItsPkiItss p_itss,
                       out ItsPkiHttp p_pki
                       ) runs on ItsMtc {
      p_itss := ItsPkiItss.create("IUT") alive;
      p_pki := ItsPkiHttp.create("TS") alive;
      
      connect(self:syncPort, mtc:syncPort);
      connect(p_itss:syncPort, self:syncPort);
      connect(p_pki:syncPort, self:syncPort);
    }
    
    /**
81
     * @desc    Setups default configuration
Yann Garcia's avatar
Yann Garcia committed
82
     * @param   p_certificate_id The certificate identifier the TA shall use in case of secured IUT
Yann Garcia's avatar
Yann Garcia committed
83
84
     */
    function f_cfHttpUp(
garciay's avatar
garciay committed
85
                        in charstring p_ea_certificate_id := "CERT_TS_A_EA", // TODO Use a constant
86
                        in charstring p_aa_certificate_id := "CERT_TS_A_AA"
garciay's avatar
garciay committed
87
                        ) runs on ItsPkiHttp /* TITAN TODO: system ItsPkiHttpSystem */ {
Yann Garcia's avatar
Yann Garcia committed
88

Yann Garcia's avatar
Yann Garcia committed
89
      if (PICS_MULTIPLE_END_POINT == false) {
Yann Garcia's avatar
Yann Garcia committed
90
91
92
93
94
95
        map(self:httpPort, system:httpPort);
      } else {
        map(self:httpEcPort, system:httpEcPort);
        map(self:httpAtVPort, system:httpAtVPort);
        map(self:httpAtPort, system:httpAtPort);
      }
Yann Garcia's avatar
Yann Garcia committed
96
      f_connect4SelfOrClientSync();
97

98
99
100
      f_initialiseSecuredMode(p_ea_certificate_id, p_aa_certificate_id); // TODO To be removed???

      // Setup EA certificate shared with PKI EA entity
garciay's avatar
garciay committed
101
      f_readCertificate(p_ea_certificate_id, vc_eaCertificate);
Yann Garcia's avatar
Yann Garcia committed
102
103
      f_readSigningKey(p_ea_certificate_id, vc_eaPrivateKey); // TODO To be removed
      f_readEncryptingKey(p_ea_certificate_id, vc_eaPrivateEncKey);
garciay's avatar
garciay committed
104
      f_getCertificateDigest(p_ea_certificate_id, vc_eaHashedId8);
105
      f_getCertificateHash(p_ea_certificate_id, vc_eaWholeHash);
Yann Garcia's avatar
Yann Garcia committed
106
      log("f_cfHttpUp: vc_eaPrivateKey= ", vc_eaPrivateKey);
107
      log("f_cfHttpUp: vc_eaPrivateEncKey= ", vc_eaPrivateEncKey);
Yann Garcia's avatar
Yann Garcia committed
108
109
      log("f_cfHttpUp: vc_eaHashedId8= ", vc_eaHashedId8);
      log("f_cfHttpUp: vc_eaWholeHash= ", vc_eaWholeHash);
110
111
112
113
114
      
      // Setup AA certificate shared with PKI AA entity
      f_readCertificate(p_aa_certificate_id, vc_aaCertificate);
      f_getCertificateDigest(p_aa_certificate_id, vc_aaHashedId8);
      f_getCertificateHash(p_aa_certificate_id, vc_aaWholeHash);
Yann Garcia's avatar
Yann Garcia committed
115
116
      log("f_cfHttpUp: vc_aaHashedId8= ", vc_aaHashedId8);
      log("f_cfHttpUp: vc_aaWholeHash= ", vc_aaWholeHash);
Yann Garcia's avatar
Yann Garcia committed
117
118
119
120
121
122
123
124

      if (PICS_MULTIPLE_END_POINT == false) {
        activate(a_default_pki_http());
      } else {
        activate(a_default_pki_http_ec());
        activate(a_default_pki_http_atv());
        activate(a_default_pki_http_at());
      }
Yann Garcia's avatar
Yann Garcia committed
125
    } // End of function f_cfHttpUp
126
    
127
    function f_cfUp_itss(
Yann Garcia's avatar
Yann Garcia committed
128
                         in charstring p_certificate_id := "CERT_TS_A_EA" // TODO Use a constant
129
130
131
                         ) runs on ItsPkiItss /* TITAN TODO: system ItsPkiItssSystem */ {
      
      map(self:geoNetworkingPort, system:geoNetworkingPort);
132
      map(self:utPort, system:utPort);
Yann Garcia's avatar
Yann Garcia committed
133
      //map(self:acPort, system:acPort);
134
      
135
136
      f_initializeState();
      
Yann Garcia's avatar
Yann Garcia committed
137
      // activate(a_default_pki()); TOTO Defualt from geoNet
138
    } // End of function f_cfUp_itss
139

Yann Garcia's avatar
Yann Garcia committed
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
    /**
     * @desc    Deletes default configuration 
     */
    function f_cfMtcDown(
                         inout ItsPkiItss p_itss,
                         inout ItsPkiHttp p_pki
                         ) runs on ItsMtc {
      disconnect(self:syncPort, mtc:syncPort);
      disconnect(p_itss:syncPort, self:syncPort);
      disconnect(p_pki:syncPort, self:syncPort);
      
      p_itss.done;
      p_pki.done;
    }
    
Yann Garcia's avatar
Yann Garcia committed
155
156
157
158
    /**
     * @desc    Deletes default configuration 
     */
    function f_cfHttpDown() runs on ItsPkiHttp /* TITAN TODO: system ItsPkiHttpSystem */ {
Yann Garcia's avatar
Yann Garcia committed
159
160
161
162
163
164
165
      if (PICS_MULTIPLE_END_POINT == false) {
        unmap(self:httpPort, system:httpPort);
      } else {
        unmap(self:httpEcPort, system:httpEcPort);
        unmap(self:httpAtVPort, system:httpAtVPort);
        unmap(self:httpAtPort, system:httpAtPort);
      }
Yann Garcia's avatar
Yann Garcia committed
166
      f_disconnect4SelfOrClientSync();
167
      f_uninitialiseSecuredMode();
Yann Garcia's avatar
Yann Garcia committed
168
169
    } // End of function f_cfHttpDown
    
170
171
172
173
174
    /**
     * @desc    Deletes default configuration 
     */
    function f_cfDown_itss() runs on ItsPkiItss /* TITAN TODO: system ItsPkiItssSystem */ {
      unmap(self:geoNetworkingPort, system:geoNetworkingPort);
175
      unmap(self:utPort, system:utPort);
Yann Garcia's avatar
Yann Garcia committed
176
      //unmap(self:acPort, system:acPort);
177
178
179
      
    } // End of function f_cfDown
    
Yann Garcia's avatar
Yann Garcia committed
180
181
182
    /**
     * @desc Initialise secure mode if required
     */
183
    function f_initialiseSecuredMode(
Yann Garcia's avatar
Yann Garcia committed
184
                                     in charstring p_certificate_id  := "CERT_TS_A_EA", // TODO Use a constant
185
186
                                     in charstring p_peerCertificateId := "CERT_IUT_A_EA"
                                     ) runs on ItsSecurityBaseComponent {
Yann Garcia's avatar
Yann Garcia committed
187
188
189
      // Local variables
      
