May 2024 - gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: esim.saip: Implement SecurityDomainSD.{add,has,remove}_key() methods

by laforge

Attention is currently required from: laforge. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/36958?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: esim.saip: Implement SecurityDomainSD.{add,has,remove}_key() methods ...................................................................... esim.saip: Implement SecurityDomainSD.{add,has,remove}_key() methods This way it's possible to programmatically inspect and modify the high-level decoded key material inside a securityDomain profile element. Change-Id: I18b1444303de80eaddd840a7e0061ea0098a8ba1 --- M pySim/esim/saip/__init__.py 1 file changed, 92 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/58/36958/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36958?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I18b1444303de80eaddd840a7e0061ea0098a8ba1 Gerrit-Change-Number: 36958 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 year

1
0
0 0

[M] Change in pysim[master]: document the CardKeyProvider

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36962?usp=email ) Change subject: document the CardKeyProvider ...................................................................... document the CardKeyProvider Change-Id: Ie6fc24695dd956a4f9fd6f243d3b0ef66acf877b --- A docs/card-key-provider.rst M docs/shell.rst 2 files changed, 112 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/62/36962/1 diff --git a/docs/card-key-provider.rst b/docs/card-key-provider.rst new file mode 100644 index 0000000..4c3941b --- /dev/null +++ b/docs/card-key-provider.rst @@ -0,0 +1,94 @@ + +Retrieving card-individual keys via CardKeyProvider +================================================== + +When working with a batch of cards, or more than one card in general, it +is a lot of effort to manually retrieve the card-specific PIN (like +ADM1) or key material (like SCP02/SCP03 keys). + +To increase productivity in that regard, pySim has a concept called the +`CardKeyProvider`. This is a generic mechanism by which different parts +of the pySim[-shell] code can programmatically request card-specific key material +from some data source (*provider*). + +For example, when you want to verify the ADM1 PIN using the `verify_adm` +command without providing an ADM1 value yourself, pySim-shell will +request the ADM1 value for the ICCID of the card via the +CardKeyProvider. + +There can in theory multiple different CardKeyProviders. You can for +example develop your own CardKeyProvider that queries some kind of +database for the key material, or that uses a key derivation function to +derive card-specific key material from a global master key. + +The only actual CardKeyProvider implementation included in pySim is the +`CardKeyProviderCsv` which retrieves the key material from a +[potentially encrypted] CSV file. + + +The CardKeyProviderCsv +---------------------- + +The `CardKeyProviderCsv` allows you to retrieve card-individual key +material from a CSV (comma separated value) file that is accessible to pySim. + +The CSV file must have the expected column names, for example `ICCID` +and `ADM1` in case you would like to use that CSV to obtain the +card-specific ADM1 PIN when using the `verify_adm` command. + +You can specify the CSV file to use via the `--csv` command-line option +of pySim-shell. If you do not specify a CSV file, pySim will attempt to +open a CSV file from the default location at +`~/.osmocom/pysim/card_data.csv`, and use that, if it exists. + + +Field naming +------------ + +* For look-up of UICC/SIM/USIM/ISIM or eSIM profile specific key + material, pySim uses the `ICCID` field as lookup key. + +* For look-up of eUICC specific key material (like SCP03 keys for the + ISD-R, ECASD), pySim uses the `EID` field as lookup key. + +As soon as the CardKeyProviderCsv finds a line (row) in your CSV where +the ICCID or EID match, it looks for the column containing the requested +data. + + +ADM PIN +~~~~~~~ + +The `verify_adm` command will attempt to look up the `ADM1` column +indexed by the ICCID of the SIM/UICC. + + +SCP02 / SCP03 +~~~~~~~~~~~~~ + +SCP02 and SCP03 each use key triplets consisting if ENC, MAC and DEK +keys. For more details, see the applicable GlobalPlatform +specifications. + +If you do not want to manually enter the key material for each specific +card as arguments to the `establish_scp02` or `establish_scp03` +commands, you can make use of the `--key-provider-sufix` option. pySim +uses this suffix to compose the column names for the CardKeyProvider as +follows. + +* `SCP02_ENC_` + suffix for the SCP02 ciphering key +* `SCP02_MAC_` + suffix for the SCP02 MAC key +* `SCP02_DEK_` + suffix for the SCP02 DEK key +* `SCP03_ENC_` + suffix for the SCP03 ciphering key +* `SCP03_MAC_` + suffix for the SCP03 MAC key +* `SCP03_DEK_` + suffix for the SCP03 DEK key + +So for example, if you are using a command like `establish_scp03 +--key-provider-suffix ISDR`, then the column names for the key material +look-up are `SCP03_ENC_ISDR`, `SCP03_MAC_ISDR` and `SCP03_DEK_ISDR`, +respectively. + +The identifier used for look-up is determined by the definition of the +Security Domain. For example, the eUICC ISD-R and ECASD will use the EID +of the eUICC. On the other hand, the ISD-P of an eSIM or the ISD of an +UICC will use the ICCID. diff --git a/docs/shell.rst b/docs/shell.rst index 084858c..111c502 100644 --- a/docs/shell.rst +++ b/docs/shell.rst @@ -69,6 +69,15 @@ suci-tutorial +Advanced Topics +--------------- +.. toctree:: + :maxdepth: 1 + :caption: Advanced pySIM-shell topics + + card-key-provider + + cmd2 basics ----------- -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36962?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ie6fc24695dd956a4f9fd6f243d3b0ef66acf877b Gerrit-Change-Number: 36962 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in pysim[master]: docs/shell: Mention GlobalPlatform and eUICC commands in overview

