- gerrit-log - lists.osmocom.org

[S] Change in pysim[master]: fixup encrypt
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36963?usp=email ) Change subject: fixup encrypt ...................................................................... fixup encrypt Change-Id: Idf0245e5077c56cb44f9af89b5a35bf5fbfe0c49 --- M contrib/csv-encrypt-columns.py 1 file changed, 14 insertions(+), 5 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/63/36963/1 diff --git a/contrib/csv-encrypt-columns.py b/contrib/csv-encrypt-columns.py index da94006..ab5d294 100755 --- a/contrib/csv-encrypt-columns.py +++ b/contrib/csv-encrypt-columns.py @@ -23,10 +23,10 @@ import argparse from Cryptodome.Cipher import AES -from pySim.utils import h2b, b2h +from pySim.utils import h2b, b2h, Hexstr from pySim.card_key_provider import CardKeyProviderCsv -def dict_keys_to_upper(d: dict): +def dict_keys_to_upper(d: dict) -> dict: return {k.upper():v for k,v in d.items()} class CsvColumnEncryptor: @@ -34,13 +34,13 @@ self.filename = filename self.transport_keys = dict_keys_to_upper(transport_keys) - def encrypt_col(self, colname:str, value: str): + def encrypt_col(self, colname:str, value: str) -> Hexstr: #print("Encrypting col %s (val=%s)" % (colname, value)) key = self.transport_keys[colname] cipher = AES.new(h2b(key), AES.MODE_CBC, CardKeyProviderCsv.IV) return b2h(cipher.encrypt(h2b(value))) - def encrypt(self): + def encrypt(self) -> None: with open(self.filename, 'r') as infile: cr = csv.DictReader(infile) cr.fieldnames = [field.upper() for field in cr.fieldnames] @@ -58,7 +58,7 @@ if __name__ == "__main__": parser = argparse.ArgumentParser() parser.add_argument('CSVFILE', help="CSV file name") - parser.add_argument('--csv-column-key', action='append', default=[], + parser.add_argument('--csv-column-key', action='append', required=True, help='per-CSV-column AES transport key') opts = parser.parse_args() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36963?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Idf0245e5077c56cb44f9af89b5a35bf5fbfe0c49 Gerrit-Change-Number: 36963 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: CardKeyProvider: Implement support for column-based transport key enc...
by laforge 30 May '24

30 May '24

Attention is currently required from: dexter, fixeria, laforge. Hello Jenkins Builder, dexter, fixeria, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/36930?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Verified+1 by Jenkins Builder Change subject: CardKeyProvider: Implement support for column-based transport key encryption ...................................................................... CardKeyProvider: Implement support for column-based transport key encryption It's generally a bad idea to keep [card specific] key material lying around unencrypted in CSV files. The industry standard solution in the GSMA is a so-called "transport key", which encrypts the key material. Let's introduce support for this in the CardKeyProvider (and specifically, the CardKeyProviderCSV) and allow the user to specify transport key material as command line options to pySim-shell. Different transport keys can be used for different key materials, so allow specification of keys on a CSV-column base. The higher-level goal is to allow the CSV file not only to store the ADM keys (like now), but also global platform key material for establishing SCP towards various security domains in a given card. Change-Id: I13146a799448d03c681dc868aaa31eb78b7821ff --- A contrib/csv-encrypt-columns.py M docs/card-key-provider.rst M pySim-shell.py M pySim/card_key_provider.py 4 files changed, 189 insertions(+), 15 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/30/36930/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36930?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I13146a799448d03c681dc868aaa31eb78b7821ff Gerrit-Change-Number: 36930 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-MessageType: newpatchset

1 0

[M] Change in pysim[master]: esim.saip: Implement SecurityDomainSD.{add,has,remove}_key() methods
by laforge 30 May '24