      // Load certificates
190
      if(not(f_loadCertificates(PX_IUT_SEC_CONFIG_NAME))) {
Yann Garcia's avatar
Yann Garcia committed
191
        log("*** INFO: TEST CASE NOW STOPPING ITSELF! ***");
192
        setverdict(inconc);
Yann Garcia's avatar
Yann Garcia committed
193
194
195
        stop;
      }
      
Yann Garcia's avatar
Yann Garcia committed
196
      //      f_prepareCertificates(p_certificate_id, vc_aaCertificate, vc_atCertificate);
Yann Garcia's avatar
Yann Garcia committed
197
    } // End of function f_initialiseSecuredMode()
198
199
    
    function f_uninitialiseSecuredMode() runs on ItsSecurityBaseComponent {
Yann Garcia's avatar
Yann Garcia committed
200
201
      f_unloadCertificates();
    } // End of function f_uninitialiseSecuredMode()
202
203
    
    function f_initializeState() runs on ItsPkiItss {
Yann Garcia's avatar
Yann Garcia committed
204
205
206
207
208
      var Oct8 v_hashedId8ToBeUsed;

      log(">>> f_initializeState: vc_hashedId8ToBeUsed= ", vc_hashedId8ToBeUsed);
      v_hashedId8ToBeUsed := f_setupIutCertificate(vc_hashedId8ToBeUsed);
      log("f_initializeState: v_hashedId8ToBeUsed= ", v_hashedId8ToBeUsed);
209
210
211
212
213
214
215
216
217

      f_utInitializeIut(UtPkiInitialize: { v_hashedId8ToBeUsed } );

      f_sleep(PX_NEIGHBOUR_DISCOVERY_DELAY);
      
      //      f_acLoadScenario(p_scenario);
      //      f_acStartScenario();
    }
    
Yann Garcia's avatar
Yann Garcia committed
218
  } // End of pkiConfigurationFunctions
garciay's avatar
garciay committed
219

220
221
222
  group ut_port {

    function f_utInitializeIut(template (value) UtPkiInitialize p_init) runs on ItsPkiItss {
Yann Garcia's avatar
Yann Garcia committed
223
      timer tc_wait := PX_TAC;
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
      
      utPort.send(p_init);
      tc_wait.start;
      alt {
        [] utPort.receive(UtPkiResults: { utPkiInitializeResult := true }) {
          tc_wait.stop;
          log("*** f_utInitializeIut: INFO: IUT initialized ***");
        }
        [] utPort.receive {
          tc_wait.stop;
          log("*** f_utInitializeIut: INFO: IUT could not be initialized ***");
          f_selfOrClientSyncAndVerdict("error", e_error);
        }
        [] tc_wait.timeout {
          log("*** f_utInitializeIut: INFO: IUT could not be initialized in time ***");
          f_selfOrClientSyncAndVerdict("error", e_timeout);
        }
      }
      
    } // End of function f_utInitializeIut
    
Yann Garcia's avatar
Yann Garcia committed
245
246
247
248
249
250
251
    function f_sendUtTriggerEnrolmentRequestPrimitive(
                                                      in octetstring p_canonical_id := ''O,
                                                      in Oct1 p_enc_algorithm := '00'O,
                                                      in octetstring p_private_key := ''O,
                                                      in octetstring p_public_key_compressed := ''O,
                                                      in integer p_compressed_mode := 0
                                                      ) runs on ItsPkiItss {
252
253
254
      var TriggerEnrolmentRequest v_ut_trigger_enrolment_request;
      var octetstring v_compressed_public_key;

Yann Garcia's avatar
Yann Garcia committed
255
256
      if (p_compressed_mode == 2) { // TODO v_compressed_public_key := int2oct(p_compressed_mode, 1) & p_public_key_compressed?
        v_compressed_public_key := '02'O & p_public_key_compressed;
257
      } else {
Yann Garcia's avatar
Yann Garcia committed
258
        v_compressed_public_key := '03'O & p_public_key_compressed;
259
260
      }
      
Yann Garcia's avatar
Yann Garcia committed
261
      v_ut_trigger_enrolment_request := { p_canonical_id, p_enc_algorithm, p_private_key, v_compressed_public_key };
262
263
264
265
266
267
268
269
      utPort.send(UtPkiTrigger: { triggerEnrolmentRequest := v_ut_trigger_enrolment_request });
      tc_ac.start;
      alt {
        [] utPort.receive(UtPkiResults: { utPkiTriggerResult := true }) {
          tc_ac.stop;
        }
        [] utPort.receive(UtPkiResults: { utPkiTriggerResult := false }) {
          tc_ac.stop;
Yann Garcia's avatar
Yann Garcia committed
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
          log("*** f_sendUtTriggerEnrolmentRequestPrimitive: ERROR: Received unexpected message ***");
          f_selfOrClientSyncAndVerdict("error", e_error);
        }
        [] tc_ac.timeout {
          log("*** f_sendAcPkiPrimitive: ERROR: Timeout while waiting for adapter control event result ***");
          f_selfOrClientSyncAndVerdict("error", e_timeout);
        }
      } // End of 'alt' statement
    } // End of function f_sendUtTriggerEnrolmentRequestPrimitive
    
    function f_sendUtTriggerAuthorizationRequestPrimitive(
                                                          in octetstring p_canonical_id := ''O,
                                                          in Oct1 p_enc_algorithm := '00'O,
                                                          in octetstring p_private_key := ''O,
                                                          in octetstring p_public_key_compressed := ''O,
                                                          in integer p_compressed_mode := 0
                                                          ) runs on ItsPkiItss {
      var TriggerAuthorizationRequest v_ut_trigger_enrolment_request;
      var octetstring v_compressed_public_key;

      if (p_compressed_mode == 2) { // TODO v_compressed_public_key := int2oct(p_compressed_mode, 1) & p_public_key_compressed?
        v_compressed_public_key := '02'O & p_public_key_compressed;
      } else {
        v_compressed_public_key := '03'O & p_public_key_compressed;
      }
      
      v_ut_trigger_enrolment_request := { p_canonical_id, p_enc_algorithm, p_private_key, v_compressed_public_key };
      utPort.send(UtPkiTrigger: { triggerAuthorizationRequest := v_ut_trigger_enrolment_request });
      tc_ac.start;
      alt {
        [] utPort.receive(UtPkiResults: { utPkiTriggerResult := true }) {
          tc_ac.stop;
        }
        [] utPort.receive(UtPkiResults: { utPkiTriggerResult := false }) {
          tc_ac.stop;
          log("*** f_sendUtTriggerAuthorizationRequestPrimitive: ERROR: Received unexpected message ***");
306
307
308
309
310
311
312
          f_selfOrClientSyncAndVerdict("error", e_error);
        }
        [] tc_ac.timeout {
          log("*** f_sendAcPkiPrimitive: ERROR: Timeout while waiting for adapter control event result ***");
          f_selfOrClientSyncAndVerdict("error", e_timeout);
        }
      } // End of 'alt' statement
Yann Garcia's avatar
Yann Garcia committed
313
    } // End of function f_sendUtTriggerAuthorizationRequestPrimitive
314
315
316
    
