armsrc/epa.c

   1 //-----------------------------------------------------------------------------
   2 // Frederik Möllers - August 2012
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Routines to support the German electronic "Personalausweis" (ID card)
   9 // Note that the functions which do not implement USB commands do NOT initialize
  10 // the card (with iso14443a_select_card etc.). If You want to use these
  11 // functions, You need to do the setup before calling them!
  12 //-----------------------------------------------------------------------------
  13 #include "epa.h"
  14
  15 #include "cmd.h"
  16 #include "fpgaloader.h"
  17 #include "iso14443a.h"
  18 #include "iso14443b.h"
  19 #include "string.h"
  20 #include "util.h"
  21 #include "dbprint.h"
  22 #include "commonutil.h"
  23 #include "ticks.h"
  24
  25 #ifdef WITH_ISO14443a
  26 // Protocol and Parameter Selection Request for ISO 14443 type A cards
  27 // use regular (1x) speed in both directions
  28 // CRC is already included
  29 static const uint8_t pps[] = {0xD0, 0x11, 0x00, 0x52, 0xA6};
  30 #endif
  31
  32 // APDUs for communication with German Identification Card
  33
  34 // General Authenticate (request encrypted nonce) WITHOUT the Le at the end
  35 static const uint8_t apdu_general_authenticate_pace_get_nonce[] = {
  36     0x10, // CLA
  37     0x86, // INS
  38     0x00, // P1
  39     0x00, // P2
  40     0x02, // Lc
  41     0x7C, // Type: Dynamic Authentication Data
  42     0x00, // Length: 0 bytes
  43 };
  44
  45 // MSE: Set AT (only CLA, INS, P1 and P2)
  46 static const uint8_t apdu_mse_set_at_start[] = {
  47     0x00, // CLA
  48     0x22, // INS
  49     0xC1, // P1
  50     0xA4, // P2
  51 };
  52
  53 // SELECT BINARY with the ID for EF.CardAccess
  54 static const uint8_t apdu_select_binary_cardaccess[] = {
  55     0x00, // CLA
  56     0xA4, // INS
  57     0x02, // P1
  58     0x0C, // P2
  59     0x02, // Lc
  60     0x01, // ID
  61     0x1C  // ID
  62 };
  63
  64 // READ BINARY
  65 static const uint8_t apdu_read_binary[] = {
  66     0x00, // CLA
  67     0xB0, // INS
  68     0x00, // P1
  69     0x00, // P2
  70     0x38  // Le
  71 };
  72
  73
  74 // the leading bytes of a PACE OID
  75 static const uint8_t oid_pace_start[] = {
  76     0x04, // itu-t, identified-organization
  77     0x00, // etsi
  78     0x7F, // reserved
  79     0x00, // etsi-identified-organization
  80     0x07, // bsi-de
  81     0x02, // protocols
  82     0x02, // smartcard
  83     0x04 // id-PACE
  84 };
  85
  86 // APDUs for replaying:
  87 // MSE: Set AT (initiate PACE)
  88 static uint8_t apdu_replay_mse_set_at_pace[41];
  89 // General Authenticate (Get Nonce)
  90 static uint8_t apdu_replay_general_authenticate_pace_get_nonce[8];
  91 // General Authenticate (Map Nonce)
  92 static uint8_t apdu_replay_general_authenticate_pace_map_nonce[75];
  93 // General Authenticate (Mutual Authenticate)
  94 static uint8_t apdu_replay_general_authenticate_pace_mutual_authenticate[75];
  95 // General Authenticate (Perform Key Agreement)
  96 static uint8_t apdu_replay_general_authenticate_pace_perform_key_agreement[18];
  97 // pointers to the APDUs (for iterations)
  98 static struct {
  99     uint8_t len;
 100     uint8_t *data;
 101 } const apdus_replay[] = {
 102     {sizeof(apdu_replay_mse_set_at_pace), apdu_replay_mse_set_at_pace},
 103     {sizeof(apdu_replay_general_authenticate_pace_get_nonce), apdu_replay_general_authenticate_pace_get_nonce},
 104     {sizeof(apdu_replay_general_authenticate_pace_map_nonce), apdu_replay_general_authenticate_pace_map_nonce},
 105     {sizeof(apdu_replay_general_authenticate_pace_mutual_authenticate), apdu_replay_general_authenticate_pace_mutual_authenticate},
 106     {sizeof(apdu_replay_general_authenticate_pace_perform_key_agreement), apdu_replay_general_authenticate_pace_perform_key_agreement}
 107 };
 108
 109 // lengths of the replay APDUs
 110 static uint8_t apdu_lengths_replay[5];
 111
 112 // type of card (ISO 14443 A or B)
 113 static char iso_type = 0;
 114
 115 //-----------------------------------------------------------------------------
 116 // Wrapper for sending APDUs to type A and B cards
 117 //-----------------------------------------------------------------------------
 118 static int EPA_APDU(uint8_t *apdu, size_t length, uint8_t *response, uint16_t respmaxlen) {
 119     switch (iso_type) {
 120         case 'a':
 121 #ifdef WITH_ISO14443a
 122             return iso14_apdu(apdu, (uint16_t) length, false, response, NULL);
 123 #else
 124             (void) apdu;
 125             (void) length;
 126             (void) response;
 127             (void) respmaxlen;
 128             return PM3_ENOTIMPL;
 129 #endif
 130         case 'b':
 131 #ifdef WITH_ISO14443b
 132             return iso14443b_apdu(apdu, length, false, response, respmaxlen, NULL);
 133 #else
