pwn 0.5.784 → 0.5.787

data/spec/lib/pwn/plugins/yubikey/protocol_spec.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Native YubiKey protocol framing' do
+  let(:protocol) { PWN::Plugins::YubiKey::Protocol }
+
+  it 'encodes and decodes ordered BER-TLV without losing duplicate tags or binary bytes' do
+    first = [0x71, 3, 0, 255, 1].pack('C*')
+    second = [0x7f, 0x49, 0x81, 128].pack('C*') + ('x'.b * 128)
+    expect(protocol.tlv(tag: 0x71, value: "\x00\xff\x01".b)).to eq(first)
+    expect(protocol.tlv(tag: 0x7f49, value: 'x'.b * 128)).to eq(second)
+    expected = [{ tag: 0x71, value: "\x00\xff\x01".b }, { tag: 0x7f49, value: 'x'.b * 128 }, { tag: 0x71, value: "\x00\xff\x01".b }]
+    expect(protocol.untlv(data: first + second + first)).to eq(expected)
+  end
+
+  it 'selects an application and assembles a bounded GET RESPONSE exchange' do
+    frames = []
+    replies = ["first\x61\x03".b, "end\x90\x00".b]
+    connection = double('offline smartcard')
+    allow(connection).to receive(:exchange) do |opts|
+      frames << opts
+      replies.shift
+    end
+    expect(protocol.select(connection: connection, aid: "\xa0\x00\x01".b, timeout: 2)).to eq('firstend'.b)
+    expect(frames.map { |frame| frame[:data].unpack1('H*') }).to eq(%w[00a4040003a00001 00c0000003])
+    expect(frames).to all(include(protocol: :apdu, timeout: be_between(0, 2)))
+  end
+
+  it 'chains short commands and supports explicit extended-length APDUs' do
+    frames = []
+    connection = double('offline smartcard')
+    allow(connection).to receive(:exchange) do |opts|
+      frames << opts[:data]
+      "\x90\x00".b
+    end
+    data = 'x'.b * 256
+    expect(protocol.apdu(connection: connection, ins: 0xda, data: data)).to eq(''.b)
+    expect(frames).to eq([[0x10, 0xda, 0, 0, 255].pack('C*') + ('x' * 255), [0, 0xda, 0, 0, 1].pack('C*') << 'x'])
+    frames.clear
+    protocol.apdu(connection: connection, ins: 0xda, data: data, extended: true, le: 65_536)
+    expect(frames).to eq([[0, 0xda, 0, 0, 0, 1, 0].pack('C*') + data + "\x00\x00".b])
+    frames.clear
+    protocol.apdu(connection: connection, ins: 0xf8)
+    expect(frames).to eq([[0, 0xf8, 0, 0, 0].pack('C*')])
+  end
+
+  it 'corrects one wrong Le and uses an application-specific continuation instruction' do
+    frames = []
+    replies = ["\x6c\x03".b, "a\x61\x00".b, "bc\x90\x00".b]
+    connection = double('offline smartcard')
+    allow(connection).to receive(:exchange) do |opts|
+      frames << opts[:data].unpack1('H*')
+      replies.shift
+    end
+    expect(protocol.apdu(connection: connection, ins: 0xca, le: 1, get_response_ins: 0xa5, get_response_le: 0)).to eq('abc'.b)
+    expect(frames).to eq(%w[00ca000001 00ca000003 00a5000000])
+  end
+
+  it 'interprets wrong-Le zero as 256 bytes even for an extended command' do
+    frames = []
+    replies = ["\x6c\x00".b, "\x90\x00".b]
+    connection = double('offline smartcard')
+    allow(connection).to receive(:exchange) do |opts|
+      frames << opts[:data].unpack1('H*')
+      replies.shift
+    end
+    protocol.apdu(connection: connection, ins: 0xca, le: 512, extended: true)
+    expect(frames).to eq(%w[00ca0000000200 00ca0000000100])
+  end
+
+  it 'parses only declared native options and preserves identifiers and repeated values' do
+    args = ['--rp-id', 'first.example', '--rp-id', 'second.example', '--no-enter', '--', '-例:account  ']
+    expect(protocol.parse_args(args: args, flags: ['--no-enter'], values: ['--rp-id'])).to eq(
+      positionals: ['-例:account  '], options: { rp_id: %w[first.example second.example], no_enter: true }
+    )