  } // End of group ut_port

317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
  group helpers {

    function f_generate_key_pair(
                                 out octetstring p_private_key,
                                 out octetstring p_public_key_x,
                                 out octetstring p_public_key_y,
                                 out octetstring p_public_key_compressed,
                                 out integer p_compressed_mode
                                 ) return boolean {
      if (PX_EC_ALG == e_nist_p256) {
        f_generate_key_pair_nistp256(p_private_key, p_public_key_x, p_public_key_y, p_public_key_compressed, p_compressed_mode);
      } else if (PX_EC_ALG == e_brainpool_p256_r1) {
        f_generate_key_pair_brainpoolp256(p_private_key, p_public_key_x, p_public_key_y, p_public_key_compressed, p_compressed_mode);
      } else {
        // error
        return false;
      }

      return true;
    }

    function f_signWithEcdsa(
                             in octetstring p_toBeSignedSecuredMessage,
                             in octetstring p_certificateIssuer,
                             in octetstring p_privateKey
                             ) return octetstring {
      if (PX_VE_ALG == e_nist_p256) {
        return f_signWithEcdsaNistp256WithSha256(p_toBeSignedSecuredMessage, p_certificateIssuer, p_privateKey);
      } else if (PX_VE_ALG == e_brainpool_p256_r1) {
        return f_signWithEcdsaBrainpoolp256WithSha256(p_toBeSignedSecuredMessage, p_certificateIssuer, p_privateKey);
      } else if (PX_VE_ALG == e_brainpool_p384_r1) {
        return f_signWithEcdsaBrainpoolp384WithSha384(p_toBeSignedSecuredMessage, p_certificateIssuer, p_privateKey);
      }
      
      return ''O;
Yann Garcia's avatar
Yann Garcia committed
352
353
354
355
356
357
358
359
360
361
    } // End of function f_signWithEcdsa

    function f_verifyEcdsa(
                           in octetstring p_tbs,
                           in octetstring p_issuer,
                           in Signature p_signature_,
                           in PublicVerificationKey p_verification_key
                           ) return boolean {
      var boolean v_ret := false;
      
Yann Garcia's avatar
Yann Garcia committed
362
363
364
365
      log(" >>> f_verifyEcdsa: p_tbs", p_tbs);
      log(" >>> f_verifyEcdsa: p_issuer", p_issuer);
      log(" >>> f_verifyEcdsa: p_signature_", p_signature_);
      log(" >>> f_verifyEcdsa: p_verification_key", p_verification_key);
Yann Garcia's avatar
Yann Garcia committed
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
      
      if (ischosen(p_verification_key.ecdsaNistP256)) {
        if (ischosen(p_verification_key.ecdsaNistP256.compressed_y_0)) {
          v_ret := f_verifyWithEcdsaNistp256WithSha256(
                                                       p_tbs,
                                                       p_issuer,
                                                       p_signature_.ecdsaNistP256Signature.rSig.x_only & p_signature_.ecdsaNistP256Signature.sSig,
                                                       p_verification_key.ecdsaNistP256.compressed_y_0,
                                                       0);
        } else {
          v_ret := f_verifyWithEcdsaNistp256WithSha256(
                                                       p_tbs,
                                                       p_issuer,
                                                       p_signature_.ecdsaNistP256Signature.rSig.x_only & p_signature_.ecdsaNistP256Signature.sSig,
                                                       p_verification_key.ecdsaNistP256.compressed_y_1,
                                                       1);
        }
      } else if (ischosen(p_verification_key.ecdsaBrainpoolP256r1)) {
        if (ischosen(p_verification_key.ecdsaBrainpoolP256r1.compressed_y_0)) {
          v_ret := f_verifyWithEcdsaBrainpoolp256WithSha256(
                                                            p_tbs,
                                                            p_issuer,
                                                            p_signature_.ecdsaBrainpoolP256r1Signature.rSig.x_only & p_signature_.ecdsaBrainpoolP256r1Signature.sSig,
                                                            p_verification_key.ecdsaBrainpoolP256r1.compressed_y_0,
                                                            0);
        } else {
          v_ret := f_verifyWithEcdsaBrainpoolp256WithSha256(
                                                            p_tbs,
                                                            p_issuer,
                                                            p_signature_.ecdsaBrainpoolP256r1Signature.rSig.x_only & p_signature_.ecdsaBrainpoolP256r1Signature.sSig,
                                                            p_verification_key.ecdsaBrainpoolP256r1.compressed_y_1,
                                                            1);
        }
      } else if (ischosen(p_verification_key.ecdsaBrainpoolP384r1)) {
        if (ischosen(p_verification_key.ecdsaBrainpoolP384r1.compressed_y_0)) {
          v_ret := f_verifyWithEcdsaBrainpoolp384WithSha384(
                                                            p_tbs,
                                                            p_issuer,
                                                            p_signature_.ecdsaBrainpoolP384r1Signature.rSig.x_only & p_signature_.ecdsaBrainpoolP384r1Signature.sSig,
                                                            p_verification_key.ecdsaBrainpoolP384r1.compressed_y_0,
                                                            0);
        } else {
          v_ret := f_verifyWithEcdsaBrainpoolp384WithSha384(
                                                            p_tbs,
                                                            p_issuer,
                                                            p_signature_.ecdsaBrainpoolP384r1Signature.rSig.x_only & p_signature_.ecdsaBrainpoolP384r1Signature.sSig,
                                                            p_verification_key.ecdsaBrainpoolP384r1.compressed_y_1,
                                                            1);
        }
      }
      
      return v_ret;
    } // End of function f_verifyEcdsa
419
420
421
    
  } // End of group helpers
  
Yann Garcia's avatar
Yann Garcia committed
422
  group http { // TODO Split into EnnerEc, Authorization & AuthorizationValidation
423

424
    function f_http_build_inner_ec_request( // TODO Cleanup parameters
garciay's avatar
garciay committed
425
                                           out octetstring p_private_key,
Yann Garcia's avatar
Yann Garcia committed
426
427
                                           out octetstring p_public_key_compressed,
                                           out integer p_compressed_mode,
428
429
430
431
432
                                           out Oct16 p_aes_sym_key,
                                           out Oct16 p_encrypted_sym_key,
                                           out Oct16 p_authentication_vector,
                                           out Oct12 p_nonce,
                                           out octetstring p_salt,
garciay's avatar
garciay committed
433
                                           out Ieee1609Dot2Data p_ieee1609dot2_signed_and_encrypted_data,
434
                                           out Oct32 p_request_hash
garciay's avatar
garciay committed
435
                                           ) runs on ItsPkiHttp {
436
437
      var InnerEcRequest v_inner_ec_request;
      var Ieee1609Dot2Data v_inner_ec_request_signed_for_pop;
garciay's avatar
garciay committed
438
439
      var octetstring v_public_enc_key;
      var integer v_compressed_enc_key_mode;
Yann Garcia's avatar
Yann Garcia committed
440
      var boolean v_result;
Yann Garcia's avatar
Yann Garcia committed
441
442

      log(">>> f_http_build_inner_ec_request");
Yann Garcia's avatar
Yann Garcia committed
443
      if (f_generate_inner_ec_request(p_private_key, p_public_key_compressed, p_compressed_mode, v_inner_ec_request) == false) {
Yann Garcia's avatar
Yann Garcia committed
444
        log("*** f_http_build_inner_ec_request: ERROR: Failed to generate InnerEcRequest ***");
445
446
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
Yann Garcia's avatar
Yann Garcia committed
447
448
449
      log ("f_http_build_enrolment_request: ==> EC verification private key: ", p_private_key);
      log ("f_http_build_enrolment_request: ==> EC verification public compressed key: ", p_public_key_compressed);
      log ("f_http_build_enrolment_request: ==> EC verification public compressed mode: ", p_compressed_mode);
450
451
      // Generate InnerEcRequestSignedForPoP
      if (f_generate_inner_ec_request_signed_for_pop(p_private_key, v_inner_ec_request, v_inner_ec_request_signed_for_pop) == false) {
Yann Garcia's avatar
Yann Garcia committed
452
        log("*** f_http_build_inner_ec_request: ERROR: Failed to generate InnerEcRequestSignedForPop ***");
453
454
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
Yann Garcia's avatar
Yann Garcia committed
455
      log("f_http_build_enrolment_request: v_inner_ec_request_signed_for_pop= ", v_inner_ec_request_signed_for_pop);
456
      
