coelner/pico-hsm
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-hsm.git synced 2024-09-20 19:30:07 +00:00
Code Issues Packages Projects Releases Wiki Activity
671 Commits 7 Branches 20 Tags 2.4 MiB
420e55901c
Commit Graph

307 Commits

Author SHA1 Message Date
Pol Henarejos
40efcd71c3
Added device option KEY_COUNTER_ALL. 
When it is set, it enables the key usage counter for all keys when generated.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 20:10:53 +02:00
Pol Henarejos
aca291da9e
Key usage counter is added for every generated key. 
When a key is generated, a key usage counter is added. It starts from 2^32-1 and is decremented for every sign request. Once it reaches 0, it forbids more signatures for this key.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 20:04:14 +02:00
Pol Henarejos
7f6bcdfb11
Addded fast crc32 checksum for DKEK storage. 
It is for checking the integrity of the DKEK and thus, the scret keys, as they are encrypted with DKEK.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 15:51:52 +02:00
Pol Henarejos
696110a5b0
Key domain deletion and kek deletion are only allowed when key domain is empty. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 11:36:32 +02:00
Pol Henarejos
73fb61070f
Added kek deletion in a particular key domain. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 11:30:08 +02:00
Pol Henarejos
23da8047bc
Fix deleting key domain. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 11:22:15 +02:00
Pol Henarejos
bf70a08c9f
Added key domain deletion. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 11:16:40 +02:00
Pol Henarejos
ce410dae65
Fix when setup a key domain. 
Now the dkek is cleared before imports.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-03 11:01:21 +02:00
Pol Henarejos
94a42c4267
Fix changing PIN with multiple domain. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-02 20:09:43 +02:00
Pol Henarejos
f4cc1fed36
Fix meta parsing. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-06-02 19:30:09 +02:00
Pol Henarejos
7c27be784b Fix parsing meta data on key generation. 2022-06-02 14:12:11 +02:00
Pol Henarejos
7d1b22c337 Added meta information for symmetric keys. 2022-06-02 12:12:12 +02:00
Pol Henarejos
2febbe2795 Fix missing comma. 2022-06-01 12:57:42 +02:00
Pol Henarejos
299516f576 Fix set point A. 
mbedtls does not set point A for some curves.
 2022-06-01 11:51:33 +02:00
Pol Henarejos
6edeab6f85 Signatures in CVC are in plain format. 
Plain format concatenates r||s.
 2022-06-01 10:30:20 +02:00
Pol Henarejos
7b79d7ffde Moving CVC procedures to a separate file. 2022-06-01 09:46:23 +02:00
Pol Henarejos
541d5b3c19
Fix CVC signature length. 
Since it is variable, it needs to be recomputed every time.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-31 20:38:30 +02:00
Pol Henarejos
d0098015fe
Removing OpenSC dependency. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-31 19:26:00 +02:00
Pol Henarejos
3660a35c2c
Implementing own functions for cvc manipulation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-31 18:51:43 +02:00
Pol Henarejos
9132dd16f0
Fix decoding asn1 integer. 
It caused overflow.
 2022-05-31 01:14:09 +02:00
Pol Henarejos
652551269e
Using own asn1 int decoder. 2022-05-31 00:40:29 +02:00
Pol Henarejos
81730f37a9
Removing sc_pkcs1_strip_digest(). 
It is hard coded here (taken from OpenSC).
 2022-05-31 00:25:54 +02:00
Pol Henarejos
4b86e96660
Removing card_context from store_keys(). 
It does not generate PRKD, as it will be stored by the client.
 2022-05-31 00:14:30 +02:00
Pol Henarejos
271240f11c
Fix initializing device. 2022-05-31 00:09:21 +02:00
Pol Henarejos
00e8596a0e
Adding asn1_find_tag() for searching for a tag in a asn1 string. 2022-05-30 23:31:17 +02:00
Pol Henarejos
39ab429c88
Adding key domain to key generation, wrap, unwrap, export and import. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-30 16:13:51 +02:00
Pol Henarejos
4fa8d4ba64
Fix warnings 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-27 20:58:45 +02:00
Pol Henarejos
1ac4402f99
res_APDU SHALL NOT BE moved, only memcpied or memmoved. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-27 00:58:35 +02:00
Pol Henarejos
8554262aaf
Migrating away from tinyUSB. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-27 00:36:33 +02:00
Pol Henarejos
d2766b2225 Using printf instead of TU 2022-05-26 14:16:32 +02:00
Pol Henarejos
f124ee52ce
Do not add FMD in FCI. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 23:31:46 +02:00
Pol Henarejos
2167d28514
Add meta files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 22:57:59 +02:00
Pol Henarejos
80792dc555
Private/secret keys can be selected. 
