Hoernchen has uploaded this change for review. (
https://gerrit.osmocom.org/c/pysim/+/43136?usp=email )
Change subject: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13)
......................................................................
GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13)
AES PSK + DES DEK for scp81, tested with sysmoEUICC1 C2T
Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d
---
M pySim/global_platform/__init__.py
M tests/unittests/test_globalplatform.py
2 files changed, 189 insertions(+), 15 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/36/43136/1
diff --git a/pySim/global_platform/__init__.py
b/pySim/global_platform/__init__.py
index 6ff4b28..31f3907 100644
--- a/pySim/global_platform/__init__.py
+++ b/pySim/global_platform/__init__.py
@@ -18,6 +18,7 @@
"""
import io
+import hashlib
from copy import deepcopy
from typing import Optional, List, Dict, Tuple
from construct import Optional as COptional
@@ -602,8 +603,8 @@
See GlobalPlatform CardSpecification v2.3 Section 11.8 for details.
The KCV (Key Check Values) can either be explicitly specified
using `--key-check`, or will
- otherwise be automatically generated for DES and AES keys. You
can suppress the latter using
- `--suppress-key-check`.
+ otherwise be automatically generated for DES, AES and TLS-PSK
keys. You can suppress the
+ latter using `--suppress-key-check`.
Example (SCP80 KIC/KID/KIK):
put_key --key-version-nr 1 --key-id 0x01 --key-type aes
--key-data 000102030405060708090a0b0c0d0e0f
@@ -620,19 +621,12 @@
kdb = []
for i in range(0, len(opts.key_type)):
if opts.key_check and len(opts.key_check) > i:
- kcv = opts.key_check[i]
+ kcv = h2b(opts.key_check[i])
elif opts.suppress_key_check:
- kcv = ''
+ kcv = b''
else:
- kcv_bin = compute_kcv(opts.key_type[i],
h2b(opts.key_data[i])) or b''
- kcv = b2h(kcv_bin)
- if self._cmd.lchan.scc.scp:
- # encrypted key data with DEK of current SCP
- kcb =
b2h(self._cmd.lchan.scc.scp.encrypt_key(h2b(opts.key_data[i])))
- else:
- # (for example) during personalization, DEK might not be
required)
- kcb = opts.key_data[i]
- kdb.append({'key_type': opts.key_type[i], 'kcb': kcb, 'kcv':
kcv})
+ kcv = compute_kcv(opts.key_type[i], h2b(opts.key_data[i]))
or b''
+ kdb.append({'key_type': opts.key_type[i], 'clear_key':
h2b(opts.key_data[i]), 'kcv': kcv})
p2 = opts.key_id
if len(opts.key_type) > 1:
p2 |= 0x80
@@ -643,10 +637,58 @@
'kcb'/Prefixed(Int8ub, GreedyBytes),
'kcv'/Prefixed(Int8ub, GreedyBytes)))
- def put_key(self, old_kvn:int, kvn: int, kid: int, key_dict: dict) ->
bytes:
+ @classmethod
+ def encode_key_data_basic(cls, key_type: str, kcb: bytes, kcv: bytes)
-> bytes:
+ """Generic Basic key data field, GP CardSpec v2.3 Table 11-68):
+ type || <1-byte length> KCB || <1-byte length> KCV"""
+ return build_construct(cls.KeyDataBasic, [{'key_type': key_type,
'kcb': b2h(kcb), 'kcv': b2h(kcv)}])
+
+ @staticmethod
+ def encode_key_data_psk(clear_key: bytes, ciphered_key: bytes, kcv:
bytes) -> bytes:
+ """Single PSK TLS '85' key data field per GP Amendment B 1.2,
3.9.1 / Table 3-13:
+ 85 | L1 | L2 | <ciphered PSK key> | <KCV length> | <KCV>
+ - L2 is the BER-encoded length of the *clear* PSK key in bytes
+ - L1 is the BER-encoded length of the (L2 || ciphered PSK key)
block
+ - KCV, if present, is the 3 most significant bytes of SHA-1(clear
key).
+ - 'ciphered_key' is DEK(block-padded clear key), no additional
length prefix."""