by laforge

laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/36953?usp=email ) Change subject: docs/shell: Mention GlobalPlatform and eUICC commands in overview ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36953?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I5b6ad752fea09ed9632f150dfbbabf2156a5a9c0 Gerrit-Change-Number: 36953 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Thu, 30 May 2024 18:07:38 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 year

1
0
0 0

[S] Change in pysim[master]: esim.saip: Implement ProfileElement.header_name for more PE types

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36960?usp=email ) Change subject: esim.saip: Implement ProfileElement.header_name for more PE types ...................................................................... esim.saip: Implement ProfileElement.header_name for more PE types We now cover all PE types as of PE_Definitions-3.3.1.asn Change-Id: I37951a0441fe53fce7a329066aebd973389cb743 --- M pySim/esim/saip/__init__.py 1 file changed, 30 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/60/36960/1 diff --git a/pySim/esim/saip/__init__.py b/pySim/esim/saip/__init__.py index ae733e1..f066ba4 100644 --- a/pySim/esim/saip/__init__.py +++ b/pySim/esim/saip/__init__.py @@ -173,6 +173,25 @@ # unneccessarry compliaction by inconsistent naming :( if self.type.startswith('opt-'): return self.type.replace('-','') + '-header' + elif self.type == 'genericFileManagement': + return 'gfm-header' + elif self.type == 'akaParameter': + return 'aka-header' + elif self.type == 'cdmaParameter': + return 'cdma-header' + elif self.type == 'application': + return 'app-header' + elif self.type == 'header': + return None + elif self.type == 'pukCodes': + # note how they couldn't even consistently captialize the 'header' suffix :( + return 'puk-Header' + elif self.type == 'pinCodes': + # note how they couldn't even consistently captialize the 'header' suffix :( + return 'pin-Header' + elif self.type == 'securityDomain': + # note how they couldn't even consistently captialize the 'header' suffix :( + return 'sd-Header' return self.type + '-header' @property -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36960?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I37951a0441fe53fce7a329066aebd973389cb743 Gerrit-Change-Number: 36960 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[M] Change in pysim[master]: pySim.esim.saip: Meaningful constructors for [I]SD + SSD

