SE050 Mandate platformSCP where current communication is encrypted

[Liad]

Hi,

I'm trying to mandate SE to use platformSCP.

I use your se05x_MandatePlatformSCP.c example and it doesn't work for me.

I suspect that the initial session config you use in this example is 

kSSS_AuthType_ID / kSSS_ConnectionType_Password

While my session config is

kSSS_AuthType_SCP03 / kSSS_ConnectionType_Encrypted

Does it matter?

Can I start with my session config to set the authentication user-id object while I'm in a secure channel session (platform SCP no AuthID) and then switch to a new session Auth ID base in order to send the SE Se05x_API_SetPlatformSCPRequest: kSE05x_PlatformSCPRequest_REQUIRED?

Please help me.

[Baver]

Hi,

I use your se05x_MandatePlatformSCP.c example and it doesn't work for me.

The API Se05x_API_WriteUserID returns SM_ERR_CONDITIONS_OF_USE_NOT_SATISFIED.

Here is the code:

____________________________________________________________________

sss_status_t status;

SE_Connect_Ctx_t eraseAuthCtx = {0};

sss_se05x_session_t *pSession = (sss_se05x_session_t *)&pCtx->session;

smStatus_t sw_status;

Se05xSession_t *pSe05xSession;

SE_Connect_Ctx_t *pOpenCtx;

sss_object_t ex_id = {0};

const uint8_t host_userid_value[] = MandateSCP_UserID_VALUE;

const uint8_t userid_value_factoryreset[] = MandateSCP_UserID_VALUE;

//For UserID/PIN based based Authentication why not SCP?

eraseAuthCtx.auth.ctx.idobj.pObj = &ex_id;

//eraseAuthCtx.i2cAddress = &ex_id;

//prepare Host

//The function initializes keyObject data structure and associates it with a key store

// in which the plain key and other attributes are stored.

status = sss_key_object_init(eraseAuthCtx.auth.ctx.idobj.pObj, &pCtx->host_ks);

if(kStatus_SSS_Success != status) {

LOG_E("Failed sss_key_object_init");

goto cleanup;

}

ESP_LOGI(TAG, "sss_key_object_init: %x", status);

status = sss_key_object_allocate_handle(eraseAuthCtx.auth.ctx.idobj.pObj,

MAKE_TEST_ID(__LINE__),

kSSS_KeyPart_Default,

kSSS_CipherType_UserID,

sizeof(host_userid_value),

kKeyObject_Mode_Transient);

ESP_LOGI(TAG, "MAKE_TEST_ID: %d",MAKE_TEST_ID(__LINE__));

if(kStatus_SSS_Success != status) {

LOG_E("Failed sss_key_object_allocate_handle");

goto cleanup;

}

ESP_LOGI(TAG, "sss_key_object_allocate_handle: %x", status);

//This function moves data[] from memory to the destination key store.

status = sss_key_store_set_key(&pCtx->host_ks,

eraseAuthCtx.auth.ctx.idobj.pObj,

host_userid_value,

sizeof(host_userid_value),

sizeof(host_userid_value) * 8,

NULL,

0);

if (kStatus_SSS_Success != status) {

LOG_E("Failed sss_key_store_set_key");

goto cleanup;

}

ESP_LOGI(TAG, "sss_key_store_set_key: %x", status);

SE05x_Result_t dataResult= 0;

sw_status = Se05x_API_CheckObjectExists(&pSession->s_ctx, kSE05x_AppletResID_PLATFORM_SCP , &dataResult);

if (SM_OK != sw_status) {

LOG_E("Failed Se05x_API_CheckObjectExists");

goto cleanup;

}

ESP_LOGI(TAG, "Se05x_API_CheckObjectExists: %x", sw_status);

// pSession->s_ctx.authType = kSSS_AuthType_None;

pSe05xSession = &pSession->s_ctx;

sw_status = Se05x_API_WriteUserID(pSe05xSession,

NULL,

SE05x_MaxAttemps_NA,

kSE05x_AppletResID_PLATFORM_SCP, //0x7FFF0207

userid_value_factoryreset,

sizeof(userid_value_factoryreset),

kSE05x_AttestationType_AUTH);

if (SM_OK != sw_status) {

LOG_E("Failed Se05x_API_WriteUserID");

ESP_LOGI(TAG, "Se05x_API_WriteUserID_FAIL: %x", sw_status);

goto cleanup;

}

ESP_LOGI(TAG, "Se05x_API_WriteUserID: %x", sw_status);

sss_session_close(&pCtx->session);

pOpenCtx = &pCtx->se05x_open_ctx;

eraseAuthCtx.tunnelCtx = pOpenCtx->tunnelCtx;

eraseAuthCtx.connType = pOpenCtx->connType;

eraseAuthCtx.portName = pOpenCtx->portName;

eraseAuthCtx.auth.authType = kSSS_AuthType_ID;

pSe05xSession = &pSession->s_ctx;

status = sss_session_open(&pCtx->session, kType_SSS_SE_SE05x,

kSE05x_AppletResID_FACTORY_RESET,

kSSS_ConnectionType_Password, &eraseAuthCtx);

if (kStatus_SSS_Success != status) {

LOG_E("Failed sss_session_open");

ESP_LOGI(TAG, "sss_session_open-FAILED: %x", status);

goto cleanup;

}

ESP_LOGI(TAG, "sss_session_open: %x", status);

