Improved TrusPoints management (a1060a3f) · Commits · MTS - Methods for Testing and Specification / ePassport

ePassport/ttcn/ePassport_Altsteps.ttcn

+17 −21

Original line number	Diff line number	Diff line
		@@ -245,7 +245,7 @@
		v_offset := v_readCommand.params.longOffset.offset;
		v_dataLength := v_readCommand.lengthE;

		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);

		if(v_data == ''O) {
		mrtdport.send(m_responseNOK(c_w1w2WrongParametersP1P2));
		@@ -281,7 +281,7 @@
		v_offset := v_readCommand.params.fileIdAndOffset.offset;
		v_dataLength := v_readCommand.lengthE;

		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);
		if(v_data == ''O ) {
		mrtdport.send(m_responseNOK(v_result));
		}
		@@ -515,7 +515,7 @@

		if(vc_simu.securityStatus != e_noApplication) {
		// Reset MRTD settings
		f_initializeMRTD(vc_simu.ePassportProfile);
		f_initializeMRTD(vc_simu.ePassportProfile, vc_simu.passportProtection);
		}

		vc_simu.securityStatus := e_noSecurity;
		@@ -545,8 +545,6 @@
		v_challengeResponse := v_command.payload
		.externalOrMutualAuthenticateData.challengeResponse ;

		// TODO check vc_simu.rndIcc != omit

		v_response := f_basicAccessControl(vc_simu.challenge, v_challengeResponse);
		if(v_response != ''O) {
		mrtdport.send(m_responseRead(v_response));
		@@ -559,7 +557,7 @@
		} // end a_bac


		altstep a_readFile(in FileInfo p_file) runs on MRTD {
		altstep a_readFile(in ElementFileInfo p_file) runs on MRTD {

		var CommandSelect v_selectCommand;
		var CommandReadBinary v_readCommand;
		@@ -588,7 +586,7 @@
		v_offset := v_readCommand.params.longOffset.offset;
		v_dataLength := v_readCommand.lengthE;

		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);
		mrtdport.send(m_responseReadWithStatus(v_data, v_result));
		t_ac.start;
		repeat;
		@@ -618,7 +616,7 @@
		v_offset := v_readCommand.params.fileIdAndOffset.offset;
		v_dataLength := v_readCommand.lengthE;

		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);
		if(v_data == ''O ) {
		mrtdport.send(m_responseNOK(v_result));
		}
		@@ -640,7 +638,7 @@
		repeat;
		}

		// FIXME Dirty hack. Codec needed.
		// Manual encoding. Codec needed
		v_encodedTlv := v_readB1Command.payload.readBinaryWithOffsetDataObjectData.data;
		v_encodedLength := oct2int(v_encodedTlv[1]);

		@@ -654,7 +652,7 @@

		if(ispresent(v_readB1Command.lengthE)) {
		v_dataLength := v_readB1Command.lengthE - 1 - lengthof(f_encodeLength(v_readB1Command.lengthE - 2)); // -1 => tag 53 and length field
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);
		}
		else {
		v_data := ''O;
		@@ -705,7 +703,7 @@
		v_offset := v_readCommand.params.longOffset.offset;
		v_dataLength := v_readCommand.lengthE;

		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel],
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename,
		v_offset, v_dataLength, v_data);
		mrtdport.send(m_responseReadWithStatus(v_data, v_result));
		t_ac.start;
		@@ -738,7 +736,7 @@

		if(ispresent(v_readCommand.lengthE)) {
		v_dataLength := v_readCommand.lengthE;
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);
		}
		else {
		v_data := ''O;
		@@ -766,7 +764,7 @@
		repeat;
		}

		// FIXME Dirty hack. Codec needed.
		// Manual encoding. Codec needed
		v_encodedTlv := v_readB1Command.payload.readBinaryWithOffsetDataObjectData.data;
		v_encodedLength := oct2int(v_encodedTlv[1]);