457
      // Secure InnerEcRequestSignedForPoP message
garciay's avatar
garciay committed
458
459
460
461
      if (f_extract_enc_key(vc_eaCertificate, v_public_enc_key, v_compressed_enc_key_mode) == false) {
        log("*** f_http_build_inner_ec_request: ERROR: Non canonical EA certificate ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
462
463
464
465
      if (PICS_SEC_FIXED_KEYS) { // Debug mode: Use fixed values
        v_public_enc_key := 'DD4F6B0DF57C6E3BD0E32B565CACA1D858CEB08A5C2BBAB2C23E203C6DE697FF'O;
        v_compressed_enc_key_mode := 0;
      }
Yann Garcia's avatar
Yann Garcia committed
466
467
      log("f_http_build_inner_ec_request: Public encryption key: ", v_public_enc_key);
      log("f_http_build_inner_ec_request: Public encryption key comp: ", v_compressed_enc_key_mode);
468
      p_salt := vc_eaWholeHash;
469
      if (PICS_SECPKI_REENROLMENT == false) { // This is the first enrolment, we used Factory keys
Yann Garcia's avatar
Yann Garcia committed
470
        v_result := f_build_pki_secured_request_message_signed_with_pop(PICS_ITS_S_SIGN_NITSP256_PRIVATE_KEY, valueof(m_signerIdentifier_self), vc_eaHashedId8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_inner_ec_request_signed_for_pop(v_inner_ec_request_signed_for_pop))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash);
garciay's avatar
garciay committed
471
      } else { // We use last valid EC certificate
Yann Garcia's avatar
Yann Garcia committed
472
473
474
475
        // TODO Retrieve EC certificate from the first enrolment instead of PX
        log("f_http_build_inner_ec_request: v_ec_private_key: ", PX_EC_PRIVATE_KEY);
        log("f_http_build_inner_ec_request: v_ec_hashed_id8: ", PX_EC_HASHED_ID8);
        v_result := f_build_pki_secured_request_message_signed_with_pop(PX_EC_PRIVATE_KEY, valueof(m_signerIdentifier_digest(PX_EC_HASHED_ID8)), PX_EC_HASHED_ID8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_inner_ec_request_signed_for_pop(v_inner_ec_request_signed_for_pop))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash);
garciay's avatar
garciay committed
476
      }
Yann Garcia's avatar
Yann Garcia committed
477
      if (v_result == false) {
Yann Garcia's avatar
Yann Garcia committed
478
        log("*** f_http_build_inner_ec_request: ERROR: Failed to generate InnerEcRequestSignedForPop ***");
479
        f_selfOrClientSyncAndVerdict("error", e_error);
Yann Garcia's avatar
Yann Garcia committed
480
481
482
      } else {
        log("f_http_build_inner_ec_request: p_ieee1609dot2_signed_and_encrypted_data= ", p_ieee1609dot2_signed_and_encrypted_data);
        log("f_http_build_inner_ec_request: p_request_hash= ", p_request_hash);
483
      }
Yann Garcia's avatar
Yann Garcia committed
484
    } // End of function f_http_build_inner_ec_request
485

486
487
    function f_http_build_invalid_enrolment_request(
                                                    out octetstring p_private_key,
Yann Garcia's avatar
Yann Garcia committed
488
489
                                                    out octetstring p_public_key_compressed,
                                                    out integer p_compressed_mode,
490
491
492
493
494
                                                    out Oct16 p_aes_sym_key,
                                                    out Oct16 p_encrypted_sym_key,
                                                    out Oct16 p_authentication_vector,
                                                    out Oct12 p_nonce,
                                                    out octetstring p_salt,
495
                                                    out Ieee1609Dot2Data p_ieee1609dot2_signed_and_encrypted_data,
496
                                                    out Oct32 p_request_hash
497
498
499
                                                    ) runs on ItsPkiHttp {
      var InnerEcRequest v_inner_ec_request;
      var Ieee1609Dot2Data v_inner_ec_request_signed_for_pop;
garciay's avatar
garciay committed
500
501
502
      var octetstring v_public_enc_key;
      var integer v_compressed_enc_key_mode;
      var boolean v_ret_code;
503
      
Yann Garcia's avatar
Yann Garcia committed
504
      if (f_generate_inner_ec_request(p_private_key, p_public_key_compressed, p_compressed_mode, v_inner_ec_request) == false) {
505
506
507
        log("*** f_http_build_invalid_enrolment_request: ERROR: Failed to generate InnerEcRequest ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
Yann Garcia's avatar
Yann Garcia committed
508
509
510
      log ("f_http_build_invalid_enrolment_request: EC verification private key: ", p_private_key);
      log ("f_http_build_invalid_enrolment_request: EC verification public compressed key: ", p_public_key_compressed);
      log ("f_http_build_invalid_enrolment_request: EC verification public compressed mode: ", p_compressed_mode);
511
512
513
514
515
      // Generate InnerEcRequestSignedForPoP
      if (f_generate_inner_ec_request_signed_for_pop(p_private_key, v_inner_ec_request, v_inner_ec_request_signed_for_pop) == false) {
        log("*** f_http_build_invalid_enrolment_request: ERROR: Failed to generate InnerEcRequestSignedForPop ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
Yann Garcia's avatar
Yann Garcia committed
516
      log("f_http_build_invalid_enrolment_request: v_inner_ec_request_signed_for_pop= ", v_inner_ec_request_signed_for_pop);
517
518
519
520
521
522
      // Modify signature to get an error
      if (ischosen(v_inner_ec_request_signed_for_pop.content.signedData.signature_.ecdsaNistP256Signature)) {
        v_inner_ec_request_signed_for_pop.content.signedData.signature_.ecdsaNistP256Signature.sSig[1] := bit2oct('10101010'B xor4b oct2bit(v_inner_ec_request_signed_for_pop.content.signedData.signature_.ecdsaNistP256Signature.sSig[1]));
      } else {
        v_inner_ec_request_signed_for_pop.content.signedData.signature_.ecdsaBrainpoolP256r1Signature.sSig[1] := bit2oct('10101010'B xor4b oct2bit(v_inner_ec_request_signed_for_pop.content.signedData.signature_.ecdsaBrainpoolP256r1Signature.sSig[1]));
      }
523
      
