- gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: pylint: transport/modem_atcmd.py
by laforge 05 Feb '24

05 Feb '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35821?usp=email ) Change subject: pylint: transport/modem_atcmd.py ...................................................................... pylint: transport/modem_atcmd.py pySim/transport/modem_atcmd.py:70:0: C0325: Unnecessary parens after 'assert' keyword (superfluous-parens) pySim/transport/modem_atcmd.py:28:0: W0401: Wildcard import pySim.exceptions (wildcard-import) pySim/transport/modem_atcmd.py:60:22: C0123: Use isinstance() rather than type() for a typecheck. (unidiomatic-typecheck) pySim/transport/modem_atcmd.py:72:12: W0707: Consider explicitly re-raising using 'except Exception as exc' and 'raise ReaderError('Failed to send AT command: %s' % cmd) from exc' (raise-missing-from) pySim/transport/modem_atcmd.py:120:12: R1705: Unnecessary "elif" after "return", remove the leading "el" from "elif" (no-else-return) pySim/transport/modem_atcmd.py:138:8: W1201: Use lazy % formatting in logging functions (logging-not-lazy) pySim/transport/modem_atcmd.py:170:12: W0707: Consider explicitly re-raising using 'except Exception as exc' and 'raise ReaderError('Failed to parse response from modem: %s' % rsp) from exc' (raise-missing-from) pySim/transport/modem_atcmd.py:168:13: W0612: Unused variable 'rsp_pdu_len' (unused-variable) pySim/transport/modem_atcmd.py:21:0: C0411: standard import "import time" should be placed before "import serial" (wrong-import-order) pySim/transport/modem_atcmd.py:22:0: C0411: standard import "import re" should be placed before "import serial" (wrong-import-order) pySim/transport/modem_atcmd.py:23:0: C0411: standard import "import argparse" should be placed before "import serial" (wrong-import-order) pySim/transport/modem_atcmd.py:24:0: C0411: standard import "from typing import Optional" should be placed before "import serial" (wrong-import-order) pySim/transport/modem_atcmd.py:28:0: W0614: Unused import(s) NoCardError and SwMatchError from wildcard import of pySim.exceptions (unused-wildcard-import) Change-Id: I2c8994eabd973b65132af1030429b1021d0c20df --- M pySim/transport/modem_atcmd.py 1 file changed, 36 insertions(+), 15 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/21/35821/1 diff --git a/pySim/transport/modem_atcmd.py b/pySim/transport/modem_atcmd.py index a05d6c4..5943e3a 100644 --- a/pySim/transport/modem_atcmd.py +++ b/pySim/transport/modem_atcmd.py @@ -17,15 +17,15 @@ # import logging as log -import serial import time import re import argparse from typing import Optional +import serial from pySim.utils import Hexstr, ResTuple from pySim.transport import LinkBase -from pySim.exceptions import * +from pySim.exceptions import ReaderError, ProtocolError # HACK: if somebody needs to debug this thing # log.root.setLevel(log.DEBUG) @@ -57,7 +57,7 @@ def send_at_cmd(self, cmd, timeout=0.2, patience=0.002): # Convert from string to bytes, if needed - bcmd = cmd if type(cmd) is bytes else cmd.encode() + bcmd = cmd if isinstance(cmd, bytes) else cmd.encode() bcmd += b'\r' # Clean input buffer from previous/unexpected data @@ -67,9 +67,9 @@ log.debug('Sending AT command: %s', cmd) try: wlen = self._sl.write(bcmd) - assert(wlen == len(bcmd)) - except: - raise ReaderError('Failed to send AT command: %s' % cmd) + assert wlen == len(bcmd) + except Exception as exc: + raise ReaderError('Failed to send AT command: %s' % cmd) from exc rsp = b'' its = 1 @@ -91,8 +91,7 @@ break time.sleep(patience) its += 1 - log.debug('Command took %0.6fs (%d cycles a %fs)', - time.time() - t_start, its, patience) + log.debug('Command took %0.6fs (%d cycles a %fs)', time.time() - t_start, its, patience) if self._echo: # Skip echo chars @@ -120,11 +119,10 @@ if result[-1] == b'OK': self._echo = False return - elif result[-1] == b'AT\r\r\nOK': + if result[-1] == b'AT\r\r\nOK': self._echo = True return - raise ReaderError( - 'Interface \'%s\' does not respond to \'AT\' command' % self._device) + raise ReaderError('Interface \'%s\' does not respond to \'AT\' command' % self._device) def reset_card(self): # Reset the modem, just to be sure @@ -135,7 +133,7 @@ if self.send_at_cmd('AT+CSIM=?') != [b'OK']: raise ReaderError('The modem does not seem to support SIM access') - log.info('Modem at \'%s\' is ready!' % self._device) + log.info('Modem at \'%s\' is ready!', self._device) def connect(self): pass # Nothing to do really ... @@ -165,9 +163,9 @@ # Make sure that the response has format: b'+CSIM: %d,\"%s\"' try: result = re.match(b'\+CSIM: (\d+),\"([0-9A-F]+)\"', rsp) - (rsp_pdu_len, rsp_pdu) = result.groups() - except: - raise ReaderError('Failed to parse response from modem: %s' % rsp) + (_rsp_pdu_len, rsp_pdu) = result.groups() + except Exception as exc: + raise ReaderError('Failed to parse response from modem: %s' % rsp) from exc # TODO: make sure we have at least SW data = rsp_pdu[:-4].decode().lower() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35821?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I2c8994eabd973b65132af1030429b1021d0c20df Gerrit-Change-Number: 35821 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: global_platform: Add DEK (key) encryption support
by laforge 05 Feb '24