		@@ -780,7 +778,7 @@

		if(ispresent(v_readB1Command.lengthE)) {
		v_dataLength := v_readB1Command.lengthE - 1 - lengthof(f_encodeLength(v_readB1Command.lengthE - 2)); // -1 => tag 53 and length field
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel], v_offset, v_dataLength, v_data);
		v_result := f_readFileData(vc_simu.currentFiles[v_logicalChannel].filename, v_offset, v_dataLength, v_data);
		}
		else {
		v_data := ''O;
		@@ -798,7 +796,7 @@

		} // end of a_readAnyFile

		altstep a_refuseFileAccess(in FileInfo p_file) runs on MRTD {
		altstep a_refuseFileAccess(in ElementFileInfo p_file) runs on MRTD {

		// SELECT Command
		[] mrtdport.receive(mw_selectByFileId(p_file.longFileId)) {
		@@ -814,11 +812,8 @@
		repeat;
		}

		// TODO: receive statements for B1

		} // end a_refuseFileAccess

		//FIXME: duplicated code
		altstep a_refuseAnyFileAccess() runs on MRTD {

		// SELECT Command
		@@ -841,6 +836,7 @@
		repeat;
		}

		// READ Command with DO (using current EF)
		[] mrtdport.receive(mw_readCurrentEFWithOffsetDataObject) {
		mrtdport.send(m_responseNOK(c_w1w2NoCurrentEF));
		repeat;

ePassport/ttcn/ePassport_Functions.ttcn

+69 −45

Original line number	Diff line number	Diff line
		@@ -36,6 +36,7 @@
		* @see Automatic Interfaces Specification (Version 1.0) - Clause 2. Automatic Interface Proposal
		*/
		external function fx_deactivateProbe();

		} // end managementExternalFunctions

		group securityExternalFunctions {
		@@ -180,7 +181,7 @@
		*/
		external function fx_extractPublicKey(in octetstring p_dgfile, out octetstring p_publicKey) return KeyAgreementAlgorithm;

		/*
		/**
		* @desc Compute a Diffie-Hellman shared secret
		* @param p_privateKeyPicc Private key of peer A
		* @param p_publicKeyPiccAndDomainInfo Public key of peer A (not used) and DH domain info
		@@ -539,16 +540,14 @@
		var KeyAgreementAlgorithm v_algo;
		var octetstring v_dummy;
		var octetstring v_dg14PrivateKey;
		var FileInfo v_dg14PrFileInfo;
		var charstring v_dg14PrFile;

		// a) The shared secret K = KA(SKPICC;^PKPCD;DPICC) = KA(^SKPCD;PKPICC;DPICC)
		// select private key based on key ref
		v_dg14PrFileInfo := c_filePrCA;
		if(p_keyReference != ''O) {
		v_dg14PrFileInfo.filename := v_dg14PrFileInfo.filename & "." & oct2str(p_keyReference);
		v_dg14PrFile := c_filePrCA & "." & oct2str(p_keyReference);
		}
		log(v_dg14PrFileInfo);
		if(f_readFileData(v_dg14PrFileInfo, 0, -1, v_dg14PrivateKey) == c_w1w2FileOrApplicationNotFound) {
		if(f_readFileData(v_dg14PrFile, 0, -1, v_dg14PrivateKey) == c_w1w2FileOrApplicationNotFound) {
		return c_w1w2ReferencedDataOrReferenceDataNotFound;
		}
		v_algo := f_computeSharedSecret(v_dg14PrivateKey, p_publicKeyPcd, v_k);
		@@ -589,15 +588,15 @@


		function f_readFileData(
		in FileInfo p_fileInfo,
		in charstring p_filename,
		in integer p_offset,
		in integer p_dataLength,
		out octetstring p_data)
		return W1W2Status {
		return fx_readFileData(p_fileInfo.filename, p_offset, p_dataLength, p_data);
		return fx_readFileData(p_filename, p_offset, p_dataLength, p_data);
		} //end f_readFileData

		function getFileByLongId(in LongFileId p_longFileId) return FileInfo {
		function getFileByLongId(in LongFileId p_longFileId) return ElementFileInfo {
		var integer i;