30 May '24

Attention is currently required from: laforge. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/36958?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: esim.saip: Implement SecurityDomainSD.{add,has,remove}_key() methods ...................................................................... esim.saip: Implement SecurityDomainSD.{add,has,remove}_key() methods This way it's possible to programmatically inspect and modify the high-level decoded key material inside a securityDomain profile element. Change-Id: I18b1444303de80eaddd840a7e0061ea0098a8ba1 --- M pySim/esim/saip/__init__.py 1 file changed, 92 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/58/36958/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36958?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I18b1444303de80eaddd840a7e0061ea0098a8ba1 Gerrit-Change-Number: 36958 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 0

[M] Change in pysim[master]: document the CardKeyProvider
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36962?usp=email ) Change subject: document the CardKeyProvider ...................................................................... document the CardKeyProvider Change-Id: Ie6fc24695dd956a4f9fd6f243d3b0ef66acf877b --- A docs/card-key-provider.rst M docs/shell.rst 2 files changed, 112 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/62/36962/1 diff --git a/docs/card-key-provider.rst b/docs/card-key-provider.rst new file mode 100644 index 0000000..4c3941b --- /dev/null +++ b/docs/card-key-provider.rst @@ -0,0 +1,94 @@ + +Retrieving card-individual keys via CardKeyProvider +================================================== + +When working with a batch of cards, or more than one card in general, it +is a lot of effort to manually retrieve the card-specific PIN (like +ADM1) or key material (like SCP02/SCP03 keys). + +To increase productivity in that regard, pySim has a concept called the +`CardKeyProvider`. This is a generic mechanism by which different parts +of the pySim[-shell] code can programmatically request card-specific key material +from some data source (*provider*). + +For example, when you want to verify the ADM1 PIN using the `verify_adm` +command without providing an ADM1 value yourself, pySim-shell will +request the ADM1 value for the ICCID of the card via the +CardKeyProvider. + +There can in theory multiple different CardKeyProviders. You can for +example develop your own CardKeyProvider that queries some kind of +database for the key material, or that uses a key derivation function to +derive card-specific key material from a global master key. + +The only actual CardKeyProvider implementation included in pySim is the +`CardKeyProviderCsv` which retrieves the key material from a +[potentially encrypted] CSV file. + + +The CardKeyProviderCsv +---------------------- + +The `CardKeyProviderCsv` allows you to retrieve card-individual key +material from a CSV (comma separated value) file that is accessible to pySim. + +The CSV file must have the expected column names, for example `ICCID` +and `ADM1` in case you would like to use that CSV to obtain the +card-specific ADM1 PIN when using the `verify_adm` command. + +You can specify the CSV file to use via the `--csv` command-line option +of pySim-shell. If you do not specify a CSV file, pySim will attempt to +open a CSV file from the default location at +`~/.osmocom/pysim/card_data.csv`, and use that, if it exists. + + +Field naming +------------ + +* For look-up of UICC/SIM/USIM/ISIM or eSIM profile specific key + material, pySim uses the `ICCID` field as lookup key. + +* For look-up of eUICC specific key material (like SCP03 keys for the + ISD-R, ECASD), pySim uses the `EID` field as lookup key. + +As soon as the CardKeyProviderCsv finds a line (row) in your CSV where +the ICCID or EID match, it looks for the column containing the requested +data. + + +ADM PIN +~~~~~~~ + +The `verify_adm` command will attempt to look up the `ADM1` column +indexed by the ICCID of the SIM/UICC. + + +SCP02 / SCP03 +~~~~~~~~~~~~~ + +SCP02 and SCP03 each use key triplets consisting if ENC, MAC and DEK +keys. For more details, see the applicable GlobalPlatform +specifications. + +If you do not want to manually enter the key material for each specific +card as arguments to the `establish_scp02` or `establish_scp03` +commands, you can make use of the `--key-provider-sufix` option. pySim +uses this suffix to compose the column names for the CardKeyProvider as +follows. + +* `SCP02_ENC_` + suffix for the SCP02 ciphering key +* `SCP02_MAC_` + suffix for the SCP02 MAC key +* `SCP02_DEK_` + suffix for the SCP02 DEK key +* `SCP03_ENC_` + suffix for the SCP03 ciphering key +* `SCP03_MAC_` + suffix for the SCP03 MAC key +* `SCP03_DEK_` + suffix for the SCP03 DEK key + +So for example, if you are using a command like `establish_scp03 +--key-provider-suffix ISDR`, then the column names for the key material +look-up are `SCP03_ENC_ISDR`, `SCP03_MAC_ISDR` and `SCP03_DEK_ISDR`, +respectively. + +The identifier used for look-up is determined by the definition of the +Security Domain. For example, the eUICC ISD-R and ECASD will use the EID +of the eUICC. On the other hand, the ISD-P of an eSIM or the ISD of an +UICC will use the ICCID. diff --git a/docs/shell.rst b/docs/shell.rst index 084858c..111c502 100644 --- a/docs/shell.rst +++ b/docs/shell.rst @@ -69,6 +69,15 @@ suci-tutorial +Advanced Topics +--------------- +.. toctree:: + :maxdepth: 1 + :caption: Advanced pySIM-shell topics + + card-key-provider + + cmd2 basics ----------- -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36962?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ie6fc24695dd956a4f9fd6f243d3b0ef66acf877b Gerrit-Change-Number: 36962 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[S] Change in pysim[master]: docs/shell: Mention GlobalPlatform and eUICC commands in overview
by laforge 30 May '24

