use secure channel if open

android/src/main/java/im/status/keycard/android/NFCCardChannel.java

@@ -24,25 +24,14 @@ public class NFCCardChannel implements CardChannel {
   public APDUResponse send(APDUCommand cmd) throws IOException {
     byte[] apdu = cmd.serialize();
     Log.d(TAG, String.format("COMMAND CLA: %02X INS: %02X P1: %02X P2: %02X LC: %02X", cmd.getCla(), cmd.getIns(), cmd.getP1(), cmd.getP2(), cmd.getData().length));
-    
-    try {
-      byte[] resp = this.isoDep.transceive(apdu);
-      APDUResponse response = new APDUResponse(resp);
-      Log.d(TAG, String.format("RESPONSE LEN: %02X, SW: %04X %n-----------------------", response.getData().length, response.getSw()));
-      return response;
-    } catch(SecurityException e) {
-      throw new IOException("Tag disconnected", e);
-    } catch(IllegalArgumentException e) {
-      throw new IOException("Malformed card response", e);
-    }
+    byte[] resp = this.isoDep.transceive(apdu);
+    APDUResponse response = new APDUResponse(resp);
+    Log.d(TAG, String.format("RESPONSE LEN: %02X, SW: %04X %n-----------------------", response.getData().length, response.getSw()));
+    return response;
   }
 
   @Override
   public boolean isConnected() {
-    try {
-      return this.isoDep.isConnected();
-    } catch(SecurityException e) {
-      return false;
-    }
+    return this.isoDep.isConnected();
   }
 }

android/src/main/java/im/status/keycard/android/NFCCardManager.java

@@ -48,11 +48,7 @@ public class NFCCardManager extends Thread implements NfcAdapter.ReaderCallback
    * @return if connected, false otherwise
    */
   public boolean isConnected() {
-    try {
-      return isoDep != null && isoDep.isConnected();
-    } catch (SecurityException e) {
-      return false;
-    }
+    return isoDep != null && isoDep.isConnected();
   }
 
   @Override
@@ -62,7 +58,7 @@ public class NFCCardManager extends Thread implements NfcAdapter.ReaderCallback
       isoDep = IsoDep.get(tag);
       isoDep.connect();
       isoDep.setTimeout(120000);
-    } catch (IOException | SecurityException e) {
+    } catch (IOException e) {
       Log.e(TAG, "error connecting to tag");
     }
   }

lib/src/main/java/im/status/keycard/applet/ApplicationInfo.java

@@ -23,9 +23,8 @@ public class ApplicationInfo {
   static final byte CAPABILITY_KEY_MANAGEMENT = (byte) 0x02;
   static final byte CAPABILITY_CREDENTIALS_MANAGEMENT = (byte) 0x04;
   static final byte CAPABILITY_NDEF = (byte) 0x08;
-  static final byte CAPABILITY_FACTORY_RESET = (byte) 0x10;
 
-  static final byte CAPABILITIES_ALL = CAPABILITY_SECURE_CHANNEL | CAPABILITY_KEY_MANAGEMENT | CAPABILITY_CREDENTIALS_MANAGEMENT | CAPABILITY_NDEF | CAPABILITY_FACTORY_RESET;
+  static final byte CAPABILITIES_ALL = CAPABILITY_SECURE_CHANNEL | CAPABILITY_KEY_MANAGEMENT | CAPABILITY_CREDENTIALS_MANAGEMENT | CAPABILITY_NDEF;
 
   /**
    * Constructs an object by parsing the TLV data.
@@ -192,13 +191,4 @@ public class ApplicationInfo {
   public boolean hasNDEFCapability() {
     return (capabilities & CAPABILITY_NDEF) == CAPABILITY_NDEF;
   }
-
-  /**
-   * Returns true if the device supports the Factory Reset capability.
-   *
-   * @return true or false
-   */
-  public boolean hasFactoryResetCapability() {
-    return (capabilities & CAPABILITY_FACTORY_RESET) == CAPABILITY_FACTORY_RESET;
-  }  
 }

lib/src/main/java/im/status/keycard/applet/BIP32KeyPair.java

@@ -66,12 +66,12 @@ public class BIP32KeyPair {
       tlv.unreadLastTag();
       privKey = tlv.readPrimitive(TLV_PRIV_KEY);
       tag = tlv.readTag();
-    }
 
