Merge branch 'piv'
This commit is contained in:
@@ -39,6 +39,7 @@ extern int parse_algoinfo(const file_t *f, int mode);
|
||||
extern int parse_app_data(const file_t *f, int mode);
|
||||
extern int parse_discrete_do(const file_t *f, int mode);
|
||||
extern int parse_pw_status(const file_t *f, int mode);
|
||||
extern int piv_parse_discovery(const file_t *f);
|
||||
|
||||
uint8_t historical_bytes[] = {
|
||||
10, 0,
|
||||
@@ -249,10 +250,236 @@ file_t file_entries[] = {
|
||||
/* 56 */ { .fid = EF_CH_3, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_NONE },
|
||||
// ** PIV ** //
|
||||
/* 57 */ { .fid = EF_PIV_ADMIN_DATA, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 58 */ { .fid = EF_PIV_ATTESTATION, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 59 */ { .fid = EF_PIV_MSCMAP, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 60 */ { .fid = EF_PIV_MSROOTS1, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 61 */ { .fid = EF_PIV_MSROOTS2, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 62 */ { .fid = EF_PIV_MSROOTS3, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 63 */ { .fid = EF_PIV_MSROOTS4, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 64 */ { .fid = EF_PIV_MSROOTS5, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 65 */ { .fid = EF_PIV_KEY_AUTHENTICATION, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 66 */ { .fid = EF_PIV_KEY_CARDMGM, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 67 */ { .fid = EF_PIV_KEY_SIGNATURE, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 68 */ { .fid = EF_PIV_KEY_KEYMGM, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 69 */ { .fid = EF_PIV_KEY_CARDAUTH, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 70 */ { .fid = EF_PIV_KEY_RETIRED1, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 71 */ { .fid = EF_PIV_KEY_RETIRED2, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 72 */ { .fid = EF_PIV_KEY_RETIRED3, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 73 */ { .fid = EF_PIV_KEY_RETIRED4, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 74 */ { .fid = EF_PIV_KEY_RETIRED5, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 75 */ { .fid = EF_PIV_KEY_RETIRED6, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 76 */ { .fid = EF_PIV_KEY_RETIRED7, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 77 */ { .fid = EF_PIV_KEY_RETIRED8, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 78 */ { .fid = EF_PIV_KEY_RETIRED9, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 79 */ { .fid = EF_PIV_KEY_RETIRED10, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 80 */ { .fid = EF_PIV_KEY_RETIRED11, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 81 */ { .fid = EF_PIV_KEY_RETIRED12, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 82 */ { .fid = EF_PIV_KEY_RETIRED12, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 83 */ { .fid = EF_PIV_KEY_RETIRED13, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 84 */ { .fid = EF_PIV_KEY_RETIRED14, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 85 */ { .fid = EF_PIV_KEY_RETIRED15, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 86 */ { .fid = EF_PIV_KEY_RETIRED16, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 87 */ { .fid = EF_PIV_KEY_RETIRED17, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 88 */ { .fid = EF_PIV_KEY_RETIRED18, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 89 */ { .fid = EF_PIV_KEY_RETIRED19, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 90 */ { .fid = EF_PIV_KEY_RETIRED20, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 91 */ { .fid = EF_PIV_KEY_ATTESTATION, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 92 */ { .fid = EF_PIV_CAPABILITY, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 93 */ { .fid = EF_PIV_CHUID, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 94 */ { .fid = EF_PIV_AUTHENTICATION, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 95 */ { .fid = EF_PIV_FINGERPRINTS, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 96 */ { .fid = EF_PIV_SECURITY, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 97 */ { .fid = EF_PIV_FACIAL, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 98 */ { .fid = EF_PIV_PRINTED, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 99 */ { .fid = EF_PIV_SIGNATURE, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 100 */ { .fid = EF_PIV_KEY_MANAGEMENT, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 101 */ { .fid = EF_PIV_CARD_AUTH, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 102 */ { .fid = EF_PIV_DISCOVERY, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FUNC, .data = (uint8_t *) piv_parse_discovery,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 103 */ { .fid = EF_PIV_KEY_HISTORY, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 104 */ { .fid = EF_PIV_IRIS, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 105 */ { .fid = EF_PIV_BITGT, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 106 */ { .fid = EF_PIV_SM_SIGNER, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 107 */ { .fid = EF_PIV_PC_REF_DATA, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 108 */ { .fid = EF_PIV_RETIRED1, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 109 */ { .fid = EF_PIV_RETIRED2, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 110 */ { .fid = EF_PIV_RETIRED3, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 111 */ { .fid = EF_PIV_RETIRED4, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 112 */ { .fid = EF_PIV_RETIRED5, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 113 */ { .fid = EF_PIV_RETIRED6, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 114 */ { .fid = EF_PIV_RETIRED7, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 115 */ { .fid = EF_PIV_RETIRED8, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 116 */ { .fid = EF_PIV_RETIRED9, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 117 */ { .fid = EF_PIV_RETIRED10, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 118 */ { .fid = EF_PIV_RETIRED11, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 119 */ { .fid = EF_PIV_RETIRED12, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 120 */ { .fid = EF_PIV_RETIRED13, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 121 */ { .fid = EF_PIV_RETIRED14, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 122 */ { .fid = EF_PIV_RETIRED15, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 123 */ { .fid = EF_PIV_RETIRED16, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 124 */ { .fid = EF_PIV_RETIRED17, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 125 */ { .fid = EF_PIV_RETIRED18, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 126 */ { .fid = EF_PIV_RETIRED19, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 127 */ { .fid = EF_PIV_RETIRED20, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
/* 128 */ { .fid = EF_PIV_PIN, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 129 */ { .fid = EF_PIV_PUK, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
|
||||
/* 130 */ { .fid = EF_META, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_NONE },
|
||||
/* 131 */ { .fid = EF_PW_RETRIES, .parent = 0, .name = NULL,
|
||||
.type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
