topic Re: Read ECC Curvelist fails when SCP03 enabled in Secure Authentication

Read ECC Curvelist fails when SCP03 enabled

deang — Wed, 17 May 2023 21:58:22 GMT

Using Se05x_API_ReadECCurveList(). Fails when SCP03 is enabled, when SCP03 is not enabled does not fail. Is this expected behavior?

Dean

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Thu, 18 May 2023 05:58:21 GMT

Hi @deang ,

It should work with SCP03 enabled, may I have your test code as well as the log for a review? I may try to reproduce it here.

Thanks for your patience!

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: Read ECC Curvelist fails when SCP03 enabled

deang — Fri, 19 May 2023 21:57:08 GMT

Test code, kSE050_ECCurve_MAX_id == 0x43

static smStatus_t _create_curve_if_necessary(SE05x_ECCurve_t curve_id)
{
smStatus_t status = SM_NOT_OK;
uint8_t curveList[kSE050_ECCurve_MAX_id] = { 0 };
size_t curveListLen = sizeof(curveList);

// TODO: Fails when SCP03 is enabled. 5/17/2023 DAG.
status = Se05x_API_ReadECCurveList(&_se050_session_ctx, curveList, &curveListLen);

if (status != SM_OK) { <-- Fails here with SM_NOT_OK

return status

}
.... rest of function not show
}

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Mon, 22 May 2023 04:25:03 GMT

Hi @deang ,

I tried your code in the se05x_minial demo, it works just well, maybe the cause is due to the _se050_session_ctx was not referred correctly?

Have a great day,
Kan

Re: Read ECC Curvelist fails when SCP03 enabled

deang — Fri, 02 Jun 2023 19:40:08 GMT

Thanks Kan.

I'm using the Nano package. Digging further it looks like response isn't decrypted correctly, but the MAC check passes. Head-scratcher. I'll do some more digging.

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Mon, 05 Jun 2023 02:21:13 GMT

Hi @deang ,

Are you referring to the case when only PlatformSCP is enabled?

Have a great day,
Kan

Re: Read ECC Curvelist fails when SCP03 enabled

deang — Mon, 05 Jun 2023 13:19:29 GMT

Yes. When using PlatformSCP the call fails.

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Tue, 06 Jun 2023 07:59:10 GMT

Hi @deang ,

Thanks for the information! Actually I just found Se05x_API_ReadECCurveList() is not included in the nano package, so how did you put this function there? maybe it is software integration issue indeed.

Have a great day,
Kan

Re: Read ECC Curvelist fails when SCP03 enabled

deang — Tue, 06 Jun 2023 18:55:11 GMT

We ported Se05x_API_ReadECCurveList() from the full Plug&Trust stack.

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Wed, 07 Jun 2023 03:09:59 GMT

Hi @deang ,

Thanks for the clarification! Actually there is slight difference in the SE05X API implementation between the Nano and Full MW, how did you port it? Maybe you can sent me the code snippets for a review?

Have a great day,
Kan

Re: Read ECC Curvelist fails when SCP03 enabled

deang — Wed, 07 Jun 2023 14:16:09 GMT

I did compare the two versions of Se05X_API_ReadCurveList(), one in Nano package and the other in full MW stack. The only difference was calling DoAPDUTxRx() in Nano vs. DoAPDUTxRx_s_Case4() in full MW. The main difference seems to be setting the LE byte in the request. I tried forcing this byte on-off without any luck. In the Nano package, the actual call is successful (DoAPDUTxRx() return SM_OK), but when the response buffer is parsed, tlvGet_u8Buf() returns 1, an error. The response buffer looks incorrect.

Here's the response buffer (23 bytes) when the call fails (starting address 0x20001A4D):

On success here the response buffer (23 bytes):

Here's the code itself:

smStatus_t Se05x_API_ReadECCurveList(pSe05xSession_t session_ctx, uint8_t *data, size_t *pdataLen)
{
smStatus_t retStatus = SM_NOT_OK;
tlvHeader_t hdr = {{kSE05x_CLA, kSE05x_INS_READ, kSE05x_P1_CURVE, kSE05x_P2_LIST}};
size_t cmdbufLen = 0;
uint8_t *pCmdbuf = NULL;
int tlvRet = 0;
uint8_t *pRspbuf = NULL;
size_t rspbufLen = 0;

ENSURE_OR_GO_CLEANUP(session_ctx != NULL);

memset(session_ctx->apdu_buffer, 0, sizeof(session_ctx->apdu_buffer));

pCmdbuf = &session_ctx->apdu_buffer[0];
pRspbuf = &session_ctx->apdu_buffer[0];
rspbufLen = sizeof(session_ctx->apdu_buffer);

SMLOG_D("APDU - Se05x_API_ReadECCurveList [] \n");

retStatus = DoAPDUTxRx(session_ctx, &hdr, session_ctx->apdu_buffer, cmdbufLen, pRspbuf, &rspbufLen, 1);
if (retStatus == SM_OK) {
retStatus = SM_NOT_OK;
size_t rspIndex = 0;
tlvRet = tlvGet_u8buf(pRspbuf, &rspIndex, rspbufLen, kSE05x_TAG_1, data, pdataLen); /* */
if (0 != tlvRet) {
goto cleanup;
}
if ((rspIndex + 2) == rspbufLen) {
retStatus = (pRspbuf[rspIndex] << | (pRspbuf[rspIndex + 1]);
}
}
if (retStatus == SM_ERR_ACCESS_DENIED_BASED_ON_POLICY) {
SMLOG_I("Denied to ReadECCurveList");
}

cleanup:
return retStatus;
}

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Thu, 08 Jun 2023 07:09:51 GMT

Hi @deang ,

Thanks for the sharing ! I tried your code with the example of ex_se05x_crypto, and found a code issue as shown below, and it works well after fixing.

Hope that helps,

Have a great day,
Kan

Re: Read ECC Curvelist fails when SCP03 enabled

deang — Thu, 08 Jun 2023 14:11:12 GMT

That's not where the code is failing. tlvGet_u8buf() returns 1 vs. 0. Digging further, inside tlvGet_u8buf(), the line of code failing is:

if (got_tag != tag) { goto cleanup; }

The tag's incorrect b/c the response from the se050 seems garbled. You can see the good and bad response in my previous post.

Re: Read ECC Curvelist fails when SCP03 enabled

Kan_Li — Fri, 09 Jun 2023 03:54:41 GMT

Hi @deang ,

Actually I could not reproduce your issue here, in your code, if tlvGet_u8buf() returns 1, Se05x_API_ReadECCurveList returns SM_NOT_OK, and "Error in Se05x_API_ReadECCurveList \n" will be printed, but in my test, this debug info doesn't come out. Maybe you can try it again with this little fix?

Have a great day,
Kan