laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35769?usp=email ) Change subject: SCP02: Only C-MAC/C-ENCRYPT APDUs whose CLA byte indicates GlobalPlatform ...................................................................... SCP02: Only C-MAC/C-ENCRYPT APDUs whose CLA byte indicates GlobalPlatform I'm not entirely sure if this is the right thing to do. For sure I do have cards which don't like SELECT with C-MAC appended... and GlobalPlatform clearly states SELECT is coded with CLA value that has the MSB not set (i.e. not a GlobalPlatform command). Change-Id: Ieda75c865a6ff2725fc3c8772bb274d96b8a5a43 --- M pySim/global_platform/scp02.py 1 file changed, 28 insertions(+), 9 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/69/35769/1 diff --git a/pySim/global_platform/scp02.py b/pySim/global_platform/scp02.py index a7325e1..4df0aff 100644 --- a/pySim/global_platform/scp02.py +++ b/pySim/global_platform/scp02.py @@ -94,14 +94,6 @@ CLA_SM = 0x04 class SCP(SecureChannel): - pass - -class SCP02(SCP): - """An instance of the GlobalPlatform SCP02 secure channel protocol.""" - - constr_iur = Struct('key_div_data'/Bytes(10), 'key_ver'/Int8ub, Const(b'\x02'), - 'seq_counter'/Int16ub, 'card_challenge'/Bytes(6), 'card_cryptogram'/Bytes(8)) - def __init__(self, card_keys: 'GpCardKeyset', lchan_nr: int = 0): self.lchan_nr = lchan_nr self.card_keys = card_keys @@ -121,6 +113,19 @@ ret = ret | CLA_SM return ret + self.lchan_nr + def wrap_cmd_apdu(self, apdu: bytes) -> bytes: + # only protect those APDUs that actually are global platform commands + if apdu[0] & 0x80: + return self._wrap_cmd_apdu(apdu) + else: + return apdu + +class SCP02(SCP): + """An instance of the GlobalPlatform SCP02 secure channel protocol.""" + + constr_iur = Struct('key_div_data'/Bytes(10), 'key_ver'/Int8ub, Const(b'\x02'), + 'seq_counter'/Int16ub, 'card_challenge'/Bytes(6), 'card_cryptogram'/Bytes(8)) + def _compute_cryptograms(self, card_challenge: bytes, host_challenge: bytes): logger.debug("host_challenge(%s), card_challenge(%s)", b2h(host_challenge), b2h(card_challenge)) self.host_cryptogram = self.sk.calc_mac_3des(self.sk.counter.to_bytes(2, 'big') + card_challenge + host_challenge) @@ -168,7 +173,7 @@ mac = self.sk.calc_mac_1des(header + self.host_cryptogram, True) return bytes([self._cla(True), INS_EXT_AUTH, self.security_level, 0, 16]) + self.host_cryptogram + mac - def wrap_cmd_apdu(self, apdu: bytes) -> bytes: + def _wrap_cmd_apdu(self, apdu: bytes) -> bytes: """Wrap Command APDU for SCP02: calculate MAC and encrypt.""" lc = len(apdu) - 5 assert len(apdu) >= 5, "Wrong APDU length: %d" % len(apdu) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35769?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ieda75c865a6ff2725fc3c8772bb274d96b8a5a43 Gerrit-Change-Number: 35769 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange