dexter submitted this change.
es9p_Types_JSON: add comment about the encoding of euiccCiPKIdToBeUsed
The spec (SGP.22) is not 100% clear about how euiccCiPKIdToBeUsed shall
be encoded as JSON object. However, observations on a productive SM-DP+
confirm that the implementation in es9p_Types_JSON.ttcn is correct.
To prevent further confusion about this, let's add a comment that
explains our implementation choice.
Related: SYS#8203
Change-Id: I4cb2c9c7e098aa42ae040c5eef0f24eb16a361f7
---
M library/euicc/es9p_Types_JSON.ttcn
1 file changed, 6 insertions(+), 0 deletions(-)
diff --git a/library/euicc/es9p_Types_JSON.ttcn b/library/euicc/es9p_Types_JSON.ttcn
index 3e13c42..f7e6587 100644
--- a/library/euicc/es9p_Types_JSON.ttcn
+++ b/library/euicc/es9p_Types_JSON.ttcn
@@ -227,6 +227,11 @@
str2oct(json_pdu.initiateAuthenticationResponse.transactionId),
dec_ServerSigned1(decode_base64(json_pdu.initiateAuthenticationResponse.serverSigned1)),
decode_base64(json_pdu.initiateAuthenticationResponse.serverSignature1),
+ /* The specification (SGP.22) is a bit vague about if the euiccCiPKIdToBeUsed JSON object shall
+ * be encoded as SubjectKeyIdentifier or if it is to be sent as plain octetstring. However,
+ * observations in the wild show that we typically find the SubjectKeyIdentifier with a BER-TLV
+ * header prepended (e.g. 0x0414), which means the encoded form is likely the correct one to
+ * use. */
dec_SubjectKeyIdentifier(decode_base64(json_pdu.initiateAuthenticationResponse.euiccCiPKIdToBeUsed)),
dec_Certificate(decode_base64(json_pdu.initiateAuthenticationResponse.serverCertificate))));
} else if (ispresent(json_pdu.getBoundProfilePackageResponse)) {
@@ -271,6 +276,7 @@
encode_base64(enc_ServerSigned1(asn1_pdu_dec.initiateAuthenticationResponse.initiateAuthenticationOk.serverSigned1));
json_pdu.initiateAuthenticationResponse.serverSignature1 :=
encode_base64(asn1_pdu_dec.initiateAuthenticationResponse.initiateAuthenticationOk.serverSignature1);
+ /* See comment in dec_RemoteProfileProvisioningResponse_from_JSON (above) */
json_pdu.initiateAuthenticationResponse.euiccCiPKIdToBeUsed :=
encode_base64(enc_SubjectKeyIdentifier(asn1_pdu_dec.initiateAuthenticationResponse.initiateAuthenticationOk.euiccCiPKIdToBeUsed));
json_pdu.initiateAuthenticationResponse.serverCertificate :=
To view, visit change 43779. To unsubscribe, or for help writing mail filters, visit settings.