05 Feb '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35808?usp=email ) Change subject: global_platform: Add DEK (key) encryption support ...................................................................... global_platform: Add DEK (key) encryption support Change-Id: I940cc2e16a1d3e3cdef4ebcf3f15fc2c8de21284 --- M pySim/global_platform/__init__.py M pySim/global_platform/scp.py 2 files changed, 71 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/08/35808/1 diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index 6d69796..6f72bdc 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -544,7 +544,13 @@ else: kcv_bin = compute_kcv(opts.key_type[i], h2b(opts.key_data[i])) or b'' kcv = b2h(kcv_bin) - kdb.append({'key_type': opts.key_type[i], 'kcb': opts.key_data[i], 'kcv': kcv}) + if self._cmd.lchan.scc.scp: + # encrypte key data with DEK of current SCP + kcb = b2h(self._cmd.lchan.scc.scp.card_keys.encrypt_key(h2b(opts.key_data[i]))) + else: + # (for example) during personalization, DEK might not be required) + kcb = opts.key_data[i] + kdb.append({'key_type': opts.key_type[i], 'kcb': kcb, 'kcv': kcv}) p2 = opts.key_id if len(opts.key_type) > 1: p2 |= 0x80 diff --git a/pySim/global_platform/scp.py b/pySim/global_platform/scp.py index b8ac122..4e64e41 100644 --- a/pySim/global_platform/scp.py +++ b/pySim/global_platform/scp.py @@ -22,7 +22,7 @@ from Cryptodome.Util.strxor import strxor from construct import Struct, Bytes, Int8ub, Int16ub, Const from construct import Optional as COptional -from pySim.utils import b2h +from pySim.utils import b2h, bertlv_parse_len, bertlv_encode_len from pySim.secure_channel import SecureChannel from typing import Optional @@ -59,6 +59,7 @@ DERIV_CONST_RMAC = b'\x01\x02' DERIV_CONST_ENC = b'\x01\x82' DERIV_CONST_DENC = b'\x01\x81' + blocksize = 8 def calc_mac_1des(self, data: bytes, reset_icv: bool = False) -> bytes: """Pad and calculate MAC according to B.1.2.2 - Single DES plus final 3DES""" @@ -175,6 +176,43 @@ def gen_ext_auth_apdu(self, security_level: int = 0x01) -> bytes: pass + def encrypt_key(self, key: bytes) -> bytes: + """Encrypt a key with the DEK.""" + num_pad = len(key) % self.sk.blocksize + if num_pad: + return bertlv_encode_len(len(key)) + self.dek_encrypt(key + b'\x00'*num_pad) + else: + return self.dek_encrypt(key) + + def decrypt_key(self, encrypted_key:bytes) -> bytes: + """Decrypt a key with the DEK.""" + if len(encrypted_key) % self.sk.blocksize: + # If the length of the Key Component Block is not a multiple of the block size of the encryption # + # algorithm (i.e. 8 bytes for DES, 16 bytes for AES), then it shall be assumed that the key + # component value was right-padded prior to encryption and that the Key Component Block was + # formatted as described in Table 11-70. In this case, the first byte(s) of the Key Component + # Block provides the actual length of the key component value, which allows recovering the + # clear-text key component value after decryption of the encrypted key component value and removal + # of padding bytes. + decrypted = self.dek_decrypt(encrypted_key) + key_len, remainder = bertlv_parse_len(decrypted) + return remainder[:key_len] + else: + # If the length of the Key Component Block is a multiple of the block size of the encryption + # algorithm (i.e. 8 bytes for DES, 16 bytes for AES), then it shall be assumed that no padding + # bytes were added before encrypting the key component value and that the Key Component Block is + # only composed of the encrypted key component value (as shown in Table 11-71). In this case, the + # clear-text key component value is simply recovered by decrypting the Key Component Block. + return self.dek_decrypt(encrypted_key) + + @abc.abstractmethod + def dek_encrypt(self, plaintext:bytes) -> bytes: + pass + + @abc.abstractmethod + def dek_decrypt(self, ciphertext:bytes) -> bytes: + pass + class SCP02(SCP): """An instance of the GlobalPlatform SCP02 secure channel protocol.""" @@ -183,6 +221,14 @@ 'seq_counter'/Int16ub, 'card_challenge'/Bytes(6), 'card_cryptogram'/Bytes(8)) kvn_range = [0x20, 0x2f] + def dek_encrypt(self, plaintext:bytes) -> bytes: + cipher = DES.new(self.card_keys.dek, DES.MODE_ECB) + return cipher.encrypt(plaintext) + + def dek_decrypt(self, ciphertext:bytes) -> bytes: + cipher = DES.new(self.card_keys.dek, DES.MODE_ECB) + return cipher.decrypt(ciphertext) + def _compute_cryptograms(self, card_challenge: bytes, host_challenge: bytes): logger.debug("host_challenge(%s), card_challenge(%s)", b2h(host_challenge), b2h(card_challenge)) self.host_cryptogram = self.sk.calc_mac_3des(self.sk.counter.to_bytes(2, 'big') + card_challenge + host_challenge) @@ -369,6 +415,14 @@ self.s_mode = kwargs.pop('s_mode', 8) super().__init__(*args, **kwargs) + def dek_encrypt(self, plaintext:bytes) -> bytes: + cipher = AES.new(self.card_keys.dek, AES.MODE_CBC, b'\x00'*16) + return cipher.encrypt(plaintext) + + def dek_decrypt(self, ciphertext:bytes) -> bytes: + cipher = AES.new(self.card_keys.dek, AES.MODE_CBC, b'\x00'*16) + return cipher.decrypt(ciphertext) + def _compute_cryptograms(self): logger.debug("host_challenge(%s), card_challenge(%s)", b2h(self.host_challenge), b2h(self.card_challenge)) # Card + Host Authentication Cryptogram: Section 6.2.2.2 + 6.2.2.3 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35808?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I940cc2e16a1d3e3cdef4ebcf3f15fc2c8de21284 Gerrit-Change-Number: 35808 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: construct: Add StripTrailerAdapter
by laforge 05 Feb '24