It returns FCP when a private/secret key is selected but it is not allowed to read them.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 13:06:00 +02:00
Pol Henarejos
080337f847
Added key domain setup 
It accepts different dkek shares for each key domain.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 11:08:29 +02:00
Pol Henarejos
5e20c830fd
Return key domain not found only when they are prepared. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 10:48:22 +02:00
Pol Henarejos
b754fdb449
Refactoring initialize command to support no dkek, random dkek, dkek shares and key domains. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 10:44:00 +02:00
Pol Henarejos
a926239613
Returning not initialized key domains. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 09:24:54 +02:00
Pol Henarejos
c80b723112
Using dynamic dkek number and current shares, for each key domain. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 09:18:35 +02:00
Pol Henarejos
a062b92dad
Replacing low level data access to high level routines. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 00:30:42 +02:00
Pol Henarejos
89d40b7c94
Extending DKEK and key storage to key domains. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-24 00:29:19 +02:00
Pol Henarejos
7b5cb48dcc
Added key domains for device initialization and dkek import. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-23 20:06:06 +02:00
Pol Henarejos
7de0121db5
Introducing MANAGE KEY DOMAIN (INS 52) 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-23 14:26:36 +02:00
Pol Henarejos
cb338af8fb
Return SW 6600 when button timeouts. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-05 22:30:07 +02:00
Pol Henarejos
fffe2fb451
Now press-to-confirm button has a timeout of 15 secs. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-05-05 20:56:28 +02:00
Pol Henarejos
5f0b15b5e9
Fix returning wrong pin retries. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-22 19:21:41 +02:00
Pol Henarejos
86298f3421
Upgrading to version 2.0. 2022-04-19 19:24:10 +02:00
Pol Henarejos
302f287967
Moving EAC and crypto to core. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-19 19:16:29 +02:00
Pol Henarejos
522860f736
Splitting the core onto another repo, which can be reused by other smart applications. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-19 18:39:52 +02:00
Pol Henarejos
e2f424d4ab
No more in the repo 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-14 01:06:50 +02:00
Pol Henarejos
69e869852e
Rewritten keypair_gen response (more friendly). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-13 19:03:33 +02:00
Pol Henarejos
618966b742
Sanity check for keypair gen. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-13 18:49:13 +02:00
Pol Henarejos
b68920ff45
Added walker function for TLV parsing. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-13 16:55:34 +02:00
Pol Henarejos
9dfe0ee7b3
Clear session pin on unload and new session. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-13 14:25:44 +02:00
Pol Henarejos
da6c578973
Fix tag_len computation for all TLV. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-13 14:14:06 +02:00
Pol Henarejos
49d9ec7cf9
Session pin is randomized. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-13 14:12:14 +02:00
Pol Henarejos
af07f1d549
Added INS for session pin generation (needs randomization). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-11 19:47:43 +02:00
Pol Henarejos
db5f5fd435
When working with SM, wrap() manipulates res_APDU. Thus, we cannot change the pointer of res_APDU anymore. Everything must be memcpy-ed. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-11 15:11:42 +02:00
Pol Henarejos
7232625bab
Merge branch 'master' into eac 2022-04-11 15:09:33 +02:00
Pol Henarejos
1557a4a039
Fix when generating keypair, which could produce wrong flash save in particular cases of concurrency. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-11 15:09:20 +02:00
Pol Henarejos
2f1f8e0c90
Fix parsing TLV in signatures. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-11 01:44:18 +02:00
Pol Henarejos
c4c2bf86ba
Fix response APDU in secure channel. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-11 01:38:15 +02:00
Pol Henarejos
f26668b81d
Fixed IV computation. IV is computed encrypting macCounter with a initial IV=0x0000. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-11 01:16:20 +02:00
Pol Henarejos
964af6a064
Adding wrap() to encrypt and sign response APDU. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-10 20:58:54 +02:00
Pol Henarejos
c3a93a46ba
Adding unwrap(), to decrypt and verify secure APDU. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-10 20:23:36 +02:00
Pol Henarejos
57d593561a
Moving all SM stuff to EAC. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-10 19:00:52 +02:00
Pol Henarejos
c098d80524
