git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

2 // Frederik Möllers - August 2012

3 //

4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

5 // at your option, any later version. See the LICENSE.txt file for the text of

6 // the license.

7 //-----------------------------------------------------------------------------

8 // Routines to support the German electronic "Personalausweis" (ID card)

9 // Note that the functions which do not implement USB commands do NOT initialize

10 // the card (with iso14443a_select_card etc.). If You want to use these

11 // functions, You need to do the setup before calling them!

12 //-----------------------------------------------------------------------------

14 #include "iso14443a.h"

15 #include "iso14443b.h"

16 #include "epa.h"

17 #include "cmd.h"

19 // Protocol and Parameter Selection Request for ISO 14443 type A cards

20 // use regular (1x) speed in both directions

21 // CRC is already included

 static const uint8_t pps[] = {0xD0, 0x11, 0x00, 0x52, 0xA6};

24 // APDUs for communication with German Identification Card

26 // General Authenticate (request encrypted nonce) WITHOUT the Le at the end

27 static const uint8_t apdu_general_authenticate_pace_get_nonce[] = {

28 0x10, // CLA

29 0x86, // INS

30 0x00, // P1

31 0x00, // P2

32 0x02, // Lc

33 0x7C, // Type: Dynamic Authentication Data

34 0x00, // Length: 0 bytes

35 };

37 // MSE: Set AT (only CLA, INS, P1 and P2)

38 static const uint8_t apdu_mse_set_at_start[] = {

39 0x00, // CLA

40 0x22, // INS

41 0xC1, // P1

42 0xA4, // P2

43 };

45 // SELECT BINARY with the ID for EF.CardAccess

46 static const uint8_t apdu_select_binary_cardaccess[] = {

47 0x00, // CLA

48 0xA4, // INS

49 0x02, // P1

50 0x0C, // P2

51 0x02, // Lc

52 0x01, // ID

53 0x1C // ID

54 };

56 // READ BINARY

57 static const uint8_t apdu_read_binary[] = {

58 0x00, // CLA

59 0xB0, // INS

60 0x00, // P1

61 0x00, // P2

62 0x38 // Le

63 };

66 // the leading bytes of a PACE OID

67 static const uint8_t oid_pace_start[] = {

68 0x04, // itu-t, identified-organization

69 0x00, // etsi

70 0x7F, // reserved

71 0x00, // etsi-identified-organization

72 0x07, // bsi-de

73 0x02, // protocols

74 0x02, // smartcard

75 0x04 // id-PACE

76 };

78 // APDUs for replaying:

79 // MSE: Set AT (initiate PACE)

80 static uint8_t apdu_replay_mse_set_at_pace[41];

81 // General Authenticate (Get Nonce)

82 static uint8_t apdu_replay_general_authenticate_pace_get_nonce[8];

83 // General Authenticate (Map Nonce)

84 static uint8_t apdu_replay_general_authenticate_pace_map_nonce[75];

85 // General Authenticate (Mutual Authenticate)

86 static uint8_t apdu_replay_general_authenticate_pace_mutual_authenticate[75];

87 // General Authenticate (Perform Key Agreement)

88 static uint8_t apdu_replay_general_authenticate_pace_perform_key_agreement[18];

89 // pointers to the APDUs (for iterations)

90 static struct {

91 uint8_t len;

92 uint8_t *data;

93 } const apdus_replay[] = {

         {sizeof(apdu_replay_mse_set_at_pace), apdu_replay_mse_set_at_pace},

         {sizeof(apdu_replay_general_authenticate_pace_get_nonce), apdu_replay_general_authenticate_pace_get_nonce},

         {sizeof(apdu_replay_general_authenticate_pace_map_nonce), apdu_replay_general_authenticate_pace_map_nonce},

         {sizeof(apdu_replay_general_authenticate_pace_mutual_authenticate), apdu_replay_general_authenticate_pace_mutual_authenticate},