//Call SE05X API to Mandate Platform SCP

//Mandate platform SCP or not

sw_status = Se05x_API_SetPlatformSCPRequest(&pSession->s_ctx, kSE05x_PlatformSCPRequest_REQUIRED);

if(SM_OK != sw_status) {

LOG_E("Se05x_API_SetPlatformSCPRequest Failed");

goto cleanup;

}

else {

LOG_I("Se05x_API_SetPlatformSCPRequest Successful-__________________________");

LOG_W("Further communication must be encrypted");

}

while(1)

{

vTaskDelay( 5000 / portTICK_PERIOD_MS);

ESP_LOGI(TAG, "HALLOOOO");

}

cleanup:

if (kStatus_SSS_Success == status) {

LOG_I("se05x_MandatePlatformSCP Example Success !!!...");

while(1)

{

ESP_LOGI(TAG, "HALLOOOO");

vTaskDelay( 500000 / portTICK_PERIOD_MS);

}

}

else {

LOG_E("se05x_MandatePlatformSCP Example Failed !!!...");

}

return status;

}

___________________________________________________________________

Please Help me.

[Liad]

Hi Kan,

I appreciate your quick response. I'm afraid that the key adjustment isn't the issue, because I can successfully rotate the binding keys using the initial OEM keys. However, for the sake of good order, it is SE050C1.

I followed the mandate example step by step, and I received an error SM_NOT_OK for the  Se05x_API_SetPlatformSCPRequest. If I open the session with SCP/encrypted instead of ID/password configuration I receive undefined error code 0x6d00.

I came to a realization that although I've been working on this component for about a month now, I've never sent a request that involved writing UserID. I did an experiment to do a true factory reset so I used a Se05x_API_WriteUserID with SE05x_AppletResID_FACTORY_RESET which succeeded but failed on Se05x_API_DeleteAll.

So to sum up my questions are:

1. I used to prepare a host with platform SCP without authKey (ex_sss_se05x_prepare_host_platformscp), should I, for this purpose, prepare a host with AuthID (ex_sss_se05x_prepare_host_userid) / AuthAES (ex_sss_se05x_prepare_host_AppletScp03Keys) instead, or does it come together: first a host with platform SCP then prepare it again with AuthID / AuthAES?
2. Does it must be AuthAES or can I use AuthID?
3. After mandating, Is it possible to do any kind of factory reset to reset the SCP03 binding keys without any authentication?

As you can see, I'm a little bit confused sorry for that.

Thank you

[Kan_Li]

Hi @Liad ,

Please kindly have my comments as below:

1. I used to prepare a host with platform SCP without authKey (ex_sss_se05x_prepare_host_platformscp), should I, for this purpose, prepare a host with AuthID (ex_sss_se05x_prepare_host_userid) / AuthAES (ex_sss_se05x_prepare_host_AppletScp03Keys) instead, or does it come together: first a host with platform SCP then prepare it again with AuthID / AuthAES?- Actually you may understand platform SCP is an authentication to the SE, and AuthID / AuthAES is an authentication to the applet inside the SE, so they can work both or either of them, but the security would be the best when you use both of them. 
2. Does it must be AuthAES or can I use AuthID? - No, you can use either of them, but AES is recommended.
3. After mandating, Is it possible to do any kind of factory reset to reset the SCP03 binding keys without any authentication? - No, it is not possible , you must use the current key to authenticate with the device and then replace them with any others.

BTW, Did you successfully rotate the platform SCP keys with the demo? I am confused with "received an error SM_NOT_OK for the  Se05x_API_SetPlatformSCPRequest." and " successfully rotate the binding keys using the initial OEM keys", would you please clarify?

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Liad · Accepted solution]

Hi Kan,

First of all, I want to thank you again, each of your responses is truly pointing me in the right direction toward my goals. Now I understand the difference between platformSCP and AuthID/AES thanks to you.

In the original post, I already managed to rotate the keys according to the demo, because it doesn't involve authentication with the applet only with the device. So that was the big difference for me with the Mandate request.

Finally, I successfully managed to mandate SCP. The major mistake in my code was that the SSSFTR_SE05X_AuthSession was false instead of true.

So, the case can be closed.

Regards,

Liad

[Liad]

I was glad too early.

Is there a reason why after successfully mandating, I received a NOT_SATISFIED error for the Se05x_API_WriteUserID request? Of course, it was within a SCP session.

I'm trying to send the Se05x_API_DeleteAll request.

[Kan_Li]

Hi @Liad ,

Just wondering the scenario from your side, did you enable platform SCP together with some AuthID? and the UserID you wanted to update is just the AuthID? Please kindly clarify.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Liad]

I enabled platformSCP with AuthID and tried to open a session with the application id of kSE05x_AppletResID_FACTORY_RESET, for doing the factory reset.

I received a status fail from sss_session_open, specifically, it failed in Se05x_API_CheckObjectExists where I received NOT_SATISFIED.

What I did is similar to the se05x_AllowWithoutPlatformSCP example, just replace the application id with kSE05x_AppletResID_FACTORY_RESET, and of course, I executed the Se05x_API_WriteUserID prior to it, so it exists.

[Kan_Li]

Hi @Liad ,

Actually there is no need to executed the Se05x_API_WriteUserID prior to the demo, in which a secure object is initialized already to contain the UserID, but the id itself is a random line number, you may specify it with any value you like.

I think that might be the root cause for your issue.

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Kan_Li]

Hi @Liad ,

The default platformSCP keys are different across SE05x variants, so maybe you have to adjust the platformSCP key settings before running this demo, would you please specify which SE05x is used in your test? Thanks for your patience!

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------