Adding private key of termca. It is the worst thing I can do, but first I need to develop the secure channel, which uses the private key of device. Later, I will figure out how to generate the private key and certificate during initialization, but it will be difficult, as it needs to be signed by the CA. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-10 01:55:57 +02:00
Pol Henarejos
6c892af9f1
Adding authentication command. Not finished. Needs lot of work. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-09 23:44:45 +02:00
Pol Henarejos
b545a1618b
Added Manage Security Environment command. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-09 20:50:00 +02:00
Pol Henarejos
dec3d54ddd
Adding more SW codes. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-09 20:29:13 +02:00
Pol Henarejos
ce4d0bf102
INS 54h is also occupied too... let's try with 64h. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-08 00:38:03 +02:00
Pol Henarejos
4e6bada892
Fix first AID load. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-08 00:29:15 +02:00
Pol Henarejos
98ad2e3d55
Fix returning card data when selected AID. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 23:32:56 +02:00
Pol Henarejos
4a57698173
Moving out INS_EXTRAS from 0x88 (taken by ISO 7816) to 0x54 (presumably free). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:32:31 +02:00
Pol Henarejos
468051288c
Upgrading to version 1.12. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
565ea12d88
Added dynamic option to enable/disable press to confirm. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
1c7ef50568
Added custom INS (named EXTRAS) to support different extra commands. At this moment: 
- 0xA: gets/sets the datetime.
- 0x6: enables/disables press to confirm (BOOTSEL). It allows other dynamic device options. At this moment, only press to confirm option is available.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
878eae9787
Added press button to confirm. Everytime a private/secret key is loaded, the Pico HSM waits for BOOTSEL button press. This mechanism guarantees that no private/secret operations are made without user consent. To confirm the operation, the user must press the BOOTSEL button. In the meanwhile, the device gets into waiting state and no other operation is performed. After release the button, the operation continues normally. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
24b1d6807b
Added support for reading binary data. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
6bc081a1e1
Added support to write arbitrary data EF. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
afb16fff65
Fix with ASN1 encapsulation for keypair generation. It only affects RSA 4096 bits. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
cf81a82645
Added a new custom APDU (88h) for setting and retrieving datetime. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-07 18:18:24 +02:00
Pol Henarejos
d27d8b0c5b
Upgrading to version 1.10 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-04 09:57:19 +02:00
Pol Henarejos
a619527482
Adding P1=0x2 and P1=0x3 for reset retry counter. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-03 20:59:50 +02:00
Pol Henarejos
85ff92c4de
Adding check for device options whether it can reset retry counter with PIN or without. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-03 20:40:16 +02:00
Pol Henarejos
b1121718db
Adding capability to reset retry counter without new PIN 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-03 20:37:16 +02:00
Pol Henarejos
2905dcc8c0
Adding custom command to set datetime. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-04-03 19:57:56 +02:00
Pol Henarejos
c9855f7214
Fix displaying device options. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 19:43:33 +02:00
Pol Henarejos
853b8f29a2
Fix returning kcv when pin is not provided. It always return 0x0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 19:31:56 +02:00
Pol Henarejos
d5378ffa41
If has_session_pin is true, it returns sw_ok 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 19:31:22 +02:00
Pol Henarejos
4400eba974
Fix returning kcv 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 19:31:02 +02:00
Pol Henarejos
0cc656c6c0
Adding transport PIN option. It does not allow to authenticate and returns sw code 0x6984 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 19:12:56 +02:00
Pol Henarejos
c9b32ab5d0
Fix return pin blocked sw code. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 18:59:54 +02:00
Pol Henarejos
f9ffd39661
Adding EF_DEVOPS to store the device options during the initialization. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 18:56:42 +02:00
Pol Henarejos
bfc12d6856
Renaming files 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 18:27:00 +02:00
Pol Henarejos
33a2222cd8
Revert "PIN remaining tries only returned when user is not logged in. If so, it returns always OK." 
