diff --git a/demo-android/.gitignore b/demo-android/.gitignore
deleted file mode 100644
index 796b96d..0000000
--- a/demo-android/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/build
diff --git a/demo-android/build.gradle b/demo-android/build.gradle
deleted file mode 100644
index 4660811..0000000
--- a/demo-android/build.gradle
+++ /dev/null
@@ -1,40 +0,0 @@
-apply plugin: 'com.android.application'
-
-android {
- compileSdkVersion 28
- defaultConfig {
- applicationId "im.status.keycard.demo"
- minSdkVersion 19
- targetSdkVersion 28
- versionCode 300
- versionName "3.0.0"
- testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
- }
- buildTypes {
- release {
- minifyEnabled false
- proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
- }
- }
-
- lintOptions {
- lintConfig file("lint-config.xml")
- }
-
- compileOptions {
- sourceCompatibility JavaVersion.VERSION_1_8
- targetCompatibility JavaVersion.VERSION_1_8
- }
-}
-
-dependencies {
- implementation 'com.android.support:appcompat-v7:28.0.0'
- implementation 'com.android.support.constraint:constraint-layout:1.1.3'
- implementation 'org.bouncycastle:bcprov-jdk15on:1.60'
-
- implementation project(':android')
-
- testImplementation 'junit:junit:4.12'
- androidTestImplementation 'com.android.support.test:runner:1.0.2'
- androidTestImplementation 'com.android.support.test.espresso:espresso-core:3.0.2'
-}
diff --git a/demo-android/lint-config.xml b/demo-android/lint-config.xml
deleted file mode 100644
index e1957ce..0000000
--- a/demo-android/lint-config.xml
+++ /dev/null
@@ -1,5 +0,0 @@
-
-
-
-
-
diff --git a/demo-android/proguard-rules.pro b/demo-android/proguard-rules.pro
deleted file mode 100644
index f1b4245..0000000
--- a/demo-android/proguard-rules.pro
+++ /dev/null
@@ -1,21 +0,0 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-# http://developer.android.com/guide/developing/tools/proguard.html
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-# public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
diff --git a/demo-android/src/main/AndroidManifest.xml b/demo-android/src/main/AndroidManifest.xml
deleted file mode 100644
index 9955e6f..0000000
--- a/demo-android/src/main/AndroidManifest.xml
+++ /dev/null
@@ -1,21 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/demo-android/src/main/java/im/status/keycard/app/MainActivity.java b/demo-android/src/main/java/im/status/keycard/app/MainActivity.java
deleted file mode 100644
index 82bad57..0000000
--- a/demo-android/src/main/java/im/status/keycard/app/MainActivity.java
+++ /dev/null
@@ -1,197 +0,0 @@
-package im.status.keycard.app;
-
-import android.bluetooth.BluetoothAdapter;
-import android.bluetooth.BluetoothDevice;
-import android.nfc.NfcAdapter;
-import android.os.Bundle;
-import android.support.v7.app.AppCompatActivity;
-import android.util.Log;
-import im.status.keycard.android.LedgerBLEManager;
-import im.status.keycard.demo.R;
-import im.status.keycard.io.CardChannel;
-import im.status.keycard.io.CardListener;
-import im.status.keycard.android.NFCCardManager;
-import im.status.keycard.applet.*;
-import org.bouncycastle.util.encoders.Hex;
-
-public class MainActivity extends AppCompatActivity {
-
- private static final String TAG = "MainActivity";
-
- private NfcAdapter nfcAdapter;
- private NFCCardManager cardManager;
- //private LedgerBLEManager cardManager;
- //private boolean connected;
-
- @Override
- protected void onCreate(Bundle savedInstanceState) {
- super.onCreate(savedInstanceState);
- setContentView(R.layout.activity_main);
- nfcAdapter = NfcAdapter.getDefaultAdapter(this);
- cardManager = new NFCCardManager();
- //cardManager = new LedgerBLEManager(this);
- cardManager.setCardListener(new CardListener() {
- @Override
- public void onConnected(CardChannel cardChannel) {
- try {
- // Applet-specific code
- KeycardCommandSet cmdSet = new KeycardCommandSet(cardChannel);
-
- Log.i(TAG, "Applet selection successful");
-
- // First thing to do is selecting the applet on the card.
- ApplicationInfo info = new ApplicationInfo(cmdSet.select().checkOK().getData());
-
- // If the card is not initialized, the INIT apdu must be sent. The actual PIN, PUK and pairing password values
- // can be either generated or chosen by the user. Using fixed values is highly discouraged.