|
||||
.ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
|
||||
|
||||
/* 57 */ { .fid = 0x0000, .parent = 0, .name = openpgp_aid, .type = FILE_TYPE_WORKING_EF,
|
||||
/* 132 */ { .fid = 0x0000, .parent = 0, .name = openpgp_aid, .type = FILE_TYPE_WORKING_EF,
|
||||
.data = NULL, .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_RO },
|
||||
/* 58 */ { .fid = 0x0000, .parent = 0xff, .name = NULL, .type = FILE_TYPE_UNKNOWN, .data = NULL,
|
||||
/* 133 */ { .fid = 0x0000, .parent = 0xff, .name = NULL, .type = FILE_TYPE_NOT_KNOWN, .data = NULL,
|
||||
.ef_structure = 0, .acl = ACL_NONE } //end
|
||||
};
|
||||
|
||||
|
||||
@@ -28,6 +28,7 @@
|
||||
#define EF_ALGO_PRIV2 0x10c2
|
||||
#define EF_ALGO_PRIV3 0x10c3
|
||||
#define EF_PW_PRIV 0x10c4
|
||||
#define EF_PW_RETRIES 0x10c5
|
||||
#define EF_PK_SIG 0x10d1
|
||||
#define EF_PK_DEC 0x10d2
|
||||
#define EF_PK_AUT 0x10d3
|
||||
@@ -81,4 +82,83 @@
|
||||
#define EF_EXLEN_INFO 0x7f66 //C
|
||||
#define EF_GFM 0x7f74 //C
|
||||
|
||||
// PIV
|
||||
|
||||
#define EF_PIV_PIN 0x1184
|
||||
#define EF_PIV_PUK 0x1185
|
||||
|
||||
#define EF_PIV_ADMIN_DATA 0xff00
|
||||
#define EF_PIV_ATTESTATION 0xff01
|
||||
#define EF_PIV_MSCMAP 0xff10
|
||||
#define EF_PIV_MSROOTS1 0xff11
|
||||
#define EF_PIV_MSROOTS2 0xff12
|
||||
#define EF_PIV_MSROOTS3 0xff13
|
||||
#define EF_PIV_MSROOTS4 0xff14
|
||||
#define EF_PIV_MSROOTS5 0xff15
|
||||
|
||||
#define EF_PIV_KEY_AUTHENTICATION 0x009a
|
||||
#define EF_PIV_KEY_CARDMGM 0x009b
|
||||
#define EF_PIV_KEY_SIGNATURE 0x009c
|
||||
#define EF_PIV_KEY_KEYMGM 0x009d
|
||||
#define EF_PIV_KEY_CARDAUTH 0x009e
|
||||
#define EF_PIV_KEY_RETIRED1 0x0082
|
||||
#define EF_PIV_KEY_RETIRED2 0x0083
|
||||
#define EF_PIV_KEY_RETIRED3 0x0084
|
||||
#define EF_PIV_KEY_RETIRED4 0x0085
|
||||
#define EF_PIV_KEY_RETIRED5 0x0086
|
||||
#define EF_PIV_KEY_RETIRED6 0x0087
|
||||
#define EF_PIV_KEY_RETIRED7 0x0088
|
||||
#define EF_PIV_KEY_RETIRED8 0x0089
|
||||
#define EF_PIV_KEY_RETIRED9 0x008a
|
||||
#define EF_PIV_KEY_RETIRED10 0x008b
|
||||
#define EF_PIV_KEY_RETIRED11 0x008c
|
||||
#define EF_PIV_KEY_RETIRED12 0x008d
|
||||
#define EF_PIV_KEY_RETIRED13 0x008e
|
||||
#define EF_PIV_KEY_RETIRED14 0x008f
|
||||
#define EF_PIV_KEY_RETIRED15 0x0090
|
||||
#define EF_PIV_KEY_RETIRED16 0x0091
|
||||
#define EF_PIV_KEY_RETIRED17 0x0092
|
||||
#define EF_PIV_KEY_RETIRED18 0x0096 // It's 0x93 but assigned to EF_SIG_COUNT
|
||||
#define EF_PIV_KEY_RETIRED19 0x0094
|
||||
#define EF_PIV_KEY_RETIRED20 0x0095
|
||||
#define EF_PIV_KEY_ATTESTATION 0x00fb // It's 0xf9 but assigned to EF_KDF
|
||||
|
||||
#define EF_PIV_CAPABILITY 0xc107
|
||||
#define EF_PIV_CHUID 0xc102
|
||||
#define EF_PIV_AUTHENTICATION 0xc105 /* cert for 9a key */
|
||||
#define EF_PIV_FINGERPRINTS 0xc103
|
||||
#define EF_PIV_SECURITY 0xc106
|
||||
#define EF_PIV_FACIAL 0xc108
|
||||
#define EF_PIV_PRINTED 0xc109
|
||||
#define EF_PIV_SIGNATURE 0xc10a /* cert for 9c key */
|
||||
#define EF_PIV_KEY_MANAGEMENT 0xc10b /* cert for 9d key */
|
||||
#define EF_PIV_CARD_AUTH 0xc101 /* cert for 9e key */
|
||||
#define EF_PIV_DISCOVERY 0x007e
|
||||
#define EF_PIV_KEY_HISTORY 0xc10c
|
||||
#define EF_PIV_IRIS 0xc121
|
||||
#define EF_PIV_BITGT 0x7f61
|
||||
#define EF_PIV_SM_SIGNER 0xc122
|
||||
#define EF_PIV_PC_REF_DATA 0xc123
|
||||
|
||||
#define EF_PIV_RETIRED1 0xc10d
|
||||
#define EF_PIV_RETIRED2 0xc10e
|
||||
#define EF_PIV_RETIRED3 0xc10f
|
||||
#define EF_PIV_RETIRED4 0xc110
|
||||
#define EF_PIV_RETIRED5 0xc111
|
||||
#define EF_PIV_RETIRED6 0xc112
|
||||
#define EF_PIV_RETIRED7 0xc113
|
||||
#define EF_PIV_RETIRED8 0xc114
|
||||
