keycard-go/command_set.go

230 lines
4.7 KiB
Go
Raw Normal View History

package keycard
import (
2019-03-13 12:49:26 +00:00
"crypto/rand"
"crypto/sha256"
2019-03-13 15:20:51 +00:00
"errors"
2019-03-13 12:49:26 +00:00
"github.com/status-im/keycard-go/apdu"
2019-03-13 12:49:26 +00:00
"github.com/status-im/keycard-go/crypto"
"github.com/status-im/keycard-go/globalplatform"
"github.com/status-im/keycard-go/identifiers"
"github.com/status-im/keycard-go/types"
)
type CommandSet struct {
c types.Channel
2019-03-13 12:49:26 +00:00
sc *SecureChannel
2019-03-13 15:20:51 +00:00
ApplicationInfo *types.ApplicationInfo
2019-03-13 12:49:26 +00:00
PairingInfo *types.PairingInfo
}
func NewCommandSet(c types.Channel) *CommandSet {
return &CommandSet{
2019-03-13 12:49:26 +00:00
c: c,
sc: NewSecureChannel(c),
}
}
2019-03-13 15:20:51 +00:00
func (cs *CommandSet) SetPairingInfo(key []byte, index int) {
cs.PairingInfo = &types.PairingInfo{
Key: key,
Index: index,
}
}
func (cs *CommandSet) Select() error {
instanceAID, err := identifiers.KeycardInstanceAID(identifiers.KeycardDefaultInstanceIndex)
if err != nil {
return err
}
cmd := apdu.NewCommand(
0x00,
globalplatform.InsSelect,
uint8(0x04),
uint8(0x00),
instanceAID,
)
cmd.SetLe(0)
resp, err := cs.c.Send(cmd)
2019-03-13 12:49:26 +00:00
if err = cs.checkOK(resp, err); err != nil {
cs.ApplicationInfo = &types.ApplicationInfo{}
2019-03-13 12:49:26 +00:00
return err
}
appInfo, err := types.ParseApplicationInfo(resp.Data)
if err != nil {
return err
}
cs.ApplicationInfo = appInfo
2019-03-13 12:49:26 +00:00
if cs.ApplicationInfo.HasSecureChannelCapability() {
err = cs.sc.GenerateSecret(cs.ApplicationInfo.PublicKey)
if err != nil {
return err
}
2019-03-13 12:49:26 +00:00
cs.sc.Reset()
}
2019-03-13 12:49:26 +00:00
return nil
}
2019-03-11 11:50:16 +00:00
func (cs *CommandSet) Init(secrets *Secrets) error {
2019-03-13 12:49:26 +00:00
data, err := cs.sc.OneShotEncrypt(secrets)
2019-03-11 11:50:16 +00:00
if err != nil {
return err
}
2019-03-13 12:49:26 +00:00
init := NewCommandInit(data)
resp, err := cs.c.Send(init)
return cs.checkOK(resp, err)
}
func (cs *CommandSet) Pair(pairingPass string) error {
challenge := make([]byte, 32)
if _, err := rand.Read(challenge); err != nil {
return err
}
cmd := NewCommandPairFirstStep(challenge)
resp, err := cs.c.Send(cmd)
if err = cs.checkOK(resp, err); err != nil {
return err
}
cardCryptogram := resp.Data[:32]
cardChallenge := resp.Data[32:]
secretHash, err := crypto.VerifyCryptogram(challenge, pairingPass, cardCryptogram)
2019-03-11 11:50:16 +00:00
if err != nil {
return err
}
2019-03-13 12:49:26 +00:00
h := sha256.New()
h.Write(secretHash[:])
h.Write(cardChallenge)
cmd = NewCommandPairFinalStep(h.Sum(nil))
resp, err = cs.c.Send(cmd)
if err = cs.checkOK(resp, err); err != nil {
return err
}
2019-03-11 11:50:16 +00:00
2019-03-13 12:49:26 +00:00
h.Reset()
h.Write(secretHash[:])
h.Write(resp.Data[1:])
pairingKey := h.Sum(nil)
pairingIndex := resp.Data[0]
cs.PairingInfo = &types.PairingInfo{
Key: pairingKey,
Index: int(pairingIndex),
}
return nil
2019-03-11 11:50:16 +00:00
}
2019-03-13 15:20:51 +00:00
func (cs *CommandSet) OpenSecureChannel() error {
if cs.ApplicationInfo == nil {
return errors.New("cannot open secure channel without setting PairingInfo")
}
cmd := NewCommandOpenSecureChannel(uint8(cs.PairingInfo.Index), cs.sc.RawPublicKey())
resp, err := cs.c.Send(cmd)
if err = cs.checkOK(resp, err); err != nil {
return err
}
encKey, macKey, iv := crypto.DeriveSessionKeys(cs.sc.Secret(), cs.PairingInfo.Key, resp.Data)
cs.sc.Init(iv, encKey, macKey)
err = cs.mutualAuthenticate()
if err != nil {
return err
}
return nil
}
func (cs *CommandSet) GetStatus() (*types.ApplicationStatus, error) {
cmd := NewCommandGetStatusApplication()
resp, err := cs.sc.Send(cmd)
if err = cs.checkOK(resp, err); err != nil {
return nil, err
}
return types.ParseApplicationStatus(resp.Data)
}
2019-03-14 15:31:30 +00:00
func (cs *CommandSet) VerifyPIN(pin string) error {
cmd := NewCommandVerifyPIN(pin)
resp, err := cs.sc.Send(cmd)
return cs.checkOK(resp, err)
}
func (cs *CommandSet) GenerateKey() ([]byte, error) {
cmd := NewCommandGenerateKey()
resp, err := cs.sc.Send(cmd)
if err = cs.checkOK(resp, err); err != nil {
return nil, err
}
return resp.Data, nil
}
2019-03-15 00:03:24 +00:00
func (cs *CommandSet) DeriveKey(path string) error {
cmd, err := NewCommandDeriveKey(path)
if err != nil {
return err
}
resp, err := cs.sc.Send(cmd)
return cs.checkOK(resp, err)
}
func (cs *CommandSet) Sign(data []byte) (*types.Signature, error) {
cmd, err := NewCommandSign(data)
if err != nil {
return nil, err
}
resp, err := cs.sc.Send(cmd)
if err = cs.checkOK(resp, err); err != nil {
return nil, err
}
return types.ParseSignature(resp.Data)
}
2019-03-13 15:20:51 +00:00
func (cs *CommandSet) mutualAuthenticate() error {
data := make([]byte, 32)
if _, err := rand.Read(data); err != nil {
return err
}
cmd := NewCommandMutuallyAuthenticate(data)
resp, err := cs.sc.Send(cmd)
return cs.checkOK(resp, err)
}
func (cs *CommandSet) checkOK(resp *apdu.Response, err error, allowedResponses ...uint16) error {
if len(allowedResponses) == 0 {
allowedResponses = []uint16{apdu.SwOK}
}
for _, code := range allowedResponses {
if code == resp.Sw {
return nil
}
}
return apdu.NewErrBadResponse(resp.Sw, "unexpected response")
}