- if (!info.isInitializedCard()) {
- Log.i(TAG, "Initializing card with test secrets");
- cmdSet.init("000000", "123456789012", "KeycardTest").checkOK();
- info = new ApplicationInfo(cmdSet.select().checkOK().getData());
- }
-
- Log.i(TAG, "Instance UID: " + Hex.toHexString(info.getInstanceUID()));
- Log.i(TAG, "Secure channel public key: " + Hex.toHexString(info.getSecureChannelPubKey()));
- Log.i(TAG, "Application version: " + info.getAppVersionString());
- Log.i(TAG, "Free pairing slots: " + info.getFreePairingSlots());
- if (info.hasMasterKey()) {
- Log.i(TAG, "Key UID: " + Hex.toHexString(info.getKeyUID()));
- } else {
- Log.i(TAG, "The card has no master key");
- }
- Log.i(TAG, String.format("Capabilities: %02X", info.getCapabilities()));
- Log.i(TAG, "Has Secure Channel: " + info.hasSecureChannelCapability());
- Log.i(TAG, "Has Key Management: " + info.hasKeyManagementCapability());
- Log.i(TAG, "Has Credentials Management: " + info.hasCredentialsManagementCapability());
- Log.i(TAG, "Has NDEF capability: " + info.hasNDEFCapability());
-
- if (info.hasSecureChannelCapability()) {
- // In real projects, the pairing key should be saved and used for all new sessions.
- cmdSet.autoPair("KeycardTest");
- Pairing pairing = cmdSet.getPairing();
-
- // Never log the pairing key in a real application!
- Log.i(TAG, "Pairing with card is done.");
- Log.i(TAG, "Pairing index: " + pairing.getPairingIndex());
- Log.i(TAG, "Pairing key: " + Hex.toHexString(pairing.getPairingKey()));
-
- // Opening a Secure Channel is needed for all other applet commands
- cmdSet.autoOpenSecureChannel();
-
- Log.i(TAG, "Secure channel opened. Getting applet status.");
- }
-
- // We send a GET STATUS command, which does not require PIN authentication
- ApplicationStatus status = new ApplicationStatus(cmdSet.getStatus(KeycardCommandSet.GET_STATUS_P1_APPLICATION).checkOK().getData());
-
- Log.i(TAG, "PIN retry counter: " + status.getPINRetryCount());
- Log.i(TAG, "PUK retry counter: " + status.getPUKRetryCount());
- Log.i(TAG, "Has master key: " + status.hasMasterKey());
-
- if (info.hasKeyManagementCapability()) {
- // A mnemonic can be generated before PIN authentication. Generating a mnemonic does not create keys on the
- // card. a subsequent loadKey step must be performed after PIN authentication. In this example we will only
- // show how to convert the output of the card to a usable format but won't actually load the key
- Mnemonic mnemonic = new Mnemonic(cmdSet.generateMnemonic(KeycardCommandSet.GENERATE_MNEMONIC_12_WORDS).checkOK().getData());
-
- // We need to set a wordlist if we plan using this object to derive the binary seed. If we just need the word
- // indexes we can skip this step and call mnemonic.getIndexes() instead.
- mnemonic.fetchBIP39EnglishWordlist();
-
- Log.i(TAG, "Generated mnemonic phrase: " + mnemonic.toMnemonicPhrase());
- Log.i(TAG, "Binary seed: " + Hex.toHexString(mnemonic.toBinarySeed()));
- }
-
- if (info.hasCredentialsManagementCapability()) {
- // PIN authentication allows execution of privileged commands
- cmdSet.verifyPIN("000000").checkAuthOK();
-
- Log.i(TAG, "Pin Verified.");
- }
-
- // If the card has no keys, we generate a new set. Keys can also be loaded on the card starting from a binary
- // seed generated from a mnemonic phrase. In alternative, we could load the generated keypair as shown in the
- // commented line of code.
- if (!status.hasMasterKey() && info.hasKeyManagementCapability()) {
- cmdSet.generateKey();
- //cmdSet.loadKey(mnemonic.toBIP32KeyPair());
- }
-
- // Get the current key path using GET STATUS
- KeyPath currentPath = new KeyPath(cmdSet.getStatus(KeycardCommandSet.GET_STATUS_P1_KEY_PATH).checkOK().getData());
- Log.i(TAG, "Current key path: " + currentPath);
-
- if (!currentPath.toString().equals("m/44'/0'/0'/0/0")) {
- // Key derivation is needed to select the desired key. The derived key remains current until a new derive
- // command is sent (it is not lost on power loss).
