dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43937?usp=email )

Change subject: eim_cfg: split eimPublicKey loading into separete function ......................................................................

eim_cfg: split eimPublicKey loading into separete function

When the eIM configuration is generated, the public eIM key is loaded from the eIM certificate. Let's put this part into a separate function and make this function public. (We will need the function to be public in a follow up patch).

Related: SYS#8287 Change-Id: I6b62603e581ea204a55de6bcdb10adcd785642ca --- M src/eim_cfg.erl 1 file changed, 21 insertions(+), 14 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/37/43937/1

diff --git a/src/eim_cfg.erl b/src/eim_cfg.erl index dc2adac..1104853 100644 --- a/src/eim_cfg.erl +++ b/src/eim_cfg.erl @@ -7,24 +7,20 @@ -module(eim_cfg).

-include_lib("public_key/include/public_key.hrl"). --export([gen_eim_configuration_data/1]). +-export([get_eimPublicKey_from_eim_cert/0, gen_eim_configuration_data/1]).

-% Generate an encoded eIM configuration string, which can be used to program the eIM configuration into an eUICC, -% either via ES10b:AddInitialEim or ESep:addEim (eUICC package, eCO). The Format parameter selects how the output data -% shall be formatted. Two formats are possible: request: AddInitialEimRequest, single: EimConfigurationData -gen_eim_configuration_data(Format) -> - {ok, EimId} = application:get_env(onomondo_eim, eim_id), - {ok, EimFqdn} = application:get_env(onomondo_eim, eim_fqdn), +% Load the eimPublicKey from the configured eIM certificate (see sys.config). +get_eimPublicKey_from_eim_cert() -> + % Load eIM certificate and extract public key. {ok, EimCertPath} = utils:get_env_priv_file_path(onomondo_eim, eim_cert), {ok, EimCertPem} = file:read_file(EimCertPath), [{'Certificate', EimCertBer, not_encrypted}] = public_key:pem_decode(EimCertPem), {ok, EimCert} = 'PKIX1Explicit88':decode('Certificate', EimCertBer), - EimCert_TbsCertificate = maps:get(tbsCertificate, EimCert), - EimCert_SubjectPublicKeyInfo = maps:get(subjectPublicKeyInfo, EimCert_TbsCertificate), - {ok, CounterValue} = application:get_env(onomondo_eim, counter_value), + EimCertTbsCertificate = maps:get(tbsCertificate, EimCert), + EimCertSubjectPublicKeyInfo = maps:get(subjectPublicKeyInfo, EimCertTbsCertificate),

- % Check certificate type - EimCert_algorithm = maps:get(algorithm, EimCert_SubjectPublicKeyInfo), + % Make sure that the algorithm is suitable and supported by this eIM. + EimCertAlgorithm = maps:get(algorithm, EimCertSubjectPublicKeyInfo), BrainpoolP256r1 = #{ algorithm => {1, 2, 840, 10045, 2, 1}, parameters => <<6, 9, 43, 36, 3, 3, 2, 8, 1, 1, 7>> @@ -33,12 +29,23 @@ algorithm => {1, 2, 840, 10045, 2, 1}, parameters => <<6, 8, 42, 134, 72, 206, 61, 3, 1, 7>> }, - case EimCert_algorithm of + case EimCertAlgorithm of BrainpoolP256r1 -> ok; Prime256v1 -> ok; _ -> throw("Incorrect eIM certificate, only BrainpoolP256r1 or Prime256v1 may be used!") end,

+ EimCertSubjectPublicKeyInfo. + +% Generate an encoded eIM configuration string, which can be used to program the eIM configuration into an eUICC, +% either via ES10b:AddInitialEim or ESep:addEim (eUICC package, eCO). The Format parameter selects how the output data +% shall be formatted. Two formats are possible: request: AddInitialEimRequest, single: EimConfigurationData +gen_eim_configuration_data(Format) -> + {ok, EimId} = application:get_env(onomondo_eim, eim_id), + {ok, EimFqdn} = application:get_env(onomondo_eim, eim_fqdn), + EimCertSubjectPublicKeyInfo = get_eimPublicKey_from_eim_cert(), + {ok, CounterValue} = application:get_env(onomondo_eim, counter_value), + % Generate eIM configuration EimConfigurationData = #{ eimId => EimId, @@ -49,7 +56,7 @@ % Optional: instruct the eUICC to calculate an association token associationToken => -1, % Mandatory - eimPublicKeyData => {eimPublicKey, EimCert_SubjectPublicKeyInfo}, + eimPublicKeyData => {eimPublicKey, EimCertSubjectPublicKeyInfo}, % This eIM implementation currently only supports ESipa via HTTPs where the only supported eIM Package % transfer procedure is the eIM Package Retrieval procedure (see also SGP.32, section 3.1.1.1. eimSupportedProtocol => [eimRetrieveHttps],