Unable to Retrieve ECC Curve Details from SE050 using Plug & Trust Nano Package

[krsuresh]

Hi Team,

I am currently using the Plug & Trust Nano package to read the ECC curve details from the SE050.
However, I am consistently receiving zero values for the curve details, even though the function call returns a success status.

I have reviewed the APDU configuration and verified my setup based on the following NXP community discussion, but I did not find any issues:
https://community.nxp.com/t5/Secure-Authentication/Read-ECC-Curvelist-fails-when-SCP03-enabled/m-p/1...

Could you please advise on the possible cause of this issue and how I can correctly retrieve the ECC curve details from the SE050?

Environment details:

SE050 variant: SE050-C and SE050-F
Package: Plug & Trust Nano
SCP03 status: Enabled
Host platform: Raspberry Pi

Code Details: 

status = Se05x_API_ReadECCurveList(&se05x_session, curveList, &curveListLen);
printf("curveListLen: %d\n", curveListLen);
if (status == SM_OK) {
printf("Supported ECC Curves:\n");
for (i = 0; i < curveListLen; i++) {
printf(" Curve ID: 0x%02X\n", curveList[i]);
}
} else {
printf("Failed to read curve list\n");
}

smStatus_t Se05x_API_ReadECCurveList(pSe05xSession_t session_ctx, uint8_t *data, size_t *pdataLen)
{
smStatus_t retStatus = SM_NOT_OK;
tlvHeader_t hdr = {{kSE05x_CLA, kSE05x_INS_READ, kSE05x_P1_CURVE, kSE05x_P2_LIST}};
size_t cmdbufLen = 0;
uint8_t *pCmdbuf = NULL;
int tlvRet = 0;
uint8_t *pRspbuf = NULL;
size_t rspbufLen = 0;

ENSURE_OR_GO_CLEANUP(session_ctx != NULL);

memset(session_ctx->apdu_buffer, 0, sizeof(session_ctx->apdu_buffer));

pCmdbuf = &session_ctx->apdu_buffer[0];
pRspbuf = &session_ctx->apdu_buffer[0];
rspbufLen = sizeof(session_ctx->apdu_buffer);

SMLOG_D("APDU - Se05x_API_ReadECCurveList [] \n");

retStatus = DoAPDUTxRx(session_ctx, &hdr, session_ctx->apdu_buffer, cmdbufLen, pRspbuf, &rspbufLen, 1);

if (retStatus == SM_OK) {
size_t rspIndex = 0;
tlvRet = tlvGet_u8buf(pRspbuf, &rspIndex, rspbufLen, kSE05x_TAG_1, data, pdataLen); /* */
if (0 != tlvRet) {
goto cleanup;
}
if ((rspIndex + 2) == rspbufLen) {
retStatus = (pRspbuf[rspIndex] << 8 | (pRspbuf[rspIndex + 1]));
}
}
if (retStatus == SM_ERR_ACCESS_DENIED_BASED_ON_POLICY) {
SMLOG_I("Denied to ReadECCurveList");
}

cleanup:
return retStatus;
}

Thanks,

Sureshkumar R

[krsuresh]

Please find the APDU log details.

[Kan_Li]

Hi @krsuresh ，

Thanks for the info! have you tried the plain communication with SE050C？ The log should be something like below:

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[krsuresh]

Hi @Kan_Li,

Thank you for your prompt response.

Please find attached the APDU log details captured in open mode. I have observed that the Se05x_API_ReadECCurveList API returns a failure in open mode, whereas it executes successfully in secure mode.

Kindly review the provided details and advise if there are any steps or configurations I might have missed in the flow.

Build steps followed:

$ cmake ..
$ make
$ ./build/src/se05x_app

Thanks,

Sureshkumar R

[krsuresh]

Hi @Kan_Li,

While generating an ECC key pair, the Se05x_API_WriteECKey function returns 0x6985 on the SE050-C board.

The same code was working fine on this board previously, and it is still working correctly on the SE050-F board.

This issue occurred suddenly, and I am unable to determine the cause. Kindly help me to resolve this issue.