30 May '24

laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/36953?usp=email ) Change subject: docs/shell: Mention GlobalPlatform and eUICC commands in overview ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36953?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I5b6ad752fea09ed9632f150dfbbabf2156a5a9c0 Gerrit-Change-Number: 36953 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Thu, 30 May 2024 18:07:38 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in pysim[master]: esim.saip: Implement ProfileElement.header_name for more PE types
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36960?usp=email ) Change subject: esim.saip: Implement ProfileElement.header_name for more PE types ...................................................................... esim.saip: Implement ProfileElement.header_name for more PE types We now cover all PE types as of PE_Definitions-3.3.1.asn Change-Id: I37951a0441fe53fce7a329066aebd973389cb743 --- M pySim/esim/saip/__init__.py 1 file changed, 30 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/60/36960/1 diff --git a/pySim/esim/saip/__init__.py b/pySim/esim/saip/__init__.py index ae733e1..f066ba4 100644 --- a/pySim/esim/saip/__init__.py +++ b/pySim/esim/saip/__init__.py @@ -173,6 +173,25 @@ # unneccessarry compliaction by inconsistent naming :( if self.type.startswith('opt-'): return self.type.replace('-','') + '-header' + elif self.type == 'genericFileManagement': + return 'gfm-header' + elif self.type == 'akaParameter': + return 'aka-header' + elif self.type == 'cdmaParameter': + return 'cdma-header' + elif self.type == 'application': + return 'app-header' + elif self.type == 'header': + return None + elif self.type == 'pukCodes': + # note how they couldn't even consistently captialize the 'header' suffix :( + return 'puk-Header' + elif self.type == 'pinCodes': + # note how they couldn't even consistently captialize the 'header' suffix :( + return 'pin-Header' + elif self.type == 'securityDomain': + # note how they couldn't even consistently captialize the 'header' suffix :( + return 'sd-Header' return self.type + '-header' @property -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36960?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I37951a0441fe53fce7a329066aebd973389cb743 Gerrit-Change-Number: 36960 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: pySim.esim.saip: Meaningful constructors for [I]SD + SSD
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36961?usp=email ) Change subject: pySim.esim.saip: Meaningful constructors for [I]SD + SSD ...................................................................... pySim.esim.saip: Meaningful constructors for [I]SD + SSD So far the main use case was to read a ProfileElement-SD from a DER file. But when we want to construct one from scratch, we need to have the constructor put some meaningful [default] values into the class members. Change-Id: I69e104f1d78165c12291317326dbab05977a1574 --- M pySim/esim/saip/__init__.py 1 file changed, 85 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/61/36961/1 diff --git a/pySim/esim/saip/__init__.py b/pySim/esim/saip/__init__.py index f066ba4..9cf8387 100644 --- a/pySim/esim/saip/__init__.py +++ b/pySim/esim/saip/__init__.py @@ -18,10 +18,11 @@ import abc import io from typing import Tuple, List, Optional, Dict, Union +from collections import OrderedDict import asn1tools -from pySim.utils import bertlv_parse_tag, bertlv_parse_len, b2h +from pySim.utils import bertlv_parse_tag, bertlv_parse_len, b2h, h2b from pySim.ts_102_221 import FileDescriptor from pySim.construct import build_construct from pySim.esim import compile_asn1_subdir @@ -300,6 +301,35 @@ class C9(BER_TLV_IE, tag=0xC9, nested=UiccSdInstallParams): pass + def __init__(self, decoded: Optional[dict] = None): + if decoded: + self.decoded = decoded + return + # provide some reasonable defaults for a MNO-SD + self.decoded = OrderedDict() + self.decoded['sd-Header'] = { 'mandated': None, 'identification': None } + self.decoded['instance'] = { + 'applicationLoadPackageAID': h2b('A0000001515350'), + 'classAID': h2b('A000000251535041'), + 'instanceAID': h2b('A000000151000000'), + # Optional: extraditeSecurityDomainAID + 'applicationPrivileges': h2b('82FC80'), + # Optioal: lifeCycleState + 'applicationSpecificParametersC9': h2b('8201f09301f08701f0'), # we assume user uses add_scp() + # Optional: systemSpecificParameters + 'applicationParameters': { + # TAR: B20100, MSL: 12 + 'uiccToolkitApplicationSpecificParametersField': h2b('0100000100000002011203B2010000'), + }, + # Optional: processData + # Optional: controlReferenceTemplate + } + self.decoded['keyList'] = [] # we assume user uses add_key() method for all keys + # Optional: sdPersoData + # Optional: openPersoData + # Optional: catTpParameters + self._post_decode() + def _post_decode(self): self.usip = self.C9() self.usip.from_bytes(self.decoded['instance']['applicationSpecificParametersC9']) @@ -347,6 +377,17 @@ self.keys.remove(key) self._pre_encode() +class ProfileElementSSD(ProfileElementSD): + """Class representing a securityDomain ProfileElement for a SSD.""" + def __init__(self): + super().__init__() + # defaults [overriding ProfileElementSD) taken from SAIP v2.3.1 Section 11.2.12 + self.decoded['instance']['instanceAID'] = h2b('A00000055910100102736456616C7565') + self.decoded['instance']['applicationPrivileges'] = h2b('808000') + self.decoded['instance']['applicationParameters'] = { + # TAR: 6C7565, MSL: 12 + 'uiccToolkitApplicationSpecificParametersField': h2b('01000001000000020112036C756500'), + } def bertlv_first_segment(binary: bytes) -> Tuple[bytes, bytes]: """obtain the first segment of a binary concatenation of BER-TLV objects. @@ -440,6 +481,35 @@ out += pe.to_der() return out + def renumber_identitification(self): + """Re-generate the 'identification' numbering of all PE headers.""" + i = 1 + for pe in self.pe_list: + hdr = pe.header + if not hdr: + continue + pe.header['identification'] = i + i += 1 + + def get_index_by_type(self, petype: str) -> List[int]: + """Return a list with the indizies of all instances of PEs of petype.""" + ret = [] + i = 0 + for pe in self.pe_list: + if pe.type == petype: + ret.append(i) + i += 1 + return ret + + def add_ssd(self, ssd: ProfileElementSSD): + """Add a SSD (Supplementary Security Domain) After MNO-SD/ISD-P.""" + # find MNO-SD index + idx = self.get_index_by_type('securityDomain')[0] + # insert _after_ MNO-SD + self.pe_list.insert(idx+1, ssd) + self._process_pelist() + self.renumber_identitification() + def __repr__(self) -> str: return "PESequence(%s)" % ', '.join([str(x) for x in self.pe_list]) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36961?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I69e104f1d78165c12291317326dbab05977a1574 Gerrit-Change-Number: 36961 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[S] Change in pysim[master]: pySim.esim.saip.validation: Ensure unique PE identification value