         {sizeof(apdu_replay_general_authenticate_pace_perform_key_agreement), apdu_replay_general_authenticate_pace_perform_key_agreement}

99 };

100

101 // lengths of the replay APDUs

102 static uint8_t apdu_lengths_replay[5];

103

104 // type of card (ISO 14443 A or B)

105 static char iso_type = 0;

106

107 //-----------------------------------------------------------------------------

108 // Wrapper for sending APDUs to type A and B cards

109 //-----------------------------------------------------------------------------

 int EPA_APDU(uint8_t *apdu, size_t length, uint8_t *response)

111 {

112 switch(iso_type)

113 {

114 case 'a':

                         return iso14_apdu(apdu, (uint16_t) length, response);

116 break;

117 case 'b':

                         return iso14443b_apdu(apdu, length, response);

119 break;

120 default:

121 return 0;

122 break;

123 }

124 }

125

126 //-----------------------------------------------------------------------------

127 // Closes the communication channel and turns off the field

128 //-----------------------------------------------------------------------------

129 void EPA_Finish()

130 {

131 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

132 LEDsoff();

133 iso_type = 0;

134 }

135

136 //-----------------------------------------------------------------------------

137 // Parses DER encoded data, e.g. from EF.CardAccess and fills out the given

138 // structs. If a pointer is 0, it is ignored.

139 // The function returns 0 on success and if an error occured, it returns the

140 // offset where it occured.

141 //

142 // TODO: This function can access memory outside of the given data if the DER

143 // encoding is broken

144 // TODO: Support skipping elements with a length > 0x7F

145 // TODO: Support OIDs with a length > 7F

146 // TODO: Support elements with long tags (tag is longer than 1 byte)

147 // TODO: Support proprietary PACE domain parameters

148 //-----------------------------------------------------------------------------

 size_t EPA_Parse_CardAccess(uint8_t *data,

150 size_t length,

151 pace_version_info_t *pace_info)

152 {

153 size_t index = 0;

154

         while (index <= length - 2) {

156 // determine type of element

157 // SET or SEQUENCE

                 if (data[index] == 0x31 || data[index] == 0x30) {

159 // enter the set (skip tag + length)

160 index += 2;

161 // check for extended length

                         if ((data[index - 1] & 0x80) != 0) {

                                 index += (data[index-1] & 0x7F);

164 }

165 }

166 // OID

                 else if (data[index] == 0x06) {

168 // is this a PACE OID?

                         if (data[index + 1] == 0x0A // length matches

                             && memcmp(data + index + 2,

171 oid_pace_start,

                                       sizeof(oid_pace_start)) == 0 // content matches

173 && pace_info != NULL)

174 {

175 // first, clear the pace_info struct

                                 memset(pace_info, 0, sizeof(pace_version_info_t));

                                 memcpy(pace_info->oid, data + index + 2, sizeof(pace_info->oid));

178 // a PACE OID is followed by the version

                                 index += data[index + 1] + 2;

                                 if (data[index] == 02 && data[index + 1] == 01) {

                                         pace_info->version = data[index + 2];

182 index += 3;

183 }

184 else {

185 return index;

186 }

187 // after that there might(!) be the parameter ID

                                 if (data[index] == 02 && data[index + 1] == 01) {

                                         pace_info->parameter_id = data[index + 2];

190 index += 3;

191 }

192 }

193 else {

194 // skip this OID

                                 index += 2 + data[index + 1];

196 }

197 }

198 // if the length is 0, something is wrong

199 // TODO: This needs to be extended to support long tags

                 else if (data[index + 1] == 0) {

201 return index;

202 }

203 else {

204 // skip this part

205 // TODO: This needs to be extended to support long tags

206 // TODO: This needs to be extended to support unknown elements with

207 // a size > 0x7F

                         index += 2 + data[index + 1];

209 }

210 }

211

212 // TODO: We should check whether we reached the end in error, but for that

213 // we need a better parser (e.g. with states like IN_SET or IN_PACE_INFO)

214 return 0;