SE05x_ECCurve_t curveID = kSE05x_ECCurve_NIST_P256;

    status = Se05x_API_WriteECKey(

        &se05x_session, NULL, 0, keyID, curveID, NULL, 0, NULL, 0, kSE05x_INS_NA, kSE05x_KeyPart_Pair);

    if (status != SM_OK) {

        SMLOG_E("Error in Se05x_API_WriteECKey \n");

        return 1;

    }

Thanks,

Sureshkumar R

[Kan_Li]

Hi @krsuresh ,

Thanks for the info! Have you modified the source code of nano package? Looks like your code is different from the code from the Github repo. Please kindly refer to https://github.com/NXPPlugNTrust/nano-package/blob/737b61c527d4145f6dc96db9b51e22a4067ca09c/lib/apdu... for details.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[krsuresh]

I have not made any code changes. I am using the older Plug & Trust package version v1.2.1 because, in the latest version, I am facing build issues when building with SCP03 mode (PLUGANDTRUST_SCP03) enabled.

The steps I followed to build in SCP mode are:

mkdir build && cd build

cmake -DPLUGANDTRUST_SCP03=ON ..

make

/usr/bin/ld: build/libse05x_lib.a(se05x_APDU_impl.c.o): in function `Se05x_API_SessionOpen':

se05x_APDU_impl.c:(.text+0x384): undefined reference to `Se05x_API_SCP03_CreateSession'

/usr/bin/ld: build/libse05x_lib.a(se05x_tlv.c.o): in function `DoAPDUTx':

se05x_tlv.c:(.text+0xe90): undefined reference to `Se05x_API_SCP03_Encrypt'

/usr/bin/ld: se05x_tlv.c:(.text+0xf0c): undefined reference to `Se05x_API_SCP03_Decrypt'

/usr/bin/ld: build/libse05x_lib.a(se05x_tlv.c.o): in function `DoAPDUTxRx':

se05x_tlv.c:(.text+0x11d0): undefined reference to `Se05x_API_SCP03_Encrypt'

/usr/bin/ld: se05x_tlv.c:(.text+0x1248): undefined reference to `Se05x_API_SCP03_Decrypt'

collect2: error: ld returned 1 exit status

make[2]: *** [CMakeFiles/ex_se05x_GetInfo.dir/build.make:114: ex_se05x_GetInfo] Error 1

make[1]: *** [CMakeFiles/Makefile2:100: CMakeFiles/ex_se05x_GetInfo.dir/all] Error 2

make: *** [Makefile:91: all] Error 2

The same issue is observed in both the older and the latest code versions, even when operating in open (non-SCP) mode.

./ex_se05x_sign 

Se05x Sign Example !

Plug and Trust nano package - version: 1.5.4 

I2C driver supports plain i2c-level commands.

Generate ecc key 

Error in Se05x_API_WriteECKey 

SE05x Sign Example Failed !

./ex_se05x_sign 

Se05x Sign Example !

Plug and Trust nano package - version: 1.2.1 

I2C driver supports plain i2c-level commands.

Generate ecc key 

Error in Se05x_API_WriteECKey 

SE05x Sign Example Failed !

Thanks,

Sureshkumar R

[krsuresh]

Hi @Kan_Li.,

I believe this issue began after executing the kSE05x_ECCurve_NIST_P384/ kSE05x_ECCurve_NIST_P521 sample. Based on the Plug & Trust full package, the se05x_Minimal and se05x_GetInfo examples are functioning correctly; however, the ex_ecc and ex_ecc_rsa examples are failing. Could it be that the secure memory has been locked? I am still able to perform Se05x_API_WriteBinary operations using the Nano package.
Kindly advise if there is any option to perform a complete reset of the SE050 device.

Thanks,

Sureshkumar R

[Kan_Li]

Hi @krsuresh ,

I tried your code in the demo of ex_se05x_sign, and the result is good as expected, I tested it with OM-SE051ARD and raspberry Pi 3B+, Please kindly refer to the following for details.

Is it possible to use the latest version and try again? maybe you can also try to delete all the ECCurves and recreate the one you need before the test.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[krsuresh]

Hi @Kan_Li,

Thanks for the response.

I have two follow-up questions regarding ECC curve support in SE05x.

1) Curve list retrieval
As per your input, Se05x_API_ReadECCurveList() works fine in the latest code.
Now I am able to read the curve family list(like, NIST-P, Brainpool) correctly.
However, I still need clarification on how to get the exact supported ECC curves such as:

NIST-P192 (0x01)
NIST-P224 (0x02)
NIST-P256 (0x03)
NIST-P384 (0x04)
NIST-P521 (0x05)
Is there any API or recommended method to read the full list of specific curve IDs supported by the SE05x?