#define EF_PIV_RETIRED9 0xc115
|
||||
#define EF_PIV_RETIRED10 0xc116
|
||||
#define EF_PIV_RETIRED11 0xc117
|
||||
#define EF_PIV_RETIRED12 0xc118
|
||||
#define EF_PIV_RETIRED13 0xc119
|
||||
#define EF_PIV_RETIRED14 0xc11a
|
||||
#define EF_PIV_RETIRED15 0xc11b
|
||||
#define EF_PIV_RETIRED16 0xc11c
|
||||
#define EF_PIV_RETIRED17 0xc11d
|
||||
#define EF_PIV_RETIRED18 0xc11e
|
||||
#define EF_PIV_RETIRED19 0xc11f
|
||||
#define EF_PIV_RETIRED20 0xc120
|
||||
|
||||
#endif
|
||||
|
||||
@@ -22,8 +22,6 @@
|
||||
#include "random.h"
|
||||
#include "eac.h"
|
||||
#include "crypto_utils.h"
|
||||
#include "mbedtls/rsa.h"
|
||||
#include "mbedtls/ecdsa.h"
|
||||
#include "mbedtls/ecdh.h"
|
||||
#include "mbedtls/asn1.h"
|
||||
#include "asn1.h"
|
||||
@@ -174,8 +172,32 @@ void scan_files() {
|
||||
memset((char *) ef->data + 12, 0, 4);
|
||||
#endif
|
||||
}
|
||||
if ((ef = search_by_fid(EF_PW1, NULL, SPECIFY_ANY))) {
|
||||
bool reset_dek = false;
|
||||
if ((ef = search_by_fid(EF_DEK, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
printf("DEK is empty\r\n");
|
||||
const uint8_t def1[6] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
|
||||
const uint8_t def3[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
|
||||
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32];
|
||||
const uint8_t *dek = random_bytes_get(IV_SIZE + 32);
|
||||
memcpy(def, dek, IV_SIZE + 32);
|
||||
memcpy(def + IV_SIZE + 32, dek + IV_SIZE, 32);
|
||||
memcpy(def + IV_SIZE + 32 + 32, dek + IV_SIZE, 32);
|
||||
hash_multi(def1, sizeof(def1), session_pw1);
|
||||
aes_encrypt_cfb_256(session_pw1, def, def + IV_SIZE, 32);
|
||||
memset(session_pw1, 0, sizeof(session_pw1));
|
||||
|
||||
hash_multi(def3, sizeof(def3), session_pw3);
|
||||
aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32, 32);
|
||||
aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32 + 32, 32);
|
||||
memset(session_pw3, 0, sizeof(session_pw3));
|
||||
flash_write_data_to_file(ef, def, sizeof(def));
|
||||
reset_dek = true;
|
||||
}
|
||||
}
|
||||
if ((ef = search_by_fid(EF_PW1, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data || reset_dek) {
|
||||
printf("PW1 is empty. Initializing with default password\r\n");
|
||||
const uint8_t def[6] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
|
||||
uint8_t dhash[33];
|
||||
@@ -185,7 +207,7 @@ void scan_files() {
|
||||
}
|
||||
}
|
||||
if ((ef = search_by_fid(EF_RC, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
if (!ef->data || reset_dek) {
|
||||
printf("RC is empty. Initializing with default password\r\n");
|
||||
|
||||
const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
|
||||
@@ -196,7 +218,7 @@ void scan_files() {
|
||||
}
|
||||
}
|
||||
if ((ef = search_by_fid(EF_PW3, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
if (!ef->data || reset_dek) {
|
||||
printf("PW3 is empty. Initializing with default password\r\n");
|
||||
|
||||
const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
|
||||
@@ -220,28 +242,6 @@ void scan_files() {
|
||||
flash_write_data_to_file(ef, def, sizeof(def));
|
||||
}
|
||||
}
|
||||
if ((ef = search_by_fid(EF_DEK, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
printf("DEK is empty\r\n");
|
||||
const uint8_t def1[6] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
|
||||
const uint8_t def3[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
|
||||
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32];
|
||||
const uint8_t *dek = random_bytes_get(IV_SIZE + 32);
|
||||
memcpy(def, dek, IV_SIZE + 32);
|
||||
memcpy(def + IV_SIZE + 32, dek + IV_SIZE, 32);
|
||||
memcpy(def + IV_SIZE + 32 + 32, dek + IV_SIZE, 32);