524
      // Secure InnerEcRequestSignedForPoP message
garciay's avatar
garciay committed
525
      if (f_extract_enc_key(vc_eaCertificate, v_public_enc_key, v_compressed_enc_key_mode) == false) {
Yann Garcia's avatar
Yann Garcia committed
526
        log("*** f_http_build_invalid_enrolment_request: ERROR: Non canonical EA certificate ***");
garciay's avatar
garciay committed
527
528
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
Yann Garcia's avatar
Yann Garcia committed
529
530
      log("*** f_http_build_invalid_enrolment_request: Public encryption key: ", v_public_enc_key);
      log("*** f_http_build_invalid_enrolment_request: Public encryption key comp: ", v_compressed_enc_key_mode);
531
      p_salt := vc_eaWholeHash;
532
      if (PICS_SECPKI_REENROLMENT == false) { // This is the first enrolment, we used Factory keys
533
        v_ret_code := f_build_pki_secured_request_message_signed_with_pop(PICS_ITS_S_SIGN_NITSP256_PRIVATE_KEY, valueof(m_signerIdentifier_self), vc_eaHashedId8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_inner_ec_request_signed_for_pop(v_inner_ec_request_signed_for_pop))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash);
garciay's avatar
garciay committed
534
      } else { // We use last valid EC certificate
Yann Garcia's avatar
Yann Garcia committed
535
536
537
538
        // TODO Retrieve EC certificate from the first enrolment instead of PX
        log("f_http_build_inner_ec_request: v_ec_private_key: ", PX_EC_PRIVATE_KEY);
        log("f_http_build_inner_ec_request: v_ec_hashed_id8: ", PX_EC_HASHED_ID8);
        v_ret_code := f_build_pki_secured_request_message_signed_with_pop(PX_EC_PRIVATE_KEY, valueof(m_signerIdentifier_digest(PX_EC_HASHED_ID8)), PX_EC_HASHED_ID8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_inner_ec_request_signed_for_pop(v_inner_ec_request_signed_for_pop))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash);
garciay's avatar
garciay committed
539
540
      }
      if (v_ret_code == false) {
541
542
543
544
        log("*** f_http_build_invalid_enrolment_request: ERROR: Failed to generate InnerEcRequestSignedForPop ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
      log("*** f_http_build_invalid_enrolment_request: DEBUG: p_ieee1609dot2_signed_and_encrypted_data = ", p_ieee1609dot2_signed_and_encrypted_data);
545
    } // End of function f_http_build_invalid_enrolment_request
garciay's avatar
garciay committed
546

Yann Garcia's avatar
Yann Garcia committed
547
548
549
550
    function f_http_build_inner_ec_response(
                                            in InnerEcRequest p_inner_ec_request,
                                            in EnrolmentResponseCode p_responseCode := ok,
                                            in Oct16 p_request_hash,
551
552
                                            in octetstring p_private_key := ''O,
                                            in octetstring p_digest := ''O,
Yann Garcia's avatar
Yann Garcia committed
553
554
555
556
557
558
559
560
561
562
563
564
                                            in Oct16 p_aes_sym_key,
                                            out Ieee1609Dot2Data p_ieee1609dot2_signed_and_encrypted_data
                                            ) return boolean {
      // Local variables
      var bitstring v_msg_bit;
      var octetstring v_msg;
      var Oct12 v_nonce;
      var Ieee1609Dot2Data v_ieee1609dot2_signed_data;
      var InnerEcResponse v_inner_ec_response;
      var EtsiTs103097Certificate v_ec_certificate;
      var boolean p_result := false;

565
566
567
568
569
570
      log(">>> f_http_build_inner_ec_response: p_inner_ec_request= ", p_inner_ec_request);
      log(">>> f_http_build_inner_ec_response: p_responseCode= ", p_responseCode);
      log(">>> f_http_build_inner_ec_response: p_request_hash= ", p_request_hash);
      log(">>> f_http_build_inner_ec_response: p_private_key= ", p_private_key);
      log(">>> f_http_build_inner_ec_response: p_digest= ", p_digest);
      log(">>> f_http_build_inner_ec_response: p_aes_sym_key= ", p_aes_sym_key);
Yann Garcia's avatar
Yann Garcia committed
571
572
573
574
575
576
577
578
579
580
581
582
      
      // Check expectred response
      if (p_responseCode != ok) {
        v_inner_ec_response := valueof(
                                       m_innerEcResponse_ko(
                                                            p_request_hash,
                                                            p_responseCode
                                                            )
                                       );
        p_result := true;
      } else {
        // Generate the certificate
583
        if (f_generate_ec_certificate_for_inner_ec_response(p_inner_ec_request, p_private_key, p_digest, v_ec_certificate) == false) {
Yann Garcia's avatar
Yann Garcia committed
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
          log("f_http_build_inner_ec_response: Failed to generate the certificate");
          v_inner_ec_response := valueof(
                                         m_innerEcResponse_ko(
                                                              p_request_hash,
                                                              incompleterequest
                                                              )
                                         );
        } else {
          v_inner_ec_response := valueof(
                                         m_innerEcResponse_ok(
                                                              p_request_hash,
                                                              v_ec_certificate
                                                              )
                                         );
        }
      }

      // Secure the response
      log("f_http_build_inner_ec_response: v_inner_ec_response= ", v_inner_ec_response);
      v_msg := bit2oct(encvalue(v_inner_ec_response));
      v_nonce := int2oct(f_getCurrentTime(), 32); // Random value
605
      // TODO Consider  Sha384: m_signerIdentifier_digest(f_HashedId8FromSha384(p_digest))
Yann Garcia's avatar
Yann Garcia committed
606
      if (f_build_pki_secured_response_message(p_private_key,
607
                                               valueof(m_signerIdentifier_digest(f_HashedId8FromSha256(p_digest))),//  in SignerIdentifier p_signer_identifier,
Yann Garcia's avatar
Yann Garcia committed
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
                                               v_msg,
                                               p_aes_sym_key,
                                               v_nonce,
                                               p_ieee1609dot2_signed_and_encrypted_data
                                               ) == false) {
        log("f_http_build_inner_ec_response: Failed to generate the certificate");
        v_inner_ec_response := valueof(
                                       m_innerEcResponse_ko(
                                                            p_request_hash,
                                                            deniedrequest
                                                            )
                                       );
      } else {
        p_result := true;
      }

      return p_result;
    } // End of function f_http_build_inner_ec_response
    
627
628
629
630
    function f_http_build_authorization_request(
                                                in Certificate p_ec_certificate, // Enrolment credentials certificate
                                                in octetstring p_ec_private_key,
                                                out octetstring p_private_key,
Yann Garcia's avatar
Yann Garcia committed
631
                                                out octetstring p_public_key_compressed,
Yann Garcia's avatar
Yann Garcia committed
632
                                                out integer p_compressed_key_mode,
633
                                                out octetstring p_private_enc_key,
Yann Garcia's avatar
Yann Garcia committed
634
                                                out octetstring p_public_compressed_enc_key,
Yann Garcia's avatar
Yann Garcia committed
635
                                                out integer p_compressed_enc_key_mode,
636
637
638
639
640
641
642
643
                                                out Oct16 p_aes_sym_key,
                                                out Oct16 p_encrypted_sym_key,
                                                out Oct16 p_authentication_vector,
                                                out Oct12 p_nonce,
                                                out octetstring p_salt,
                                                out Ieee1609Dot2Data p_ieee1609dot2_signed_and_encrypted_data,
                                                out Oct32 p_request_hash
                                                ) runs on ItsPkiHttp {
vagrant's avatar
vagrant committed
644
      // Local variables
645
646
647
648
      var octetstring v_public_key_x;
      var octetstring v_public_key_y;
      var octetstring v_public_enc_key_x;
      var octetstring v_public_enc_key_y;
vagrant's avatar
vagrant committed
649
650
      var octetstring v_public_enc_key;
      var integer v_compressed_enc_key_mode;
651
652
653
654
      var InnerAtRequest v_inner_at_request;
      var Ieee1609Dot2Data v_inner_at_request_data;
      var InnerAtRequest v_authorization_request;
      var bitstring v_authorization_request_msg;
Yann Garcia's avatar
Yann Garcia committed
655
656
657