- cmdSet.deriveKey("m/44'/0'/0'/0/0").checkOK();
- Log.i(TAG, "Derived m/44'/0'/0'/0/0");
- }
-
- // We retrieve the wallet public key
- BIP32KeyPair walletPublicKey = BIP32KeyPair.fromTLV(cmdSet.exportCurrentKey(true).checkOK().getData());
-
- Log.i(TAG, "Wallet public key: " + Hex.toHexString(walletPublicKey.getPublicKey()));
- Log.i(TAG, "Wallet address: " + Hex.toHexString(walletPublicKey.toEthereumAddress()));
-
- byte[] hash = "thiscouldbeahashintheorysoitisok".getBytes();
-
- RecoverableSignature signature = new RecoverableSignature(hash, cmdSet.sign(hash).checkOK().getData());
-
- Log.i(TAG, "Signed hash: " + Hex.toHexString(hash));
- Log.i(TAG, "Recovery ID: " + signature.getRecId());
- Log.i(TAG, "R: " + Hex.toHexString(signature.getR()));
- Log.i(TAG, "S: " + Hex.toHexString(signature.getS()));
-
- if (info.hasSecureChannelCapability()) {
- // Cleanup, in a real application you would not unpair and instead keep the pairing key for successive interactions.
- // We also remove all other pairings so that we do not fill all slots with failing runs. Again in real application
- // this would be a very bad idea to do.
- cmdSet.unpairOthers();
- cmdSet.autoUnpair();
-
- Log.i(TAG, "Unpaired.");
- }
- } catch (Exception e) {
- Log.e(TAG, e.getMessage());
- }
-
- }
-
- @Override
- public void onDisconnected() {
- Log.i(TAG, "Card disconnected.");
- }
- });
- cardManager.start();
- /*connected = false;
- cardManager.startScan(new BluetoothAdapter.LeScanCallback() {
- @Override
- public void onLeScan(BluetoothDevice device, int rssi, byte[] scanRecord) {
- if (connected) {
- return;
- }
-
- connected = true;
- cardManager.stopScan(this);
- cardManager.connectDevice(device);
- }
- });*/
- }
-
- @Override
- public void onResume() {
- super.onResume();
- if (nfcAdapter != null) {
- nfcAdapter.enableReaderMode(this, this.cardManager, NfcAdapter.FLAG_READER_NFC_A | NfcAdapter.FLAG_READER_SKIP_NDEF_CHECK, null);
- }
- }
-
- @Override
- public void onPause() {
- super.onPause();
- if (nfcAdapter != null) {
- nfcAdapter.disableReaderMode(this);
- }
- }
-}
diff --git a/demo-android/src/main/res/drawable-v24/ic_launcher_foreground.xml b/demo-android/src/main/res/drawable-v24/ic_launcher_foreground.xml
deleted file mode 100644
index 6348baa..0000000
--- a/demo-android/src/main/res/drawable-v24/ic_launcher_foreground.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-
-
-
-
-
+ * - Handshake: ECDHE on secp256k1 + HKDF-SHA256 key derivation
+ * - Card authentication: ECDSA-SHA256 signature over the full key exchange transcript
+ * - Encrypted commands: AES-128-CCM (T=8, L=13) with implicit per-session nonce counter
+ *
+ *
+ * All traffic after the handshake is wrapped in a single command type:
+ * {@code [0x80 | 0x18 | 0x00 | 0x00 | LC'] || ciphertext || tag(8B)}
+ *
+ * The inner APDU (including CLA, INS, P1, P2, LC, and data) is fully encrypted.
+ * The ISO-level SW is always 0x9000 (decrypt OK) or 0x6982 (decrypt error);
+ * the real command SW is inside the encrypted response payload.
+ *
+ * Unlike V1, V2 does not use pairing. Each session establishes independent keys
+ * via ECDHE, authenticated by the card's persistent identity key certificate.
+ */
+public class SecureChannelV2 implements SecureChannel {
+
+ // Protocol constants
+ private static final byte[] PROTOCOL_LABEL = { 's', 'c', '_', 'v', '2', '_', 'c', 'c', 'm' };
+
+ static final short HKDF_SALT_SIZE = 32;
+ static final short PUBKEY_SIZE = 65; // uncompressed secp256k1 point
+ static final short ECDH_SHARED_X_SIZE = 32;
+ static final short OKM_SIZE = 32;
+ static final short AES_KEY_SIZE = 16;
+ static final short CCM_TAG_SIZE = 8;
+ static final short CCM_NONCE_SIZE = 13;
+ static final short SIGNATURE_DOMAIN_LEN = 5;
+
+ static final byte INS_OPEN_SECURE_CHANNEL = (byte) 0x10;
+ static final byte INS_SECURED_APDU = (byte) 0x18;
+
+ // Trusted CA public keys for certificate verification (compressed, 33 bytes each)
+ private final List caPublicKeys;
+ // Whitelisted card identity public keys (compressed, 33 bytes each)
+ // Allows accepting specific cards even when their CA is not trusted
+ private final List whitelistedCardPublicKeys;
+
+ // Session state
+ private SecretKeySpec keyH2C;
+ private SecretKeySpec keyC2H;
+ private Cipher aesCCM;
+ private byte[] nonceCounter;
+ private boolean open;
+
+ // Card identity (set during handshake)
+ private byte[] cardIdentPub; // compressed, 33 bytes
+
+ // Handshake ephemeral key (kept for debug/testing)
+ private byte[] clientEphPub;
+
+ private final SecureRandom random;
+
+ /**
+ * Creates a V2 secure channel client with the given set of trusted CA public keys
+ * and optionally whitelisted card identity public keys.