|
||||
hash_multi(def1, sizeof(def1), session_pw1);
|
||||
aes_encrypt_cfb_256(session_pw1, def, def + IV_SIZE, 32);
|
||||
memset(session_pw1, 0, sizeof(session_pw1));
|
||||
|
||||
hash_multi(def3, sizeof(def3), session_pw3);
|
||||
aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32, 32);
|
||||
aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32 + 32, 32);
|
||||
memset(session_pw3, 0, sizeof(session_pw3));
|
||||
flash_write_data_to_file(ef, def, sizeof(def));
|
||||
}
|
||||
}
|
||||
if ((ef = search_by_fid(EF_UIF_SIG, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
printf("UIF SIG is empty. Initializing to default\r\n");
|
||||
@@ -270,7 +270,6 @@ void scan_files() {
|
||||
flash_write_data_to_file(ef, def, sizeof(def));
|
||||
}
|
||||
}
|
||||
|
||||
if ((ef = search_by_fid(EF_SEX, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
printf("Sex is empty. Initializing to default\r\n");
|
||||
@@ -278,11 +277,20 @@ void scan_files() {
|
||||
flash_write_data_to_file(ef, def, sizeof(def));
|
||||
}
|
||||
}
|
||||
if ((ef = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY))) {
|
||||
if (!ef->data) {
|
||||
printf("PW retries is empty. Initializing to default\r\n");
|
||||
const uint8_t def[] = { 0x1, 3, 3, 3 };
|
||||
flash_write_data_to_file(ef, def, sizeof(def));
|
||||
}
|
||||
}
|
||||
low_flash_available();
|
||||
}
|
||||
|
||||
extern bool has_pwpiv;
|
||||
extern uint8_t session_pwpiv[32];
|
||||
int load_dek() {
|
||||
if (!has_pw1 && !has_pw2 && !has_pw3) {
|
||||
if (!has_pw1 && !has_pw2 && !has_pw3 && !has_pwpiv) {
|
||||
return CCID_NO_LOGIN;
|
||||
}
|
||||
file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF);
|
||||
@@ -299,6 +307,11 @@ int load_dek() {
|
||||
memcpy(dek + IV_SIZE, file_get_data(tf) + IV_SIZE + 32 + 32, 32);
|
||||
r = aes_decrypt_cfb_256(session_pw3, dek, dek + IV_SIZE, 32);
|
||||
}
|
||||
else if (has_pwpiv) {
|
||||
memcpy(dek, file_get_data(tf), IV_SIZE);
|
||||
memcpy(dek + IV_SIZE, file_get_data(tf) + IV_SIZE + 32 + 32 + 32, 32);
|
||||
r = aes_decrypt_cfb_256(session_pwpiv, dek, dek + IV_SIZE, 32);
|
||||
}
|
||||
if (r != 0) {
|
||||
return CCID_EXEC_ERROR;
|
||||
}
|
||||
@@ -578,14 +591,6 @@ int parse_pw_status(const file_t *f, int mode) {
|
||||
return res_APDU_size - init_len;
|
||||
}
|
||||
|
||||
#define ALGO_RSA 0x01
|
||||
#define ALGO_ECDH 0x12
|
||||
#define ALGO_ECDSA 0x13
|
||||
#define ALGO_AES 0x70
|
||||
#define ALGO_AES_128 0x71
|
||||
#define ALGO_AES_192 0x72
|
||||
#define ALGO_AES_256 0x74
|
||||
|
||||
#define ALGO_RSA_1K 0
|
||||
#define ALGO_RSA_2k 1
|
||||
#define ALGO_RSA_3K 2
|
||||
@@ -820,8 +825,10 @@ static int cmd_get_data() {
|
||||
uint16_t data_len = parse_do(fids, 1);
|
||||
uint8_t *p = NULL;
|
||||
uint16_t tg = 0;
|
||||
size_t tg_len = 0;
|
||||
if (walk_tlv(res_APDU, data_len, &p, &tg, &tg_len, NULL)) {
|
||||
uint16_t tg_len = 0;
|
||||
asn1_ctx_t ctxi;
|
||||
asn1_ctx_init(res_APDU, data_len, &ctxi);
|
||||
if (walk_tlv(&ctxi, &p, &tg, &tg_len, NULL)) {
|
||||
uint8_t dec = 2;
|
||||
if ((tg & 0x1f) == 0x1f) {
|
||||
dec++;
|
||||
@@ -846,16 +853,21 @@ int pin_reset_retries(const file_t *pin, bool force) {
|
||||
return CCID_ERR_NULL_PARAM;
|
||||
}
|
||||
file_t *pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF);
|
||||
if (!pw_status) {
|
||||
file_t *pw_retries = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_EF);
|
||||
if (!pw_status || !pw_retries) {
|
||||
return CCID_ERR_FILE_NOT_FOUND;
|
||||
}
|
||||
uint8_t p[7];
|
||||
memcpy(p, file_get_data(pw_status), 7);
|
||||
uint8_t retries = p[3 + (pin->fid & 0x3)];
|
||||