05 Feb '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35806?usp=email ) Change subject: construct: Add StripTrailerAdapter ...................................................................... construct: Add StripTrailerAdapter In smart cards, we every so often encounter data types that contain a bit-mask whose length depends on whether or not there are any of the least-significant bits are set. So far we worked around this with some kind of Struct('byte1', 'byte2'/COptional, 'byte3'/COptional) approach. Let's do thisin a generic way using the new StripTrailerAdapter. Change-Id: I659aa7247c57c680895b0bf8412f9e477fc3587d --- M pySim/construct.py M pySim/global_platform/__init__.py M tests/test_construct.py 3 files changed, 97 insertions(+), 25 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/06/35806/1 diff --git a/pySim/construct.py b/pySim/construct.py index 988dbf3..8ef7941 100644 --- a/pySim/construct.py +++ b/pySim/construct.py @@ -365,6 +365,37 @@ ia = ipaddress.IPv6Address(obj) return ia.packed +class StripTrailerAdapter(Adapter): + """ + Encoder removes all trailing bytes matching the default_value + Decoder pads input data up to total_length with default_value + + This is used in constellations like "FlagsEnum(StripTrailerAdapter(GreedyBytes, 3), ..." + where you have a bit-mask that may have 1, 2 or 3 bytes, depending on whether or not any + of the LSBs are actually set. + """ + def __init__(self, subcon, total_length:int, default_value=b'\x00', min_len=1): + super().__init__(subcon) + assert len(default_value) == 1 + self.total_length = total_length + self.default_value = default_value + self.min_len = min_len + + def _decode(self, obj, context, path): + assert type(obj) == bytes + # pad with suppressed/missing bytes + if len(obj) < self.total_length: + obj += self.default_value * (self.total_length - len(obj)) + return int.from_bytes(obj, 'big') + + def _encode(self, obj, context, path): + assert type(obj) == int + obj = obj.to_bytes(self.total_length, 'big') + # remove trailing bytes if they are zero + while len(obj) > self.min_len and obj[-1] == self.default_value[0]: + obj = obj[:-1] + return obj + def filter_dict(d, exclude_prefix='_'): """filter the input dict to ensure no keys starting with 'exclude_prefix' remain.""" diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index 494cfe1..7b5ab8f 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -124,15 +124,16 @@ pass # GP v2.3 11.1.9 -KeyUsageQualifier = Struct('byte1'/FlagsEnum(Byte, verification_encryption=0x80, - computation_decipherment=0x40, - sm_response=0x20, - sm_command=0x10, - confidentiality=0x08, - crypto_checksum=0x04, - digital_signature=0x02, - crypto_authorization=0x01), - 'byte2'/COptional(FlagsEnum(Byte, key_agreement=0x80))) +KeyUsageQualifier = FlagsEnum(StripTrailerAdapter(GreedyBytes, 2), + verification_encryption=0x8000, + computation_decipherment=0x4000, + sm_response=0x2000, + sm_command=0x1000, + confidentiality=0x0800, + crypto_checksum=0x0400, + digital_signature=0x0200, + crypto_authorization=0x0100, + key_agreement=0x0080) # GP v2.3 11.1.10 KeyAccess = Enum(Byte, sd_and_any_assoc_app=0x00, sd_only=0x01, any_assoc_app_but_not_sd=0x02, @@ -210,13 +211,13 @@ class CiphersForLFDBEncryption(BER_TLV_IE, tag=0x84): _construct = Enum(Byte, tripledes16=0x01, aes128=0x02, aes192=0x04, aes256=0x08, icv_supported_for_lfdb=0x80) -CipherSuitesForSignatures = Struct('byte1'/FlagsEnum(Byte, rsa1024_pkcsv15_sha1=0x01, - rsa_gt1024_pss_sha256=0x02, - single_des_plus_final_triple_des_mac_16b=0x04, - cmac_aes128=0x08, cmac_aes192=0x10, cmac_aes256=0x20, - ecdsa_ecc256_sha256=0x40, ecdsa_ecc384_sha384=0x80), - 