+ *
+ * During certificate verification, a card is accepted if either:
+ *
+ * - The CA public key recovered from its certificate matches one of the trusted CA keys, or
+ * - The card's identity public key is in the whitelist
+ *
+ *
+ * @param caPublicKeys list of compressed secp256k1 CA public keys (33 bytes each)
+ * @param whitelistedCardPublicKeys list of compressed card identity public keys (33 bytes each)
+ */
+ public SecureChannelV2(List caPublicKeys, List whitelistedCardPublicKeys) {
+ if (caPublicKeys == null) {
+ throw new IllegalArgumentException("caPublicKeys must not be null");
+ }
+ if (whitelistedCardPublicKeys == null) {
+ throw new IllegalArgumentException("whitelistedCardPublicKeys must not be null");
+ }
+ this.caPublicKeys = Collections.unmodifiableList(caPublicKeys);
+ this.whitelistedCardPublicKeys = Collections.unmodifiableList(whitelistedCardPublicKeys);
+ this.random = new SecureRandom();
+ initCiphers();
+ }
+
+ private void initCiphers() {
+ try {
+ aesCCM = Cipher.getInstance("AES/CCM/NoPadding", "BC");
+ nonceCounter = new byte[CCM_NONCE_SIZE];
+ } catch (Exception e) {
+ throw new RuntimeException("Is BouncyCastle in the classpath?", e);
+ }
+ }
+
+ // ── SecureChannel interface implementation ──────────────────────────
+
+ @Override
+ public void autoOpenSecureChannel(CardChannel apduChannel)
+ throws IOException, APDUException {
+ byte[] salt = new byte[HKDF_SALT_SIZE];
+ random.nextBytes(salt);
+
+ // Generate client ephemeral key pair
+ KeyPair ephKeyPair = generateEphemeralKeyPair();
+ clientEphPub = getUncompressedPublicKey(ephKeyPair.getPublic());
+
+ // Build request: hkdf_salt || client_eph_pub (uncompressed)
+ byte[] requestData = new byte[(int) (HKDF_SALT_SIZE + PUBKEY_SIZE)];
+ System.arraycopy(salt, 0, requestData, 0, HKDF_SALT_SIZE);
+ System.arraycopy(clientEphPub, 0, requestData, HKDF_SALT_SIZE, PUBKEY_SIZE);
+
+ // Send OPEN_SECURE_CHANNEL
+ APDUCommand cmd = new APDUCommand(0x80, INS_OPEN_SECURE_CHANNEL, 0, 0, requestData);
+ APDUResponse resp = apduChannel.send(cmd);
+ resp.checkOK("OPEN SECURE CHANNEL failed");
+
+ processHandshakeResponse(salt, ephKeyPair.getPrivate(), resp.getData());
+ }
+
+ @Override
+ public void autoPair(CardChannel apduChannel, byte pairingMode, byte[] sharedSecret)
+ throws IOException, APDUException {
+ throw new UnsupportedOperationException("Pairing is not supported in Secure Channel V2");
+ }
+
+ @Override
+ public void autoUnpair(CardChannel apduChannel) throws IOException, APDUException {
+ throw new UnsupportedOperationException("Unpairing is not supported in Secure Channel V2");
+ }
+
+ @Override
+ public void unpairOthers(CardChannel apduChannel) throws IOException, APDUException {
+ throw new UnsupportedOperationException("Unpairing is not supported in Secure Channel V2");
+ }
+
+ @Override
+ public APDUResponse openSecureChannel(CardChannel apduChannel, byte index, byte[] data)
+ throws IOException {
+ open = false;
+ APDUCommand cmd = new APDUCommand(0x80, INS_OPEN_SECURE_CHANNEL, 0, 0, data);
+ return apduChannel.send(cmd);
+ }
+
+ @Override
+ public APDUResponse mutuallyAuthenticate(CardChannel apduChannel) throws IOException {
+ throw new UnsupportedOperationException(
+ "Mutual authentication is not a separate step in Secure Channel V2");
+ }
+
+ @Override
+ public APDUResponse mutuallyAuthenticate(CardChannel apduChannel, byte[] data)
+ throws IOException {
+ throw new UnsupportedOperationException(
+ "Mutual authentication is not a separate step in Secure Channel V2");
+ }
+
+ @Override
+ public APDUResponse pair(CardChannel apduChannel, byte p1, byte p2, byte[] data)
+ throws IOException {
+ throw new UnsupportedOperationException("Pairing is not supported in Secure Channel V2");
+ }
+
+ @Override
+ public APDUResponse unpair(CardChannel apduChannel, byte p1) throws IOException {
+ throw new UnsupportedOperationException("Unpairing is not supported in Secure Channel V2");
+ }
+
+ @Override
+ public APDUCommand protectedCommand(int cla, int ins, int p1, int p2, byte[] data) {
+ if (!open) {
+ return new APDUCommand(cla, ins, p1, p2, data);
+ }
+