      // Generate the InnerAtRequest
      if (f_generate_inner_at_request(vc_eaCertificate, vc_eaHashedId8, p_ec_certificate, p_ec_private_key, p_private_key, p_public_key_compressed, p_compressed_key_mode, p_private_enc_key, p_public_compressed_enc_key, p_compressed_enc_key_mode, v_inner_at_request) == false) {
vagrant's avatar
vagrant committed
658
659
        log("*** f_http_build_authorization_request: ERROR: Failed to generate AuthorizationValidationRequest ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
660
        return;
vagrant's avatar
vagrant committed
661
      }
Yann Garcia's avatar
Yann Garcia committed
662
      log("f_http_build_authorization_request: v_inner_at_request= ", v_inner_at_request);
663
664
665
      
      // Secure InnerAtRequest message
      if (f_extract_enc_key(vc_aaCertificate, v_public_enc_key, v_compressed_enc_key_mode) == false) {
Yann Garcia's avatar
Yann Garcia committed
666
        log("*** f_http_build_authorization_request: ERROR: Non canonical AA certificate ***");
vagrant's avatar
vagrant committed
667
668
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
669
670
671
672
      if (PICS_SEC_FIXED_KEYS) { // Debug mode: Use fixed values
        v_public_enc_key := 'DD4F6B0DF57C6E3BD0E32B565CACA1D858CEB08A5C2BBAB2C23E203C6DE697FF'O;
        v_compressed_enc_key_mode := 0;
      }
vagrant's avatar
vagrant committed
673
674
      log("*** f_http_build_authorization_request: Public encryption key: ", v_public_enc_key);
      log("*** f_http_build_authorization_request: Public encryption key comp: ", v_compressed_enc_key_mode);
675
676
      p_salt := vc_aaWholeHash;
      log("*** f_http_build_authorization_request: p_salt: ", p_salt);
677
678
679
680
681
682
683
      if (PX_AUTHORIZATION_REQUEST_WITH_POP) {
        if(f_build_pki_secured_request_message_signed_with_pop(PICS_ITS_S_SIGN_NITSP256_PRIVATE_KEY, valueof(m_signerIdentifier_self), vc_aaHashedId8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_authorization_request(v_inner_at_request))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash) == false) {
          log("*** f_http_build_authorization_request: ERROR: Failed to generate Authorization Request ***");
          f_selfOrClientSyncAndVerdict("error", e_error);
        }
      } else { // Only encryption of EtsiTs102941Data/InnerAtRequest
        log("*** f_http_build_authorization_request: POP signature not applied");
684
        if(f_build_pki_secured_request_message_for_authorization(vc_aaHashedId8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_authorization_request(v_inner_at_request))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash) == false) {
685
686
687
          log("*** f_http_build_authorization_request: ERROR: Failed to generate Authorization Request ***");
          f_selfOrClientSyncAndVerdict("error", e_error);
        }
688
689
690
691
      }
      log("*** f_http_build_authorization_request: DEBUG: p_ieee1609dot2_signed_and_encrypted_data= ", p_ieee1609dot2_signed_and_encrypted_data);
      log("*** f_http_build_authorization_request: DEBUG: p_request_hash= ", p_request_hash);
    } // End of function f_http_build_authorization_request
692
    
Yann Garcia's avatar
Yann Garcia committed
693
    function f_http_build_authorization_validation_request(
Yann Garcia's avatar
Yann Garcia committed
694
                                                           in InnerAtRequest p_inner_at_request,
garciay's avatar
garciay committed
695
                                                           out octetstring p_private_key,
Yann Garcia's avatar
Yann Garcia committed
696
                                                           out octetstring p_public_key_compressed,
Yann Garcia's avatar
Yann Garcia committed
697
698
699
700
701
702
703
704
705
706
707
                                                           out integer p_compressed_key_mode,
                                                           out octetstring p_private_enc_key,
                                                           out octetstring p_public_compressed_enc_key,
                                                           out integer p_compressed_enc_key_mode,
                                                           out Oct16 p_aes_sym_key,
                                                           out Oct16 p_encrypted_sym_key,
                                                           out Oct16 p_authentication_vector,
                                                           out Oct12 p_nonce,
                                                           out octetstring p_salt,
                                                           out Ieee1609Dot2Data p_ieee1609dot2_signed_and_encrypted_data,
                                                           out Oct32 p_request_hash
garciay's avatar
garciay committed
708
709
710
                                                           ) runs on ItsPkiHttp {
      // Local variables
      var AuthorizationValidationRequest v_authorization_validation_request;
711
      var bitstring v_authorization_validation_request_msg;
garciay's avatar
garciay committed
712
713
      var octetstring v_public_enc_key;
      var integer v_compressed_enc_key_mode;
Yann Garcia's avatar
Yann Garcia committed
714
715
716
717
718

      // Copy the sharedAtRequest component from the InnerAtRequest received in the AuthorizationRequestMessage
      v_authorization_validation_request.sharedAtRequest := p_inner_at_request.sharedAtRequest;
      // Copy the ecSignature component from the InnerAtRequest received in the AuthorizationRequestMessage or AuthorizationRequestMessageWithPop
      v_authorization_validation_request.ecSignature := p_inner_at_request.ecSignature;
garciay's avatar
garciay committed
719
720
      // Secure the Pki message
      if (f_extract_enc_key(vc_eaCertificate, v_public_enc_key, v_compressed_enc_key_mode) == false) {
Yann Garcia's avatar
Yann Garcia committed
721
        log("*** f_http_build_authorization_validation_request: ERROR: Non canonical EA certificate ***");
garciay's avatar
garciay committed
722
723
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
garciay's avatar
garciay committed
724
725
726
      log("*** f_http_build_authorization_validation_request: Public encryption key: ", v_public_enc_key);
      log("*** f_http_build_authorization_validation_request: Public encryption key comp: ", v_compressed_enc_key_mode);

