dexter has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43779?usp=email )
Change subject: es9p_Types_JSON: add comment about the encoding of euiccCiPKIdToBeUsed ......................................................................
es9p_Types_JSON: add comment about the encoding of euiccCiPKIdToBeUsed
The spec (SGP.22) is not 100% clear about how euiccCiPKIdToBeUsed shall be encoded as JSON object. However, observations on a productive SM-DP+ confirm that the implementation in es9p_Types_JSON.ttcn is correct.
To prevent further confusion about this, let's add a comment that explains our implementation choice.
Related: SYS#8203 Change-Id: I4cb2c9c7e098aa42ae040c5eef0f24eb16a361f7 --- M library/euicc/es9p_Types_JSON.ttcn 1 file changed, 6 insertions(+), 0 deletions(-)
Approvals: jolly: Looks good to me, approved Jenkins Builder: Verified
diff --git a/library/euicc/es9p_Types_JSON.ttcn b/library/euicc/es9p_Types_JSON.ttcn index 3e13c42..f7e6587 100644 --- a/library/euicc/es9p_Types_JSON.ttcn +++ b/library/euicc/es9p_Types_JSON.ttcn @@ -227,6 +227,11 @@ str2oct(json_pdu.initiateAuthenticationResponse.transactionId), dec_ServerSigned1(decode_base64(json_pdu.initiateAuthenticationResponse.serverSigned1)), decode_base64(json_pdu.initiateAuthenticationResponse.serverSignature1), + /* The specification (SGP.22) is a bit vague about if the euiccCiPKIdToBeUsed JSON object shall + * be encoded as SubjectKeyIdentifier or if it is to be sent as plain octetstring. However, + * observations in the wild show that we typically find the SubjectKeyIdentifier with a BER-TLV + * header prepended (e.g. 0x0414), which means the encoded form is likely the correct one to + * use. */ dec_SubjectKeyIdentifier(decode_base64(json_pdu.initiateAuthenticationResponse.euiccCiPKIdToBeUsed)), dec_Certificate(decode_base64(json_pdu.initiateAuthenticationResponse.serverCertificate)))); } else if (ispresent(json_pdu.getBoundProfilePackageResponse)) { @@ -271,6 +276,7 @@ encode_base64(enc_ServerSigned1(asn1_pdu_dec.initiateAuthenticationResponse.initiateAuthenticationOk.serverSigned1)); json_pdu.initiateAuthenticationResponse.serverSignature1 := encode_base64(asn1_pdu_dec.initiateAuthenticationResponse.initiateAuthenticationOk.serverSignature1); + /* See comment in dec_RemoteProfileProvisioningResponse_from_JSON (above) */ json_pdu.initiateAuthenticationResponse.euiccCiPKIdToBeUsed := encode_base64(enc_SubjectKeyIdentifier(asn1_pdu_dec.initiateAuthenticationResponse.initiateAuthenticationOk.euiccCiPKIdToBeUsed)); json_pdu.initiateAuthenticationResponse.serverCertificate :=