This reverts commit 86e38419ac.
 2022-03-31 14:30:50 +02:00
Pol Henarejos
923e05a36c
Revert "Also for SOPIN." 
This reverts commit ad66170379.
 2022-03-31 14:30:50 +02:00
Pol Henarejos
ad66170379
Also for SOPIN. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 13:18:56 +02:00
Pol Henarejos
86e38419ac
PIN remaining tries only returned when user is not logged in. If so, it returns always OK. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 13:17:16 +02:00
Pol Henarejos
7cf166d615
Upgrading to version 1.8 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 11:18:52 +02:00
Pol Henarejos
413c3e0208
Fix update ef when offset is required. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 01:08:39 +02:00
Pol Henarejos
7410498df1
Fix with RSA CRT import mode (keytype 6). 
In RSA CRT import, the N parameter shall not be imported. Otherwise, mbedtls will fail (it is deduced from N=PQ).

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-31 00:24:50 +02:00
Pol Henarejos
7aee18110e
Fix kmac and kenc computation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-30 23:59:06 +02:00
Pol Henarejos
7aca7b323a
Fix loading kcv, kenc and kmac. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-30 23:21:23 +02:00
Pol Henarejos
4651a0e224
Adding AES wrapping/unwrapping 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-30 01:33:54 +02:00
Pol Henarejos
d018e3b9b9
Adding RSA and EC wrap/unwrap, compatible with SC HSM wrap format. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-30 00:59:37 +02:00
Pol Henarejos
1c272842a7
Adding dkek_decode_key for unwrapping. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 20:18:08 +02:00
Pol Henarejos
0141e0ab4e
Adding ec curve find from prime. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 20:17:42 +02:00
Pol Henarejos
e7d8695394
Added length checks. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 19:16:15 +02:00
Pol Henarejos
6876edea5a
Some fix in encode key 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 19:06:00 +02:00
Pol Henarejos
2e655d6341
Fixes with AES encryption 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 18:25:47 +02:00
Pol Henarejos
2f4cca19c4
Moving some dkek crypt stuff to dkek. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 13:45:28 +02:00
Pol Henarejos
5eb74d8ca3
Adding encode_key with dkek (for wrapping). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 13:45:07 +02:00
Pol Henarejos
7b0d5a6700
Fix loading aes key in decrypt function 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 09:35:06 +02:00
Pol Henarejos
427260663f
Replacing CFB to CBC AES proc 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-29 09:34:44 +02:00
Pol Henarejos
047a443536
Adding dkek procedures to wrap/unwrap. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-28 17:38:15 +02:00
Pol Henarejos
2535d0e537
Adding generic aes encryption/decryption. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-28 17:37:53 +02:00
Pol Henarejos
6fe7d7991b
Len of CMAC is always 16. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-28 17:37:24 +02:00
Pol Henarejos
d061958f90
Moving hash to other file. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-28 16:02:28 +02:00
Pol Henarejos
69a406832d
Adding hsm initializing options 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-28 01:37:36 +02:00
Pol Henarejos
cd4ceb0a61
Fix returning current dkeks when the device is initialized without dkeks. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-28 01:37:19 +02:00
Pol Henarejos
450ec5dec1
Also list PRKD files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 20:47:11 +02:00
Pol Henarejos
c7abd1a067
Adding DKEK report 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 20:27:10 +02:00
Pol Henarejos
c6d87756ab
Adding SOPIN verification. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 19:00:21 +02:00
Pol Henarejos
0916489388
Initialization now returns free memory if no parameters are given. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 18:53:41 +02:00
Pol Henarejos
b1e83c92e9
Adding cvcerts and dica 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 18:15:16 +02:00
Pol Henarejos
d01e06aa11
2F02 returns terminal's cvcert and DICA. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 18:15:06 +02:00
Pol Henarejos
464107b13f
Adding tag 85 for FCP when selecting applet 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 12:26:36 +02:00
Pol Henarejos
e4ed917c1c
Updating to v1.6 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 12:26:35 +02:00
Pol Henarejos
ade3e6d2fb
Added sanity check for some boards without led. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-27 12:26:35 +02:00
Pol Henarejos
74127a038f
Changing label name. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-25 12:09:32 +01:00
Pol Henarejos
a01bd39f21
Adding license headers. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-25 12:08:48 +01:00
Pol Henarejos
c2a474df98
Fix an overflow in EC key derivation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-24 20:42:43 +01:00
Pol Henarejos
483dc5e953
- Fixed a random bug when generating EC keys. 