+    expect { protocol.parse_args(args: ['--pin', 'fixture'], flags: [], values: []) }.to raise_error(ArgumentError, /option/)
+    expect { protocol.parse_args(args: ['--rp-id'], values: ['--rp-id']) }.to raise_error(ArgumentError, /value/)
+  end
+
+  it 'provides a unique-tag mapping while rejecting truncated and duplicate fields' do
+    expect(protocol.tlv_map(data: "\x71\x01a\x72\x01b".b)).to eq(0x71 => 'a'.b, 0x72 => 'b'.b)
+    expect { protocol.tlv_map(data: "\x71\x01a\x71\x01b".b) }.to raise_error(PWN::Plugins::YubiKey::ResponseError, /Duplicate/)
+    ["\x71", "\x71\x80", "\x71\x82\x00", "\x71\x02a", "\x7f\x81"].each do |truncated|
+      expect { protocol.untlv(data: truncated.b) }.to raise_error(PWN::Plugins::YubiKey::ResponseError)
+    end
+  end
+
+  it 'applies the same complete-frame bound to TLV encoding and decoding' do
+    expect { protocol.tlv(tag: 0x71, value: 'x' * protocol::MAX_BYTES) }.to raise_error(ArgumentError, /frame/)
+  end
+
+  it 'requires literal caller consent instead of truthy substitutes' do
+    expect(protocol.require_confirm(confirm: true)).to eq(:confirmed)
+    [nil, false, 'true', 1].each do |value|
+      expect { protocol.require_confirm(confirm: value) }.to raise_error(PWN::Plugins::YubiKey::ConfirmationRequired)
+    end
+  end
+
+  it 'obtains secrets only from explicit memory values or a supplied callback' do
+    provider = double('private caller input')
+    expect(provider).to receive(:call).with(:pin).once.and_return('000123')
+    expect(protocol.secret(name: :pin, secret_provider: provider)).to eq('000123')
+    expect(protocol.secret(name: :key, value: "\x00\xff".b, secret_provider: provider)).to eq("\x00\xff".b)
+    expect { protocol.secret(name: :pin, value: false, secret_provider: provider) }.to raise_error(ArgumentError, /pin/)
+    expect { protocol.secret(name: :pin) }.to raise_error(ArgumentError, /pin/)
+  end
+
+  it 'compares explicit firmware tuples without normalizing malformed versions' do
+    expect(protocol.version_at_least?(version: [5, 7, 0], minimum: [5, 6, 9])).to be(true)
+    expect(protocol.version_at_least?(version: [5, 7, 0], minimum: [5, 7, 1])).to be(false)
+    expect { protocol.version_at_least?(version: ['5', 7, 0], minimum: [5, 7, 0]) }.to raise_error(ArgumentError)
+  end
+
+  it 'rejects invalid request bounds before sending any command' do
+    connection = double('offline smartcard', exchange: nil)
+    expect(connection).not_to receive(:exchange)
+    [{ timeout: false }, { timeout: 0 }, { timeout: Float::INFINITY }, { ins: 256 }, { cla: 1.0 },
+     { extended: 'true' }, { le: 257 }, { data: 'x' * 65_536 }, { get_response_ins: -1 }, { max_response: 0 }].each do |invalid|
+      expect { protocol.apdu({ connection: connection, ins: 1 }.merge(invalid)) }.to raise_error(ArgumentError)
+    end
+  end
+
+  it 'keeps authentication errors secret-free and never replays them' do
+    connection = double('offline smartcard')
+    expect(connection).to receive(:exchange).once.and_return("\x63\xc2".b)
+    expect { protocol.apdu(connection: connection, ins: 0x20, data: 'fixture-private-pin') }.to raise_error(PWN::Plugins::YubiKey::Protocol::APDUError) do |error|
+      expect(error.status).to eq(0x63c2)
+      expect(error.message).not_to include('fixture-private-pin')
+    end
+  end
+
+  it 'bounds truncated, oversized and endless continuation responses' do
+    connection = double('offline smartcard')
+    ['', "\x90", "long\x90\x00"].each do |response|
+      allow(connection).to receive(:exchange).and_return(response.b)