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36961?usp=email ) Change subject: pySim.esim.saip: Meaningful constructors for [I]SD + SSD ...................................................................... pySim.esim.saip: Meaningful constructors for [I]SD + SSD So far the main use case was to read a ProfileElement-SD from a DER file. But when we want to construct one from scratch, we need to have the constructor put some meaningful [default] values into the class members. Change-Id: I69e104f1d78165c12291317326dbab05977a1574 --- M pySim/esim/saip/__init__.py 1 file changed, 85 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/61/36961/1 diff --git a/pySim/esim/saip/__init__.py b/pySim/esim/saip/__init__.py index f066ba4..9cf8387 100644 --- a/pySim/esim/saip/__init__.py +++ b/pySim/esim/saip/__init__.py @@ -18,10 +18,11 @@ import abc import io from typing import Tuple, List, Optional, Dict, Union +from collections import OrderedDict import asn1tools -from pySim.utils import bertlv_parse_tag, bertlv_parse_len, b2h +from pySim.utils import bertlv_parse_tag, bertlv_parse_len, b2h, h2b from pySim.ts_102_221 import FileDescriptor from pySim.construct import build_construct from pySim.esim import compile_asn1_subdir @@ -300,6 +301,35 @@ class C9(BER_TLV_IE, tag=0xC9, nested=UiccSdInstallParams): pass + def __init__(self, decoded: Optional[dict] = None): + if decoded: + self.decoded = decoded + return + # provide some reasonable defaults for a MNO-SD + self.decoded = OrderedDict() + self.decoded['sd-Header'] = { 'mandated': None, 'identification': None } + self.decoded['instance'] = { + 'applicationLoadPackageAID': h2b('A0000001515350'), + 'classAID': h2b('A000000251535041'), + 'instanceAID': h2b('A000000151000000'), + # Optional: extraditeSecurityDomainAID + 'applicationPrivileges': h2b('82FC80'), + # Optioal: lifeCycleState + 'applicationSpecificParametersC9': h2b('8201f09301f08701f0'), # we assume user uses add_scp() + # Optional: systemSpecificParameters + 'applicationParameters': { + # TAR: B20100, MSL: 12 + 'uiccToolkitApplicationSpecificParametersField': h2b('0100000100000002011203B2010000'), + }, + # Optional: processData + # Optional: controlReferenceTemplate + } + self.decoded['keyList'] = [] # we assume user uses add_key() method for all keys + # Optional: sdPersoData + # Optional: openPersoData + # Optional: catTpParameters + self._post_decode() + def _post_decode(self): self.usip = self.C9() self.usip.from_bytes(self.decoded['instance']['applicationSpecificParametersC9']) @@ -347,6 +377,17 @@ self.keys.remove(key) self._pre_encode() +class ProfileElementSSD(ProfileElementSD): + """Class representing a securityDomain ProfileElement for a SSD.""" + def __init__(self): + super().__init__() + # defaults [overriding ProfileElementSD) taken from SAIP v2.3.1 Section 11.2.12 + self.decoded['instance']['instanceAID'] = h2b('A00000055910100102736456616C7565') + self.decoded['instance']['applicationPrivileges'] = h2b('808000') + self.decoded['instance']['applicationParameters'] = { + # TAR: 6C7565, MSL: 12 + 'uiccToolkitApplicationSpecificParametersField': h2b('01000001000000020112036C756500'), + } def bertlv_first_segment(binary: bytes) -> Tuple[bytes, bytes]: """obtain the first segment of a binary concatenation of BER-TLV objects. @@ -440,6 +481,35 @@ out += pe.to_der() return out + def renumber_identitification(self): + """Re-generate the 'identification' numbering of all PE headers.""" + i = 1 + for pe in self.pe_list: + hdr = pe.header + if not hdr: + continue + pe.header['identification'] = i + i += 1 + + def get_index_by_type(self, petype: str) -> List[int]: + """Return a list with the indizies of all instances of PEs of petype.""" + ret = [] + i = 0 + for pe in self.pe_list: + if pe.type == petype: + ret.append(i) + i += 1 + return ret + + def add_ssd(self, ssd: ProfileElementSSD): + """Add a SSD (Supplementary Security Domain) After MNO-SD/ISD-P.""" + # find MNO-SD index + idx = self.get_index_by_type('securityDomain')[0] + # insert _after_ MNO-SD + self.pe_list.insert(idx+1, ssd) + self._process_pelist() + self.renumber_identitification() + def __repr__(self) -> str: return "PESequence(%s)" % ', '.join([str(x) for x in self.pe_list]) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36961?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I69e104f1d78165c12291317326dbab05977a1574 Gerrit-Change-Number: 36961 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in pysim[master]: pySim.esim.saip.validation: Ensure unique PE identification value