+ // Build inner APDU: CLA | INS | P1 | P2 | LC | data
+ ByteArrayOutputStream inner = new ByteArrayOutputStream();
+ inner.write(cla & 0xFF);
+ inner.write(ins & 0xFF);
+ inner.write(p1 & 0xFF);
+ inner.write(p2 & 0xFF);
+ inner.write(data.length & 0xFF);
+ inner.write(data, 0, data.length);
+
+ byte[] innerApdu = inner.toByteArray();
+ byte[] ciphertext = encryptCCM(innerApdu);
+
+ return new APDUCommand(0x80, INS_SECURED_APDU, 0, 0, ciphertext);
+ }
+
+ @Override
+ public APDUResponse transmit(CardChannel apduChannel, APDUCommand apdu) throws IOException {
+ APDUResponse resp = apduChannel.send(apdu);
+
+ if (resp.getSw() != 0x9000) {
+ open = false;
+ return resp;
+ }
+
+ if (!open) {
+ return resp;
+ }
+
+ byte[] ciphertext = resp.getData();
+ byte[] plaintext = decryptCCM(ciphertext);
+
+ incrementNonce();
+
+ return new APDUResponse(plaintext);
+ }
+
+ @Override
+ public Pairing getPairing() {
+ return null; // V2 does not use pairing
+ }
+
+ @Override
+ public void setPairing(Pairing pairing) {
+ // No-op: V2 does not use pairing
+ }
+
+ @Override
+ public void reset() {
+ open = false;
+ keyH2C = null;
+ keyC2H = null;
+ Arrays.fill(nonceCounter, (byte) 0);
+ cardIdentPub = null;
+ clientEphPub = null;
+ }
+
+ // ── Handshake processing ────────────────────────────────────────────
+
+ /**
+ * Processes the card's handshake response.
+ *
+ * @param salt the HKDF salt sent by the client
+ * @param clientEphPriv the client's ephemeral private key
+ * @param cardResponse the raw response data (card_eph_pub || DER_signature)
+ */
+ void processHandshakeResponse(byte[] salt, PrivateKey clientEphPriv, byte[] cardResponse) throws APDUException {
+ // Parse card response: card_eph_pub (65B) || sig (DER, variable)
+ if (cardResponse.length < PUBKEY_SIZE + 2) {
+ throw new APDUException("Invalid handshake response: too short");
+ }
+
+ byte[] cardEphPub = Arrays.copyOfRange(cardResponse, 0, (int) PUBKEY_SIZE);
+ byte[] signature = Arrays.copyOfRange(cardResponse, (int) PUBKEY_SIZE, cardResponse.length);
+
+ // ECDH key agreement
+ byte[] sharedSecret = computeECDH(clientEphPriv, cardEphPub);
+
+ // HKDF-SHA256 key derivation
+ byte[] okm = hkdfExpand(salt, sharedSecret, PROTOCOL_LABEL, OKM_SIZE);
+
+ // Set session keys: key_h2c = OKM[0..15], key_c2h = OKM[16..31]
+ keyH2C = new SecretKeySpec(okm, 0, AES_KEY_SIZE, "AES");
+ keyC2H = new SecretKeySpec(okm, AES_KEY_SIZE, AES_KEY_SIZE, "AES");
+
+ initCiphers();
+
+ // Verify card's ECDSA signature over transcript
+ // transcript = hkdf_salt || client_eph_pub || card_eph_pub
+ verifyCardSignature(salt, clientEphPub, cardEphPub, signature);
+
+ // Initialize nonce counter to zero
+ Arrays.fill(nonceCounter, (byte) 0);
+ open = true;
+ }
+
+ private void verifyCardSignature(byte[] salt, byte[] clientPub, byte[] cardPub, byte[] signature) throws APDUException {
+ try {
+ // Hash the transcript
+ MessageDigest md = MessageDigest.getInstance("SHA-256", "BC");
+ md.update(PROTOCOL_LABEL);
+ md.update(salt);
+ md.update(clientPub);
+ md.update(cardPub);
+ byte[] transcriptHash = md.digest();
+
+ if (cardIdentPub == null) {
+ throw new APDUException("Card identity public key not available");
+ }
+
+ // Verify the ECDSA signature using standard JCA API
+ Signature verifier = Signature.getInstance("NONEwithECDSA", "BC");
+ ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp256k1");
+ ECPublicKeySpec keySpec = new ECPublicKeySpec(ecSpec.getCurve().decodePoint(cardIdentPub), ecSpec);
+ ECPublicKey identKey = (ECPublicKey) KeyFactory.getInstance("EC", "BC").generatePublic(keySpec);
+ verifier.initVerify(identKey);
+ verifier.update(transcriptHash);
+
+ if (!verifier.verify(signature)) {
+ throw new APDUException("Card authentication failed: invalid signature");
+ }
+ } catch (APDUException e) {
+ throw e;
+ } catch (Exception e) {
+ throw new APDUException("Card authentication failed: " + e.getMessage());
+ }
+ }
+
+ // ── Certificate handling ────────────────────────────────────────────
+
+ /**
+ * Parses the card's identity certificate from the SELECT response and
+ * validates the CA public key against the known anchor.