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36959?usp=email ) Change subject: pySim.esim.saip.validation: Ensure unique PE identification value ...................................................................... pySim.esim.saip.validation: Ensure unique PE identification value Change-Id: I37b9eb4cfb74de79b0493986d976c8a5f8ccd8ea --- M pySim/esim/saip/validation.py 1 file changed, 15 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/59/36959/1 diff --git a/pySim/esim/saip/validation.py b/pySim/esim/saip/validation.py index f9f5773..c253b7a 100644 --- a/pySim/esim/saip/validation.py +++ b/pySim/esim/saip/validation.py @@ -95,6 +95,12 @@ if 'profile-a-p256' in m_svcs and not ('usim' in m_svcs or 'isim' in m_svcs): raise ProfileError('profile-a-p256 mandatory, but no usim or isim') + def check_identification_unique(self, pes: ProfileElementSequence): + """Ensure that each PE has a unique identification value.""" + id_list = [pe.header['identification'] for pe in pes.pe_list if pe.header] + if len(id_list) != len(set(id_list)): + raise ProfileError('PE identification values are not unique') + FileChoiceList = List[Tuple] class FileError(ProfileError): -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36959?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I37b9eb4cfb74de79b0493986d976c8a5f8ccd8ea Gerrit-Change-Number: 36959 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: osmo-smdpp: Don't re-encode euiccSigned1/euiccSigned2
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36954?usp=email ) Change subject: osmo-smdpp: Don't re-encode euiccSigned1/euiccSigned2 ...................................................................... osmo-smdpp: Don't re-encode euiccSigned1/euiccSigned2 We used to re-encode those parts of a decoded ASN.1 struct that is cryptographically signed in the GSMA SGP.22 specification. However, if the received data follows a later spec and contains new/unknown records, then our poor-man's attempt at re-encoding will render a different binary, which in turn means the signature check will fail. Let's instead do a manual step-by-step raw decode of the DER TLV structure to extract the actual binary information of parts of ASN.1 objects. Change-Id: I4e31fd4b23ec3be15b9d07c2c30a3e31e22bdda1 Closes: OS#6473 --- M osmo-smdpp.py M pySim/esim/rsp.py 2 files changed, 61 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/54/36954/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index 3dc6131..9ed1e39 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -292,8 +292,7 @@ r_ok = authenticateServerResp[1] euiccSigned1 = r_ok['euiccSigned1'] - # TODO: use original data, don't re-encode? - euiccSigned1_bin = rsp.asn1.encode('EuiccSigned1', euiccSigned1) + euiccSigned1_bin = rsp.extract_euiccSigned1(authenticateServerResp_bin) euiccSignature1_bin = r_ok['euiccSignature1'] euiccCertificate_dec = r_ok['euiccCertificate'] # TODO: use original data, don't re-encode? @@ -422,8 +421,7 @@ # Verify the euiccSignature2 computed over euiccSigned2 and smdpSignature2 using the PK.EUICC.SIG attached to the ongoing RSP session euiccSigned2 = r_ok['euiccSigned2'] - # TODO: use original data, don't re-encode? - euiccSigned2_bin = rsp.asn1.encode('EUICCSigned2', euiccSigned2) + euiccSigned2_bin = rsp.extract_euiccSigned2(prepDownloadResp_bin) if not self._ecdsa_verify(ss.euicc_cert, r_ok['euiccSignature2'], euiccSigned2_bin + ss.smdpSignature2_do): raise ApiError('8.1', '6.1', 'eUICC signature is invalid') diff --git a/pySim/esim/rsp.py b/pySim/esim/rsp.py index ec317fc..a032031 100644 --- a/pySim/esim/rsp.py +++ b/pySim/esim/rsp.py @@ -24,6 +24,7 @@ from cryptography.hazmat.primitives.serialization import Encoding from cryptography import x509 +from pySim.utils import bertlv_parse_one, bertlv_encode_tag, bertlv_encode_len, b2h from pySim.esim import compile_asn1_subdir asn1 = compile_asn1_subdir('rsp') @@ -96,3 +97,41 @@ class RspSessionStore(shelve.DbfilenameShelf): """A derived class as wrapper around the database-backed