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36959?usp=email ) Change subject: pySim.esim.saip.validation: Ensure unique PE identification value ...................................................................... pySim.esim.saip.validation: Ensure unique PE identification value Change-Id: I37b9eb4cfb74de79b0493986d976c8a5f8ccd8ea --- M pySim/esim/saip/validation.py 1 file changed, 15 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/59/36959/1 diff --git a/pySim/esim/saip/validation.py b/pySim/esim/saip/validation.py index f9f5773..c253b7a 100644 --- a/pySim/esim/saip/validation.py +++ b/pySim/esim/saip/validation.py @@ -95,6 +95,12 @@ if 'profile-a-p256' in m_svcs and not ('usim' in m_svcs or 'isim' in m_svcs): raise ProfileError('profile-a-p256 mandatory, but no usim or isim') + def check_identification_unique(self, pes: ProfileElementSequence): + """Ensure that each PE has a unique identification value.""" + id_list = [pe.header['identification'] for pe in pes.pe_list if pe.header] + if len(id_list) != len(set(id_list)): + raise ProfileError('PE identification values are not unique') + FileChoiceList = List[Tuple] class FileError(ProfileError): -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36959?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I37b9eb4cfb74de79b0493986d976c8a5f8ccd8ea Gerrit-Change-Number: 36959 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[M] Change in pysim[master]: osmo-smdpp: Don't re-encode euiccSigned1/euiccSigned2