		for(i:=0; i<sizeof(c_ePassportFiles); i:=i+1) {
		@@ -609,7 +608,7 @@
		return c_noFileInfo;
		} // end getFileByLongId

		function getFileByShortId(in ShortFileId p_shortFileId) return FileInfo {
		function getFileByShortId(in ShortFileId p_shortFileId) return ElementFileInfo {
		var integer i;

		for(i:=0; i<sizeof(c_ePassportFiles); i:=i+1) {
		@@ -628,7 +627,7 @@
		return fx_readCertificateData(v_fullpath);
		} // end f_readCertificateData

		function f_createDg(in FileInfo p_fileInfo, in octetstring p_data) {
		function f_createDg(in ElementFileInfo p_fileInfo, in octetstring p_data) {
		fx_createDg(p_fileInfo.filename, p_data);
		} // end f_createDg

		@@ -680,55 +679,65 @@

		group initializationFunctions {

		function f_initializeMRTD(in charstring p_configurationId) runs on MRTD {
		function f_initializeMRTD(in charstring p_configurationId, in PassportProtection p_passportProctection) runs on MRTD {

		var octetstring v_trustPointRaw;
		var octetstring v_csvCertRefIds;
		var octetstring v_trustPointsRaw;
		var octetstring v_cvcaRaw;
		var ChrList v_cvcaTrustPoints;
		var octetstring v_csvCertRefIds;
		var ChrList v_trustPoints;
		var octetstring v_trustPointRaw;
		var CvCertificate v_trustPointCertificate;
		var Chr v_trustPointChr;
		var integer v_decodeResult;
		var octetstring v_dg1 := ''O;
		var integer i;

		// Load profile
		f_loadPassportConfiguration(p_configurationId);
		vc_simu.ePassportProfile := p_configurationId;

		// Optical MRZ
		f_readFileData(c_fileMRZ, 0, -1, vc_simu.opticalMrz);

		// Prepare Automatic Interface
		f_readFileData(c_fileCertRefIds, 0, -1, v_csvCertRefIds);
		vc_simu.aisCertRefIds := f_parseCertRefIds(v_csvCertRefIds);
		f_createDg(c_fileDGCertData, f_encodeCertData(vc_simu.aisCertRefIds));

		// Prepare basic access keys
		f_readFileData(c_fileDG1, 0, -1, v_dg1);
		f_readFileData(c_fileDG1.filename, 0, -1, v_dg1);
		vc_simu.mrz := f_extractMrzFromDg1(v_dg1);
		f_deriveKeys(f_extractKseedFromMrz(vc_simu.mrz), vc_simu.kEnc, vc_simu.kMac);
		vc_simu.documentNumber := f_extractDocumentNumberFromMrz(vc_simu.mrz);

		// Initialize ePassport security
		vc_simu.securityStatus := e_noApplication;
		vc_simu.passportProtection := e_bac;
		vc_simu.passportProtection := p_passportProctection;
		vc_simu.activeAuthenticationPerformed := false;

		// Read officialy trusted CHRs from EF.CVCA
		f_readFileData(c_fileCVCA, 0, -1, v_cvcaRaw);
		// Terminal Authentication
		f_readFileData(c_fileCVCA.filename, 0, -1, v_cvcaRaw);
		v_cvcaTrustPoints := f_decodeCvca(v_cvcaRaw);