2) Key write failures
When I try to create or use curve NIST-P384, I get an error:
Se05x_API_CreateECCurve(&se05x_session, kSE05x_ECCurve_NIST_P384);

After this, all EC key write or key generation operations fail with:
Error in Se05x_API_WriteECKey

Even if I switch back to kSE05x_ECCurve_NIST_P256, the issue persists.
Currently, I am unable to perform any write operations on both of my boards:

* OM-SE050ARD
* OM-SE050ARD-F

It seems that attempting P-384 has caused all key write operations to fail.

Could you please clarify:
* Does SE05x fully support NIST-P384?
* Why are all write operations failing even after switching back to P-256?
* Is there a way to reset or recover the SE05x to a known working state?

Thanks,

Sureshkumar R

[krsuresh]

Hi @Kan_Li,

As per the latest Nano package code, the se05x_crypto sample works correctly for NIST-P384, but all operations for NIST-P256 fail.
If I change to NIST-P384 (curveID = 4), does this mean the chip will no longer support NIST-P256?

* Is this expected behavior on SE05x when switching from P256 to P384?
* Is there a recommended procedure to recover NIST-P256 operations if NIST-P384 has been used?

Log details for se05x_crypto
Se05x crypto Example !
Plug and Trust nano package - version: 1.5.4
I2C driver supports plain i2c-level commands.
Establish Secure Channel to SE05x !
Created scp03 Session
Get Version ==>
Applet Version 3.6.0
ex_get_version, PASSED
Error in Se05x_API_WriteECKey
ex_generate_nist256_key, FAILED
Error in Se05x_API_WriteECKey
ex_set_get_nist256_key, FAILED
Error in Se05x_API_WriteECKey
ex_nist256_sign_verify, FAILED
curveID = 4 already exists
ex_generate_nist384_key, PASSED
ex_set_get_nist384_key, PASSED
ex_nist384_sign_verify, PASSED
ex_set_certificate, PASSED
Error in Se05x_API_WriteECKey
ex_ecdh, FAILED
ex_aes_ECB_NOPAD, PASSED
ex_aes_CBC_NOPAD, PASSED
ex_aes_CTR, PASSED
Error in Se05x_API_WriteECKey
ex_nist256_sign_policy, FAILED
Error in Se05x_API_WriteECKey
ex_read_attst_object, FAILED
Close i2c device 3.
SE05x crypto Example Success !

Thanks,

Sureshkumar R

[Kan_Li]

Hi @krsuresh ，

Is it possible to enable the debug log? You may enable this by modifying the prj.conf file with the following configurations:

CONFIG_LOG=y
CONFIG_PLUGANDTRUST_LOG_LEVEL_DBG=y
CONFIG_LOG_MODE_IMMEDIATE=y

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[krsuresh]

Hi  @Kan_Li,

Thanks for the quick response.

I thought prj.conf was only used for Zephyr and not for Linux. For my Linux build, I enabled the debug logs using -DPLUGANDTRUST_DEBUG_LOGS=ON instead. The debug output is attached here for your reference.

Please let me know if there is any additional configuration needed.

Thanks,

Sureshkumar R

[Kan_Li]

Hi @krsuresh ,

Thanks but I could not find the attachment, would you please update your message with the new log? 

Best Regards,

Kan

[krsuresh]

Hi @Kan_Li 

Please find the log details attached. I am unsure why the attachment is not displaying on your end, even though I have already included the log information here.

Log Details:

Se05x crypto Example !
Plug and Trust nano package - version: 1.5.4
I2C driver supports plain i2c-level commands.
APDU Tx> :00 a4 04 00 10 a0 00 00 03 96 54 53 00 00 00 01 03 00 00 00 00 00
APDU Rx< :03 01 00 6f ff 01 0b 90 00
Establish Secure Channel to SE05x !
hostChallenge ==> :11 22 33 44 55 66 77 88
Sending GP Initialize Update Command !!!
APDU Tx> :80 50 0b 00 08 11 22 33 44 55 66 77 88
APDU Rx< :90 03 92 84 04 50 05 99 37 34 0b 03 00 49 87 9e 91 c8 8e a5 05 4e c7 68 e0 01 db cd fb 90 00
Output: keyDivData :90 03 92 84 04 50 05 99 37 34
Output: keyInfo :0b 03 00
Output: cardChallenge :49 87 9e 91 c8 8e a5 05
Output: cardCryptoGram :4e c7 68 e0 01 db cd fb
Set the Derviation data to generate Session ENC key
Output:scp03_session_enc_Key ==> :3b aa cc 97 b6 9a c8 67 81 1c 43 da 4b c8 50 ac
Set the Derviation data to generate Session MAC key
Output:scp03_session_mac_Key ==> :50 aa 3d e2 bd 41 13 f8 4f 99 4c e1 24 08 65 3d
Set the Derviation data to generate Session RMAC key
Output:scp03_session_rmac_Key ==> :b4 ab 4b 42 1a b5 47 8f 0e e9 47 36 9d 52 a1 8c
Output:cardCryptogram ==> :4e c7 68 e0 01 db cd fb fb 61 21 7c aa 3b c8 fd
cardCryptoGram ==> :4e c7 68 e0 01 db cd fb
CardCryptogram verified successfully...Calculate HostCryptogram
Output:hostCryptogram ==> :0d fd 88 98 2e f2 d9 18 93 36 df 2c 42 76 52 1c
hostCryptogram ==> :0d fd 88 98 2e f2 d9 18
Output: Calculated MAC ==> :35 2e 69 65 bc 68 58 32 22 ce aa fc 6c ef 60 80
Add calculated MAC Value to cmd DataSending GP External Authenticate Command !!!APDU Tx> :84 82 33 00 10 0d fd 88 98 2e f2 d9 18 35 2e 69 65 bc 68 58 32
APDU Rx< :90 00
Authentication Successful!!!
Created scp03 Session
Get Version ==>
APDU - GetVersion []
SCP03: Encrypted Data ==> :84 04 00 20 08 f0 fa c1 18 c7 92 28 ea
APDU Tx> :84 04 00 20 08 f0 fa c1 18 c7 92 28 ea
APDU Rx< :b6 3b eb a7 99 31 df c8 8d 5b e9 5b 8d bd 8d 03 13 08 e8 34 6a c5 b6 0c 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 82 00 07 03 01 00 6f ff 01 0b 90 00
Applet Version 3.1.0
ex_get_version, PASSED
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B0001F3
SCP03: Encrypted Data ==> :84 04 00 27 18 ed cb 0e b5 59 73 8e 7c d0 a2 27 f5 a4 93 f9 d0 1f 1f 2b 97 1f 55 b9 bb
APDU Tx> :84 04 00 27 18 ed cb 0e b5 59 73 8e 7c d0 a2 27 f5 a4 93 f9 d0 1f 1f 2b 97 1f 55 b9 bb
APDU Rx< :73 a3 2a 78 0b 78 a0 e3 09 07 f3 9e 25 bb 38 1b 6b 50 49 fa 36 fb f5 38 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - Se05x_API_CreateECCurve []
APDU :DEBUG:kSE05x_TAG_1["curve id"] = 0x3
SCP03: Encrypted Data ==> :84 01 0b 04 18 a9 e2 3c 38 29 44 85 c3 74 71 60 4d ed 0a a2 93 30 71 36 d7 0f 96 dd c2
APDU Tx> :84 01 0b 04 18 a9 e2 3c 38 29 44 85 c3 74 71 60 4d ed 0a a2 93 30 71 36 d7 0f 96 dd c2
APDU Rx< :84 2c c7 02 74 30 da dc 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :90 00
APDU - Se05x_API_SetECCurveParam []
APDU :DEBUG:kSE05x_TAG_1["curve id"] = 0x3