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36954?usp=email ) Change subject: osmo-smdpp: Don't re-encode euiccSigned1/euiccSigned2 ...................................................................... osmo-smdpp: Don't re-encode euiccSigned1/euiccSigned2 We used to re-encode those parts of a decoded ASN.1 struct that is cryptographically signed in the GSMA SGP.22 specification. However, if the received data follows a later spec and contains new/unknown records, then our poor-man's attempt at re-encoding will render a different binary, which in turn means the signature check will fail. Let's instead do a manual step-by-step raw decode of the DER TLV structure to extract the actual binary information of parts of ASN.1 objects. Change-Id: I4e31fd4b23ec3be15b9d07c2c30a3e31e22bdda1 Closes: OS#6473 --- M osmo-smdpp.py M pySim/esim/rsp.py 2 files changed, 61 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/54/36954/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index 3dc6131..9ed1e39 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -292,8 +292,7 @@ r_ok = authenticateServerResp[1] euiccSigned1 = r_ok['euiccSigned1'] - # TODO: use original data, don't re-encode? - euiccSigned1_bin = rsp.asn1.encode('EuiccSigned1', euiccSigned1) + euiccSigned1_bin = rsp.extract_euiccSigned1(authenticateServerResp_bin) euiccSignature1_bin = r_ok['euiccSignature1'] euiccCertificate_dec = r_ok['euiccCertificate'] # TODO: use original data, don't re-encode? @@ -422,8 +421,7 @@ # Verify the euiccSignature2 computed over euiccSigned2 and smdpSignature2 using the PK.EUICC.SIG attached to the ongoing RSP session euiccSigned2 = r_ok['euiccSigned2'] - # TODO: use original data, don't re-encode? - euiccSigned2_bin = rsp.asn1.encode('EUICCSigned2', euiccSigned2) + euiccSigned2_bin = rsp.extract_euiccSigned2(prepDownloadResp_bin) if not self._ecdsa_verify(ss.euicc_cert, r_ok['euiccSignature2'], euiccSigned2_bin + ss.smdpSignature2_do): raise ApiError('8.1', '6.1', 'eUICC signature is invalid') diff --git a/pySim/esim/rsp.py b/pySim/esim/rsp.py index ec317fc..a032031 100644 --- a/pySim/esim/rsp.py +++ b/pySim/esim/rsp.py @@ -24,6 +24,7 @@ from cryptography.hazmat.primitives.serialization import Encoding from cryptography import x509 +from pySim.utils import bertlv_parse_one, bertlv_encode_tag, bertlv_encode_len, b2h from pySim.esim import compile_asn1_subdir asn1 = compile_asn1_subdir('rsp') @@ -96,3 +97,41 @@ class RspSessionStore(shelve.DbfilenameShelf): """A derived class as wrapper around the database-backed non-volatile storage 'shelve', in case we might need to extend it in the future. We use it to store RspSessionState objects indexed by transactionId.""" + +def extract_euiccSigned1(authenticateServerResponse: bytes) -> bytes: + """Extract the raw, DER-encoded binary euiccSigned1 field from the given AuthenticateServerResponse. This + is needed due to the very peculiar SGP.22 notion of signing sections of DER-encoded ASN.1 objects.""" + tdict, l, v, remainder = bertlv_parse_one(authenticateServerResponse) + rawtag = bertlv_encode_tag(tdict) + if len(remainder): + raise ValueError('Excess data at end of TLV') + if b2h(rawtag) != 'bf38': + raise ValueError('Unexpected outer tag: %s' % b2h(rawtag)) + tdict, l, v1, remainder = bertlv_parse_one(v) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != 'a0': + raise ValueError('Unexpected tag where CHOICE was expected') + tdict, l, v2, remainder = bertlv_parse_one(v1) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != '30': + raise ValueError('Unexpected tag where SEQUENCE was expected') + return rawtag + bertlv_encode_len(l) + v2 + +def extract_euiccSigned2(prepareDownloadResponse: bytes) -> bytes: + """Extract the raw, DER-encoded binary euiccSigned2 field from the given prepareDownloadrResponse. This is + needed due to the very peculiar SGP.22 notion of signing sections of DER-encoded ASN.1 objects.""" + tdict, l, v, remainder = bertlv_parse_one(prepareDownloadResponse) + rawtag = bertlv_encode_tag(tdict) + if len(remainder): + raise ValueError('Excess data at end of TLV') + if b2h(rawtag) != 'bf21': + raise ValueError('Unexpected outer tag: %s' % b2h(rawtag)) + tdict, l, v1, remainder = bertlv_parse_one(v) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != 'a0': + raise ValueError('Unexpected tag where CHOICE was expected') + tdict, l, v2, remainder = bertlv_parse_one(v1) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != '30': + raise ValueError('Unexpected tag where SEQUENCE was expected') + return rawtag + bertlv_encode_len(l) + v2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36954?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I4e31fd4b23ec3be15b9d07c2c30a3e31e22bdda1 Gerrit-Change-Number: 36954 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in pysim[master]: docs/shell: Mention GlobalPlatform and eUICC commands in overview