		// TODO: Read real trust points

		// FIXME: only in case of terminal authentication
		f_readFileData(c_fileTrustPointCert, 0, -1, v_trustPointRaw);
		f_readFileData(c_fileTrustPointIds, 0, -1, v_trustPointsRaw);
		v_trustPoints := f_parseTrustPointIds(v_trustPointsRaw);
		for(i:=0; i < sizeof(v_trustPoints); i:=i+1) {
		f_readFileData(v_trustPoints[i], 0, -1, v_trustPointRaw);
		if(v_trustPointRaw != ''O) {
		v_decodeResult := decvalue(oct2bit(v_trustPointRaw), v_trustPointCertificate);
		// FIXME check v_decodeREsiult + ispresent
		if(oct2char(v_trustPointCertificate.tlvValue.cvCertificateBody.tlvValue.cvCertificateHolderReference.tlvValue) != v_cvcaTrustPoints[0]) {
		log("** f_initializeMRTD: WARNING: " & c_fileCVCA.filename & " does not match trust points **");
		v_trustPointChr := oct2char(v_trustPointCertificate.tlvValue.cvCertificateBody.tlvValue.cvCertificateHolderReference.tlvValue);
		if(v_trustPointChr != v_trustPoints[i]) {
		log("** f_initializeMRTD: WARNING: " & v_trustPoints[i] & " filename does not match CHR (" & v_trustPointChr & ") **");
		}
		if(not(match(v_cvcaTrustPoints, superset(v_trustPoints[i])))) {
		log("** f_initializeMRTD: WARNING: Trustpoint " & v_trustPoints[i] & " not contained in " & c_fileCVCA.filename & " **");
		}
		vc_simu.trustedCAs := {oct2char(v_trustPointCertificate.tlvValue.cvCertificateBody.tlvValue.cvCertificateHolderReference.tlvValue)};
		vc_simu.trustedCAs := {v_trustPointChr};
		f_addTrustedCertificate(
		oct2char(v_trustPointCertificate.tlvValue.cvCertificateBody.tlvValue.cvCertificateHolderReference.tlvValue),
		v_trustPointChr,
		v_trustPointCertificate.tlvValue.cvCertificateBody.tlvValue.cvPublicKey.tlvValue);
		}

		f_readFileData(c_fileMRZ, 0, -1, vc_simu.opticalMrz);

		// Read c_fileCertRefIds
		f_readFileData(c_fileCertRefIds, 0, -1, v_csvCertRefIds);
		vc_simu.aisCertRefIds := f_parseCertRefIds(v_csvCertRefIds);
		f_createDg(c_fileDGCertData, f_encodeCertData(vc_simu.aisCertRefIds));
		}

		// Active Authentication
		vc_simu.aaHashAlgorithm := e_sha1;
		@@ -1020,6 +1029,21 @@

		group AutomaticInterfaceSpecificationFunctions {


		function f_parseTrustPointIds(in octetstring p_trustPointIds)
		return ChrList {

		var ChrList v_trustPointIds := {};
		var octetstring v_trustPointId;
		var integer v_next := 0;

		do {
		v_next := f_extractId(p_trustPointIds, v_next, v_trustPointId) + 1;
		v_trustPointIds[sizeof(v_trustPointIds)] := oct2char(v_trustPointId);
		} while(v_next < lengthof(p_trustPointIds));
		return v_trustPointIds;
		}

		function f_parseCertRefIds(in octetstring p_csvCertRefIds)
		return AisCertificateReferenceIds {

ePassport/ttcn/ePassport_Templates.ttcn

+0 −1

Original line number	Diff line number	Diff line
		@@ -117,7 +117,6 @@ module ePassport_Templates {
		lengthE := omit
		}

		//SELECT TEMPLATES 00 a4 02 0c 02 01 1e
		template CommandSelect mw_selectByFileId (LongFileId v_fileID) := {
		class := mw_class_00,
		ins := e_select,

ePassport/ttcn/ePassport_Testcases.ttcn

+52 −83

File changed.

Preview size limit exceeded, changes collapsed.

ePassport/ttcn/ePassport_Types.ttcn

+2 −2

Original line number	Diff line number	Diff line
		@@ -89,13 +89,13 @@ module ePassport_Types {
		type Oct2 LongFileId;
		type Oct1 ShortFileId;

		type record FileInfo {
		type record ElementFileInfo {
		charstring filename,
		ShortFileId shortFileId,
		LongFileId longFileId
		};

		type record of FileInfo FileSet;
		type record of ElementFileInfo FileSet;

		type enumerated MrtdConfiguration {
		e_cfgDfltBac,