@trustchex/react-native-sdk 1.161.0

package/src/Shared/EIDReader/lds/iso19794/faceInfo.ts

@@ -0,0 +1,198 @@
+import type { BiometricDataBlock } from '../../cbeff/biometricDataBlock';
+import { CBEFFInfo } from '../../cbeff/cbeffInfo';
+import { ISO781611 } from '../../cbeff/iso781611';
+import { StandardBiometricHeader } from '../../cbeff/standardBiometricHeader';
+import { Gender } from '../../data/gender';
+import { ByteArrayInputStream } from '../../java/byteArrayInputStream';
+import { ByteArrayOutputStream } from '../../java/byteArrayOutputStream';
+import { DataInputStream } from '../../java/dataInputStream';
+import { DataOutputStream } from '../../java/dataOutputStream';
+import { InputStream } from '../../java/inputStream';
+import { OutputStream } from '../../java/outputStream';
+import { AbstractListInfo } from '../abstractListInfo';
+import {
+  Expression,
+  EyeColor,
+  FaceImageInfo,
+  HairColor,
+  ImageColorSpace,
+  ImageDataType,
+  SourceType,
+} from './faceImageInfo';
+import { Buffer } from 'buffer';
+
+export class FaceInfo
+  extends AbstractListInfo<FaceImageInfo>
+  implements BiometricDataBlock
+{
+  private static readonly FORMAT_IDENTIFIER = 0x46414300;
+  private static readonly VERSION_NUMBER = 0x30313000;
+  private static readonly FORMAT_OWNER_VALUE = 0x0101;
+  private static readonly FORMAT_TYPE_VALUE = 0x0008;
+
+  private sbh: StandardBiometricHeader | null;
+
+  constructor() {
+    super();
+    this.sbh = null;
+  }
+
+  public async readObject(inputStream: InputStream): Promise<void> {
+    const dataInputStream =
+      inputStream instanceof DataInputStream
+        ? inputStream
+        : new DataInputStream(inputStream);
+
+    const fac0 = await dataInputStream.readInt();
+    if (fac0 !== FaceInfo.FORMAT_IDENTIFIER) {
+      console.debug(`'FAC' marker expected! Found ${fac0.toString(16)}`);
+
+      if (fac0 === 0x0000000c) {
+        const bOut = new ByteArrayOutputStream();
+        const dataOutputStream = new DataOutputStream(bOut);
+        dataOutputStream.write(fac0);
+
+        const imageLength = await dataInputStream.readShort();
+        dataOutputStream.write(imageLength);
+
+        let totalBytesRead = 0;
+        while (totalBytesRead < imageLength) {
+          const buffer = new Uint8Array(2048);
+          const chunkSize = await dataInputStream.readBytes(buffer);
+          if (chunkSize < 0) {
+            break;
+          }
+          bOut.writeBytes(buffer);
+          totalBytesRead += chunkSize;
+        }
+
+        const imageInfo = new FaceImageInfo(
+          Gender.UNKNOWN,
+          EyeColor.UNSPECIFIED,
+          0x00,
+          HairColor.UNSPECIFIED.toInt(),
+          Expression.EXPRESSION_UNSPECIFIED,
+          [0, 0, 0],
+          [0, 0, 0],
+          ImageDataType.IMAGE_DATA_TYPE_JPEG2000,
+          ImageColorSpace.IMAGE_COLOR_SPACE_UNSPECIFIED,
+          SourceType.SOURCE_TYPE_UNSPECIFIED,
+          0x00,
+          0,
+          [],
+          0,
+          0,
+          new ByteArrayInputStream(Buffer.from(bOut.toByteArray())),
+          imageLength,
+          ImageDataType.IMAGE_DATA_TYPE_JPEG2000
+        );
+        this.add(imageInfo);
+        return;
+      }
+    }
+
+    const version = await dataInputStream.readInt();
+    if (version !== FaceInfo.VERSION_NUMBER) {
+      throw new Error(
+        `'010' version number expected! Found ${version.toString(16)}`
+      );
+    }
+
+    const recordLength = (await dataInputStream.readInt()) & 0xffffffff;
+    const headerLength = 14;
+    const dataLength = recordLength - headerLength;
+
+    let constructedDataLength = 0;
+
+    const count = await dataInputStream.readUnsignedShort();
+
+    for (let i = 0; i < count; i++) {
+      const imageInfo = await FaceImageInfo.from(inputStream);
+      constructedDataLength += imageInfo.getRecordLength();
+      this.add(imageInfo);
+    }
+    if (dataLength !== constructedDataLength) {
+      console.debug(
+        `ConstructedDataLength and dataLength differ: dataLength = ${dataLength}, constructedDataLength = ${constructedDataLength}`
+      );
+    }
+  }
+
+  public writeObject(outputStream: OutputStream): void {
+    const headerLength = 14;
+    let dataLength = 0;
+    const faceImageInfos = this.getSubRecords();
+    for (const faceImageInfo of faceImageInfos) {
+      dataLength += faceImageInfo.getRecordLength();
+    }
+
+    const recordLength = headerLength + dataLength;
+
+    const dataOut =
+      outputStream instanceof DataOutputStream
+        ? outputStream
+        : new DataOutputStream(outputStream);
+
+    dataOut.write(FaceInfo.FORMAT_IDENTIFIER);
+    dataOut.write(FaceInfo.VERSION_NUMBER);
+    dataOut.write(recordLength & 0x00000000ffffffff);
+    dataOut.write(faceImageInfos.length);
+
+    for (const faceImageInfo of faceImageInfos) {
+      faceImageInfo.writeObject(dataOut);
+    }
+  }
+
+  public getStandardBiometricHeader(): StandardBiometricHeader {
+    if (!this.sbh) {
+      const biometricType = [CBEFFInfo.BIOMETRIC_TYPE_FACIAL_FEATURES];
+      const biometricSubtype = [CBEFFInfo.BIOMETRIC_SUBTYPE_NONE];
+      const formatOwner = [
+        (FaceInfo.FORMAT_OWNER_VALUE & 0xff00) >> 8,
+        FaceInfo.FORMAT_OWNER_VALUE & 0xff,
+      ];
+      const formatType = [
+        (FaceInfo.FORMAT_TYPE_VALUE & 0xff00) >> 8,
+        FaceInfo.FORMAT_TYPE_VALUE & 0xff,
+      ];
+
+      const elements = new Map<number, Uint8Array>();
+      elements.set(
+        ISO781611.BIOMETRIC_TYPE_TAG,
+        Uint8Array.from(biometricType)
+      );
+      elements.set(
+        ISO781611.BIOMETRIC_SUBTYPE_TAG,
+        Uint8Array.from(biometricSubtype)
+      );
+      elements.set(ISO781611.FORMAT_OWNER_TAG, Uint8Array.from(formatOwner));
+      elements.set(ISO781611.FORMAT_TYPE_TAG, Uint8Array.from(formatType));
+      this.sbh = new StandardBiometricHeader(elements);
+    }
+    return this.sbh;
+  }
+
+  public getFaceImageInfos(): FaceImageInfo[] {
+    return this.getSubRecords();
+  }
+
+  public addFaceImageInfo(faceImageInfo: FaceImageInfo): void {
+    this.add(faceImageInfo);
+  }
+
+  public removeFaceImageInfo(index: number): void {
+    this.remove(index);
+  }
+
+  static async from(
+    inputStream: InputStream,
+    sbh?: StandardBiometricHeader
+  ): Promise<FaceInfo> {
+    const faceInfo = new FaceInfo();
+    if (sbh) {
+      faceInfo.sbh = sbh;
+    }
+    await faceInfo.readObject(inputStream);
+    return faceInfo;
+  }
+}