+ *
+ * @param certData the 98-byte certificate from the SELECT response
+ * @throws IOException if CA verification fails
+ */
+ public void setCardCertificate(byte[] certData) throws IOException {
+ try {
+ Certificate cert = Certificate.fromTLV(certData);
+ cardIdentPub = cert.getIdentPub();
+
+ // Check if the card's identity public key is whitelisted
+ boolean whitelisted = isCardWhitelisted(cardIdentPub);
+
+ // Check if the CA public key is trusted
+ byte[] caPub = cert.getPublicKey(); // recovered CA public key (compressed)
+ boolean caTrusted = isCaTrusted(caPub);
+
+ if (!caTrusted && !whitelisted) {
+ throw new IOException("Card certificate verification failed: unknown CA public key and card not whitelisted");
+ }
+ } catch (IOException e) {
+ throw e;
+ } catch (Exception e) {
+ throw new IOException("Failed to parse card certificate: " + e.getMessage());
+ }
+ }
+
+ /**
+ * Returns the card's identity public key (set during handshake).
+ *
+ * @return compressed public key, or null if not yet set
+ */
+ public byte[] getCardIdentPub() {
+ return cardIdentPub;
+ }
+
+ /**
+ * Checks if the given card identity public key is in the whitelist.
+ *
+ * @param identPub compressed card identity public key (33 bytes)
+ * @return true if the key is whitelisted
+ */
+ public boolean isCardWhitelisted(byte[] identPub) {
+ for (byte[] key : whitelistedCardPublicKeys) {
+ if (Arrays.equals(key, identPub)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Checks if the given CA public key is trusted.
+ *
+ * @param caPub compressed CA public key (33 bytes)
+ * @return true if the key is trusted
+ */
+ public boolean isCaTrusted(byte[] caPub) {
+ for (byte[] key : caPublicKeys) {
+ if (Arrays.equals(key, caPub)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ // ── Cryptographic helpers ───────────────────────────────────────────
+
+ private KeyPair generateEphemeralKeyPair() {
+ try {
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("ECDSA", "BC");
+ kpg.initialize(new ECGenParameterSpec("secp256k1"), random);
+ return kpg.generateKeyPair();
+ } catch (Exception e) {
+ throw new RuntimeException("Is BouncyCastle in the classpath?", e);
+ }
+ }
+
+ private byte[] getUncompressedPublicKey(PublicKey pubKey) {
+ return ((ECPublicKey) pubKey).getQ().getEncoded(false);
+ }
+
+ private byte[] computeECDH(PrivateKey clientPriv, byte[] cardPubUncompressed) {
+ try {
+ ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp256k1");
+
+ ECPublicKeySpec cardKeySpec = new ECPublicKeySpec(ecSpec.getCurve().decodePoint(cardPubUncompressed), ecSpec);
+ ECPublicKey cardPub = (ECPublicKey) KeyFactory.getInstance("EC", "BC").generatePublic(cardKeySpec);
+
+ KeyAgreement ka = KeyAgreement.getInstance("ECDH", "BC");
+ ka.init(clientPriv);
+ ka.doPhase(cardPub, true);
+ return ka.generateSecret();
+ } catch (Exception e) {
+ throw new RuntimeException("ECDH key agreement failed", e);
+ }
+ }
+
+ /**
+ * HKDF-SHA256 (Extract-then-Expand) as defined in RFC 5869.
+ * Implements the N=1 case used by the protocol.
+ *
+ * @param salt the salt (32 bytes)
+ * @param ikm the input keying material (shared secret)
+ * @param info the context and application specific information
+ * @param length the length of the output keying material
+ * @return the derived key material
+ */
+ private byte[] hkdfExpand(byte[] salt, byte[] ikm, byte[] info, short length) {
+ try {
+ // Extract: PRK = HMAC-SHA256(salt, IKM)
+ javax.crypto.Mac mac = javax.crypto.Mac.getInstance("HmacSHA256");
+ mac.init(new SecretKeySpec(salt, "HmacSHA256"));
+ byte[] prk = mac.doFinal(ikm);
+
+ // Expand: OKM = HKDF-Expand(PRK, info, L)
+ // T(0) = empty string (no input to MAC)
+ // T(1) = HMAC-Hash(PRK, T(0) || info || 0x01)
+ mac = javax.crypto.Mac.getInstance("HmacSHA256");
+ mac.init(new SecretKeySpec(prk, "HmacSHA256"));
+ mac.update(info);
+ mac.update((byte) 0x01);
+ return mac.doFinal();
+ } catch (Exception e) {
+ throw new RuntimeException("HKDF failed", e);
+ }
+ }
+
+ /**
+ * Encrypts plaintext with AES-128-CCM using the client-to-card key.