+ block = bertlv_encode_len(len(clear_key)) + ciphered_key
+ return (b'\x85' + bertlv_encode_len(len(block)) + block +
+ bytes([len(kcv)]) + kcv)
+
+ @classmethod
+ def build_put_key_data(cls, kvn: int, keys: List[dict], scp) -> bytes:
+ """Assemble the PUT KEY data field, mixed PSK + DES DEK is
supported:
+ - new KVN followed by one key data field per key.
+ - tls_psk keys per GP Amendment B
+ - other key types generic Basic format
+ Param 'keys' is a dict:
+ - 'key_type' (str)
+ - 'clear_key' (bytes)
+ - 'kcv' (bytes / empty).
+ 'scp' may be None (e.g. during personalization, when the DEK may
not be required)."""
+ key_data = kvn.to_bytes(1, 'big')
+ for k in keys:
+ clear = k['clear_key']
+ if scp:
+ # encipher the clear key with the DEK of the current SCP
+ ciphered = scp.encrypt_key(clear)
+ else:
+ ciphered = clear
+ if k['key_type'] == 'tls_psk':
+ # Table 3-13 contains the clear key length L2, but
scp.encrypt_key() already
+ # prepends that during right padding a non block aligned
key (GP CardSpec Table 11-70)
+ # strip it so the 'Ciphered PSK key' field is only the raw
ciphertext.
+ if scp and len(clear) % scp.sk.blocksize:
+ ciphered =
ciphered[len(bertlv_encode_len(len(clear))):]
+ key_data += cls.encode_key_data_psk(clear, ciphered,
k['kcv'])
+ else:
+ key_data += cls.encode_key_data_basic(k['key_type'],
ciphered, k['kcv'])
+ return key_data
+
+ def put_key(self, old_kvn:int, kvn: int, kid: int, keys: List[dict])
-> bytes:
"""Perform the GlobalPlatform PUT KEY command in order to store a
new key on the card.
See GlobalPlatform CardSpecification v2.3 Section 11.8 for
details."""
- key_data = kvn.to_bytes(1, 'big') +
build_construct(ADF_SD.AddlShellCommands.KeyDataBasic, key_dict)
+ key_data = self.build_put_key_data(kvn, keys,
self._cmd.lchan.scc.scp)
hdr = "80D8%02x%02x%02x" % (old_kvn, kid, len(key_data))
data, _sw = self._cmd.lchan.scc.send_apdu_checksw(hdr +
b2h(key_data) + "00")
return data
@@ -1065,10 +1107,16 @@
cipher = AES.new(key, AES.MODE_ECB)
return cipher.encrypt(plaintext)
+def compute_kcv_psk(key:bytes) -> bytes:
+ # GP Amendment B v1.2, 3.9.1 / Table 3-13
+ # KCV of a PSK TLS key is the 3 highest-order bytes of the SHA-1 digest of
the clear key value.
+ return hashlib.sha1(key).digest()
+
# dict is keyed by the string name of the KeyType enum above in this file
KCV_CALCULATOR = {
'aes': compute_kcv_aes,
'des': compute_kcv_des,
+ 'tls_psk': compute_kcv_psk,
}
def compute_kcv(key_type: str, key: bytes) -> Optional[bytes]:
diff --git a/tests/unittests/test_globalplatform.py
b/tests/unittests/test_globalplatform.py
index 8698470..d016d7d 100644
--- a/tests/unittests/test_globalplatform.py
+++ b/tests/unittests/test_globalplatform.py
@@ -17,7 +17,9 @@
import unittest
import logging
+import hashlib
from osmocom.utils import b2h, h2b
+from osmocom.tlv import bertlv_encode_len
from pySim.global_platform import *
from pySim.global_platform.scp import *
@@ -290,6 +292,130 @@
self.assertEqual(compute_kcv('aes', KEYSET_AES128.dek), h2b('840DE5'))
+class PutKey_PSK_Test(unittest.TestCase):
+ """Tests for the PUT KEY command data field encoding, in particular the
PSK TLS ('85') key data
+ field defined by GlobalPlatform Amendment B (Remote Application Management
over HTTP) Table 3-13."""