package/src/Shared/EIDReader/lds/ldsElement.ts

@@ -0,0 +1,8 @@
+export interface LDSElement {
+  /**
+   * Returns the encoded contents of this LDS info.
+   *
+   * @return a Uint8Array containing the encoding of this LDS info
+   */
+  getEncoded(): Uint8Array | null;
+}

package/src/Shared/EIDReader/lds/ldsFile.ts

@@ -0,0 +1,14 @@
+import type { LDSElement } from './ldsElement';
+
+export interface LDSFile extends LDSElement {
+  /*
+   * FIXME: Note that this is not necessarily the total length of the file:
+   * For TLV files this gives the length of the value. -- MO
+   */
+  /**
+   * Returns the length of this file.
+   *
+   * @return the length of this file
+   */
+  getLength(): number;
+}

package/src/Shared/EIDReader/nfcManagerCardService.ts

@@ -0,0 +1,58 @@
+import NFCManager, { NfcTech } from 'react-native-nfc-manager';
+import { CardService } from './cardService';
+import { CommandAPDU } from './smartcards/commandAPDU';
+import { ResponseAPDU } from './smartcards/responseAPDU';
+import { Platform } from 'react-native';
+
+export class NFCManagerCardService extends CardService {
+  private isOpened = false;
+  public async open(): Promise<void> {
+    await NFCManager.start();
+    await NFCManager.requestTechnology([
+      NfcTech.IsoDep,
+      NfcTech.NfcA,
+      NfcTech.NfcB,
+    ]);
+    // await NFCManager.setTimeout(5000);
+    this.isOpened = true;
+  }
+
+  public getIsOpen(): boolean {
+    return this.isOpened;
+  }
+
+  public async transmit(commandAPDU: CommandAPDU): Promise<ResponseAPDU> {
+    // console.debug(
+    //   `T[${ISO7816_INS[commandAPDU.getINS()]}]:`,
+    //   Buffer.from(commandAPDU.getBytes()).toString('hex').toUpperCase(),
+    // );
+    let response: number[];
+
+    if (Platform.OS === 'ios') {
+      const iosResponse = await NFCManager.sendCommandAPDUIOS(
+        Array.from(commandAPDU.getBytes())
+      );
+      response = [...iosResponse.response, iosResponse.sw1, iosResponse.sw2];
+    } else {
+      response = await NFCManager.transceive(
+        Array.from(commandAPDU.getBytes())
+      );
+    }
+    // console.debug('R:', Buffer.from(response).toString('hex').toUpperCase());
+
+    return new ResponseAPDU(response);
+  }
+
+  public getATR(): Uint8Array {
+    throw new Error('Method not implemented.');
+  }
+
+  public getIsConnectionLost(_error: Error): boolean {
+    return !this.isOpened;
+  }
+
+  public async close(): Promise<void> {
+    await NFCManager.cancelTechnologyRequest();
+    this.isOpened = false;
+  }
+}