+      expect { protocol.apdu(connection: connection, ins: 1, max_response: 2) }.to raise_error(PWN::Plugins::YubiKey::ResponseError)
+    end
+    allow(connection).to receive(:exchange).and_return("\x61\x00".b)
+    expect { protocol.apdu(connection: connection, ins: 1) }.to raise_error(PWN::Plugins::YubiKey::ResponseError, /fragments/)
+  end
+
+  it 'uses one total deadline across response fragments' do
+    connection = double('offline smartcard')
+    expect(connection).to receive(:exchange).once.and_return("\x61\x00".b)
+    allow(Process).to receive(:clock_gettime).with(Process::CLOCK_MONOTONIC).and_return(1, 1, 2)
+    expect { protocol.apdu(connection: connection, ins: 1, timeout: 1) }.to raise_error(PWN::Plugins::YubiKey::TimeoutError)
+  end
+end

data/spec/lib/pwn/plugins/yubikey/protocol_vectors_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+
+RSpec.describe PWN::Plugins::YubiKey::Protocol, 'independent APDU frame vectors' do
+  vectors = JSON.parse(File.read(File.expand_path('../../../../fixtures/yubikey/apdu_frames.json', __dir__))).fetch('vectors')
+
+  vectors.each do |vector|
+    it "matches the reference formatter for #{vector.fetch('name')}" do
+      options = vector.fetch('options').transform_keys(&:to_sym)
+      options[:data] = [options.delete(:data_hex)].pack('H*')
+      connection = double('offline smartcard')
+      expect(connection).to receive(:exchange).with(hash_including(protocol: :apdu, data: [vector.fetch('expected_hex')].pack('H*'))).once.and_return("\x90\x00".b)
+      expect(described_class.apdu(options.merge(connection: connection))).to eq(''.b)
+    end
+  end
+end

data/spec/lib/pwn/plugins/yubikey/security_domain/scp_spec.rb

@@ -0,0 +1,256 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pwn/plugins/yubikey/security_domain/scp'
+
+RSpec.describe PWN::Plugins::YubiKey::SecurityDomain::SCP do
+  # NIST SP 800-38B / RFC 4493 examples. Public synthetic test material only.
+  def hex(value)
+    [value].pack('H*')
+  end
+
+  require_relative 'support'
+
+  def scp03(card, **options)
+    key = (0...16).to_a.pack('C*')
+    described_class.open({ connection: card, scp: :scp03, kvn: 1, key_enc: key, key_mac: key, key_dek: key, confirm: true }.merge(options))
+  end
+
+  it 'verifies both SCP03 cryptograms and encrypted APDUs while retaining the authenticated status' do
+    card = Scp03Card.new
+    channel = scp03(card)
+    expect(channel.exchange(protocol: :apdu, data: hex('00ca000003616263'), timeout: 1)).to eq("reply\x62\x82".b)
+    expect(card.received).to eq('abc')
+    expect(channel.descriptor).to include(secure_channel: :scp03, extended_apdu: true, authenticated: true)
+    expect(channel.inspect).not_to include('key_', '@enc', '@chain')
+    channel.close
+    expect(card.closed).to be(true)
+  end
+
+  %i[mac status missing_mac truncated_ciphertext padding padding_long counter replay].each do |fault|
+    it "fails closed and never passes data after #{fault}" do
+      allow(SecureRandom).to receive(:random_bytes).with(8).and_return('HOSTRAND'.b)
+      card = Scp03Card.new
+      channel = scp03(card)
+      channel.exchange(protocol: :apdu, data: hex('00ca0000')) if fault == :replay
+      card.fault = fault
+      expect { channel.exchange(protocol: :apdu, data: hex('00ca0000')) }.to raise_error(described_class::ChannelError)
+      expect(card.closed).to be(true)
+      count = card.commands.length
+      expect { channel.exchange(protocol: :apdu, data: hex('00ca0000')) }.to raise_error(described_class::ChannelError, /closed/)
+      expect(card.commands.length).to eq(count)
+    end
+  end
+
+  it 'never sends host authentication after a wrong card cryptogram' do