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36953?usp=email ) Change subject: docs/shell: Mention GlobalPlatform and eUICC commands in overview ...................................................................... docs/shell: Mention GlobalPlatform and eUICC commands in overview Change-Id: I5b6ad752fea09ed9632f150dfbbabf2156a5a9c0 --- M docs/shell.rst 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/53/36953/1 diff --git a/docs/shell.rst b/docs/shell.rst index a27c450..084858c 100644 --- a/docs/shell.rst +++ b/docs/shell.rst @@ -20,6 +20,9 @@ * if your card supports it, and you have the related privileges: resizing, creating, enabling and disabling of files +* performing GlobalPlatform operations, including establishment of Secure Channel Protocol (SCP), Installing + applications, installing key material, etc. +* listing/enabling/disabling/deleting eSIM profiles on Consumer eUICC By means of using the python ``cmd2`` module, various useful features improve usability: -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36953?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I5b6ad752fea09ed9632f150dfbbabf2156a5a9c0 Gerrit-Change-Number: 36953 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in pysim[master]: osmo-smdpp: Make error message more descriptive

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36955?usp=email ) Change subject: osmo-smdpp: Make error message more descriptive ...................................................................... osmo-smdpp: Make error message more descriptive Before this patch we had three different error causes that would cause a "Verification failed" error message. Let's state explicitly which part of verification did actually fail. Change-Id: I5030758fe365bb802ae367b494aace5a66bc7a91 --- M osmo-smdpp.py 1 file changed, 16 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/55/36955/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index 9ed1e39..d7fc872 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -325,14 +325,14 @@ try: cs.verify_cert_chain(euicc_cert) except VerifyError: - raise ApiError('8.1.3', '6.1', 'Verification failed') + raise ApiError('8.1.3', '6.1', 'Verification failed (certificate chain)') # raise ApiError('8.1.3', '6.3', 'Expired') # Verify euiccSignature1 over euiccSigned1 using pubkey from euiccCertificate. # Otherwise, the SM-DP+ SHALL return a status code "eUICC - Verification failed" if not self._ecdsa_verify(euicc_cert, euiccSignature1_bin, euiccSigned1_bin): - raise ApiError('8.1', '6.1', 'Verification failed') + raise ApiError('8.1', '6.1', 'Verification failed (euiccSignature1 over euiccSigned1)') # TODO: verify EID of eUICC cert is within permitted range of EUM cert @@ -343,7 +343,7 @@ # serverChallenge returned by the eUICC. Otherwise, the SM-DP+ SHALL return a status code "eUICC - # Verification failed". if euiccSigned1['serverChallenge'] != ss.serverChallenge: - raise ApiError('8.1', '6.1', 'Verification failed') + raise ApiError('8.1', '6.1', 'Verification failed (serverChallenge)') # If ctxParams1 contains a ctxParamsForCommonAuthentication data object, the SM-DP+ Shall [...] # TODO: We really do a very simplistic job here, this needs to be properly implemented later, -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36955?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I5030758fe365bb802ae367b494aace5a66bc7a91 Gerrit-Change-Number: 36955 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[M] Change in pysim[master]: esim.saip: Introduce ProfileElement derived classes