-    if (tag == TLV_CHAIN_CODE) {
-      tlv.unreadLastTag();
-      chainCode = tlv.readPrimitive(TLV_CHAIN_CODE);
-    }    
+      if (tag == TLV_CHAIN_CODE) {
+        tlv.unreadLastTag();
+        chainCode = tlv.readPrimitive(TLV_CHAIN_CODE);
+      }
+    }
 
     return new BIP32KeyPair(privKey, chainCode, pubKey);
   }

lib/src/main/java/im/status/keycard/applet/KeycardCommandSet.java

@@ -18,7 +18,6 @@ import java.util.Arrays;
  */
 public class KeycardCommandSet {
   static final byte INS_INIT = (byte) 0xFE;
-  static final byte INS_FACTORY_RESET = (byte) 0xFD;
   static final byte INS_GET_STATUS = (byte) 0xF2;
   static final byte INS_SET_NDEF = (byte) 0xF3;
   static final byte INS_IDENTIFY_CARD = (byte) 0x14;
@@ -78,12 +77,8 @@ public class KeycardCommandSet {
   static final byte EXPORT_KEY_P1_DERIVE = 0x01;
   static final byte EXPORT_KEY_P1_DERIVE_AND_MAKE_CURRENT = 0x02;
 
-  public static final byte EXPORT_KEY_P2_PRIVATE_AND_PUBLIC = 0x00;
-  public static final byte EXPORT_KEY_P2_PUBLIC_ONLY = 0x01;
-  public static final byte EXPORT_KEY_P2_EXTENDED_PUBLIC = 0x02;
-
-  static final byte FACTORY_RESET_P1_MAGIC = (byte) 0xAA;
-  static final byte FACTORY_RESET_P2_MAGIC = 0x55;
+  static final byte EXPORT_KEY_P2_PRIVATE_AND_PUBLIC = 0x00;
+  static final byte EXPORT_KEY_P2_PUBLIC_ONLY = 0x01;
 
   static final byte TLV_APPLICATION_INFO_TEMPLATE = (byte) 0xA4;
 
@@ -558,7 +553,7 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse sign(byte[] data, int p1) throws IOException {
-    APDUCommand sign = secureChannel.protectedCommand(0x80, INS_SIGN, p1, 0x01, data);
+    APDUCommand sign = secureChannel.protectedCommand(0x80, INS_SIGN, p1, 0x00, data);
     return secureChannel.transmit(apduChannel, sign);
   }
 
@@ -638,10 +633,6 @@ public class KeycardCommandSet {
     return secureChannel.transmit(apduChannel, setPinlessPath);
   }
 
-  private byte poToP2(boolean publicOnly) {
-    return publicOnly ? EXPORT_KEY_P2_PUBLIC_ONLY : EXPORT_KEY_P2_PRIVATE_AND_PUBLIC;
-  }
-
   /**
    * Sends an EXPORT KEY APDU to export the current key.
    *
@@ -650,20 +641,9 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse exportCurrentKey(boolean publicOnly) throws IOException {
-    return exportCurrentKey(poToP2(publicOnly));
+    return exportKey(EXPORT_KEY_P1_CURRENT, publicOnly, new byte[0]);
   }
 