APDU :DEBUG:kSE05x_TAG_2["ecCurveParam"] = 0x1
APDU :DEBUG:kSE05x_TAG_3["inputData"] :ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ff 00 00 00 00 00 00 00 00 ff ff ff fc
SCP03: Encrypted Data ==> :84 01 0b 40 48 9d 8b bf 11 43 e1 fb 31 17 34 36 e2 5e 4f d1 bd e5 ee 66 37 98 c5 32 83 e0 cb fb 52 47 37 52 a8 dc 1f a5 08 a5 1d b0 2d 98 b2 17 2f 50 2c 61 1d 4e 87 64 57 80 99 e5 b2 a3 37 70 17 80 ad ae 7f 63 cf 10 85 92 8a 5b 04
APDU Tx> :84 01 0b 40 48 9d 8b bf 11 43 e1 fb 31 17 34 36 e2 5e 4f d1 bd e5 ee 66 37 98 c5 32 83 e0 cb fb 52 47 37 52 a8 dc 1f a5 08 a5 1d b0 2d 98 b2 17 2f 50 2c 61 1d 4e 87 64 57 80 99 e5 b2 a3 37 70 17 80 ad ae 7f 63 cf 10 85 92 8a 5b 04
APDU Rx< :69 85
Error in ex_se05x_create_curve
ex_generate_nist256_key, FAILED
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B000223
SCP03: Encrypted Data ==> :84 04 00 27 18 fc d1 4c 76 77 1c 23 86 f4 0a e6 6c 74 40 74 f9 ac a8 25 20 16 28 3a 1a
APDU Tx> :84 04 00 27 18 fc d1 4c 76 77 1c 23 86 f4 0a e6 6c 74 40 74 f9 ac a8 25 20 16 28 3a 1a
APDU Rx< :08 5a fe 92 6c 33 d0 be 7b 6e 11 d8 b7 fe b4 d7 a5 53 5c f6 dc ae 3b 69 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - WriteECKey []
APDU :DEBUG:kSE05x_TAG_MAX_ATTEMPTS["maxAttempt"] = 0x0
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B000223
APDU :DEBUG:kSE05x_TAG_2["curveID"] = 0x3
APDU :DEBUG:kSE05x_TAG_3["privKey"] :e4 ee 5f 99 d9 d8 37 8f 39 c2 c9 fd a9 12 5e a7 3f b8 fd 00 b5 19 e6 94 1e f1 34 75 8d 33 59 8a
APDU :DEBUG:kSE05x_TAG_4["pubKey"] :04 f2 24 bc 5e ea 74 28 a1 20 d3 d2 69 fe 22 f3 59 9c 20 33 a2 e0 cb 81 c2 ce a9 d6 d4 66 c3 68 f8 b6 a8 9c de 08 88 b5 49 cd ed 85 d3 b5 88 72 0a dc 26 32 b0 30 bf b1 67 d0 fd bc 89 e7 2b 9c c1
SCP03: Encrypted Data ==> :84 01 61 00 78 78 06 6e 6b 30 9d 1e 3a 1e 5e 5a 42 54 ef b4 04 17 db ab 49 3e e6 4a 90 29 64 13 73 2a bb 9e ce 27 f0 5d 04 4c 96 8b c6 cb e4 15 74 7a 75 97 35 08 c2 98 c0 3b 8f 6d fa 58 f8 f5 23 f6 f4 ca 96 8e 1b c3 f2 c3 c1 66 33 e9 24 e1 cd 83 ca a1 47 5d d6 e5 fb c0 ec e8 52 d0 c0 7f b6 32 fb e1 75 ab d4 36 38 ba a6 8a 06 15 1b d4 13 a9 e8 f7 6e cf c7 96 75 0a b7 54 82
APDU Tx> :84 01 61 00 78 78 06 6e 6b 30 9d 1e 3a 1e 5e 5a 42 54 ef b4 04 17 db ab 49 3e e6 4a 90 29 64 13 73 2a bb 9e ce 27 f0 5d 04 4c 96 8b c6 cb e4 15 74 7a 75 97 35 08 c2 98 c0 3b 8f 6d fa 58 f8 f5 23 f6 f4 ca 96 8e 1b c3 f2 c3 c1 66 33 e9 24 e1 cd 83 ca a1 47 5d d6 e5 fb c0 ec e8 52 d0 c0 7f b6 32 fb e1 75 ab d4 36 38 ba a6 8a 06 15 1b d4 13 a9 e8 f7 6e cf c7 96 75 0a b7 54 82
APDU Rx< :69 85
Error in Se05x_API_WriteECKey
ex_set_get_nist256_key, FAILED
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B00025E
SCP03: Encrypted Data ==> :84 04 00 27 18 96 34 9b ee 76 9f 60 d1 08 4f 46 41 e8 df 1c 24 f5 d3 71 f5 b1 be cf 19
APDU Tx> :84 04 00 27 18 96 34 9b ee 76 9f 60 d1 08 4f 46 41 e8 df 1c 24 f5 d3 71 f5 b1 be cf 19