+ *
+ * @param plaintext the data to encrypt
+ * @return ciphertext with appended 8-byte tag
+ */
+ private byte[] encryptCCM(byte[] plaintext) {
+ try {
+ byte[] nonce = Arrays.copyOf(nonceCounter, CCM_NONCE_SIZE);
+ GCMParameterSpec spec = new GCMParameterSpec(CCM_TAG_SIZE * 8, nonce);
+
+ aesCCM.init(Cipher.ENCRYPT_MODE, keyH2C, spec);
+ byte[] ciphertext = aesCCM.doFinal(plaintext);
+
+ return ciphertext; // CCM appends tag automatically
+ } catch (Exception e) {
+ throw new RuntimeException("AES-CCM encryption failed", e);
+ }
+ }
+
+ /**
+ * Decrypts ciphertext with AES-128-CCM using the card-to-client key.
+ *
+ * @param ciphertext the data to decrypt (includes appended 8-byte tag)
+ * @return the decrypted plaintext
+ */
+ private byte[] decryptCCM(byte[] ciphertext) {
+ try {
+ byte[] nonce = Arrays.copyOf(nonceCounter, CCM_NONCE_SIZE);
+ GCMParameterSpec spec = new GCMParameterSpec(CCM_TAG_SIZE * 8, nonce);
+
+ aesCCM.init(Cipher.DECRYPT_MODE, keyC2H, spec);
+ return aesCCM.doFinal(ciphertext);
+ } catch (Exception e) {
+ open = false;
+ throw new RuntimeException("AES-CCM decryption failed", e);
+ }
+ }
+
+ /**
+ * Increments the 13-byte nonce counter as a big-endian integer.
+ *
+ * @throws RuntimeException on overflow (2^104 would require session reset)
+ */
+ private void incrementNonce() {
+ for (int i = CCM_NONCE_SIZE - 1; i >= 0; i--) {
+ nonceCounter[i]++;
+ if (nonceCounter[i] != 0) {
+ return;
+ }
+ }
+ // Overflow — session must be reset
+ open = false;
+ throw new RuntimeException("Nonce counter overflow — secure channel session expired");
+ }
+}
diff --git a/lib/src/main/java/im/status/keycard/applet/TinyBERTLV.java b/lib/src/main/java/im/status/keycard/applet/TinyBERTLV.java
index 66a480f..84f7d04 100644
--- a/lib/src/main/java/im/status/keycard/applet/TinyBERTLV.java
+++ b/lib/src/main/java/im/status/keycard/applet/TinyBERTLV.java
@@ -147,6 +147,21 @@ public int readTag() {
return (pos < buffer.length) ? buffer[pos++] : END_OF_TLV;
}
+ /**
+ * Checks the next tag. The current implementation only reads tags on one byte. Can be extended if needed.
+ *
+ * @return the tag
+ */
+ public boolean nextTagIs(int expectedTag) {
+ int nextTag = readTag();
+
+ if (nextTag != END_OF_TLV) {
+ unreadLastTag();
+ }
+
+ return nextTag == expectedTag;
+ }
+
/**
* Reads the next tag. The current implementation only reads length on one and two bytes. Can be extended if needed.