+
+ # the PUT KEY encoder we exercise
+ C = ADF_SD.AddlShellCommands
+
+ # SCP80 TLS-PSK example key from the do_put_key docstring (16 bytes)
+ PSK_CLEAR = h2b('303132333435363738393a3b3c3d3e3f')
+ # its DEK ciphertext + Table 3-13 KCV with SCP02 session set up below
+ PSK_CIPHERED = h2b('15abf1fe16ccc5aa13743394442942cd')
+ PSK_KCV = h2b('06125d') # = SHA-1(PSK_CLEAR)[:3]
+
+ def setUp(self):
+ # SCP02 with same vectors as SCP02_Test so encrypt_key() so the whole
PUT KEY data field are reproducible.
+ self.scp02 = SCP02(card_keys=ck_3des_70)
+ self.scp02.gen_init_update_apdu(host_challenge=h2b('40A62C37FA6304F8'))
+
self.scp02.parse_init_update_resp(h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3'))
+ self.scp02.gen_ext_auth_apdu()
+
+ def test_psk_kcv_is_sha1(self):
+ # GP Amendment B Table 3-13: KCV = 3 most significant bytes of
SHA-1(clear key)
+ self.assertEqual(compute_kcv('tls_psk', self.PSK_CLEAR),
hashlib.sha1(self.PSK_CLEAR).digest()[:3])
+ self.assertEqual(compute_kcv('tls_psk', self.PSK_CLEAR), self.PSK_KCV)
+
+ def test_encode_psk_framing_golden(self):
+ # assert the exact Table 3-13 layout
+ # 85 | L1 | L2 | <ciphered> | 03 | <SHA-1(clear)[:3]>
+ clear = self.PSK_CLEAR
+ ciphered = h2b('aabbccddeeff00112233445566778899') # arbitrary
16-byte ciphertext
+ kcv = hashlib.sha1(clear).digest()[:3]
+ field = self.C.encode_key_data_psk(clear, ciphered, kcv)
+ # 85 L1 L2 <---------- ciphered
-----------> 03 <-kcv->
+ self.assertEqual(b2h(field),'85' '11' '10'
'aabbccddeeff00112233445566778899' '03' + b2h(kcv))
+ self.assertEqual(b2h(field),'851110aabbccddeeff0011223344556677889903'
+ '06125d')
+
+ def test_psk_golden_over_scp02(self):
+ # Full PUT KEY data field (KVN 0x40 + single PSK key) enciphered with
the SCP02 DEK.
+ keys = [{'key_type': 'tls_psk', 'clear_key': self.PSK_CLEAR,
+ 'kcv': compute_kcv('tls_psk', self.PSK_CLEAR)}]
+ data = self.C.build_put_key_data(0x40, keys, self.scp02)
+ self.assertEqual(b2h(data),
+ '40' '85' '11' '10' + b2h(self.PSK_CIPHERED) + '03' +
b2h(self.PSK_KCV))
+
+ def test_wrong_basic_format_differs(self):
+ # regression test, the generic "Basic format" does NOT match Table
3-13 for a PSK key
+ # rejected by card with with 6a88
+ wrong_basic = self.C.encode_key_data_basic('tls_psk',
self.PSK_CIPHERED, b'')
+ right_psk = self.C.encode_key_data_psk(self.PSK_CLEAR,
self.PSK_CIPHERED, self.PSK_KCV)
+ self.assertEqual(b2h(wrong_basic), '8510' + b2h(self.PSK_CIPHERED) +
'00')
+ self.assertEqual(b2h(right_psk), '8511' '10' + b2h(self.PSK_CIPHERED)
+ '03' + b2h(self.PSK_KCV))
+ self.assertNotEqual(wrong_basic, right_psk)
+
+ def test_basic_format_unchanged(self):
+ # as before
+ for kt, clear in [('des', h2b('404142434445464748494a4b4c4d4e4f')),
+ ('aes', h2b('000102030405060708090a0b0c0d0e0f'))]:
+ ciph = self.scp02.encrypt_key(clear)
+ kcv = compute_kcv(kt, clear)
+ via_construct = build_construct(self.C.KeyDataBasic, [{'key_type':
kt, 'kcb': b2h(ciph), 'kcv': b2h(kcv)}])
+ via_helper = self.C.encode_key_data_basic(kt, ciph, kcv)
+ self.assertEqual(via_helper, via_construct)
+
+ def test_psk_padding_no_double_length(self):
+ # A PSK key whose length is not a multiple of the DEK block size (DES:
8) is right-padded before
+ # ciphering. Table 3-13 already contains the clear key length (L2), so
encrypt_key() length
+ # prefix must be stripped:
+ # - ciphered field == padded ciphertext (no doubling),
+ # - clear key == first L2 bytes.