if (3 + (pin->fid & 0xf) >= file_get_size(pw_status) || (pin->fid & 0xf) >= file_get_size(pw_retries)) {
|
||||
return CCID_ERR_MEMORY_FATAL;
|
||||
}
|
||||
uint8_t p[64];
|
||||
memcpy(p, file_get_data(pw_status), file_get_size(pw_status));
|
||||
uint8_t retries = p[3 + (pin->fid & 0xf)];
|
||||
if (retries == 0 && force == false) { //blocked
|
||||
return CCID_ERR_BLOCKED;
|
||||
}
|
||||
p[3 + (pin->fid & 0x3)] = 3;
|
||||
uint8_t max_retries = file_get_data(pw_retries)[(pin->fid & 0xf)];
|
||||
p[3 + (pin->fid & 0xf)] = max_retries;
|
||||
int r = flash_write_data_to_file(pw_status, p, file_get_size(pw_status));
|
||||
low_flash_available();
|
||||
return r;
|
||||
@@ -869,19 +881,19 @@ int pin_wrong_retry(const file_t *pin) {
|
||||
if (!pw_status) {
|
||||
return CCID_ERR_FILE_NOT_FOUND;
|
||||
}
|
||||
uint8_t p[7];
|
||||
memcpy(p, file_get_data(pw_status), 7);
|
||||
if (p[3 + (pin->fid & 0x3)] > 0) {
|
||||
p[3 + (pin->fid & 0x3)] -= 1;
|
||||
uint8_t p[64];
|
||||
memcpy(p, file_get_data(pw_status), file_get_size(pw_status));
|
||||
if (p[3 + (pin->fid & 0xf)] > 0) {
|
||||
p[3 + (pin->fid & 0xf)] -= 1;
|
||||
int r = flash_write_data_to_file(pw_status, p, file_get_size(pw_status));
|
||||
if (r != CCID_OK) {
|
||||
return r;
|
||||
}
|
||||
low_flash_available();
|
||||
if (p[3 + (pin->fid & 0x3)] == 0) {
|
||||
if (p[3 + (pin->fid & 0xf)] == 0) {
|
||||
return CCID_ERR_BLOCKED;
|
||||
}
|
||||
return p[3 + (pin->fid & 0x3)];
|
||||
return p[3 + (pin->fid & 0xf)];
|
||||
}
|
||||
return CCID_ERR_BLOCKED;
|
||||
}
|
||||
@@ -972,7 +984,7 @@ static int cmd_verify() {
|
||||
if (apdu.nc > 0) {
|
||||
return check_pin(pw, apdu.data, apdu.nc);
|
||||
}
|
||||
uint8_t retries = *(file_get_data(pw_status) + 3 + (fid & 0x3));
|
||||
uint8_t retries = *(file_get_data(pw_status) + 3 + (fid & 0xf));
|
||||
if (retries == 0) {
|
||||
return SW_PIN_BLOCKED();
|
||||
}
|
||||
@@ -1020,7 +1032,7 @@ static int cmd_put_data() {
|
||||
if (!tf) {
|
||||
return SW_REFERENCE_NOT_FOUND();
|
||||
}
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32];
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32 + 32];
|
||||
memcpy(def, file_get_data(tf), file_get_size(tf));
|
||||
hash_multi(apdu.data, apdu.nc, session_rc);
|
||||
memcpy(def + IV_SIZE + 32, dek + IV_SIZE, 32);
|
||||
@@ -1065,7 +1077,7 @@ static int cmd_change_pin() {
|
||||
if (!tf) {
|
||||
return SW_REFERENCE_NOT_FOUND();
|
||||
}
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32];
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32 + 32];
|
||||
memcpy(def, file_get_data(tf), file_get_size(tf));
|
||||
if (P2(apdu) == 0x81) {
|
||||
hash_multi(apdu.data + pin_len, apdu.nc - pin_len, session_pw1);
|
||||
@@ -1124,7 +1136,7 @@ static int cmd_reset_retry() {
|
||||
if (!tf) {
|
||||
return SW_REFERENCE_NOT_FOUND();
|
||||
}
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32];
|
||||
uint8_t def[IV_SIZE + 32 + 32 + 32 + 32];
|
||||
memcpy(def, file_get_data(tf), file_get_size(tf));
|
||||
hash_multi(apdu.data + (apdu.nc - newpin_len), newpin_len, session_pw1);
|
||||
memcpy(def + IV_SIZE, dek + IV_SIZE, 32);
|
||||
@@ -1144,7 +1156,7 @@ static int cmd_reset_retry() {
|
||||
return SW_INCORRECT_P1P2();
|
||||
}
|
||||
|
||||
int store_keys(void *key_ctx, int type, uint16_t key_id) {
|
||||
int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek) {
|
||||
int r, key_size = 0;
|
||||
uint8_t kdata[4096 / 8]; //worst
|
||||
|
||||
@@ -1182,9 +1194,11 @@ int store_keys(void *key_ctx, int type, uint16_t key_id) {
|
||||
}
|
||||
memcpy(kdata, key_ctx, key_size);
|
||||
}
|
||||
r = dek_encrypt(kdata, key_size);
|
||||
if (r != CCID_OK) {
