Ticket: TPS Rewrite: Implement Secure Channel Protocol 02 (#883).

First cut of gp211 and scp protocol 02 for tokens.

Allow token operations using a GP211 token over secure channel protocol 02.

This patch supports the following:

1. Token operations with a GP211 card and SCP02 protocol, implementation 15.
2. Token still supports GP201 cards with SCP01.
3. SCP02 tested with SC650 gp211/scp02 card.

Things still to do:

1. Right now the SCP02 support has been tested with the current gp201 applet and
enrollment and formatting works just fine. We need to modify and compile the applet
against the GP211 spec and retest to see if any further changes are needed.

2. The nistSP800 key derivation stuff is not completed for the SCP02 protocol. Some
of the routines are self contained vs similar SCP01 ones. We have another ticket to
complete the nistSP800 support from end to end. This work will be done for that ticket.

3. One of the new scp02 deriviation functions can make use of a new NSS derive mechanism.
As of now this work is done by simple encryption, this can be done later.

4. The security APDU level of "RMAC" is not supported because the card does not support it.
It could have been done to the spec, but it having the card to test is more convenient and there
were more crucial issues to this point.

1 files changed, 54 insertions, 12 deletions

diff --git a/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java b/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java
index 9221d1ba0..e7efcc031 100644
--- a/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java
+++ b/base/tps/src/org/dogtagpki/server/tps/engine/TPSEngine.java
@@ -106,11 +106,13 @@ public class TPSEngine {
     public static final String CFG_APPLET_DIRECTORY = "update.applet.directory";
     public static final String CFG_APPLET_EXTENSION = "general.applet_ext";
 
-    public static final String CFG_CHANNEL_BLOCK_SIZE = "channel.blockSize";
+    public static final String CFG_CHANNEL_BLOCK_SIZE = "channel.blocksize";
     public static final String CFG_CHANNEL_INSTANCE_SIZE = "channel.instanceSize";
     public static final String CFG_CHANNEL_DEFKEY_VERSION = "channel.defKeyVersion";
     public static final String CFG_CHANNEL_APPLET_MEMORY_SIZE = "channel.appletMemorySize";
     public static final String CFG_CHANNEL_DEFKEY_INDEX = "channel.defKeyIndex";
+    public static final String CFG_CHANNEL_DEF_PLATFORM = "channel.defPlatform";
+    public static final String CFG_CHANNEL_DEF_SECURE_PROTO = "channel.defSecureProtocol";
     public static final String CFG_ISSUER_INFO_ENABLE = "issuerinfo.enable";
     public static final String CFG_ISSUER_INFO_VALUE = "issuerinfo.value";
     public static final String CFG_UPDATE_APPLET_ENCRYPTION = "update.applet.encryption";
@@ -119,6 +121,7 @@ public class TPSEngine {
 
     /* default values */
     public static final String CFG_DEF_CARDMGR_INSTANCE_AID = "A0000000030000";
+    public static final String CFG_DEF_CARDMGR_211_INSTANCE_AID = "A000000003000000";
     public static final String CFG_DEF_NETKEY_INSTANCE_AID = "627601FF000000";
     public static final String CFG_DEF_NETKEY_FILE_AID = "627601FF0000";
     public static final String CFG_DEF_NETKEY_OLD_INSTANCE_AID = "A00000000101";
@@ -204,6 +207,45 @@ public class TPSEngine {
         return rc;
     }
 