Yann Garcia's avatar
Yann Garcia committed
727
728
729
730
731
732
733
734
735
736
737
738
739
      // Secure InnerAtRequest message
      if (f_extract_enc_key(vc_eaCertificate, v_public_enc_key, v_compressed_enc_key_mode) == false) {
        log("*** f_http_build_authorization_validation_request: ERROR: Non canonical EA certificate ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
      }
      if (PICS_SEC_FIXED_KEYS) { // Debug mode: Use fixed values
        v_public_enc_key := 'DD4F6B0DF57C6E3BD0E32B565CACA1D858CEB08A5C2BBAB2C23E203C6DE697FF'O;
        v_compressed_enc_key_mode := 0;
      }
      log("*** f_http_build_authorization_validation_request: Public encryption key: ", v_public_enc_key);
      log("*** f_http_build_authorization_validation_request: Public encryption key comp: ", v_compressed_enc_key_mode);
      p_salt := vc_eaWholeHash;
      log("*** f_http_build_authorization_validation_request: p_salt: ", p_salt);
740
741
742
      if(f_build_pki_secured_request_message_signed_with_pop(PICS_ITS_S_SIGN_NITSP256_PRIVATE_KEY, valueof(m_signerIdentifier_self), vc_eaHashedId8/*recipientId*/, v_public_enc_key, v_compressed_enc_key_mode, p_salt, bit2oct(encvalue(m_etsiTs102941Data_authorization_validation_request(v_authorization_validation_request))), p_ieee1609dot2_signed_and_encrypted_data, p_aes_sym_key, p_encrypted_sym_key, p_authentication_vector, p_nonce, p_request_hash) == false) {
        log("*** f_http_build_authorization_validation_request: ERROR: Failed to generate Authorization Request ***");
        f_selfOrClientSyncAndVerdict("error", e_error);
Yann Garcia's avatar
Yann Garcia committed
743
744
745
      }
      log("*** f_http_build_authorization_validation_request: DEBUG: p_ieee1609dot2_signed_and_encrypted_data= ", p_ieee1609dot2_signed_and_encrypted_data);
      log("*** f_http_build_authorization_validation_request: DEBUG: p_request_hash= ", p_request_hash);
garciay's avatar
garciay committed
746
    } // End of function f_http_build_authorization_validation_request
Yann Garcia's avatar
Yann Garcia committed
747
    
748
  } // End of group http
749
750
751
752

  group generate_certificates {

    function f_generate_ec_certificate(
Yann Garcia's avatar
Yann Garcia committed
753
                                       out octetstring p_private_key,
754
755
                                       out Certificate p_ec_certificate
                                       ) return boolean {
Yann Garcia's avatar
Yann Garcia committed
756
757
758
759
760
      var octetstring v_public_key_x;
      var octetstring v_public_key_y;
      var octetstring p_public_key_compressed;
      var integer p_compressed_mode;
      var EccP256CurvePoint v_ecc_p256_curve_point;
761
762
763
764
765
766
767
768
      var SequenceOfPsidSsp v_appPermissions := { // ETSI TS 102 965 Table A.1: ETSI ITS standardized ITS-AIDs
        valueof(m_appPermissions(36, { bitmapSsp := '830001'O })), 
        valueof(m_appPermissions(37, { bitmapSsp := '830001'O })) 
      };
      var template (value) EtsiTs103097Certificate v_cert;
      var bitstring v_tbs;
      var Oct32 v_sig;
      var bitstring v_enc_msg;
769
      var PublicVerificationKey v_public_verification_key;
770
      
Yann Garcia's avatar
Yann Garcia committed
771
772
773
      log(">>> f_generate_ec_certificate");
      
      // Generate verification keys for the certificate
774
      if (f_generate_key_pair(p_private_key, v_public_key_x, v_public_key_y, p_public_key_compressed, p_compressed_mode) == false) {
Yann Garcia's avatar
Yann Garcia committed
775
776
777
778
779
780
781
782
        log("f_generate_ec_certificate: Failed to generate verification key");
        return false;
      }
      if (p_compressed_mode == 0) {
        v_ecc_p256_curve_point := valueof(m_eccP256CurvePoint_compressed_y_0(p_public_key_compressed));
      } else {
        v_ecc_p256_curve_point := valueof(m_eccP256CurvePoint_compressed_y_1(p_public_key_compressed));
      }
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797

      if (PX_EC_ALG == e_nist_p256) {
        v_public_verification_key := valueof(
                                             m_publicVerificationKey_ecdsaNistP256(
                                                                                   v_ecc_p256_curve_point
                                                                                   ));
      } else if (PX_EC_ALG == e_brainpool_p256_r1) {
        v_public_verification_key := valueof(
                                             m_publicVerificationKey_ecdsaBrainpoolP256r1(
                                                                                          v_ecc_p256_curve_point
                                                                                          ));
      } else {
        log("f_generate_ec_certificate: Wrong encryption algorithm, check PX_EC_ALG");
        return false;
      }
798
799
800
801
802
      v_cert := m_etsiTs103097Certificate(
                                          m_issuerIdentifier_sha256AndDigest(f_HashedId8FromSha256(f_hashWithSha256('616263'O))),
                                          m_toBeSignedCertificate_at(
                                                                     v_appPermissions,
                                                                     m_verificationKeyIndicator_verificationKey(
803
804
                                                                                                                v_public_verification_key
                                                                                                                ),
805
                                                                     m_validityPeriod(
Yann Garcia's avatar
Yann Garcia committed
806
                                                                                      f_getCurrentTime() / 1000,
807
                                                                                      m_duration_years(1)
808
809
810
811
812
813
814
815
816
817
818
                                                                                      ),
                                                                     m_geographicRegion_identifiedRegion(
                                                                                                         {
                                                                                                           m_identifiedRegion_country_only(12), 
                                                                                                           m_identifiedRegion_country_only(34)
                                                                                                           }
                                                                                                         )
                                                                     )
                                          );
      // Encode it ==> Get octetstring
      v_tbs := encvalue(v_cert.toBeSigned);
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
      // Sign the certificate
      v_sig := f_signWithEcdsa(bit2oct(v_tbs), int2oct(11, 32), p_private_key);
      if ((PX_VE_ALG == e_nist_p256) or (PX_VE_ALG == e_brainpool_p256_r1)) {
        v_cert.signature_ := m_signature_ecdsaNistP256(
                                                       m_ecdsaP256Signature(
                                                                            m_eccP256CurvePoint_x_only(
                                                                                                       substr(v_sig, 0, 32)
                                                                                                       ),
                                                                            substr(v_sig, 32, 32)
                                                                            )
                                                       );
      } else if (PX_VE_ALG == e_brainpool_p384_r1) {
        v_cert.signature_ := m_signature_ecdsaBrainpoolP384r1(
                                                              m_ecdsaP384Signature(
                                                                                   m_eccP384CurvePoint_x_only(
                                                                                                              substr(v_sig, 0, 48)
                                                                                                              ),
                                                                                   substr(v_sig, 48, 48)
                                                                                   )
                                                              );
      }
Yann Garcia's avatar
Yann Garcia committed
840
      log("f_generate_ec_certificate: v_cert= ", v_cert);
841
842
843
844
845
      
      p_ec_certificate := valueof(v_cert);
      return true;
    } // End of function f_generate_ec_certificate
    