'byte2'/COptional(FlagsEnum(Byte, ecdsa_ecc512_sha512=0x01, - ecdsa_ecc_521_sha512=0x02))) +CipherSuitesForSignatures = FlagsEnum(StripTrailerAdapter(GreedyBytes, 2), + rsa1024_pkcsv15_sha1=0x0100, + rsa_gt1024_pss_sha256=0x0200, + single_des_plus_final_triple_des_mac_16b=0x0400, + cmac_aes128=0x0800, cmac_aes192=0x1000, cmac_aes256=0x2000, + ecdsa_ecc256_sha256=0x4000, ecdsa_ecc384_sha384=0x8000, + ecdsa_ecc512_sha512=0x0001, ecdsa_ecc_521_sha512=0x0002) class CiphersForTokens(BER_TLV_IE, tag=0x85): _construct = CipherSuitesForSignatures class CiphersForReceipts(BER_TLV_IE, tag=0x86): @@ -387,15 +388,16 @@ # Section 11.4.3.1 Table 11-36 + Section 11.1.2 class Privileges(BER_TLV_IE, tag=0xc5): - _construct = Struct('byte1'/FlagsEnum(Byte, security_domain=0x80, dap_verification=0x40, - delegated_management=0x20, card_lock=0x10, card_terminate=0x08, - card_reset=0x04, cvm_management=0x02, - mandated_dap_verification=0x01), - 'byte2'/COptional(FlagsEnum(Byte, trusted_path=0x80, authorized_management=0x40, - token_management=0x20, global_delete=0x10, global_lock=0x08, - global_registry=0x04, final_application=0x02, global_service=0x01)), - 'byte3'/COptional(FlagsEnum(Byte, receipt_generation=0x80, ciphered_load_file_data_block=0x40, - contactless_activation=0x20, contactless_self_activation=0x10))) + _construct = FlagsEnum(StripTrailerAdapter(GreedyBytes, 3), + security_domain=0x800000, dap_verification=0x400000, + delegated_management=0x200000, card_lock=0x100000, card_terminate=0x080000, + card_reset=0x040000, cvm_management=0x020000, + mandated_dap_verification=0x010000, + trusted_path=0x8000, authorized_management=0x4000, + token_management=0x2000, global_delete=0x1000, global_lock=0x0800, + global_registry=0x0400, final_application=0x0200, global_service=0x0100, + receipt_generation=0x80, ciphered_load_file_data_block=0x40, + contactless_activation=0x20, contactless_self_activation=0x10) # Section 11.4.3.1 Table 11-36 + Section 11.1.7 class ImplicitSelectionParameter(BER_TLV_IE, tag=0xcf): diff --git a/tests/test_construct.py b/tests/test_construct.py index 11822a8..6251a14 100644 --- a/tests/test_construct.py +++ b/tests/test_construct.py @@ -1,7 +1,9 @@ #!/usr/bin/env python3 import unittest +from pySim.utils import b2h, h2b from pySim.construct import * +from construct import FlagsEnum tests = [ ( b'\x80', 0x80 ), @@ -75,6 +77,26 @@ re_enc = self.ad._encode(string, None, None) self.assertEqual(encoded, re_enc) +class TestTrailerAdapter(unittest.TestCase): + Privileges = FlagsEnum(StripTrailerAdapter(GreedyBytes, 3), security_domain=0x800000, + dap_verification=0x400000, + delegated_management=0x200000, card_lock=0x100000, + card_terminate=0x080000, card_reset=0x040000, + cvm_management=0x020000, mandated_dap_verification=0x010000, + trusted_path=0x8000, authorized_management=0x4000, + token_management=0x2000, global_delete=0x1000, + global_lock=0x0800, global_registry=0x0400, + final_application=0x0200, global_service=0x0100, + receipt_generation=0x80, ciphered_load_file_data_block=0x40, + contactless_activation=0x20, contactless_self_activation=0x10) + examples = ['00', '80', '8040', '400010'] + def test_examples(self): + for e in self.examples: + dec = self.Privileges.parse(h2b(e)) + reenc = self.Privileges.build(dec) + self.assertEqual(e, b2h(reenc)) + + if __name__ == "__main__": -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35806?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I659aa7247c57c680895b0bf8412f9e477fc3587d Gerrit-Change-Number: 35806 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: global_platform: INSTALL [for install] support
by laforge 05 Feb '24