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36957?usp=email ) Change subject: esim.saip: Introduce ProfileElement derived classes ...................................................................... esim.saip: Introduce ProfileElement derived classes It's rather useful to have derived classes implementing specific functions related to that SAIP profile type. Let's introruce that concept and a first example for securityDomain, where methods allow checking/adding/removing support for SCPs. Change-Id: I0929cc704b2aabddbc2ddee79ab8b674b1ed4691 --- M pySim/esim/saip/__init__.py 1 file changed, 62 insertions(+), 8 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/57/36957/1 diff --git a/pySim/esim/saip/__init__.py b/pySim/esim/saip/__init__.py index b8e41ce..fc86b63 100644 --- a/pySim/esim/saip/__init__.py +++ b/pySim/esim/saip/__init__.py @@ -26,6 +26,8 @@ from pySim.construct import build_construct from pySim.esim import compile_asn1_subdir from pySim.esim.saip import templates +from pySim.tlv import BER_TLV_IE +from pySim.global_platform.uicc import UiccSdInstallParams asn1 = compile_asn1_subdir('saip') @@ -134,6 +136,9 @@ """Class representing a Profile Element (PE) within a SAIP Profile.""" FILE_BEARING = ['mf', 'cd', 'telecom', 'usim', 'opt-usim', 'isim', 'opt-isim', 'phonebook', 'gsm-access', 'csim', 'opt-csim', 'eap', 'df-5gs', 'df-saip', 'df-snpn', 'df-5gprose', 'iot', 'opt-iot'] + def __init__(self, decoded = None): + self.decoded = decoded + def _fixup_sqnInit_dec(self) -> None: """asn1tools has a bug when working with SEQUENCE OF that have DEFAULT values. Let's work around this.""" @@ -161,12 +166,6 @@ # none of the fields were initialized with a non-default (non-zero) value, so we can skip it del self.decoded['sqnInit'] - def parse_der(self, der: bytes) -> None: - """Parse a sequence of PE and store the result in instance attributes.""" - self.type, self.decoded = asn1.decode('ProfileElement', der) - # work around asn1tools bug regarding DEFAULT for a SEQUENCE OF - self._fixup_sqnInit_dec() - @property def header_name(self) -> str: """Return the name of the header field within the profile element.""" @@ -195,12 +194,24 @@ @classmethod def from_der(cls, der: bytes) -> 'ProfileElement': """Construct an instance from given raw, DER encoded bytes.""" - inst = cls() - inst.parse_der(der) + pe_type, decoded = asn1.decode('ProfileElement', der) + if pe_type == 'securityDomain': + inst = ProfileElementSD(decoded) + else: + inst = ProfileElement(decoded) + inst.type = pe_type + # work around asn1tools bug regarding DEFAULT for a SEQUENCE OF + inst._fixup_sqnInit_dec() + # run any post-decoder a derived class may have + if hasattr(inst, '_post_decode'): + inst._post_decode() return inst def to_der(self) -> bytes: """Build an encoded DER representation of the instance.""" + # run any pre-encoder a derived class may have + if hasattr(self, '_pre_encode'): + self._pre_encode() # work around asn1tools bug regarding DEFAULT for a SEQUENCE OF self._fixup_sqnInit_enc() return asn1.encode('ProfileElement', (self.type, self.decoded)) @@ -208,6 +219,35 @@ def __str__(self) -> str: return self.type +class ProfileElementSD(ProfileElement): + """Class representing a securityDomain ProfileElement.""" + type = 'securityDomain' + + class C9(BER_TLV_IE, tag=0xC9, nested=UiccSdInstallParams): + pass + + def _post_decode(self): + self.usip = self.C9() + self.usip.from_bytes(self.decoded['instance']['applicationSpecificParametersC9']) + + def _pre_encode(self): + self.decoded['instance']['applicationSpecificParametersC9'] = self.usip.to_bytes() + + def has_scp(self, scp: int) -> bool: + """Determine if SD Installation parameters already specify given SCP.""" + return self.usip.nested_collection.has_scp(scp) + + def add_scp(self, scp: int, i: int): + """Add given SCP (and i parameter) to list of SCP of the Security Domain Install Params. + Example: add_scp(0x03, 0x70) for SCP03, or add_scp(0x02, 0x55) for SCP02.""" + self.usip.nested_collection.add_scp(scp, i) + self._pre_encode() + + def remove_scp(self, scp: int): + """Remove given SCP from list of SCP of the Security Domain Install Params.""" + self.usip.nested_collection.remove_scp(scp) + self._pre_encode() + def bertlv_first_segment(binary: bytes) -> Tuple[bytes, bytes]: """obtain the first segment of a binary concatenation of BER-TLV objects. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36957?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I0929cc704b2aabddbc2ddee79ab8b674b1ed4691 Gerrit-Change-Number: 36957 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

2025

2024

2023

2022

gerrit-log May 2024