APDU Rx< :d5 3f d5 a4 87 54 fa fe 1e cf e7 14 b9 19 21 ef cd 48 6f f4 c5 d5 0c ff 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - WriteECKey []
APDU :DEBUG:kSE05x_TAG_MAX_ATTEMPTS["maxAttempt"] = 0x0
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B00025E
APDU :DEBUG:kSE05x_TAG_2["curveID"] = 0x3
APDU :DEBUG:kSE05x_TAG_3["privKey"] :
APDU :DEBUG:kSE05x_TAG_4["pubKey"] :
SCP03: Encrypted Data ==> :84 81 61 00 18 15 b7 bf a6 af 1a 00 63 b7 37 d1 c7 cb 14 70 31 ae 07 63 b6 01 be cf b1
APDU Tx> :84 81 61 00 18 15 b7 bf a6 af 1a 00 63 b7 37 d1 c7 cb 14 70 31 ae 07 63 b6 01 be cf b1
APDU Rx< :69 85
Error in Se05x_API_WriteECKey
ex_nist256_sign_verify, FAILED
APDU - Se05x_API_ReadECCurveList []
SCP03: Encrypted Data ==> :84 02 0b 25 08 e3 fc c6 50 cd 1b 88 50
APDU Tx> :84 02 0b 25 08 e3 fc c6 50 cd 1b 88 50
APDU Rx< :55 49 93 04 25 48 e5 02 b4 45 9a 75 98 40 2c a7 bd 22 8c 24 62 23 33 12 f8 a1 52 93 5b c4 34 32 19 f2 3c 1e e5 a8 82 a4 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 82 00 11 01 01 02 02 02 01 02 01 01 01 01 01 01 01 01 02 01 90 00
curveID = 4 already exists
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B0002EF
SCP03: Encrypted Data ==> :84 04 00 27 18 d1 b6 cc 45 d1 7d ac 8d cb 3f c6 cb 45 48 00 6a c1 53 88 d8 a2 86 de 25
APDU Tx> :84 04 00 27 18 d1 b6 cc 45 d1 7d ac 8d cb 3f c6 cb 45 48 00 6a c1 53 88 d8 a2 86 de 25
APDU Rx< :f0 ff 7f 0d 5a ae 24 1d a5 01 6c 8e 22 a6 8a 43 f2 2d 86 29 f2 e8 6c 31 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - WriteECKey []
APDU :DEBUG:kSE05x_TAG_MAX_ATTEMPTS["maxAttempt"] = 0x0
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B0002EF
APDU :DEBUG:kSE05x_TAG_2["curveID"] = 0x4
APDU :DEBUG:kSE05x_TAG_3["privKey"] :
APDU :DEBUG:kSE05x_TAG_4["pubKey"] :
SCP03: Encrypted Data ==> :84 01 61 00 18 be 74 54 b5 11 5d 57 12 d1 cf 85 61 10 d9 8a 51 61 15 b0 92 7a 91 7c ca
APDU Tx> :84 01 61 00 18 be 74 54 b5 11 5d 57 12 d1 cf 85 61 10 d9 8a 51 61 15 b0 92 7a 91 7c ca
APDU Rx< :be ac eb f1 87 4e e5 93 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :90 00
APDU - Se05x_API_DeleteSecureObject []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B0002EF
SCP03: Encrypted Data ==> :84 04 00 28 18 9c 5d 90 bf 78 d3 5f 13 d7 fc fa 20 23 9a 7f c1 37 61 f2 7c d3 3a a0 31
APDU Tx> :84 04 00 28 18 9c 5d 90 bf 78 d3 5f 13 d7 fc fa 20 23 9a 7f c1 37 61 f2 7c d3 3a a0 31
APDU Rx< :c3 e9 ab 19 4c 45 95 9e 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :90 00
ex_generate_nist384_key, PASSED
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B00032F
SCP03: Encrypted Data ==> :84 04 00 27 18 0b 44 54 e9 70 89 ab 65 c9 bc 29 9b 79 f6 53 21 99 f6 44 e7 40 36 e6 da
APDU Tx> :84 04 00 27 18 0b 44 54 e9 70 89 ab 65 c9 bc 29 9b 79 f6 53 21 99 f6 44 e7 40 36 e6 da
APDU Rx< :81 d5 e6 69 21 05 7e 38 7e 30 90 6c 09 ad 30 ce 8d 36 dc 7c 3d 9f 2d 46 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - WriteECKey []