-  /**
-   * Sends an EXPORT KEY APDU to export the current key.
-   *
-   * @param p2 the p2 parameter
-   * @return the raw card reponse
-   * @throws IOException communication error
-   */
-  public APDUResponse exportCurrentKey(byte p2) throws IOException {
-    return exportKey(EXPORT_KEY_P1_CURRENT, p2, new byte[0]);
-  }  
-
   /**
    * Sends an EXPORT KEY APDU. Performs derivation of the given keypath and optionally makes it the current key.
    *
@@ -674,22 +654,9 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse exportKey(String keyPath, boolean makeCurrent, boolean publicOnly) throws IOException {
-    return exportKey(keyPath, makeCurrent, poToP2(publicOnly));
-  }
-
-  /**
-   * Sends an EXPORT KEY APDU. Performs derivation of the given keypath and optionally makes it the current key.
-   *
-   * @param keyPath the keypath to export
-   * @param makeCurrent if the key should be made current or not
-   * @param p2 the P2 parameter
-   * @return the raw card response
-   * @throws IOException communication error
-   */
-  public APDUResponse exportKey(String keyPath, boolean makeCurrent, byte p2) throws IOException {
     KeyPath path = new KeyPath(keyPath);
-    return exportKey(path.getData(), path.getSource(), makeCurrent, p2);
-  }  
+    return exportKey(path.getData(), path.getSource(), makeCurrent, publicOnly);
+  }
 
   /**
    * Sends an EXPORT KEY APDU. Performs derivation of the given keypath and optionally makes it the current key.
@@ -701,22 +668,9 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse exportKey(byte[] keyPath, int source, boolean makeCurrent, boolean publicOnly) throws IOException {
-    return exportKey(keyPath, source, makeCurrent, poToP2(publicOnly));
-  }
-
-  /**
-   * Sends an EXPORT KEY APDU. Performs derivation of the given keypath and optionally makes it the current key.
-   *
-   * @param keyPath the keypath to export
-   * @param makeCurrent if the key should be made current or not
-   * @param p2 the P2 parameter
-   * @return the raw card response
-   * @throws IOException communication error
-   */
-  public APDUResponse exportKey(byte[] keyPath, int source, boolean makeCurrent, byte p2) throws IOException {
     int p1 = source | (makeCurrent ? EXPORT_KEY_P1_DERIVE_AND_MAKE_CURRENT : EXPORT_KEY_P1_DERIVE);
-    return exportKey(p1, p2, keyPath);
-  }  
+    return exportKey(p1, publicOnly, keyPath);
+  }
 
   /**
    * Sends an EXPORT KEY APDU. The parameters are sent as-is.
@@ -728,22 +682,10 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse exportKey(int derivationOptions, boolean publicOnly, byte[] keypath) throws IOException {
-    return exportKey(derivationOptions, poToP2(publicOnly), keypath);
-  }
-
-  /**
-   * Sends an EXPORT KEY APDU. The parameters are sent as-is.
-   *
-   * @param derivationOptions the P1 parameter
-   * @param p2 the P2 parameter
-   * @param keypath the data parameter
-   * @return the raw card response
-   * @throws IOException communication error
-   */
-  public APDUResponse exportKey(int derivationOptions, byte p2, byte[] keypath) throws IOException {
+    byte p2 = publicOnly ? EXPORT_KEY_P2_PUBLIC_ONLY : EXPORT_KEY_P2_PRIVATE_AND_PUBLIC;
     APDUCommand exportKey = secureChannel.protectedCommand(0x80, INS_EXPORT_KEY, derivationOptions, p2, keypath);
     return secureChannel.transmit(apduChannel, exportKey);
-  }  
+  }
 
   /**
    * Sends a GET DATA APDU.
@@ -819,25 +761,9 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse init(String pin, String puk, String pairingPassword, byte pinRetries, byte pukRetries) throws IOException {
-    return this.init(pin, null, puk, pairingPasswordToSecret(pairingPassword), pinRetries, pukRetries);
+    return this.init(pin, puk, pairingPasswordToSecret(pairingPassword), pinRetries, pukRetries);
   }
 
-  /**
-   * Sends the INIT command to the card.
-   *
-   * @param pin the PIN
-   * @param altPin the alternative PIN
-   * @param puk the PUK
-   * @param pairingPassword pairing password
-   * @param pinRetries the number of allowed PIN retries
-   * @param pukRetries the number of allowed PUK retries
-   * @return the raw card response
-   * @throws IOException communication error
-   */
-  public APDUResponse init(String pin, String altPin, String puk, String pairingPassword, byte pinRetries, byte pukRetries) throws IOException {
-    return this.init(pin, altPin, puk, pairingPasswordToSecret(pairingPassword), pinRetries, pukRetries);
-  }  
-
   /**
    * Sends the INIT command to the card.
    *
@@ -848,14 +774,13 @@ public class KeycardCommandSet {
    * @throws IOException communication error
    */
   public APDUResponse init(String pin, String puk, byte[] sharedSecret) throws IOException {
-    return init(pin, null, puk, sharedSecret, (byte) 0, (byte) 0);
+    return init(pin, puk, sharedSecret, (byte) 0, (byte) 0);
   }
 