+    card = Scp03Card.new
+    card.fault = :card_cryptogram
+    expect { scp03(card) }.to raise_error(described_class::ChannelError, /cryptogram/)
+    expect(card.commands.map { |data| data.getbyte(1) }).to eq([0xa4, 0x50])
+    expect(card.closed).to be(true)
+  end
+
+  it 'validates consent, key lengths, protocol, key version and timeout before I/O' do
+    [{ confirm: 'true' }, { key_enc: nil }, { key_mac: 'short' }, { kvn: 256 }, { kvn: -1 }, { timeout: Float::INFINITY }, { scp: :unknown }].each do |options|
+      card = Scp03Card.new
+      expect { scp03(card, **options) }.to raise_error(StandardError)
+      expect(card.commands).to be_empty
+    end
+  end
+
+  it 'supports extended command data and rejects malformed, wrapped and oversized APDUs' do
+    card = Scp03Card.new
+    channel = scp03(card)
+    data = 'x'.b * 300
+    command = hex('00da000000') + [data.bytesize].pack('n') + data + hex('0100')
+    expect(channel.exchange(protocol: :apdu, data: command)).to eq("reply\x62\x82".b)
+    expect(card.received).to eq(data)
+    %w[00 00da00000001 00da00000200 04da0000].each do |malformed|
+      expect { channel.exchange(protocol: :apdu, data: hex(malformed)) }.to raise_error(ArgumentError)
+    end
+    channel.instance_variable_set(:@enc_counter, 0x100000000)
+    count = card.commands.length
+    expect { channel.exchange(protocol: :apdu, data: hex('00ca0000')) }.to raise_error(described_class::ChannelError, /counter/)
+    expect(card.commands.length).to eq(count)
+  end
+
+  it 'closes on uncertain transport failure and cancellation without retrying' do
+    [IOError.new('synthetic'), Interrupt.new].each do |error|
+      card = Scp03Card.new
+      channel = scp03(card)
+      allow(card).to receive(:exchange).and_raise(error)
+      expect { channel.exchange(protocol: :apdu, data: hex('00ca0000')) }.to raise_error(error.class)
+      expect(card.closed).to be(true)
+    end
+  end
+
+  def certificate(key, issuer_key: key, issuer: nil, is_ca: false)
+    cert = OpenSSL::X509::Certificate.new
+    cert.version = 2
+    cert.serial = 7
+    cert.subject = OpenSSL::X509::Name.parse(is_ca ? '/CN=Synthetic CA' : '/CN=Synthetic leaf')
+    cert.issuer = issuer ? issuer.subject : cert.subject
+    cert.public_key = key
+    cert.not_before = Time.utc(2020)
+    cert.not_after = Time.utc(2090)
+    factory = OpenSSL::X509::ExtensionFactory.new
+    factory.subject_certificate = cert
+    factory.issuer_certificate = issuer || cert
+    cert.extensions = [factory.create_extension('basicConstraints', is_ca ? 'CA:TRUE' : 'CA:FALSE', true), factory.create_extension('keyUsage', is_ca ? 'keyCertSign,cRLSign' : 'keyAgreement', true)]
+    cert.sign(issuer_key, OpenSSL::Digest.new('SHA256'))
+    cert
+  end
+
+  %i[scp11a scp11b scp11c].each do |variant|
+    it "performs #{variant} receipt verification and encrypted exchange with an independent ECDH peer" do
+      card = Scp11Card.new
+      options = { connection: card, scp: variant, kvn: 1, card_public_key: card.public_key, confirm: true }
+      unless variant == :scp11b
+        ca_key = OpenSSL::PKey::EC.generate('prime256v1')
+        ca = certificate(ca_key, is_ca: true)
+        host_key = OpenSSL::PKey::EC.generate('prime256v1')
+        leaf = certificate(host_key, issuer_key: ca_key, issuer: ca)
+        options.merge!(oce_private_key: host_key, oce_certificates: [ca, leaf], oce_kid: 0x10, oce_kvn: 2)
+      end
+      channel = described_class.open(options)
+      expect(channel.exchange(protocol: :apdu, data: hex('00ca0000'))).to eq("reply\x62\x82".b)