 134             (void) apdu;
 135             (void) length;
 136             (void) response;
 137             (void) respmaxlen;
 138             return PM3_ENOTIMPL;
 139 #endif
 140         default:
 141             return 0;
 142     }
 143 }
 144
 145 //-----------------------------------------------------------------------------
 146 // Closes the communication channel and turns off the field
 147 //-----------------------------------------------------------------------------
 148 void EPA_Finish(void) {
 149     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 150     LEDsoff();
 151     iso_type = 0;
 152 }
 153
 154 //-----------------------------------------------------------------------------
 155 // Parses DER encoded data, e.g. from EF.CardAccess and fills out the given
 156 // structs. If a pointer is 0, it is ignored.
 157 // The function returns 0 on success and if an error occurred, it returns the
 158 // offset where it occurred.
 159 //
 160 // TODO: This function can access memory outside of the given data if the DER
 161 //       encoding is broken
 162 // TODO: Support skipping elements with a length > 0x7F
 163 // TODO: Support OIDs with a length > 7F
 164 // TODO: Support elements with long tags (tag is longer than 1 byte)
 165 // TODO: Support proprietary PACE domain parameters
 166 //-----------------------------------------------------------------------------
 167 size_t EPA_Parse_CardAccess(uint8_t *data, size_t length, pace_version_info_t *pace_info) {
 168
 169     size_t index = 0;
 170
 171     while (index <= length - 2) {
 172         // determine type of element
 173         // SET or SEQUENCE
 174         if (data[index] == 0x31 || data[index] == 0x30) {
 175             // enter the set (skip tag + length)
 176             index += 2;
 177             // check for extended length
 178             if ((data[index - 1] & 0x80) != 0) {
 179                 index += (data[index - 1] & 0x7F);
 180             }
 181         }
 182
 183         // OID
 184         else if (data[index] == 0x06) {
 185             // is this a PACE OID?
 186             if (data[index + 1] == 0x0A // length matches
 187                     && memcmp(data + index + 2, oid_pace_start, sizeof(oid_pace_start)) == 0 // content matches
 188                     && pace_info != NULL) {
 189
 190                 // first, clear the pace_info struct
 191                 memset(pace_info, 0, sizeof(pace_version_info_t));
 192
 193                 memcpy(pace_info->oid, data + index + 2, sizeof(pace_info->oid));
 194
 195                 // a PACE OID is followed by the version
 196                 index += data[index + 1] + 2;
 197
 198                 if (data[index] == 02 && data[index + 1] == 01) {
 199                     pace_info->version = data[index + 2];
 200                     index += 3;
 201                 } else {
 202                     return index;
 203                 }
 204                 // after that there might(!) be the parameter ID
 205                 if (data[index] == 02 && data[index + 1] == 01) {
 206                     pace_info->parameter_id = data[index + 2];
 207                     index += 3;
 208                 }
 209
 210             } else {
 211                 // skip this OID
 212                 index += 2 + data[index + 1];
 213             }
 214         }
 215         // if the length is 0, something is wrong
 216         // TODO: This needs to be extended to support long tags
 217         else if (data[index + 1] == 0) {
 218             return index;
 219         } else {
 220             // skip this part
 221             // TODO: This needs to be extended to support long tags
 222             // TODO: This needs to be extended to support unknown elements with
 223             //       a size > 0x7F
 224             index += 2 + data[index + 1];
 225         }
 226     }
 227
 228     // TODO: We should check whether we reached the end in error, but for that
 229     //       we need a better parser (e.g. with states like IN_SET or IN_PACE_INFO)
 230     return 0;
 231 }
 232
 233 //-----------------------------------------------------------------------------
 234 // Read the file EF.CardAccess and save it into a buffer (at most max_length bytes)
 235 // Returns -1 on failure or the length of the data on success
 236 // TODO: for the moment this sends only 1 APDU regardless of the requested length
 237 //-----------------------------------------------------------------------------
 238 int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length) {
 239     // the response APDU of the card
 240     // since the card doesn't always care for the expected length we send it,
 241     // we reserve 262 bytes here just to be safe (256-byte APDU + SW + ISO frame)
 242     uint8_t response_apdu[262];
 243
 244     // select the file EF.CardAccess