*
diff --git a/lib/src/main/java/im/status/keycard/io/LedgerUtil.java b/lib/src/main/java/im/status/keycard/io/LedgerUtil.java
deleted file mode 100644
index 8def964..0000000
--- a/lib/src/main/java/im/status/keycard/io/LedgerUtil.java
+++ /dev/null
@@ -1,153 +0,0 @@
-package im.status.keycard.io;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-
-public class LedgerUtil {
- private static final int LEDGER_DEFAULT_CHANNEL = 1;
- private static final int TAG_APDU = 0x05;
-
- private LedgerUtil() {}
-
- public interface Callback {
- void write(byte[] chunk) throws IOException;
- void read(byte[] chunk) throws IOException;
- }
-
- public static APDUResponse send(APDUCommand cmd, int segmentSize, boolean channelInfo, LedgerUtil.Callback cb) throws IOException {
- int offset = 0;
-
- byte[] command = LedgerUtil.wrapCommandAPDU(cmd.serialize(), segmentSize, channelInfo);
- byte[] chunk = new byte[segmentSize];
-
- while(offset != command.length) {
- System.arraycopy(command, offset, chunk, 0, segmentSize);
- cb.write(chunk);
- offset += segmentSize;
- }
-
- ByteArrayOutputStream response = new ByteArrayOutputStream();
- byte[] responseData = null;
-
- while ((responseData = LedgerUtil.unwrapResponseAPDU(response.toByteArray(), segmentSize, channelInfo)) == null) {
- cb.read(chunk);
- response.write(chunk, 0, segmentSize);
- }
-
- return new APDUResponse(responseData);
- }
-
- private static byte[] unwrapResponseAPDU(byte[] data, int segmentSize, boolean channelInfo) throws IOException {
- if ((data == null) || (data.length < 7 + 5)) {
- return null;
- }
-
- int sequenceIdx = 0;
- int offset = checkResponseHeader(data, 0, sequenceIdx, channelInfo);
-
- int responseLength = ((data[offset++] & 0xff) << 8);
- responseLength |= (data[offset++] & 0xff);
-
- if (data.length < 7 + responseLength) {
- return null;
- }
-
- ByteArrayOutputStream response = new ByteArrayOutputStream();
-
- int headerSize = channelInfo ? 5 : 3;
- int initialHeaderSize = headerSize + 2;
-
- int blockSize = (responseLength > segmentSize - initialHeaderSize ? segmentSize - initialHeaderSize : responseLength);
- response.write(data, offset, blockSize);
- offset += blockSize;
-
- while (response.size() != responseLength) {
- sequenceIdx++;
-
- if (offset == data.length) {
- return null;
- }
-
- offset = checkResponseHeader(data, offset, sequenceIdx, channelInfo);
-
- blockSize = (responseLength - response.size() > segmentSize - headerSize ? segmentSize - headerSize : responseLength - response.size());
- if (blockSize > data.length - offset) {
- return null;
- }
- response.write(data, offset, blockSize);
- offset += blockSize;
- }
-
- return response.toByteArray();
- }
-
- private static int checkResponseHeader(byte[] data, int offset, int sequenceIdx, boolean channelInfo) throws IOException {
- if (channelInfo) {
- if (data[offset++] != (LEDGER_DEFAULT_CHANNEL >> 8)) {
- throw new IOException("Invalid channel");
- }
-
- if (data[offset++] != (LEDGER_DEFAULT_CHANNEL & 0xff)) {
- throw new IOException("Invalid channel");
- }
- }
-
- if (data[offset++] != TAG_APDU) {
- throw new IOException("Invalid tag");
- }
-
- if (data[offset++] != (sequenceIdx >> 8)) {
- throw new IOException("Invalid sequence");
- }
-
- if (data[offset++] != (sequenceIdx & 0xff)) {
- throw new IOException("Invalid sequence");
- }
- return offset;
- }
-
- private static byte[] wrapCommandAPDU(byte[] command, int segmentSize, boolean channelInfo) {
- ByteArrayOutputStream output = new ByteArrayOutputStream();
-
- int headerSize = channelInfo ? 5 : 3;
- int initialHeaderSize = headerSize + 2;
-
- int sequenceIdx = 0;
- int offset = 0;
- writeCommandHeader(output, sequenceIdx, channelInfo);
- sequenceIdx++;
-
- output.write(command.length >> 8);
- output.write(command.length);
- int blockSize = (command.length > (segmentSize - initialHeaderSize) ? (segmentSize - initialHeaderSize) : command.length);
- output.write(command, offset, blockSize);
- offset += blockSize;
-
- while (offset != command.length) {
- writeCommandHeader(output, sequenceIdx, channelInfo);
- sequenceIdx++;
-
- blockSize = ((command.length - offset) > (segmentSize - headerSize) ? (segmentSize - headerSize) : (command.length - offset));
- output.write(command, offset, blockSize);
- offset += blockSize;
- }
-
- if ((output.size() % segmentSize) != 0) {
- byte[] padding = new byte[segmentSize - (output.size() % segmentSize)];
- output.write(padding, 0, padding.length);
- }
-
- return output.toByteArray();
- }
-
- private static void writeCommandHeader(ByteArrayOutputStream output, int sequenceIdx, boolean channelInfo) {
- if (channelInfo) {
- output.write(LEDGER_DEFAULT_CHANNEL >> 8);
- output.write(LEDGER_DEFAULT_CHANNEL);
- }
-
- output.write(TAG_APDU);
- output.write(sequenceIdx >> 8);
- output.write(sequenceIdx);
- }
-}
diff --git a/settings.gradle b/settings.gradle
index bf5b867..0d6f95f 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -1,4 +1,3 @@
include 'lib'
-include 'android'
-include 'desktop'
-include 'demo-android'
+//include 'android'
+include 'desktop'
\ No newline at end of file