+      expect(channel.authenticated?).to eq(variant == :scp11a)
+      expect(card.commands.select { |c| c.getbyte(1) == 0x2a }.map { |c| c.byteslice(2, 2) }).to eq(["\x02\x90".b, "\x02\x10".b]) unless variant == :scp11b
+    end
+  end
+
+  it 'authenticates a fetched leaf-last SCP11 bundle against explicit CA anchors' do
+    card = Scp11Card.new
+    ca_key = OpenSSL::PKey::EC.generate('prime256v1')
+    ca = certificate(ca_key, is_ca: true)
+    leaf = certificate(card.public_key, issuer_key: ca_key, issuer: ca)
+    card.card_bundle = leaf.to_der
+    channel = described_class.open(connection: card, scp: :scp11b, kvn: 1, ca_certificates: [ca], confirm: true)
+    expect(channel.exchange(protocol: :apdu, data: hex('00ca0000'))).to eq("reply\x62\x82".b)
+    expect(card.commands[1].unpack1('H*')).to eq('00cabf2106a60483021301')
+  end
+
+  it 'rejects untrusted, expired and pinned-mismatched card certificates before authentication' do
+    card = Scp11Card.new
+    ca_key = OpenSSL::PKey::EC.generate('prime256v1')
+    ca = certificate(ca_key, is_ca: true)
+    alien = certificate(OpenSSL::PKey::EC.generate('prime256v1'), is_ca: true)
+    leaf = certificate(card.public_key, issuer_key: ca_key, issuer: ca)
+    base = { connection: card, scp: :scp11b, kvn: 1, card_certificates: [leaf], confirm: true }
+    expect { described_class.open(base.merge(ca_certificates: [alien])) }.to raise_error(described_class::ChannelError, /Untrusted/)
+    expect { described_class.open(base.merge(card_public_key: alien.public_key)) }.to raise_error(described_class::ChannelError, /pin/)
+    leaf.not_after = Time.utc(2021)
+    leaf.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+    expect { described_class.open(base.merge(ca_certificates: [ca])) }.to raise_error(described_class::ChannelError, /validity/)
+    expect(card.commands).to be_empty
+  end
+
+  it 'rejects a wrong SCP11 receipt and wrong card key without plaintext fallback' do
+    %i[receipt pin].each do |fault|
+      card = Scp11Card.new
+      card.fault = fault
+      key = fault == :pin ? OpenSSL::PKey::EC.generate('prime256v1') : card.public_key
+      expect { described_class.open(connection: card, scp: :scp11b, kvn: 1, card_public_key: key, confirm: true) }.to raise_error(described_class::ChannelError, /receipt/)
+      expect(card.closed).to be(true)
+      expect(card.commands.map { |data| data.getbyte(1) }).to eq([0xa4, 0x88])
+    end
+  end
+
+  it 'requires explicit card trust and valid OCE credentials before any authentication attempt' do
+    card = Scp11Card.new
+    expect { described_class.open(connection: card, scp: :scp11b, kvn: 1, confirm: true) }.to raise_error(ArgumentError, /pinned/)
+    options = { connection: card, scp: :scp11a, kvn: 1, card_public_key: card.public_key, confirm: true }
+    expect { described_class.open(options) }.to raise_error(KeyError)
+    key = OpenSSL::PKey::EC.generate('prime256v1')
+    cert = certificate(OpenSSL::PKey::EC.generate('prime256v1'))
+    expect { described_class.open(options.merge(oce_private_key: key, oce_certificates: [cert])) }.to raise_error(ArgumentError, /match/)
+    expect(card.commands).to be_empty
+  end
+
+  it 'reassembles transport response fragments before one R-MAC verification without consuming another counter' do
+    card = Scp03Card.new
+    channel = scp03(card)
+    calls = 0
+    remainder = nil
+    allow(card).to receive(:exchange).and_wrap_original do |original, opts|
+      calls += 1
+      if opts[:data] == hex('00c00000')
+        remainder
+      else
+        reply = original.call(opts)
+        remainder = reply.byteslice(7..)