05 Feb '24

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35807?usp=email ) Change subject: global_platform: INSTALL [for install] support ...................................................................... global_platform: INSTALL [for install] support Change-Id: I4c1da90f1aa8ad9609602272f374078d1e1faa11 --- M docs/shell.rst M pySim/global_platform/__init__.py 2 files changed, 54 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/07/35807/1 diff --git a/docs/shell.rst b/docs/shell.rst index 42dfe1b..d86f500 100644 --- a/docs/shell.rst +++ b/docs/shell.rst @@ -977,6 +977,12 @@ :module: pySim.global_platform :func: ADF_SD.AddlShellCommands.inst_perso_parser +install_for_install +~~~~~~~~~~~~~~~~~~~ +.. argparse:: + :module: pySim.global_platform + :func: ADF_SD.AddlShellCommands.inst_inst_parser + delete_card_content ~~~~~~~~~~~~~~~~~~~ .. argparse:: diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index 7b5ab8f..6d69796 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -18,7 +18,7 @@ """ from construct import Optional as COptional -from construct import Struct, GreedyRange, FlagsEnum, Int16ub, Padding, Bit, Const +from construct import Struct, GreedyRange, FlagsEnum, Int16ub, Int24ub, Padding, Bit, Const from typing import Optional, List, Dict, Tuple from copy import deepcopy from bidict import bidict @@ -388,7 +388,8 @@ # Section 11.4.3.1 Table 11-36 + Section 11.1.2 class Privileges(BER_TLV_IE, tag=0xc5): - _construct = FlagsEnum(StripTrailerAdapter(GreedyBytes, 3), + # we only support 3-byte encoding. Can't use StripTrailerAdapter as length==2 is not permitted. sigh. + _construct = FlagsEnum(Int24ub, security_domain=0x800000, dap_verification=0x400000, delegated_management=0x200000, card_lock=0x100000, card_terminate=0x080000, card_reset=0x040000, cvm_management=0x020000, @@ -624,11 +625,46 @@ @cmd2.with_argparser(inst_perso_parser) def do_install_for_personalization(self, opts): - """Perform GlobalPlatform INSTALL [for personalization] command in order toinform a Security + """Perform GlobalPlatform INSTALL [for personalization] command in order to inform a Security Domain that the following STORE DATA commands are meant for a specific AID (specified here).""" # Section 11.5.2.3.6 / Table 11-47 self.install(0x20, 0x00, "0000%02u%s000000" % (len(opts.application_aid)//2, opts.application_aid)) + inst_inst_parser = argparse.ArgumentParser() + inst_inst_parser.add_argument('--load-file-aid', type=is_hexstr, default='', + help='Executable Load File AID') + inst_inst_parser.add_argument('--module-aid', type=is_hexstr, default='', + help='Executable Module AID') + inst_inst_parser.add_argument('--application-aid', type=is_hexstr, required=True, + help='Application AID') + inst_inst_parser.add_argument('--install-parameters', type=is_hexstr, default='', + help='Install Parameters') + inst_inst_parser.add_argument('--privilege', action='append', dest='privileges', default=[], + choices=Privileges._construct.flags.keys(), + help='Privilege granted to newly installed Application') + inst_inst_parser.add_argument('--install-token', type=is_hexstr, default='', + help='Install Token (Section GPCS C.4.2/C.4.7)') + inst_inst_parser.add_argument('--make-selectable', action='store_true', + help='Install and make selectable') + + @cmd2.with_argparser(inst_inst_parser) + def do_install_for_install(self, opts): + """Perform GlobalPlatform INSTALL [for install] command in order to install an application.""" + InstallForInstallCD = Struct('load_file_aid'/HexAdapter(Prefixed(Int8ub, GreedyBytes)), + 'module_aid'/HexAdapter(Prefixed(Int8ub, GreedyBytes)), + 'application_aid'/HexAdapter(Prefixed(Int8ub, GreedyBytes)), + 'privileges'/Prefixed(Int8ub, Privileges._construct), + 'install_parameters'/HexAdapter(Prefixed(Int8ub, GreedyBytes)), + 'install_token'/HexAdapter(Prefixed(Int8ub, GreedyBytes))) + p1 = 0x04 + if opts.make_selectable: + p1 |= 0x08 + decoded = vars(opts) + # convert from list to "true-dict" as required by construct.FlagsEnum + decoded['privileges'] = {x: True for x in decoded['privileges']} + ifi_bytes = build_construct(InstallForInstallCD, decoded) + self.install(p1, 0x00, b2h(ifi_bytes)) + def install(self, p1:int, p2:int, data:Hexstr) -> ResTuple: cmd_hex = "80E6%02x%02x%02x%s" % (p1, p2, len(data)//2, data) return self._cmd.lchan.scc.send_apdu_checksw(cmd_hex) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35807?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I4c1da90f1aa8ad9609602272f374078d1e1faa11 Gerrit-Change-Number: 35807 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[S] Change in pysim[master]: contrib/jenkins.sh: include tests/*.py in pylint
by laforge 05 Feb '24