|
||||
return r;
|
||||
if (use_kek) {
|
||||
r = dek_encrypt(kdata, key_size);
|
||||
if (r != CCID_OK) {
|
||||
return r;
|
||||
}
|
||||
}
|
||||
//r = aes_encrypt_cfb_256(file_read(pw3->data+2), session_pw3, kdata, key_size);
|
||||
//if (r != CCID_OK)
|
||||
@@ -1197,11 +1211,11 @@ int store_keys(void *key_ctx, int type, uint16_t key_id) {
|
||||
return CCID_OK;
|
||||
}
|
||||
|
||||
int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey) {
|
||||
int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey, bool use_dek) {
|
||||
int key_size = file_get_size(fkey);
|
||||
uint8_t kdata[4096 / 8];
|
||||
memcpy(kdata, file_get_data(fkey), key_size);
|
||||
if (dek_decrypt(kdata, key_size) != 0) {
|
||||
if (use_dek && dek_decrypt(kdata, key_size) != 0) {
|
||||
return CCID_EXEC_ERROR;
|
||||
}
|
||||
if (mbedtls_mpi_read_binary(&ctx->P, kdata, key_size / 2) != 0) {
|
||||
@@ -1231,11 +1245,11 @@ int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey) {
|
||||
return CCID_OK;
|
||||
}
|
||||
|
||||
int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey) {
|
||||
int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey, bool use_dek) {
|
||||
int key_size = file_get_size(fkey);
|
||||
uint8_t kdata[67]; //Worst case, 521 bit + 1byte
|
||||
memcpy(kdata, file_get_data(fkey), key_size);
|
||||
if (dek_decrypt(kdata, key_size) != 0) {
|
||||
if (use_dek && dek_decrypt(kdata, key_size) != 0) {
|
||||
return CCID_EXEC_ERROR;
|
||||
}
|
||||
mbedtls_ecp_group_id gid = kdata[0];
|
||||
@@ -1244,6 +1258,12 @@ int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey) {
|
||||
mbedtls_ecdsa_free(ctx);
|
||||
return CCID_EXEC_ERROR;
|
||||
}
|
||||
mbedtls_platform_zeroize(kdata, sizeof(kdata));
|
||||
r = mbedtls_ecp_mul(&ctx->grp, &ctx->Q, &ctx->d, &ctx->grp.G, random_gen, NULL);
|
||||
if (r != 0) {
|
||||
mbedtls_ecdsa_free(ctx);
|
||||
return CCID_EXEC_ERROR;
|
||||
}
|
||||
return CCID_OK;
|
||||
}
|
||||
|
||||
@@ -1376,7 +1396,7 @@ static int cmd_keypair_gen() {
|
||||
mbedtls_rsa_free(&rsa);
|
||||
return SW_EXEC_ERROR();
|
||||
}
|
||||
r = store_keys(&rsa, ALGO_RSA, fid);
|
||||
r = store_keys(&rsa, ALGO_RSA, fid, true);
|
||||
make_rsa_response(&rsa);
|
||||
mbedtls_rsa_free(&rsa);
|
||||
if (r != CCID_OK) {
|
||||
@@ -1397,7 +1417,7 @@ static int cmd_keypair_gen() {
|
||||
mbedtls_ecdsa_free(&ecdsa);
|
||||
return SW_EXEC_ERROR();
|
||||
}
|
||||
r = store_keys(&ecdsa, algo[0], fid);
|
||||
r = store_keys(&ecdsa, algo[0], fid, true);
|
||||
make_ecdsa_response(&ecdsa);
|
||||
mbedtls_ecdsa_free(&ecdsa);
|
||||
if (r != CCID_OK) {
|
||||
@@ -1424,7 +1444,7 @@ static int cmd_keypair_gen() {
|
||||
uint8_t aes_key[32]; //maximum AES key size
|
||||
uint8_t key_size = 32;
|
||||
memcpy(aes_key, random_bytes_get(key_size), key_size);
|
||||
r = store_keys(aes_key, ALGO_AES_256, EF_AES_KEY);
|
||||
r = store_keys(aes_key, ALGO_AES_256, EF_AES_KEY, true);
|
||||
/* if storing the key fails, we silently continue */
|
||||
//if (r != CCID_OK)
|
||||
// return SW_EXEC_ERROR();
|
||||
@@ -1452,7 +1472,7 @@ int rsa_sign(mbedtls_rsa_context *ctx,
|
||||
uint8_t *d = (uint8_t *) data, *end = d + data_len, *hsh = NULL;
|
||||
size_t seq_len = 0, hash_len = 0;
|
||||
int key_size = ctx->len, r = 0;
|
||||
mbedtls_md_type_t md = MBEDTLS_MD_SHA256;
|
||||
mbedtls_md_type_t md = MBEDTLS_MD_NONE;
|
||||
if (mbedtls_asn1_get_tag(&d, end, &seq_len,
|
||||
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) == 0) {
|
||||
mbedtls_asn1_buf mdb;
|
||||
@@ -1608,7 +1628,7 @@ static int cmd_pso() {
|
||||
if (algo[0] == ALGO_RSA) {
|
||||
mbedtls_rsa_context ctx;
|
||||
mbedtls_rsa_init(&ctx);