 245     int rapdu_length = EPA_APDU((uint8_t *)apdu_select_binary_cardaccess,
 246                                 sizeof(apdu_select_binary_cardaccess),
 247                                 response_apdu,
 248                                 sizeof(response_apdu)
 249                                );
 250
 251     if (rapdu_length < 6
 252             || response_apdu[rapdu_length - 4] != 0x90
 253             || response_apdu[rapdu_length - 3] != 0x00) {
 254         DbpString("Failed to select EF.CardAccess!");
 255         return -1;
 256     }
 257
 258     // read the file
 259     rapdu_length = EPA_APDU((uint8_t *)apdu_read_binary,
 260                             sizeof(apdu_read_binary),
 261                             response_apdu,
 262                             sizeof(response_apdu)
 263                            );
 264
 265     if (rapdu_length <= 6
 266             || response_apdu[rapdu_length - 4] != 0x90
 267             || response_apdu[rapdu_length - 3] != 0x00) {
 268         Dbprintf("Failed to read EF.CardAccess!");
 269         return -1;
 270     }
 271
 272     // copy the content into the buffer
 273     // length of data available: apdu_length - 4 (ISO frame) - 2 (SW)
 274     size_t len = rapdu_length - 6;
 275     len = len < max_length ? len : max_length;
 276     memcpy(buffer, response_apdu + 2, len);
 277     return len;
 278 }
 279
 280 //-----------------------------------------------------------------------------
 281 // Abort helper function for EPA_PACE_Collect_Nonce
 282 // sets relevant data in ack, sends the response
 283 //-----------------------------------------------------------------------------
 284 static void EPA_PACE_Collect_Nonce_Abort(uint32_t cmd, uint8_t step, int func_return) {
 285     // power down the field
 286     EPA_Finish();
 287
 288     // send the USB packet
 289     reply_mix(cmd, step, func_return, 0, 0, 0);
 290 }
 291
 292 //-----------------------------------------------------------------------------
 293 // Acquire one encrypted PACE nonce
 294 //-----------------------------------------------------------------------------
 295 void EPA_PACE_Collect_Nonce(PacketCommandNG *c) {
 296     /*
 297      * ack layout:
 298      *   arg:
 299      *       1. element
 300      *           step where the error occurred or 0 if no error occurred
 301      *       2. element
 302      *           return code of the last executed function
 303      *   d:
 304      *       Encrypted nonce
 305      */
 306     // set up communication
 307     int func_return = EPA_Setup();
 308     if (func_return != 0) {
 309         EPA_PACE_Collect_Nonce_Abort(CMD_HF_EPA_COLLECT_NONCE, 1, func_return);
 310         return;
 311     }
 312
 313     // read the CardAccess file
 314     // this array will hold the CardAccess file
 315     uint8_t card_access[256] = {0};
 316     int cardlen = EPA_Read_CardAccess(card_access, 256);
 317     // the response has to be at least this big to hold the OID
 318     if (cardlen < 18) {
 319         EPA_PACE_Collect_Nonce_Abort(CMD_HF_EPA_COLLECT_NONCE, 2, cardlen);
 320         return;
 321     }
 322
 323     // this will hold the PACE info of the card
 324     pace_version_info_t pace_version_info;
 325
 326     // search for the PACE OID
 327     func_return = EPA_Parse_CardAccess(card_access, cardlen, &pace_version_info);
 328
 329     if (func_return != 0 || pace_version_info.version == 0) {
 330         EPA_PACE_Collect_Nonce_Abort(CMD_HF_EPA_COLLECT_NONCE, 3, func_return);
 331         return;
 332     }
 333
 334     // initiate the PACE protocol
 335     // use the CAN for the password since that doesn't change
 336     func_return = EPA_PACE_MSE_Set_AT(pace_version_info, 2);
 337     // check if the command succeeded
 338     if (func_return != 0) {
 339         EPA_PACE_Collect_Nonce_Abort(CMD_HF_EPA_COLLECT_NONCE, 4, func_return);
 340         return;
 341     }
 342
 343     // now get the nonce
 344     uint8_t nonce[256] = {0};
 345
 346     struct p {
 347         uint32_t m;
 348     } PACKED;
 349     struct p *packet = (struct p *)c->data.asBytes;
 350
 351     func_return = EPA_PACE_Get_Nonce(packet->m, nonce);
 352     // check if the command succeeded
 353     if (func_return < 0) {
 354         EPA_PACE_Collect_Nonce_Abort(CMD_HF_EPA_COLLECT_NONCE, 5, func_return);
 355         return;
 356     }
 357
 358     EPA_Finish();
 359
 360     // save received information
 361     reply_mix(CMD_HF_EPA_COLLECT_NONCE, 0, func_return, 0, nonce, func_return);
 362 }
 363
 364 //-----------------------------------------------------------------------------
 365 // Performs the "Get Nonce" step of the PACE protocol and saves the returned
 366 // nonce. The caller is responsible for allocating enough memory to store the
 367 // nonce. Note that the returned size might be less or than or greater than the
 368 // requested size!