- Removed cvc_req. Now it is encapsulated from the previous existing cvc.
- All tests passed (sc-hsm-pkcs11-test invasive)

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-24 00:34:29 +01:00
Pol Henarejos
f490f073b0
When updating an EF, if it does not exist, we create it. 
Added support for CA and CD certificates update.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 16:04:40 +01:00
Pol Henarejos
2eab8eba09
Added asymmetric key derivation. Only for EC. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 15:37:34 +01:00
Pol Henarejos
783c901567
Replaced EC load private key with read_key, which performs sanity checks. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 14:25:00 +01:00
Pol Henarejos
90d1fa0f9b
If modulusSize is used, the test will fail as it is an unexpected field. It does not seems necessary. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 11:37:05 +01:00
Pol Henarejos
96b791b3b9
- Fixed bug where PublicKD was saved in EE_CERTIFICATE_PREFIX. We save there the CSR instead in CVC format. 
- We put the CHR and CAR into the CSR if provided during the keypair generation.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 11:31:24 +01:00
Pol Henarejos
78d71a6d9c
Upgrading to version 1.4. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 00:55:50 +01:00
Pol Henarejos
0a2740fbab
Added AES derive support based on HKDF. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-21 00:54:59 +01:00
Pol Henarejos
ae1e2ac111
Fix storing public key description when generating a new keypair. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-19 19:11:09 +01:00
Pol Henarejos
d87073f4cc
Auth status should not be removed when apple is reselected. Auth status is removed when the reader disconnects the card (unloads it). 
With this fix, it is possible to login first and send immediate low level APDU command that requires authentification (such as login+CMAC).

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-17 23:37:02 +01:00
Pol Henarejos
36a8f78313
Added support for AES-CMAC. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-17 23:35:07 +01:00
Pol Henarejos
ab1490a50b
Added ECDH key derivation. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-17 00:28:16 +01:00
Pol Henarejos
23f53a6095
Added some free on bad return. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-16 23:40:09 +01:00
Pol Henarejos
920cf3a1c5
Upgrading to v1.2 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-16 23:31:17 +01:00
Pol Henarejos
8988d1cf15
Fix support for ECDSA and ECDSA-SHAx signatures. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-16 18:20:17 +01:00
Pol Henarejos
591b02804e
Fix for HASH PSS and HASH PKCS. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-16 12:02:49 +01:00
Pol Henarejos
37c3028b1c
Adding code for AES derive 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-16 12:02:09 +01:00
Pol Henarejos
73bc2ede6b
Fixed a bug with RSA-PKCS-PSS. Surprisingly, PKCS_V21 signature takes in place (input buffer = output buffer) and, for a strange reason, it does not work for res_APDU. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-16 00:27:07 +01:00
Pol Henarejos
1c6fb98350
Logout user when applet selected. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-10 00:48:47 +01:00
Pol Henarejos
f1c0b12f5c
Increasing random buffer and checks. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-10 00:13:13 +01:00
Pol Henarejos
213b675b9f
Fix returned error code for wrong pin. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-10 00:09:35 +01:00
Pol Henarejos
b701f639ac
Increasing CCID buffer. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-10 00:08:22 +01:00
Pol Henarejos
4a0144ed2a
Adding version header to show in lsusb command (bcdDevice) and major version in pkcs15-tool -D. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-08 18:43:30 +01:00
Pol Henarejos
9be78aade6
Changing project name. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-08 00:37:27 +01:00
Pol Henarejos
7988083d6b
Reorganization of file structure. 
At this moment I disabled openpgp/gnuk due to missing deep tests.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2022-03-07 23:37:10 +01:00