215 }

216

217 //-----------------------------------------------------------------------------

218 // Read the file EF.CardAccess and save it into a buffer (at most max_length bytes)

219 // Returns -1 on failure or the length of the data on success

220 // TODO: for the moment this sends only 1 APDU regardless of the requested length

221 //-----------------------------------------------------------------------------

 int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)

223 {

224 // the response APDU of the card

225 // since the card doesn't always care for the expected length we send it,

226 // we reserve 262 bytes here just to be safe (256-byte APDU + SW + ISO frame)

227 uint8_t response_apdu[262];

228 int rapdu_length = 0;

229

230 // select the file EF.CardAccess

         rapdu_length = EPA_APDU((uint8_t *)apdu_select_binary_cardaccess,

232 sizeof(apdu_select_binary_cardaccess),

233 response_apdu);

234 if (rapdu_length < 6

             || response_apdu[rapdu_length - 4] != 0x90

             || response_apdu[rapdu_length - 3] != 0x00)

237 {

238 DbpString("Failed to select EF.CardAccess!");

239 return -1;

240 }

241

242 // read the file

         rapdu_length = EPA_APDU((uint8_t *)apdu_read_binary,

244 sizeof(apdu_read_binary),

245 response_apdu);

246 if (rapdu_length <= 6

             || response_apdu[rapdu_length - 4] != 0x90

             || response_apdu[rapdu_length - 3] != 0x00)

249 {

250 Dbprintf("Failed to read EF.CardAccess!");

251 return -1;

252 }

253

254 // copy the content into the buffer

255 // length of data available: apdu_length - 4 (ISO frame) - 2 (SW)

         size_t to_copy = rapdu_length - 6;

         to_copy = to_copy < max_length ? to_copy : max_length;

         memcpy(buffer, response_apdu+2, to_copy);

259 return to_copy;

260 }

261

262 //-----------------------------------------------------------------------------

263 // Abort helper function for EPA_PACE_Collect_Nonce

264 // sets relevant data in ack, sends the response

265 //-----------------------------------------------------------------------------

 static void EPA_PACE_Collect_Nonce_Abort(uint8_t step, int func_return)

267 {

268 // power down the field

269 EPA_Finish();

270

271 // send the USB packet

         cmd_send(CMD_ACK,step,func_return,0,0,0);

273 }

274

275 //-----------------------------------------------------------------------------

276 // Acquire one encrypted PACE nonce

277 //-----------------------------------------------------------------------------

 void EPA_PACE_Collect_Nonce(UsbCommand *c)

279 {

280 /*

281 * ack layout:

282 * arg:

283 * 1. element

284 * step where the error occured or 0 if no error occured

285 * 2. element

286 * return code of the last executed function

287 * d:

288 * Encrypted nonce

289 */

290

291 // return value of a function

292 int func_return = 0;

293

294 // set up communication

295 func_return = EPA_Setup();

         if (func_return != 0) {

                 EPA_PACE_Collect_Nonce_Abort(1, func_return);

298 return;

299 }

300

301 // read the CardAccess file

302 // this array will hold the CardAccess file

         uint8_t card_access[256] = {0};

         int card_access_length = EPA_Read_CardAccess(card_access, 256);

305 // the response has to be at least this big to hold the OID

         if (card_access_length < 18) {

                 EPA_PACE_Collect_Nonce_Abort(2, card_access_length);

308 return;

309 }

310

311 // this will hold the PACE info of the card

312 pace_version_info_t pace_version_info;

313 // search for the PACE OID

314 func_return = EPA_Parse_CardAccess(card_access,

315 card_access_length,

316 &pace_version_info);

         if (func_return != 0 || pace_version_info.version == 0) {

                 EPA_PACE_Collect_Nonce_Abort(3, func_return);

319 return;

320 }

321

322 // initiate the PACE protocol

323 // use the CAN for the password since that doesn't change

         func_return = EPA_PACE_MSE_Set_AT(pace_version_info, 2);