 369 // Returns the actual size of the nonce on success or a less-than-zero error
 370 // code on failure.
 371 //-----------------------------------------------------------------------------
 372 int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce) {
 373
 374     // build the APDU
 375     uint8_t apdu[sizeof(apdu_general_authenticate_pace_get_nonce) + 1];
 376
 377     // copy the constant part
 378     memcpy(apdu, apdu_general_authenticate_pace_get_nonce, sizeof(apdu_general_authenticate_pace_get_nonce));
 379
 380     // append Le (requested length + 2 due to tag/length taking 2 bytes) in RAPDU
 381     apdu[sizeof(apdu_general_authenticate_pace_get_nonce)] = requested_length + 4;
 382
 383     uint8_t response_apdu[262];
 384     int send_return = EPA_APDU(apdu, sizeof(apdu), response_apdu, sizeof(response_apdu));
 385     if (send_return < 6
 386             || response_apdu[send_return - 4] != 0x90
 387             || response_apdu[send_return - 3] != 0x00) {
 388         return -1;
 389     }
 390
 391     // if there is no nonce in the RAPDU, return here
 392     if (send_return < 10) {
 393         // no error
 394         return 0;
 395     }
 396     // get the actual length of the nonce
 397     uint8_t nonce_length = response_apdu[5];
 398     if (nonce_length > send_return - 10) {
 399         nonce_length = send_return - 10;
 400     }
 401     // copy the nonce
 402     memcpy(nonce, response_apdu + 6, nonce_length);
 403
 404     return nonce_length;
 405 }
 406
 407 //-----------------------------------------------------------------------------
 408 // Initializes the PACE protocol by performing the "MSE: Set AT" step
 409 // Returns 0 on success or a non-zero error code on failure
 410 //-----------------------------------------------------------------------------
 411 int EPA_PACE_MSE_Set_AT(pace_version_info_t pace_version_info, uint8_t password) {
 412     // create the MSE: Set AT APDU
 413     uint8_t apdu[23];
 414
 415     // the minimum length (will be increased as more data is added)
 416     size_t apdu_length = 20;
 417
 418     // copy the constant part
 419     memcpy(apdu, apdu_mse_set_at_start, sizeof(apdu_mse_set_at_start));
 420
 421     // type: OID
 422     apdu[5] = 0x80;
 423
 424     // length of the OID
 425     apdu[6] = sizeof(pace_version_info.oid);
 426
 427     // copy the OID
 428     memcpy(apdu + 7, pace_version_info.oid, sizeof(pace_version_info.oid));
 429
 430     // type: password
 431     apdu[17] = 0x83;
 432
 433     // length: 1
 434     apdu[18] = 1;
 435
 436     // password
 437     apdu[19] = password;
 438
 439     // if standardized domain parameters are used, copy the ID
 440     if (pace_version_info.parameter_id != 0) {
 441         apdu_length += 3;
 442         // type: domain parameter
 443         apdu[20] = 0x84;
 444         // length: 1
 445         apdu[21] = 1;
 446         // copy the parameter ID
 447         apdu[22] = pace_version_info.parameter_id;
 448     }
 449
 450     // now set Lc to the actual length
 451     apdu[4] = apdu_length - 5;
 452
 453     // send it
 454     uint8_t response_apdu[6];
 455     int send_return = EPA_APDU(apdu, apdu_length, response_apdu, sizeof(response_apdu));
 456
 457     Dbprintf("send ret %d bytes", send_return);
 458
 459 //    Dbhexdump(send_return, response_apdu, false);
 460
 461     // check if the command succeeded
 462     if (send_return != 6)
 463 //            && response_apdu[send_return - 4] != 0x90
 464 //            || response_apdu[send_return - 3] != 0x00)
 465     {
 466         return 1;
 467     }
 468     return 0;
 469 }
 470
 471 //-----------------------------------------------------------------------------
 472 // Perform the PACE protocol by replaying given APDUs
 473 //-----------------------------------------------------------------------------
 474 void EPA_PACE_Replay(PacketCommandNG *c) {
 475
 476     uint32_t timings[ARRAYLEN(apdu_lengths_replay)] = {0};
 477
 478     // if an APDU has been passed, save it
 479     if (c->oldarg[0] != 0) {
 480         // make sure it's not too big