Yann Garcia's avatar
Yann Garcia committed
846
847
    function f_generate_ec_certificate_for_inner_ec_response(
                                                             in InnerEcRequest p_inner_ec_request,
848
849
                                                             in octetstring p_private_key,
                                                             in octetstring p_digest,
Yann Garcia's avatar
Yann Garcia committed
850
851
                                                             out EtsiTs103097Certificate p_ec_certificate
                                                             ) return boolean {
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
      var EtsiTs103097Certificate v_cert;
      var IssuerIdentifier v_issuer;
      var bitstring v_tbs;
      var octetstring v_sig;
      
      log(">>> f_generate_ec_certificate_for_inner_ec_response");

      v_issuer := valueof(m_issuerIdentifier_sha256AndDigest(f_HashedId8FromSha256(p_digest))); // TODO Check sha256/384 f_HashedId8FromSha384
      v_cert := valueof(
                        m_etsiTs103097Certificate(
                                                  v_issuer,
                                                  m_toBeSignedCertificate_ec(
                                                                             p_inner_ec_request.requestedSubjectAttributes.id,
                                                                             p_inner_ec_request.requestedSubjectAttributes.appPermissions,
                                                                             m_verificationKeyIndicator_verificationKey(
                                                                                                                        p_inner_ec_request.publicKeys.verificationKey
                                                                                                                        ),
                                                                             p_inner_ec_request.requestedSubjectAttributes.validityPeriod,
                                                                             p_inner_ec_request.requestedSubjectAttributes.region,
                                                                             p_inner_ec_request.requestedSubjectAttributes.assuranceLevel,
                                                                             p_inner_ec_request.publicKeys.encryptionKey
                                                                             )
                                                  )
                        );
Yann Garcia's avatar
Yann Garcia committed
876
877
878
      // Encode it ==> Get octetstring
      v_tbs := encvalue(v_cert.toBeSigned);
      // Sign the certificate
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
      v_sig := f_signWithEcdsa(bit2oct(v_tbs), p_digest, p_private_key);
      if (PX_VE_ALG == e_nist_p256) {
        v_cert.signature_ := valueof(
                                     m_signature_ecdsaNistP256(
                                                               m_ecdsaP256Signature(
                                                                                    m_eccP256CurvePoint_x_only(
                                                                                                               substr(v_sig, 0, 32)
                                                                                                               ),
                                                                                    substr(v_sig, 32, 32)
                                                                                    )
                                                               )
                                     );
      } else if (PX_VE_ALG == e_brainpool_p256_r1) {
        v_cert.signature_ := valueof(
                                     m_signature_ecdsaBrainpoolP256r1(
                                                                      m_ecdsaP256Signature(
                                                                                           m_eccP256CurvePoint_x_only(
                                                                                                                      substr(v_sig, 0, 32)
                                                                                                                      ),
                                                                                           substr(v_sig, 32, 32)
                                                                                           )
                                                                      )
                                     );
Yann Garcia's avatar
Yann Garcia committed
902
      } else if (PX_VE_ALG == e_brainpool_p384_r1) {
903
904
905
906
907
908
909
910
911
912
        v_cert.signature_ := valueof(
                                     m_signature_ecdsaBrainpoolP384r1(
                                                                      m_ecdsaP384Signature(
                                                                                           m_eccP384CurvePoint_x_only(
                                                                                                                      substr(v_sig, 0, 48)
                                                                                                                      ),
                                                                                           substr(v_sig, 48, 48)
                                                                                           )
                                                                      )
                                     );
Yann Garcia's avatar
Yann Garcia committed
913
      }
914
915
      p_ec_certificate := valueof(v_cert);
      log("f_generate_ec_certificate_for_inner_ec_response: p_ec_certificate= ", p_ec_certificate);
Yann Garcia's avatar
Yann Garcia committed
916
917
918
919
      
      return true;
    } // End of function f_generate_ec_certificate_for_inner_ec_response
    
920
921
922
923
924
925
926
927
928
929
930
931
932
    function f_generate_at_certificate(
                                       in octetstring p_private_key,
                                       in InnerEcRequest p_inner_ec_request,
                                       out Certificate p_at_certificate
                                       ) return boolean {
      var SequenceOfPsidSsp v_appPermissions := { // ETSI TS 102 965 Table A.1: ETSI ITS standardized ITS-AIDs
        valueof(m_appPermissions(36, { bitmapSsp := '830001'O })), 
        valueof(m_appPermissions(37, { bitmapSsp := '830001'O })) 
      };
      var template (value) EtsiTs103097Certificate v_cert;
      var bitstring v_tbs;
      var Oct32 v_sig;
      var bitstring v_enc_msg;
933
      var PublicVerificationKey v_public_verification_key;
934
      
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
      if (PX_EC_ALG == e_nist_p256) {
        v_public_verification_key := valueof(
                                             m_publicVerificationKey_ecdsaNistP256(
                                                                                   p_inner_ec_request.publicKeys.verificationKey.ecdsaNistP256
                                                                                   ));
      } else if (PX_EC_ALG == e_brainpool_p256_r1) {
        v_public_verification_key := valueof(
                                             m_publicVerificationKey_ecdsaBrainpoolP256r1(
                                                                                          p_inner_ec_request.publicKeys.verificationKey.ecdsaBrainpoolP256r1
                                                                                          ));
      } else {
        // Error
        log("f_generate_ec_certificate: Wrong encryption algorithm, check PX_EC_ALG");
        return false;
      }
950
951
952
953
954
      v_cert := m_etsiTs103097Certificate(
                                          m_issuerIdentifier_sha256AndDigest(f_HashedId8FromSha256(f_hashWithSha256('616263'O))),
                                          m_toBeSignedCertificate_at(
                                                                     v_appPermissions,
                                                                     m_verificationKeyIndicator_verificationKey(
955
956
                                                                                                                v_public_verification_key
                                                                                                                ),
957
                                                                     m_validityPeriod(
Yann Garcia's avatar
Yann Garcia committed
958
                                                                                      f_getCurrentTime() / 1000,
959
                                                                                      m_duration_years(1)
960
961
962
963
964
965
966
967
968
969
970
                                                                                      ),
                                                                     m_geographicRegion_identifiedRegion(
                                                                                                         {
                                                                                                           m_identifiedRegion_country_only(12), 
                                                                                                           m_identifiedRegion_country_only(34)
                                                                                                           }
                                                                                                         )
                                                                     )
                                          );
      // Encode it ==> Get octetstring
      v_tbs := encvalue(v_cert.toBeSigned);
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
      
      // Sign the certificate
      v_sig := f_signWithEcdsa(bit2oct(v_tbs), int2oct(11, 32), p_private_key);
      if ((PX_VE_ALG == e_nist_p256) or (PX_VE_ALG == e_brainpool_p256_r1)) {
        v_cert.signature_ := m_signature_ecdsaNistP256(
                                                       m_ecdsaP256Signature(
                                                                            m_eccP256CurvePoint_x_only(
                                                                                                       substr(v_sig, 0, 32)
                                                                                                       ),
                                                                            substr(v_sig, 32, 32)
                                                                            )
                                                       );
      } else if (PX_VE_ALG == e_brainpool_p384_r1) {
        v_cert.signature_ := m_signature_ecdsaBrainpoolP384r1(
                                                              m_ecdsaP384Signature(
                                                                                   m_eccP384CurvePoint_x_only(
                                                                                                              substr(v_sig, 0, 48)
                                                                                                              ),
                                                                                   substr(v_sig, 48, 48)
                                                                                   )
                                                              );
      }
993
994
995
996
997
998
999
      log("v_cert= ", v_cert);
      
      p_at_certificate := valueof(v_cert);
      return true;
    } // End of function f_generate_at_certificate
    
  } // End of group generate_certificates 
Yann Garcia's avatar
Yann Garcia committed
1000
  
For faster browsing, not all history is shown. View entire blame