05 Feb '24

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/35805?usp=email ) Change subject: contrib/jenkins.sh: include tests/*.py in pylint ...................................................................... contrib/jenkins.sh: include tests/*.py in pylint Change-Id: I9c8113acf5341b198d91040710b6b10cb2b6ef38 --- M contrib/jenkins.sh 1 file changed, 10 insertions(+), 1 deletion(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/contrib/jenkins.sh b/contrib/jenkins.sh index e75ac40..3f32e9e 100755 --- a/contrib/jenkins.sh +++ b/contrib/jenkins.sh @@ -45,7 +45,7 @@ --disable E1102 \ --disable E0401 \ --enable W0301 \ - pySim *.py + pySim tests/*.py *.py ;; "docs") rm -rf docs/_build -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35805?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I9c8113acf5341b198d91040710b6b10cb2b6ef38 Gerrit-Change-Number: 35805 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-MessageType: merged

1 0

[S] Change in pysim[master]: Be more conservative in our imports
by laforge 05 Feb '24

05 Feb '24

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/35802?usp=email ) Change subject: Be more conservative in our imports ...................................................................... Be more conservative in our imports Try to avoid '*' from anything into various modules, polluting the namespace. Change-Id: Iba749d18e1863ded88ba2d2183e2e8d718b2d612 --- M pySim/apdu/ts_102_221.py M pySim/construct.py M pySim/global_platform/__init__.py M pySim/tlv.py M pySim/ts_31_103.py 5 files changed, 20 insertions(+), 5 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/pySim/apdu/ts_102_221.py b/pySim/apdu/ts_102_221.py index 443ae1e..48401c0 100644 --- a/pySim/apdu/ts_102_221.py +++ b/pySim/apdu/ts_102_221.py @@ -18,6 +18,7 @@ """ import logging +from construct import GreedyRange, Struct from pySim.construct import * from pySim.filesystem import * from pySim.runtime import RuntimeLchan diff --git a/pySim/construct.py b/pySim/construct.py index 0c82c41..988dbf3 100644 --- a/pySim/construct.py +++ b/pySim/construct.py @@ -1,7 +1,9 @@ from construct.lib.containers import Container, ListContainer from construct.core import EnumIntegerString import typing -from construct import * +from construct import Adapter, Prefixed, Int8ub, GreedyBytes, Default, Flag, Byte, Construct, Enum +from construct import BitsInteger, BitStruct, Bytes, StreamError, stream_read_entire, stream_write +from construct import SizeofError, IntegerError, swapbytes from construct.core import evaluate, BitwisableString from construct.lib import integertypes from pySim.utils import b2h, h2b, swap_nibbles diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index ba34db8..b6d2343 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -17,9 +17,9 @@ along with this program. If not, see <http://www.gnu.org/licenses/>. """ -from typing import Optional, List, Dict, Tuple from construct import Optional as COptional -from construct import * +from construct import Struct, GreedyRange, FlagsEnum, Int16ub, Padding, Bit, Const +from typing import Optional, List, Dict, Tuple from copy import deepcopy from bidict import bidict from Cryptodome.Random import get_random_bytes @@ -612,7 +612,7 @@ def set_status(self, scope:str, status:str, aid:Hexstr = ''): SetStatus = Struct(Const(0x80, Byte), Const(0xF0, Byte), 'scope'/SetStatusScope, 'status'/CLifeCycleState, - 'aid'/HexAdapter(Prefixed(Int8ub, Optional(GreedyBytes)))) + 'aid'/HexAdapter(Prefixed(Int8ub, COptional(GreedyBytes)))) apdu = build_construct(SetStatus, {'scope':scope, 'status':status, 'aid':aid}) data, sw = self._cmd.lchan.scc.send_apdu_checksw(b2h(apdu)) diff --git a/pySim/tlv.py b/pySim/tlv.py index 31051aa..0dfb858 100644 --- a/pySim/tlv.py +++ b/pySim/tlv.py @@ -19,7 +19,6 @@ from typing import Optional, List, Dict, Any, Tuple from bidict import bidict -from construct import * from pySim.utils import bertlv_encode_len, bertlv_parse_len, bertlv_encode_tag, bertlv_parse_tag from pySim.utils import comprehensiontlv_encode_tag, comprehensiontlv_parse_tag diff --git a/pySim/ts_31_103.py b/pySim/ts_31_103.py index a85e0ad..81de13c 100644 --- a/pySim/ts_31_103.py +++ b/pySim/ts_31_103.py @@ -22,6 +22,7 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. # +from construct import Struct, Switch, this, Bytes, GreedyString from pySim.filesystem import * from pySim.utils import * from pySim.tlv import * -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35802?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Iba749d18e1863ded88ba2d2183e2e8d718b2d612 Gerrit-Change-Number: 35802 Gerrit-PatchSet: 5 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-MessageType: merged

1 0

[S] Change in pysim[master]: make our tests pass pylint
by laforge 05 Feb '24

05 Feb '24

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/35804?usp=email ) Change subject: make our tests pass pylint ...................................................................... make our tests pass pylint Change-Id: If3a9f178c3f915123178efe00269fce74f6e585d --- M tests/test_globalplatform.py M tests/test_tlv.py 2 files changed, 22 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/tests/test_globalplatform.py b/tests/test_globalplatform.py index 62eb43e..8496018 100644 --- a/tests/test_globalplatform.py +++ b/tests/test_globalplatform.py @@ -71,6 +71,14 @@ get_eid_cmd_plain = h2b('80E2910006BF3E035C015A') get_eid_rsp_plain = h2b('bf3e125a1089882119900000000000000000000005') + # must be overridden by derived classes + init_upd_cmd = b'' + init_upd_rsp = b'' + ext_auth_cmd = b'' + get_eid_cmd = b'' + get_eid_rsp = b'' + keyset = None + @property def host_challenge(self) -> bytes: return self.init_upd_cmd[5:] @@ -102,18 +110,22 @@ cls.scp = SCP03(card_keys = cls.keyset) def test_01_initialize_update(self): + # pylint: disable=no-member self.assertEqual(self.init_upd_cmd, self.scp.gen_init_update_apdu(self.host_challenge)) def test_02_parse_init_upd_resp(self): self.scp.parse_init_update_resp(self.init_upd_rsp) def test_03_gen_ext_auth_apdu(self): + # pylint: disable=no-member self.assertEqual(self.ext_auth_cmd, self.scp.gen_ext_auth_apdu(self.security_level)) def test_04_wrap_cmd_apdu_get_eid(self): + # pylint: disable=no-member self.assertEqual(self.get_eid_cmd, self.scp.wrap_cmd_apdu(self.get_eid_cmd_plain)) def test_05_unwrap_rsp_apdu_get_eid(self): + # pylint: disable=no-member self.assertEqual(self.get_eid_rsp_plain, self.scp.unwrap_rsp_apdu(h2b('9000'), self.get_eid_rsp)) diff --git a/tests/test_tlv.py b/tests/test_tlv.py index 1e5000d..0e73ab1 100644 --- a/tests/test_tlv.py +++ b/tests/test_tlv.py @@ -17,6 +17,7 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. import unittest +from construct import Int8ub from pySim.tlv import * class TestUtils(unittest.TestCase): -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35804?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: If3a9f178c3f915123178efe00269fce74f6e585d Gerrit-Change-Number: 35804 Gerrit-PatchSet: 3 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-MessageType: merged