Thanks,

Sureshkumar R

[Kan_Li]

Hi @krsuresh ,

Thanks for the info! I can see  Se05x_API_SetECCurveParam had a 6985 error, which means the curve has already be set up , but might not set up correctly, so you can not set it up again , neither using it for create key pairs, so please remove this curve at first. and re-run the se05x_crypto demo.

Please kindly refer to the following for details.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[krsuresh]

Hi @Kan_Li,

Thank you for the information. I have attempted to remove the curve using Se05x_API_DeleteECCurve, but I am still encountering the same 0x6985 error.
Could you please confirm if this is the correct procedure to delete a curve, or if I am missing any steps? Please find attached the debug log for your reference.

status = Se05x_API_DeleteECCurve(session_ctx, kSE05x_ECCurve_NIST_P256);
if (status != SM_OK) {
SMLOG_E("Error in Se05x_API_DeleteECCurve \n");
return 1;
} else {
SMLOG_I("Curve Deleted Success.... \n");
}

status = ex_se05x_create_curve(session_ctx, curveID);
if (status != SM_OK) {
SMLOG_I("Error in ex_se05x_create_curve \n");
goto exit;
}

Log Details:

ex_get_version, PASSED
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B0001F3
SCP03: Encrypted Data ==> :84 04 00 27 18 d3 f3 89 46 7d af 66 e8 67 09 59 27 f3 cb f8 35 b2 3f 88 79 c3 50 2d 3f
APDU Tx> :84 04 00 27 18 d3 f3 89 46 7d af 66 e8 67 09 59 27 f3 cb f8 35 b2 3f 88 79 c3 50 2d 3f
APDU Rx< :7b 78 12 39 41 5e 28 e6 ef 8f 93 9c 4b 79 aa 3d 91 a6 7c fe fd 2d 88 15 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - Se05x_API_DeleteECCurve []
APDU :DEBUG:kSE05x_TAG_1["curve id"] = 0x3
SCP03: Encrypted Data ==> :84 04 0b 28 18 4d d7 f6 7c 76 5b c8 d8 70 bb 72 9d 7e f1 7c 59 ea 04 a3 4c c8 37 65 56
APDU Tx> :84 04 0b 28 18 4d d7 f6 7c 76 5b c8 d8 70 bb 72 9d 7e f1 7c 59 ea 04 a3 4c c8 37 65 56
APDU Rx< :17 58 65 57 b6 41 08 ca 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :90 00
Curve Deleted Success....
APDU - Se05x_API_CreateECCurve []
APDU :DEBUG:kSE05x_TAG_1["curve id"] = 0x3
SCP03: Encrypted Data ==> :84 01 0b 04 18 2c 27 d5 77 43 c8 76 d8 29 04 8b d9 66 d4 db 3e f8 a4 85 a1 26 8c 91 d4
APDU Tx> :84 01 0b 04 18 2c 27 d5 77 43 c8 76 d8 29 04 8b d9 66 d4 db 3e f8 a4 85 a1 26 8c 91 d4
APDU Rx< :bf c3 26 f8 16 8a e0 d0 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :90 00
APDU - Se05x_API_SetECCurveParam []
APDU :DEBUG:kSE05x_TAG_1["curve id"] = 0x3
APDU :DEBUG:kSE05x_TAG_2["ecCurveParam"] = 0x1
APDU :DEBUG:kSE05x_TAG_3["inputData"] :ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ff 00 00 00 00 00 00 00 00 ff ff ff fc
SCP03: Encrypted Data ==> :84 01 0b 40 48 0b a5 d4 2e 76 eb 95 a5 b0 44 a3 51 ff 9e ec 9d 5f d5 3f c6 98 fc 7c cf 0f 80 e2 59 d6 7b a6 14 07 01 a3 df bb 86 8b 2a 0e d5 f3 4c f3 c9 6b 07 02 1c 77 83 6e 85 e1 f6 dd 9b 9c 4c 6d c8 69 3d a1 df d3 45 e1 dd 6d 7a
APDU Tx> :84 01 0b 40 48 0b a5 d4 2e 76 eb 95 a5 b0 44 a3 51 ff 9e ec 9d 5f d5 3f c6 98 fc 7c cf 0f 80 e2 59 d6 7b a6 14 07 01 a3 df bb 86 8b 2a 0e d5 f3 4c f3 c9 6b 07 02 1c 77 83 6e 85 e1 f6 dd 9b 9c 4c 6d c8 69 3d a1 df d3 45 e1 dd 6d 7a
APDU Rx< :69 85
Error in ex_se05x_create_curve
ex_generate_nist256_key, FAILED
APDU - CheckObjectExists []
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B00022C
SCP03: Encrypted Data ==> :84 04 00 27 18 94 09 fd ce 6b 42 04 6a f0 08 94 b7 b8 ff 23 63 08 c3 57 ed 9c 2f 1f 0b
APDU Tx> :84 04 00 27 18 94 09 fd ce 6b 42 04 6a f0 08 94 b7 b8 ff 23 63 08 c3 57 ed 9c 2f 1f 0b
APDU Rx< :be 03 06 02 b6 29 d7 d3 76 1b 10 bc 4a 6b 22 6b 83 8b f2 21 1b 48 67 e1 90 00
SCP03: RMAC verified successfully...Decrypt Response Data
SCP03: Decrypted Data ==> :41 01 02 90 00
APDU - WriteECKey []
APDU :DEBUG:kSE05x_TAG_MAX_ATTEMPTS["maxAttempt"] = 0x0
APDU :DEBUG:kSE05x_TAG_1["object id"] = 0x7B00022C
APDU :DEBUG:kSE05x_TAG_2["curveID"] = 0x3
APDU :DEBUG:kSE05x_TAG_3["privKey"] :e4 ee 5f 99 d9 d8 37 8f 39 c2 c9 fd a9 12 5e a7 3f b8 fd 00 b5 19 e6 94 1e f1 34 75 8d 33 59 8a
APDU :DEBUG:kSE05x_TAG_4["pubKey"] :04 f2 24 bc 5e ea 74 28 a1 20 d3 d2 69 fe 22 f3 59 9c 20 33 a2 e0 cb 81 c2 ce a9 d6 d4 66 c3 68 f8 b6 a8 9c de 08 88 b5 49 cd ed 85 d3 b5 88 72 0a dc 26 32 b0 30 bf b1 67 d0 fd bc 89 e7 2b 9c c1
SCP03: Encrypted Data ==> :84 01 61 00 78 4b c2 7d c9 fc a3 f5 01 27 7c d2 8d d3 03 01 bd bf 56 c6 04 9f 7e 58 40 fa c3 13 67 b2 9a 0e 1e c6 22 a9 87 06 23 74 6c 46 b0 0b 1f 9a e8 eb f3 78 c8 c9 88 a1 d8 ca 71 20 eb 86 ca d8 86 85 13 51 ba bc 3d ed 99 5d 5e f3 ea 79 5c 64 5b 09 bf 0d e2 6a 8e b3 a7 61 c8 e3 0e b4 bf 18 af 56 13 5a e2 4b dc bf 8e f2 db 9c a5 1e 16 df f7 45 cd a0 21 1a 82 78 b3 9f e2
APDU Tx> :84 01 61 00 78 4b c2 7d c9 fc a3 f5 01 27 7c d2 8d d3 03 01 bd bf 56 c6 04 9f 7e 58 40 fa c3 13 67 b2 9a 0e 1e c6 22 a9 87 06 23 74 6c 46 b0 0b 1f 9a e8 eb f3 78 c8 c9 88 a1 d8 ca 71 20 eb 86 ca d8 86 85 13 51 ba bc 3d ed 99 5d 5e f3 ea 79 5c 64 5b 09 bf 0d e2 6a 8e b3 a7 61 c8 e3 0e b4 bf 18 af 56 13 5a e2 4b dc bf 8e f2 db 9c a5 1e 16 df f7 45 cd a0 21 1a 82 78 b3 9f e2
APDU Rx< :69 85
Error in Se05x_API_WriteECKey
ex_set_get_nist256_key, FAILED