325

326 // now get the nonce

         uint8_t nonce[256] = {0};

         uint8_t requested_size = (uint8_t)c->arg[0];

         func_return = EPA_PACE_Get_Nonce(requested_size, nonce);

330 // check if the command succeeded

         if (func_return < 0)

332 {

                 EPA_PACE_Collect_Nonce_Abort(4, func_return);

334 return;

335 }

336

337 // all done, return

338 EPA_Finish();

339

340 // save received information

         cmd_send(CMD_ACK,0,func_return,0,nonce,func_return);

342 }

343

344 //-----------------------------------------------------------------------------

345 // Performs the "Get Nonce" step of the PACE protocol and saves the returned

346 // nonce. The caller is responsible for allocating enough memory to store the

347 // nonce. Note that the returned size might be less or than or greater than the

348 // requested size!

349 // Returns the actual size of the nonce on success or a less-than-zero error

350 // code on failure.

351 //-----------------------------------------------------------------------------

 int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)

353 {

354 // build the APDU

         uint8_t apdu[sizeof(apdu_general_authenticate_pace_get_nonce) + 1];

356 // copy the constant part

357 memcpy(apdu,

358 apdu_general_authenticate_pace_get_nonce,

359 sizeof(apdu_general_authenticate_pace_get_nonce));

360 // append Le (requested length + 2 due to tag/length taking 2 bytes) in RAPDU

         apdu[sizeof(apdu_general_authenticate_pace_get_nonce)] = requested_length + 4;

362

363 // send it

364 uint8_t response_apdu[262];

         int send_return = EPA_APDU(apdu,

366 sizeof(apdu),

367 response_apdu);

368 // check if the command succeeded

369 if (send_return < 6

                 || response_apdu[send_return - 4] != 0x90

                 || response_apdu[send_return - 3] != 0x00)

372 {

373 return -1;

374 }

375

376 // if there is no nonce in the RAPDU, return here

         if (send_return < 10)

378 {

379 // no error

380 return 0;

381 }

382 // get the actual length of the nonce

         uint8_t nonce_length = response_apdu[5];

         if (nonce_length > send_return - 10)

385 {

386 nonce_length = send_return - 10;

387 }

388 // copy the nonce

         memcpy(nonce, response_apdu + 6, nonce_length);

390

391 return nonce_length;

392 }

393

394 //-----------------------------------------------------------------------------

395 // Initializes the PACE protocol by performing the "MSE: Set AT" step

396 // Returns 0 on success or a non-zero error code on failure

397 //-----------------------------------------------------------------------------

 int EPA_PACE_MSE_Set_AT(pace_version_info_t pace_version_info, uint8_t password)

399 {

400 // create the MSE: Set AT APDU

401 uint8_t apdu[23];

402 // the minimum length (will be increased as more data is added)

403 size_t apdu_length = 20;

404 // copy the constant part

405 memcpy(apdu,

406 apdu_mse_set_at_start,

407 sizeof(apdu_mse_set_at_start));

408 // type: OID

         apdu[5] = 0x80;

410 // length of the OID

         apdu[6] = sizeof(pace_version_info.oid);

412 // copy the OID

         memcpy(apdu + 7,

414 pace_version_info.oid,

415 sizeof(pace_version_info.oid));

416 // type: password

         apdu[17] = 0x83;

418 // length: 1

         apdu[18] = 1;

420 // password

421 apdu[19] = password;

422 // if standardized domain parameters are used, copy the ID

         if (pace_version_info.parameter_id != 0) {

424 apdu_length += 3;

425 // type: domain parameter

                 apdu[20] = 0x84;

427 // length: 1

                 apdu[21] = 1;

429 // copy the parameter ID

                 apdu[22] = pace_version_info.parameter_id;

431 }

432 // now set Lc to the actual length

         apdu[4] = apdu_length - 5;

434 // send it

435 uint8_t response_apdu[6];

         int send_return = EPA_APDU(apdu,

437 apdu_length,

438 response_apdu);