|
||||
r = load_private_key_rsa(&ctx, ef);
|
||||
r = load_private_key_rsa(&ctx, ef, true);
|
||||
if (r != CCID_OK) {
|
||||
mbedtls_rsa_free(&ctx);
|
||||
return SW_EXEC_ERROR();
|
||||
@@ -1647,7 +1667,7 @@ static int cmd_pso() {
|
||||
if (P1(apdu) == 0x9E && P2(apdu) == 0x9A) {
|
||||
mbedtls_ecdsa_context ctx;
|
||||
mbedtls_ecdsa_init(&ctx);
|
||||
r = load_private_key_ecdsa(&ctx, ef);
|
||||
r = load_private_key_ecdsa(&ctx, ef, true);
|
||||
if (r != CCID_OK) {
|
||||
mbedtls_ecdsa_free(&ctx);
|
||||
return SW_EXEC_ERROR();
|
||||
@@ -1777,7 +1797,7 @@ static int cmd_internal_aut() {
|
||||
if (algo[0] == ALGO_RSA) {
|
||||
mbedtls_rsa_context ctx;
|
||||
mbedtls_rsa_init(&ctx);
|
||||
r = load_private_key_rsa(&ctx, ef);
|
||||
r = load_private_key_rsa(&ctx, ef, true);
|
||||
if (r != CCID_OK) {
|
||||
mbedtls_rsa_free(&ctx);
|
||||
return SW_EXEC_ERROR();
|
||||
@@ -1793,7 +1813,7 @@ static int cmd_internal_aut() {
|
||||
else if (algo[0] == ALGO_ECDH || algo[0] == ALGO_ECDSA) {
|
||||
mbedtls_ecdsa_context ctx;
|
||||
mbedtls_ecdsa_init(&ctx);
|
||||
r = load_private_key_ecdsa(&ctx, ef);
|
||||
r = load_private_key_ecdsa(&ctx, ef, true);
|
||||
if (r != CCID_OK) {
|
||||
mbedtls_ecdsa_free(&ctx);
|
||||
return SW_EXEC_ERROR();
|
||||
@@ -1964,7 +1984,7 @@ static int cmd_import_data() {
|
||||
mbedtls_rsa_free(&rsa);
|
||||
return SW_EXEC_ERROR();
|
||||
}
|
||||
r = store_keys(&rsa, ALGO_RSA, fid);
|
||||
r = store_keys(&rsa, ALGO_RSA, fid, true);
|
||||
make_rsa_response(&rsa);
|
||||
mbedtls_rsa_free(&rsa);
|
||||
if (r != CCID_OK) {
|
||||
@@ -1997,7 +2017,7 @@ static int cmd_import_data() {
|
||||
mbedtls_ecdsa_free(&ecdsa);
|
||||
return SW_EXEC_ERROR();
|
||||
}
|
||||
r = store_keys(&ecdsa, ALGO_ECDSA, fid);
|
||||
r = store_keys(&ecdsa, ALGO_ECDSA, fid, true);
|
||||
make_ecdsa_response(&ecdsa);
|
||||
mbedtls_ecdsa_free(&ecdsa);
|
||||
if (r != CCID_OK) {
|
||||
|
||||
@@ -25,8 +25,35 @@
|
||||
|
||||
#include "pico_keys.h"
|
||||
#include "apdu.h"
|
||||
#include "mbedtls/rsa.h"
|
||||
#include "mbedtls/ecdsa.h"
|
||||
|
||||
extern bool has_pw1;
|
||||
extern bool has_pw3;
|
||||
|
||||
extern int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek);
|
||||
extern void make_rsa_response(mbedtls_rsa_context *rsa);
|
||||
extern void make_ecdsa_response(mbedtls_ecdsa_context *ecdsa);
|
||||
extern int ecdsa_sign(mbedtls_ecdsa_context *ctx,
|
||||
const uint8_t *data,
|
||||
size_t data_len,
|
||||
uint8_t *out,
|
||||
size_t *out_len);
|
||||
extern int rsa_sign(mbedtls_rsa_context *ctx,
|
||||
const uint8_t *data,
|
||||
size_t data_len,
|
||||
uint8_t *out,
|
||||
size_t *out_len);
|
||||
extern int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey, bool use_dek);
|
||||
extern int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey, bool use_dek);
|
||||
extern int pin_reset_retries(const file_t *pin, bool force);
|
||||
|
||||
#define ALGO_RSA 0x01
|
||||
#define ALGO_ECDH 0x12
|
||||
#define ALGO_ECDSA 0x13
|
||||
#define ALGO_AES 0x70
|
||||
#define ALGO_AES_128 0x71
|
||||
#define ALGO_AES_192 0x72
|
||||
#define ALGO_AES_256 0x74
|
||||
|
||||
#endif
|
||||
|
||||
1157
src/openpgp/piv.c
1157
src/openpgp/piv.c
File diff suppressed because it is too large
Load Diff
@@ -29,7 +29,7 @@
|
||||
#define PIPGP_VERSION_MAJOR ((PIPGP_VERSION >> 8) & 0xff)
|
||||
#define PIPGP_VERSION_MINOR (PIPGP_VERSION & 0xff)
|
||||
|
||||
#define PIV_VERSION 0x0500
|
||||
#define PIV_VERSION 0x0507
|
||||
|
||||
#define PIV_VERSION_MAJOR ((PIV_VERSION >> 8) & 0xff)
|
||||
#define PIV_VERSION_MINOR (PIV_VERSION & 0xff)
|
||||
|
||||
Reference in New Issue
Block a user