non-volatile storage 'shelve', in case we might need to extend it in the future. We use it to store RspSessionState objects indexed by transactionId.""" + +def extract_euiccSigned1(authenticateServerResponse: bytes) -> bytes: + """Extract the raw, DER-encoded binary euiccSigned1 field from the given AuthenticateServerResponse. This + is needed due to the very peculiar SGP.22 notion of signing sections of DER-encoded ASN.1 objects.""" + tdict, l, v, remainder = bertlv_parse_one(authenticateServerResponse) + rawtag = bertlv_encode_tag(tdict) + if len(remainder): + raise ValueError('Excess data at end of TLV') + if b2h(rawtag) != 'bf38': + raise ValueError('Unexpected outer tag: %s' % b2h(rawtag)) + tdict, l, v1, remainder = bertlv_parse_one(v) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != 'a0': + raise ValueError('Unexpected tag where CHOICE was expected') + tdict, l, v2, remainder = bertlv_parse_one(v1) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != '30': + raise ValueError('Unexpected tag where SEQUENCE was expected') + return rawtag + bertlv_encode_len(l) + v2 + +def extract_euiccSigned2(prepareDownloadResponse: bytes) -> bytes: + """Extract the raw, DER-encoded binary euiccSigned2 field from the given prepareDownloadrResponse. This is + needed due to the very peculiar SGP.22 notion of signing sections of DER-encoded ASN.1 objects.""" + tdict, l, v, remainder = bertlv_parse_one(prepareDownloadResponse) + rawtag = bertlv_encode_tag(tdict) + if len(remainder): + raise ValueError('Excess data at end of TLV') + if b2h(rawtag) != 'bf21': + raise ValueError('Unexpected outer tag: %s' % b2h(rawtag)) + tdict, l, v1, remainder = bertlv_parse_one(v) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != 'a0': + raise ValueError('Unexpected tag where CHOICE was expected') + tdict, l, v2, remainder = bertlv_parse_one(v1) + rawtag = bertlv_encode_tag(tdict) + if b2h(rawtag) != '30': + raise ValueError('Unexpected tag where SEQUENCE was expected') + return rawtag + bertlv_encode_len(l) + v2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36954?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I4e31fd4b23ec3be15b9d07c2c30a3e31e22bdda1 Gerrit-Change-Number: 36954 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[S] Change in pysim[master]: docs/shell: Mention GlobalPlatform and eUICC commands in overview
by laforge 30 May '24

30 May '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/36953?usp=email ) Change subject: docs/shell: Mention GlobalPlatform and eUICC commands in overview ...................................................................... docs/shell: Mention GlobalPlatform and eUICC commands in overview Change-Id: I5b6ad752fea09ed9632f150dfbbabf2156a5a9c0 --- M docs/shell.rst 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/53/36953/1 diff --git a/docs/shell.rst b/docs/shell.rst index a27c450..084858c 100644 --- a/docs/shell.rst +++ b/docs/shell.rst @@ -20,6 +20,9 @@ * if your card supports it, and you have the related privileges: resizing, creating, enabling and disabling of files +* performing GlobalPlatform operations, including establishment of Secure Channel Protocol (SCP), Installing + applications, installing key material, etc. +* listing/enabling/disabling/deleting eSIM profiles on Consumer eUICC By means of using the python ``cmd2`` module, various useful features improve usability: -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36953?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I5b6ad752fea09ed9632f150dfbbabf2156a5a9c0 Gerrit-Change-Number: 36953 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

2026

2025

2024

2023

2022

gerrit-log