439 // check if the command succeeded

440 if (send_return != 6

                 || response_apdu[send_return - 4] != 0x90

                 || response_apdu[send_return - 3] != 0x00)

443 {

444 return 1;

445 }

446 return 0;

447 }

448

449 //-----------------------------------------------------------------------------

450 // Perform the PACE protocol by replaying given APDUs

451 //-----------------------------------------------------------------------------

 void EPA_PACE_Replay(UsbCommand *c)

453 {

         uint32_t timings[sizeof(apdu_lengths_replay) / sizeof(apdu_lengths_replay[0])] = {0};

455

456 // if an APDU has been passed, save it

         if (c->arg[0] != 0) {

458 // make sure it's not too big

                 if(c->arg[2] > apdus_replay[c->arg[0] - 1].len)

460 {

                         cmd_send(CMD_ACK, 1, 0, 0, NULL, 0);

462 }

                 memcpy(apdus_replay[c->arg[0] - 1].data + c->arg[1],

464 c->d.asBytes,

465 c->arg[2]);

466 // save/update APDU length

                 if (c->arg[1] == 0) {

                         apdu_lengths_replay[c->arg[0] - 1] = c->arg[2];

469 } else {

                         apdu_lengths_replay[c->arg[0] - 1] += c->arg[2];

471 }

                 cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);

473 return;

474 }

475

476 // return value of a function

477 int func_return;

478

479 // set up communication

480 func_return = EPA_Setup();

         if (func_return != 0) {

482 EPA_Finish();

                 cmd_send(CMD_ACK, 2, func_return, 0, NULL, 0);

484 return;

485 }

486

487 // response APDU

         uint8_t response_apdu[300] = {0};

489

490 // now replay the data and measure the timings

         for (int i = 0; i < sizeof(apdu_lengths_replay); i++) {

492 StartCountUS();

                 func_return = EPA_APDU(apdus_replay[i].data,

494 apdu_lengths_replay[i],

495 response_apdu);

496 timings[i] = GetCountUS();

497 // every step but the last one should succeed

                 if (i < sizeof(apdu_lengths_replay) - 1

499 && (func_return < 6

                         || response_apdu[func_return - 4] != 0x90

                         || response_apdu[func_return - 3] != 0x00))

502 {

503 EPA_Finish();

                         cmd_send(CMD_ACK, 3 + i, func_return, 0, timings, 20);

505 return;

506 }

507 }

508 EPA_Finish();

         cmd_send(CMD_ACK,0,0,0,timings,20);

510 return;

511 }

512

513 //-----------------------------------------------------------------------------

514 // Set up a communication channel (Card Select, PPS)

515 // Returns 0 on success or a non-zero error code on failure

516 //-----------------------------------------------------------------------------

517 int EPA_Setup()

518 {

519 int return_code = 0;

520 uint8_t uid[10];

521 uint8_t pps_response[3];

522 uint8_t pps_response_par[1];

523 iso14a_card_select_t card_select_info;

524

525 // first, look for type A cards

526 // power up the field

527 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);

528 // select the card

         return_code = iso14443a_select_card(uid, &card_select_info, NULL);

         if (return_code == 1) {

531 // send the PPS request

                 ReaderTransmit((uint8_t *)pps, sizeof(pps), NULL);

                 return_code = ReaderReceive(pps_response, pps_response_par);

                 if (return_code != 3 || pps_response[0] != 0xD0) {

                         return return_code == 0 ? 2 : return_code;

536 }

537 Dbprintf("ISO 14443 Type A");

538 iso_type = 'a';

539 return 0;

540 }

541

542 // if we're here, there is no type A card, so we look for type B

543 // power up the field

544 iso14443b_setup();

545 // select the card

546 return_code = iso14443b_select_card();

         if (return_code == 1) {

548 Dbprintf("ISO 14443 Type B");

549 iso_type = 'b';

550 return 0;

551 }

552 Dbprintf("No card found.");

553 return 1;

554 }