   /**
    * Sends the INIT command to the card. If either pinRetries or pukRetries is zero, neither will be sent.
    *
    * @param pin the PIN
-   * @param pin the alternative
    * @param puk the PUK
    * @param sharedSecret the shared secret for pairing
    * @param pinRetries the number of allowed PIN retries
@@ -863,43 +788,18 @@ public class KeycardCommandSet {
    * @return the raw card response
    * @throws IOException communication error
    */
-  public APDUResponse init(String pin, String altPin, String puk, byte[] sharedSecret, byte pinRetries, byte pukRetries) throws IOException {
-    int baselen = pin.length() + puk.length() + sharedSecret.length;
-    int extlen;
-
-    if (altPin != null) {
-      extlen = 2 + altPin.length();
-    } else if ((pinRetries != 0) || (pukRetries != 0)) {
-      extlen = 2;
-    } else {
-      extlen = 0;
-    }
-    
-    byte[] initData = Arrays.copyOf(pin.getBytes(), baselen + extlen);
+  public APDUResponse init(String pin, String puk, byte[] sharedSecret, byte pinRetries, byte pukRetries) throws IOException {
+    boolean addRetries = !((pinRetries == 0) || (pukRetries == 0));
+    byte[] initData = Arrays.copyOf(pin.getBytes(), pin.length() + puk.length() + sharedSecret.length + (addRetries ? 2 : 0));
     System.arraycopy(puk.getBytes(), 0, initData, pin.length(), puk.length());
     System.arraycopy(sharedSecret, 0, initData, pin.length() + puk.length(), sharedSecret.length);
 
-    if (extlen > 0) {
-      initData[baselen] = pinRetries;
-      initData[baselen + 1] = pukRetries;
-
-      if (extlen > 2) {
-        System.arraycopy(altPin.getBytes(), 0, initData, baselen + 2, altPin.length());
-      }
+    if (addRetries) {
+      initData[initData.length - 2] = pinRetries;
+      initData[initData.length - 1] = pukRetries;
     }
 
     APDUCommand init = new APDUCommand(0x80, INS_INIT, 0, 0, secureChannel.oneShotEncrypt(initData));
     return apduChannel.send(init);
   }
-  
-  /**
-   * Sends the FACTORY RESET command to the card.
-   *
-   * @return the raw card response
-   * @throws IOException communication error
-   */
-  public APDUResponse factoryReset() throws IOException {
-    APDUCommand factoryReset = new APDUCommand(0x80, INS_FACTORY_RESET, FACTORY_RESET_P1_MAGIC, FACTORY_RESET_P2_MAGIC, new byte[0]);
-    return apduChannel.send(factoryReset);
-  }  
 }

lib/src/main/java/im/status/keycard/applet/Mnemonic.java

@@ -124,7 +124,7 @@ public class Mnemonic {
       PBEKeySpec spec = new PBEKeySpec(mnemonicPhrase.toCharArray(), ("mnemonic" + password).getBytes(), 2048, 512);
       key = skf.generateSecret(spec);
     } catch (Exception e) {
-      throw new RuntimeException("Is Bouncycastle correctly initialized?", e);
+      throw new RuntimeException("Is Bouncycastle correctly initialized?");
     }
 
     return key.getEncoded();

lib/src/main/java/im/status/keycard/applet/RecoverableSignature.java

@@ -23,7 +23,6 @@ public class RecoverableSignature {
   private boolean compressed;
 
   public static final byte TLV_SIGNATURE_TEMPLATE = (byte) 0xA0;
-  public static final byte TLV_RAW_SIGNATURE = (byte) 0x80;
   public static final byte TLV_ECDSA_TEMPLATE = (byte) 0x30;
 