+        reply.byteslice(0, 7) + hex('6100')
+      end
+    end
+    expect(channel.exchange(protocol: :apdu, data: hex('00ca0000'))).to eq("reply\x62\x82".b)
+    expect(calls).to eq(2)
+    expect(channel.instance_variable_get(:@enc_counter)).to eq(2)
+  end
+
+  it 'rejects conflicting KIDs, unsupported protocol metadata and truncated card cryptograms' do
+    card = Scp03Card.new
+    expect { scp03(card, kid: 0x13) }.to raise_error(ArgumentError, /KID/)
+    expect(card.commands).to be_empty
+    [->(reply) { reply.byteslice(0, 20) + hex('9000') }, lambda { |reply|
+      reply.setbyte(11, 2)
+      reply
+    }, lambda { |reply|
+         reply.setbyte(10, 7)
+         reply
+       }].each do |mutate|
+      peer = Scp03Card.new
+      allow(peer).to receive(:exchange).and_wrap_original do |original, options|
+        reply = original.call(options)
+        options[:data].getbyte(1) == 0x50 ? mutate.call(reply) : reply
+      end
+      expect { scp03(peer) }.to raise_error(described_class::ChannelError)
+      expect(peer.commands.map { |data| data.getbyte(1) }).to eq([0xa4, 0x50])
+    end
+  end
+
+  it 'rejects malformed peer EC points and repeated or truncated SCP11 receipt TLVs' do
+    [->(response) { response.byteslice(0...-3) + hex('9000') }, lambda { |response|
+      response.setbyte(3, 0)
+      response
+    }, ->(response) { response.byteslice(0...-2) + hex('8600') + hex('9000') }, ->(response) { response.byteslice(0, 2) + hex('8141') + response.byteslice(3..) }].each do |mutate|
+      card = Scp11Card.new
+      allow(card).to receive(:exchange).and_wrap_original do |original, options|
+        response = original.call(options)
+        options[:data].getbyte(1) == 0x88 ? mutate.call(response) : response
+      end
+      expect { described_class.open(connection: card, scp: :scp11b, kvn: 1, card_public_key: card.public_key, confirm: true) }.to raise_error(PWN::Plugins::YubiKey::ResponseError)
+      expect(card.closed).to be(true)
+    end
+  end
+
+  it 'carries Protocol SELECT and extended application APDUs through the real secure wrapper' do
+    card = Scp03Card.new
+    channel = scp03(card)
+    card.handler = ->(_header, plaintext) { [plaintext, hex('9000')] }
+    protocol = PWN::Plugins::YubiKey::Protocol
+    aid = hex('a000000308')
+    expect(protocol.select(connection: channel, aid: aid)).to eq(aid)
+    payload = 'x'.b * 300
+    expect(protocol.apdu(connection: channel, ins: 0xda, data: payload, extended: true)).to eq(payload)
+    expect(card.commands.last.getbyte(4)).to eq(0)
+    expect(card.commands.count { |command| command.getbyte(1) == 0xda }).to eq(1)
+  end
+
+  it 'bounds fragmented replies and closes without exposing an unauthenticated prefix' do
+    card = Scp03Card.new
+    channel = scp03(card)
+    allow(card).to receive(:exchange).and_return(hex('006100'))
+    expect { channel.exchange(protocol: :apdu, data: hex('00ca0000')) }.to raise_error(described_class::ChannelError, /fragmentation/)
+    expect(card).to have_received(:exchange).exactly(64).times
+    expect(card.closed).to be(true)
+  end
+
+  it 'implements all RFC 4493 AES-CMAC vectors, including empty and partial blocks' do
+    crypto = described_class::Crypto.new
+    key = hex('2b7e151628aed2a6abf7158809cf4f3c')
+    message = hex('6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710')
+    { 0 => 'bb1d6929e95937287fa37d129b756746', 16 => '070a16b46b4d4144f79bdd9dd04a287c', 40 => 'dfa66747de9ae63030ca32611497c827', 64 => '51f0bebf7e3b9d92fc49741779363cfe' }.each do |length, expected|
+      expect(crypto.cmac(key, message.byteslice(0, length))).to eq(hex(expected))
+    end
+  end
+end

data/spec/lib/pwn/plugins/yubikey/security_domain/support.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+# Independent reference uses CBC reduction, rather than the implementation's
+# block-by-block ECB chain. Never uses implementation helpers or actual devices.