Thanks,

Sureshkumar R

[Kan_Li]

Hi @krsuresh ，

Looks like you are using the api to generate ECC curve for nist384 to generate ECC curve for nist256, but keep the ECC parameters the same, so lead to this error, you have to use the parameters for nist256 instead.

#define EC_PARAM_prime256v1_prime \
0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, \
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, \
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
#define EC_PARAM_prime256v1_a \
0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, \
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, \
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC
#define EC_PARAM_prime256v1_b \
0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, \
0xB3, 0xEB, 0xBD, 0x55, 0x76, 0x98, 0x86, 0xBC, \
0x65, 0x1D, 0x06, 0xB0, 0xCC, 0x53, 0xB0, 0xF6, \
0x3B, 0xCE, 0x3C, 0x3E, 0x27, 0xD2, 0x60, 0x4B
#define EC_PARAM_prime256v1_x \
0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, \
0xF8, 0xBC, 0xE6, 0xE5, 0x63, 0xA4, 0x40, 0xF2, \
0x77, 0x03, 0x7D, 0x81, 0x2D, 0xEB, 0x33, 0xA0, \
0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98, 0xC2, 0x96
#define EC_PARAM_prime256v1_y \
0x4F, 0xE3, 0x42, 0xE2, 0xFE, 0x1A, 0x7F, 0x9B, \
0x8E, 0xE7, 0xEB, 0x4A, 0x7C, 0x0F, 0x9E, 0x16, \
0x2B, 0xCE, 0x33, 0x57, 0x6B, 0x31, 0x5E, 0xCE, \
0xCB, 0xB6, 0x40, 0x68, 0x37, 0xBF, 0x51, 0xF5
#define EC_PARAM_prime256v1_order \
0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, \
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \
0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84, \
0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51
#endif

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------