1 0

[M] Change in pysim[master]: global_platform: KCV support for PUT KEY
by laforge 05 Feb '24

05 Feb '24

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/35803?usp=email ) Change subject: global_platform: KCV support for PUT KEY ...................................................................... global_platform: KCV support for PUT KEY GlobalPlatform requires the use of the KCV for DES + AES keys. Let's implement that. (11.8.2.3.3: "For all key types described in section B.6, the Key Check Value shall be present.") Change-Id: Ief168a66dee58b56f4126db12829b3a98906c8db --- M pySim/global_platform/__init__.py M tests/test_globalplatform.py 2 files changed, 55 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index b6d2343..494cfe1 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -539,7 +539,8 @@ if opts.key_check and len(opts.key_check) > i: kcv = opts.key_check[i] else: - kcv = '' + kcv_bin = compute_kcv(opts.key_type[i], h2b(opts.key_data[i])) or b'' + kcv = b2h(kcv_bin) kdb.append({'key_type': opts.key_type[i], 'kcb': opts.key_data[i], 'kcv': kcv}) p2 = opts.key_id if len(opts.key_type) > 1: @@ -770,3 +771,35 @@ def __str__(self): return "%s(KVN=%u, ENC=%s, MAC=%s, DEK=%s)" % (self.__class__.__name__, self.kvn, b2h(self.enc), b2h(self.mac), b2h(self.dek)) + +from Cryptodome.Cipher import DES, DES3, AES + +def compute_kcv_des(key:bytes) -> bytes: + # GP Card Spec B.6: For a DES key, the key check value is computed by encrypting 8 bytes, each with + # value '00', with the key to be checked and retaining the 3 highest-order bytes of the encrypted + # result. + plaintext = b'\x00' * 8 + cipher = DES3.new(key, DES.MODE_ECB) + return cipher.encrypt(plaintext) + +def compute_kcv_aes(key:bytes) -> bytes: + # GP Card Spec B.6: For a AES key, the key check value is computed by encrypting 16 bytes, each with + # value '01', with the key to be checked and retaining the 3 highest-order bytes of the encrypted + # result. + plaintext = b'\x01' * 16 + cipher = AES.new(key, AES.MODE_ECB) + return cipher.encrypt(plaintext) + +# dict is keyed by the string name of the KeyType enum above in this file +KCV_CALCULATOR = { + 'aes': compute_kcv_aes, + 'des': compute_kcv_des, + } + +def compute_kcv(key_type: str, key: bytes) -> Optional[bytes]: + """Compute the KCV (Key Check Value) for given key type and key.""" + kcv_calculator = KCV_CALCULATOR.get(key_type) + if not kcv_calculator: + return None + else: + return kcv_calculator(key)[:3] diff --git a/tests/test_globalplatform.py b/tests/test_globalplatform.py index 8496018..ba4ad76 100644 --- a/tests/test_globalplatform.py +++ b/tests/test_globalplatform.py @@ -214,6 +214,12 @@ # FIXME: test auth with random (0x60) vs pseudo-random (0x70) challenge +class SCP03_KCV_Test(unittest.TestCase): + def test_kcv(self): + self.assertEqual(compute_kcv('aes', KEYSET_AES128.enc), h2b('C35280')) + self.assertEqual(compute_kcv('aes', KEYSET_AES128.mac), h2b('013808')) + self.assertEqual(compute_kcv('aes', KEYSET_AES128.dek), h2b('840DE5')) + if __name__ == "__main__": unittest.main() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35803?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ief168a66dee58b56f4126db12829b3a98906c8db Gerrit-Change-Number: 35803 Gerrit-PatchSet: 3 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-MessageType: merged

1 0

[M] Change in pysim[master]: global_platform: KCV support for PUT KEY
by laforge 05 Feb '24

05 Feb '24

laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/35803?usp=email ) Change subject: global_platform: KCV support for PUT KEY ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35803?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ief168a66dee58b56f4126db12829b3a98906c8db Gerrit-Change-Number: 35803 Gerrit-PatchSet: 3 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Sun, 04 Feb 2024 23:58:20 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in pysim[master]: Be more conservative in our imports
by laforge 05 Feb '24

05 Feb '24

laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/35802?usp=email ) Change subject: Be more conservative in our imports ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35802?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Iba749d18e1863ded88ba2d2183e2e8d718b2d612 Gerrit-Change-Number: 35802 Gerrit-PatchSet: 5 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Sun, 04 Feb 2024 23:58:13 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

2026

2025

2024

2023

2022

gerrit-log