+class ReferenceCrypto
+  def aes(key, input, vector = nil, decrypt: false)
+    cipher = OpenSSL::Cipher.new(vector ? 'aes-128-cbc' : 'aes-128-ecb')
+    decrypt ? cipher.decrypt : cipher.encrypt
+    cipher.padding = 0
+    cipher.key = key
+    cipher.iv = vector if vector
+    cipher.update(input) + cipher.final
+  end
+
+  def cmac(key, message)
+    n = aes(key, "\0".b * 16).unpack1('H*').to_i(16)
+    subkeys = 2.times.map do
+      n = ((n << 1) ^ (n >= (1 << 127) ? 0x87 : 0)) & ((1 << 128) - 1)
+      n
+    end
+    complete = !message.empty? && message.bytesize.modulo(16).zero?
+    padded = complete ? message.dup : (message + "\x80".b).ljust(((message.bytesize / 16) + 1) * 16, "\0".b)
+    last = padded.byteslice(-16, 16).unpack1('H*').to_i(16) ^ subkeys[complete ? 0 : 1]
+    padded[-16, 16] = [last.to_s(16).rjust(32, '0')].pack('H*')
+    aes(key, padded, "\0".b * 16).byteslice(-16, 16)
+  end
+
+  def derive(key, type, context, bits = 128)
+    cmac(key, [0, 0, 0, 0, type, 0, bits, 1].pack('NNnCCCnC') + context).byteslice(0, bits / 8)
+  end
+
+  def crypt(key, counter, message, response: false, decrypt: false)
+    iv = aes(key, [(response ? 128 : 0)].pack('C') + [counter.to_s(16).rjust(30, '0')].pack('H*'))
+    aes(key, message, iv, decrypt: decrypt)
+  end
+end
+
+class Scp03Card
+  attr_reader :commands, :closed, :received
+  attr_accessor :fault, :handler
+
+  def initialize
+    @crypto = ReferenceCrypto.new
+    @commands = []
+    @static = (0...16).to_a.pack('C*')
+    @card = 'CARDRAND'.b
+    @counter = 0
+  end
+
+  def descriptor
+    { protocol: :apdu, reader: 'synthetic' }
+  end
+
+  def close
+    @closed = true
+  end
+
+  def exchange(opts)
+    command = opts.fetch(:data)
+    @commands << command
+    ins = command.getbyte(1)
+    return "\x90\0".b if ins == 0xa4 && command.getbyte(0).zero?