 481         if (c->oldarg[2] > apdus_replay[c->oldarg[0] - 1].len) {
 482             reply_mix(CMD_ACK, 1, 0, 0, NULL, 0);
 483         }
 484         memcpy(apdus_replay[c->oldarg[0] - 1].data + c->oldarg[1],
 485                c->data.asBytes,
 486                c->oldarg[2]);
 487         // save/update APDU length
 488         if (c->oldarg[1] == 0) {
 489             apdu_lengths_replay[c->oldarg[0] - 1] = c->oldarg[2];
 490         } else {
 491             apdu_lengths_replay[c->oldarg[0] - 1] += c->oldarg[2];
 492         }
 493         reply_mix(CMD_ACK, 0, 0, 0, NULL, 0);
 494         return;
 495     }
 496
 497     // return value of a function
 498     int func_return;
 499
 500     // set up communication
 501     func_return = EPA_Setup();
 502     if (func_return != 0) {
 503         EPA_Finish();
 504         reply_mix(CMD_ACK, 2, func_return, 0, NULL, 0);
 505         return;
 506     }
 507
 508     // increase the timeout (at least some cards really do need this!)/////////////
 509     // iso14a_set_timeout(0x0003FFFF);
 510
 511     // response APDU
 512     uint8_t response_apdu[300] = {0};
 513
 514     // now replay the data and measure the timings
 515     for (int i = 0; i < ARRAYLEN(apdu_lengths_replay); i++) {
 516         StartCountUS();
 517         func_return = EPA_APDU(apdus_replay[i].data,
 518                                apdu_lengths_replay[i],
 519                                response_apdu,
 520                                sizeof(response_apdu)
 521                               );
 522         timings[i] = GetCountUS();
 523         // every step but the last one should succeed
 524         if (i < ARRAYLEN(apdu_lengths_replay) - 1
 525                 && (func_return < 6
 526                     || response_apdu[func_return - 4] != 0x90
 527                     || response_apdu[func_return - 3] != 0x00)) {
 528             EPA_Finish();
 529             reply_mix(CMD_ACK, 3 + i, func_return, 0, timings, 20);
 530             return;
 531         }
 532     }
 533     EPA_Finish();
 534     reply_mix(CMD_ACK, 0, 0, 0, timings, 20);
 535     return;
 536 }
 537
 538 //-----------------------------------------------------------------------------
 539 // Set up a communication channel (Card Select, PPS)
 540 // Returns 0 on success or a non-zero error code on failure
 541 //-----------------------------------------------------------------------------
 542 int EPA_Setup(void) {
 543
 544 #ifdef WITH_ISO14443a
 545     {
 546         // first, look for type A cards
 547         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 548         // power up the field
 549         iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
 550         iso14a_card_select_t card_a_info;
 551         int return_code = iso14443a_select_card(NULL, &card_a_info, NULL, true, 0, false);
 552
 553         if (return_code == 1) {
 554             uint8_t pps_response[3];
 555             uint8_t pps_response_par[1];
 556             // send the PPS request
 557             ReaderTransmit((uint8_t *)pps, sizeof(pps), NULL);
 558             return_code = ReaderReceive(pps_response, pps_response_par);
 559             if (return_code != 3 || pps_response[0] != 0xD0) {
 560                 return return_code == 0 ? 2 : return_code;
 561             }
 562             Dbprintf("ISO 14443 Type A");
 563             iso_type = 'a';
 564             return 0;
 565         }
 566     }
 567 #endif
 568 #ifdef WITH_ISO14443b
 569     {
 570         // if we're here, there is no type A card, so we look for type B
 571         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 572         // power up the field
 573         iso14443b_setup();
 574         iso14b_card_select_t card_b_info;
 575         int return_code = iso14443b_select_card(&card_b_info);
 576
 577         if (return_code == 0) {
 578             Dbprintf("ISO 14443 Type B");
 579             iso_type = 'b';
 580             return 0;
 581         }
 582     }
 583 #endif
 584     Dbprintf("No card found");
 585     return 1;
 586 }