+ clear = bytes(range(20)) # 20 bytes, 20 % 8
= 4 -> pad to 24
+ field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk',
'clear_key': clear,
+ 'kcv':
compute_kcv('tls_psk', clear)}], self.scp02)[1:]
+ self.assertEqual(field[0], 0x85)
+ l1 = field[1]
+ l2 = field[2]
+ self.assertEqual(l2, 20) # single-byte BER
length of clear key
+ ciphered = field[3:3 + (l1 - 1)] # block = L2(1
byte) || ciphered
+ self.assertEqual(len(ciphered), 24) # padded to the
8-byte DES block size
+ self.assertEqual(l1, 1 + 24) # no duplicated
length prefix
+ self.assertEqual(self.scp02.dek_decrypt(ciphered)[:20], clear)
+
+ def test_kcv_suppressed(self):
+ # --suppress-key-check -> KCV length 00 and no KCV bytes
+ field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk',
'clear_key': self.PSK_CLEAR,
+ 'kcv': b''}], self.scp02)[1:]
+ self.assertEqual(b2h(field), '8511' '10' + b2h(self.PSK_CIPHERED) +
'00')
+
+ def test_multikey_psk_plus_des_dek(self):
+ # load a PSK TLS key (KID 1, Amendment B format) together with its DES
DEK
+ # (KID 2, Basic format) in one PUT KEY.
+ # Verify the concatenated data field parses back into the two
components with proper type formats.
+ dek = h2b('404142434445464748494a4b4c4d4e4f')
+ keys = [{'key_type': 'tls_psk', 'clear_key': self.PSK_CLEAR, 'kcv':
compute_kcv('tls_psk', self.PSK_CLEAR)},
+ {'key_type': 'des', 'clear_key': dek, 'kcv':
compute_kcv('des', dek)}]
+ data = self.C.build_put_key_data(0x40, keys, self.scp02)
+
+ b = data
+ self.assertEqual(b[0], 0x40) # KVN
+ b = b[1:]
+ # component 1: PSK TLS (Table 3-13)
+ self.assertEqual(b[0], 0x85)
+ self.assertEqual(b[1], 0x11) # L1 = 17
+ self.assertEqual(b[2], 0x10) # L2 = 16 (clear key length)
+ self.assertEqual(b[3:3 + 16], self.PSK_CIPHERED)
+ self.assertEqual(b[3 + 16], 0x03) # KCV length
+ self.assertEqual(b[3 + 16 + 1:3 + 16 + 1 + 3], self.PSK_KCV)
+ b = b[3 + 16 + 1 + 3:]
+ # component 2: DES DEK (Basic format)
+ self.assertEqual(b[0], 0x80) # key type des
+ kcb_len = b[1]
+ self.assertEqual(kcb_len, 16)
+ self.assertEqual(b[2:2 + kcb_len], self.scp02.encrypt_key(dek))
+ b = b[2 + kcb_len:]
+ self.assertEqual(b[0], 0x03) # KCV length
+ self.assertEqual(b[1:1 + 3], compute_kcv('des', dek))
+ self.assertEqual(b[1 + 3:], b'') # no trailing bytes
+
+ def test_no_scp_leaves_key_clear(self):
+ # During personalization (no SCP) the key is not enciphered, framing
still follows Table 3-13.
+ field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk',
'clear_key': self.PSK_CLEAR,
+ 'kcv': self.PSK_KCV}],
None)[1:]
+ self.assertEqual(b2h(field), '8511' '10' + b2h(self.PSK_CLEAR) + '03'
+ b2h(self.PSK_KCV))
+
+
class Install_param_Test(unittest.TestCase):
def test_gen_install_parameters(self):
load_parameters = gen_install_parameters(256, 256,
'010001001505000000000000000000000000')
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/43136?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d
Gerrit-Change-Number: 43136
Gerrit-PatchSet: 1
Gerrit-Owner: Hoernchen <[email protected]>