+
+    if ins == 0x50
+      context = command.byteslice(5, 8) + @card
+      @enc = @crypto.derive(@static, 4, context)
+      @mac = @crypto.derive(@static, 6, context)
+      @rmac = @crypto.derive(@static, 7, context)
+      @host = @crypto.derive(@mac, 1, context, 64)
+      @chain = "\0".b * 16
+      cryptogram = @crypto.derive(@mac, 0, context, 64)
+      cryptogram.setbyte(0, cryptogram.getbyte(0) ^ 1) if fault == :card_cryptogram
+      return ("\0".b * 10) + "\x01\x03\x70".b + @card + cryptogram + "\x90\0".b
+    end
+    start = command.getbyte(4).zero? ? 7 : 5
+    length = start == 7 ? command.byteslice(5, 2).unpack1('n') : command.getbyte(4)
+    ciphertext = command.byteslice(start, length - 8)
+    full_mac = @crypto.cmac(@mac, @chain + command.byteslice(0, start) + ciphertext)
+    raise 'synthetic card rejected command MAC' unless full_mac.byteslice(0, 8) == command.byteslice(start + length - 8, 8)
+
+    @chain = full_mac
+    if ins == 0x82
+      raise 'synthetic card rejected host cryptogram' unless ciphertext == @host && command.byteslice(0, 4) == "\x84\x82\x33\0".b
+
+      return "\x90\0".b
+    end
+    @counter += 1
+    @received = @crypto.crypt(@enc, @counter, ciphertext, decrypt: true).sub(/\x80\x00*\z/n, ''.b)
+    return @last_reply if fault == :replay
+    return "\x90\0".b if fault == :missing_mac
+
+    payload, sw = handler ? handler.call(command.byteslice(0, 4), @received) : ['reply'.b, "\x62\x82".b]
+    padding = fault == :padding ? 'x' * 16 : (payload + "\x80".b).ljust(((payload.bytesize / 16) + 1) * 16, "\0".b)
+    padding = "data\x80".b.ljust(32, "\0".b) if fault == :padding_long
+    encrypted = @crypto.crypt(@enc, fault == :counter ? @counter + 1 : @counter, padding, response: true)
+    encrypted = encrypted.byteslice(0, 15) if fault == :truncated_ciphertext
+    mac = @crypto.cmac(@rmac, @chain + encrypted + sw).byteslice(0, 8)
+    mac.setbyte(0, mac.getbyte(0) ^ 1) if fault == :mac
+    sw = "\x90\0".b if fault == :status
+    @last_reply = encrypted + mac + sw
+  end
+end
+
+class Scp11Card < Scp03Card
+  attr_reader :public_key, :certificates
+  attr_accessor :card_bundle
+
+  def initialize
+    super
+    @private_key = OpenSSL::PKey::EC.generate('prime256v1')
+    @public_key = OpenSSL::PKey.read(@private_key.public_to_der)
+    @certificates = []
+  end
+
+  def exchange(opts)
+    command = opts.fetch(:data)
+    ins = command.getbyte(1)
+    if ins == 0xca && command.getbyte(0) == 0 && card_bundle
+      @commands << command
+      return card_bundle + "\x90\0".b
+    end
+    return super unless [0x2a, 0x88, 0x82].include?(ins)
+
+    @commands << command
+    start = command.getbyte(4).zero? ? 7 : 5
+    length = start == 7 ? command.byteslice(5, 2).unpack1('n') : command.getbyte(4)
+    data = command.byteslice(start, length)
+    if ins == 0x2a
+      cert = OpenSSL::X509::Certificate.new(data)
+      raise 'synthetic OCE signature rejected' if !@certificates.empty? && !cert.verify(@certificates.last.public_key)
+
+      @certificates << cert
+      return "\x90\0".b
+    end
+    variant = { 0x11 => 1, 0x13 => 0, 0x15 => 3 }.fetch(command.getbyte(3))
+    raise 'invalid SCP11 control template' unless data.byteslice(0, 15) == ["a60d900211#{variant.to_s(16).rjust(2, '0')}95013c800188810110"].pack('H*')
+    raise 'invalid SCP11 point tag' unless data.byteslice(15, 3) == "\x5f\x49\x41".b
+
+    point = OpenSSL::PKey::EC::Point.new(@private_key.group, OpenSSL::BN.new(data.byteslice(18, 65), 2))
+    host_point = variant.zero? ? point : @certificates.last.public_key.public_key
+    ephemeral = OpenSSL::PKey::EC.generate('prime256v1')
+    z = ephemeral.dh_compute_key(point) + @private_key.dh_compute_key(host_point)
+    key_bytes = (1..3).map { |counter| OpenSSL::Digest::SHA256.digest(z + [counter].pack('N') + "\x3c\x88\x10".b) }.join.byteslice(0, 80)
+    receipt_key, @enc, @mac, @rmac, @dek = key_bytes.scan(/.{16}/mn)
+    peer = "\x5f\x49\x41".b + ephemeral.public_key.to_octet_string(:uncompressed)
+    @chain = @crypto.cmac(receipt_key, data + peer)
+    receipt = @chain.dup
+    receipt.setbyte(0, receipt.getbyte(0) ^ 1) if fault == :receipt
+    peer + "\x86\x10".b + receipt + "\x90\0".b
+  end
+end