   private static final X9ECParameters CURVE_PARAMS = CustomNamedCurves.getByName("secp256k1");
@@ -42,19 +41,6 @@ public class RecoverableSignature {
    */
   public RecoverableSignature(byte[] hash, byte[] tlvData) {
     TinyBERTLV tlv = new TinyBERTLV(tlvData);
-    int tag = tlv.readTag();
-    tlv.unreadLastTag();
-
-    if (tag == TLV_RAW_SIGNATURE) {
-      initFromRawSignature(hash, tlv.readPrimitive(tag));
-    } else if (tag == TLV_SIGNATURE_TEMPLATE) {
-      initFromLegacy(hash, tlv);
-    } else {
-      throw new IllegalArgumentException("invalid tlv");
-    }
-  }
-
-  private void initFromLegacy(byte[] hash, TinyBERTLV tlv) {
     tlv.enterConstructed(TLV_SIGNATURE_TEMPLATE);
     this.publicKey = tlv.readPrimitive(ApplicationInfo.TLV_PUB_KEY);
     tlv.enterConstructed(TLV_ECDSA_TEMPLATE);
@@ -65,14 +51,6 @@ public class RecoverableSignature {
     calculateRecID(hash);
   }
 
-  private void initFromRawSignature(byte[] hash, byte[] signature) {
-    this.r = Arrays.copyOfRange(signature, 0, 32);
-    this.s = Arrays.copyOfRange(signature, 32, 64);
-    this.recId = signature[64];
-    this.compressed = false;
-    this.publicKey = recoverFromSignature(this.recId, hash, this.r, this.s, this.compressed);
-  }
-
   public RecoverableSignature(byte[] publicKey, boolean compressed, byte[] r, byte[] s, int recId) {
     this.publicKey = publicKey;
     this.r = r;

lib/src/main/java/im/status/keycard/globalplatform/GlobalPlatformCommandSet.java

@@ -278,7 +278,11 @@ public class GlobalPlatformCommandSet {
    * @throws IOException communication error
    */
   public void deleteKeycardInstancesAndPackage() throws IOException, APDUException {
-    delete(Identifiers.PACKAGE_AID, (byte) 0x80).checkSW(APDUResponse.SW_OK, APDUResponse.SW_REFERENCED_DATA_NOT_FOUND);
+    deleteNDEFInstance().checkSW(APDUResponse.SW_OK, APDUResponse.SW_REFERENCED_DATA_NOT_FOUND);
+    deleteKeycardInstance().checkSW(APDUResponse.SW_OK, APDUResponse.SW_REFERENCED_DATA_NOT_FOUND);
+    deleteCashInstance().checkSW(APDUResponse.SW_OK, APDUResponse.SW_REFERENCED_DATA_NOT_FOUND);
+    deleteIdentInstance().checkSW(APDUResponse.SW_OK, APDUResponse.SW_REFERENCED_DATA_NOT_FOUND);
+    deleteKeycardPackage().checkSW(APDUResponse.SW_OK, APDUResponse.SW_REFERENCED_DATA_NOT_FOUND);
   }
 
   /**
@@ -289,27 +293,15 @@ public class GlobalPlatformCommandSet {
    * @throws IOException communication error.
    */
   public APDUResponse delete(byte[] aid) throws IOException {
-    return delete(aid, (byte) 0);
-  }
-
-  /**
-   * Sends a DELETE APDU with the given AID
-   * @param aid the AID to the delete
-   * @param p2 the P2 value
-   * @return the raw card response
-   *
-   * @throws IOException communication error.
-   */
-  public APDUResponse delete(byte[] aid, byte p2) throws IOException {
     byte[] data = new byte[aid.length + 2];
     data[0] = 0x4F;
     data[1] = (byte) aid.length;
     System.arraycopy(aid, 0, data, 2, aid.length);
 
-    APDUCommand cmd = new APDUCommand(0x80, INS_DELETE, 0, p2, data);
+    APDUCommand cmd = new APDUCommand(0x80, INS_DELETE, 0, 0, data);
 
     return this.secureChannel.send(cmd);
-  }  
+  }
 
   /**
    * Loads the Keycard package.