+    public TKSComputeSessionKeyResponse computeSessionKeySCP02(
+            TPSBuffer cuid,
+            TPSBuffer keyInfo,
+            TPSBuffer sequenceCounter,
+            TPSBuffer derivationConstant,
+            String connId,
+            String tokenType)
+            throws TPSException {
+
+        if (cuid == null || keyInfo == null || sequenceCounter == null || derivationConstant == null
+                || tokenType == null) {
+            throw new TPSException("TPSEngine.computeSessionKeySCP02: Invalid input data!",
+                    TPSStatus.STATUS_ERROR_SECURE_CHANNEL);
+        }
+
+        CMS.debug("TPSEngine.computeSessionKeySCP02");
+
+        TKSRemoteRequestHandler tks = null;
+
+        TKSComputeSessionKeyResponse resp = null;
+        try {
+            tks = new TKSRemoteRequestHandler(connId);
+            resp = tks.computeSessionKeySCP02(cuid, keyInfo, sequenceCounter, derivationConstant, tokenType);
+        } catch (EBaseException e) {
+            throw new TPSException("TPSEngine.computeSessionKeySCP02: Error computing session key!" + e,
+                    TPSStatus.STATUS_ERROR_SECURE_CHANNEL);
+        }
+
+        int status = resp.getStatus();
+        if (status != 0) {
+            CMS.debug("TPSEngine.computeSessionKeySCP02: Non zero status result: " + status);
+            throw new TPSException("TPSEngine.computeSessionKeySCP02: invalid returned status: " + status);
+
+        }
+
+        return resp;
+
+    }
+
     public TKSComputeSessionKeyResponse computeSessionKey(TPSBuffer cuid,
             TPSBuffer keyInfo,
             TPSBuffer card_challenge,
@@ -330,7 +372,7 @@ public class TPSEngine {
 
     }
 
-    public TPSBuffer createKeySetData(TPSBuffer newMasterVersion, TPSBuffer oldVersion, TPSBuffer cuid, String connId)
+    public TPSBuffer createKeySetData(TPSBuffer newMasterVersion, TPSBuffer oldVersion, int protocol, TPSBuffer cuid, TPSBuffer wrappedDekSessionKey, String connId)
             throws TPSException {
         CMS.debug("TPSEngine.createKeySetData. entering...");
 
@@ -345,7 +387,7 @@ public class TPSEngine {
 
         try {
             tks = new TKSRemoteRequestHandler(connId);
-            resp = tks.createKeySetData(newMasterVersion, oldVersion, cuid);
+            resp = tks.createKeySetData(newMasterVersion, oldVersion, cuid, protocol,wrappedDekSessionKey);
         } catch (EBaseException e) {
 
             throw new TPSException("TPSEngine.createKeySetData, failure to get key set data from TKS",
@@ -541,27 +583,27 @@ public class TPSEngine {
 
     }
 
-  //Check to see if special operations transition is allowed
+    //Check to see if special operations transition is allowed
 
     public boolean isOperationTransitionAllowed(TokenStatus oldState, TokenStatus newState) throws TPSException {
         boolean allowed = true;
 
-        if(transitionList == null) {
+        if (transitionList == null) {
 
             IConfigStore configStore = CMS.getConfigStore();
 
-            String transConfig  = CFG_OPERATIONS_TRANSITIONS;
+            String transConfig = CFG_OPERATIONS_TRANSITIONS;
 
             CMS.debug("TPSEngine.isOperationTransistionAllowed: getting config: " + transConfig);
             try {
-                transitionList = configStore.getString(transConfig,null);
+                transitionList = configStore.getString(transConfig, null);
             } catch (EBaseException e) {
                 throw new TPSException(
                         "TPSProcessor.isOperationTransitionAllowed: Internal error getting config value for operations transition list!",
                         TPSStatus.STATUS_ERROR_MISCONFIGURATION);
             }
 
-            if(transitionList == null) {
+            if (transitionList == null) {
                 throw new TPSException(
                         "TPSProcessor.isOperationTransitionAllowed: Can't find non null config value for operations transition list!",
                         TPSStatus.STATUS_ERROR_MISCONFIGURATION);
@@ -569,21 +611,21 @@ public class TPSEngine {
 
             CMS.debug("TPSEngine.isOperationTransistionAllowed: transitionList is: " + transitionList);
 
-
         }
 
         String transition = oldState.toInt() + ":" + newState.toInt();
 
         CMS.debug("TPSEngine.isOperationTransistionAllowed: checking for transition: " + transition);
 
-        if(transitionList.indexOf(transition) == -1) {
+        if (transitionList.indexOf(transition) == -1) {
             CMS.debug("TPSEngine.isOperationTransistionAllowed: checking for transition: " + transition);
             allowed = false;
         }
 
-        CMS.debug("TPSEngine.isOperationTransistionAllowed: checking for transition: " + transition + " allowed: " + allowed);
+        CMS.debug("TPSEngine.isOperationTransistionAllowed: checking for transition: " + transition + " allowed: "
+                + allowed);
 
-        return  allowed;
+        return allowed;
 
     }