package/src/Shared/EIDReader/protocol/bacAPDUSender.ts

@@ -0,0 +1,146 @@
+import type { APDULevelBACCapable } from '../apduLevelBACCapable';
+import { CardService } from '../cardService';
+import { CommandAPDU } from '../smartcards/commandAPDU';
+import { ISO7816_CLA, ISO7816_INS, ISO7816_SW } from '../smartcards/iso7816';
+import cryptoUtils from '../utils/crypto.utils';
+import { Buffer } from 'buffer';
+
+export class BACAPDUSender implements APDULevelBACCapable {
+  private service: CardService;
+
+  constructor(service: CardService) {
+    this.service = service;
+  }
+
+  public async sendGetChallenge() {
+    const commandAPDU = new CommandAPDU(
+      ISO7816_CLA.ISO7816,
+      ISO7816_INS.GET_CHALLENGE,
+      0x00,
+      0x00,
+      null,
+      0,
+      0,
+      8
+    );
+    const responseAPDU = await this.service.transmit(commandAPDU);
+
+    const challenge = responseAPDU.getData();
+    if (challenge === null || challenge.length !== 8) {
+      throw new Error('Get challenge failed');
+    }
+    return Buffer.from(challenge).toString('hex');
+  }
+
+  public async sendMutualAuth(
+    rndIFD: string,
+    rndICC: string,
+    kIFD: string,
+    kEnc: string,
+    kMac: string
+  ) {
+    if (rndIFD === null || rndIFD.length !== 16) {
+      throw new Error('rndIFD wrong length');
+    }
+    if (rndICC === null || rndICC.length !== 16) {
+      throw new Error('rndICC wrong length');
+    }
+    if (kIFD === null || kIFD.length !== 32) {
+      throw new Error('kIFD wrong length');
+    }
+    if (kEnc === null) {
+      throw new Error('kEnc === null');
+    }
+    if (kMac === null) {
+      throw new Error('kMac === null');
+    }
+
+    const plaintext = Buffer.alloc(32);
+    plaintext.set(Buffer.from(rndIFD, 'hex'), 0);
+    plaintext.set(Buffer.from(rndICC, 'hex'), 8);
+    plaintext.set(Buffer.from(kIFD, 'hex'), 16);
+    const ciphertext = cryptoUtils.encryptWith3DES(
+      Buffer.from(plaintext).toString('hex'),
+      kEnc
+    );
+    if (ciphertext.length !== 64) {
+      throw new Error(`Cryptogram wrong length ${ciphertext.length}`);
+    }
+
+    const mactext = cryptoUtils.computeMac(ciphertext, kMac, true);
+    if (mactext.length !== 16) {
+      throw new Error('MAC wrong length');
+    }
+
+    const data = Buffer.alloc(32 + 8);
+    data.set(Buffer.from(ciphertext, 'hex'), 0);
+    data.set(Buffer.from(mactext, 'hex'), 32);
+    let le = 40; // 40 means max ne is 40 (0x28).
+    let commandAPDU = new CommandAPDU(
+      ISO7816_CLA.ISO7816,
+      ISO7816_INS.EXTERNAL_AUTHENTICATE,
+      0x00,
+      0x00,
+      data,
+      0,
+      data.length,
+      le
+    );
+
+    let responseAPDU = await this.service.transmit(commandAPDU);
+    if (responseAPDU === null) {
+      throw new Error(
+        'Mutual authentication failed, received null response APDU'
+      );
+    }
+
+    let responseAPDUBytes = responseAPDU.getBytes();
+    let sw = responseAPDU.getSW();
+    if (responseAPDUBytes === null) {
+      throw new Error(
+        'Mutual authentication failed, received empty data in response APDU'
+      );
+    }
+
+    // Some MRTDs apparently don't support 40 here, try again with 0. See R2-p1_v2_sIII_0035 (and other issues).
+    if (sw !== ISO7816_SW.NO_ERROR) {
+      le = 0; // 0 means ne is max 256 (0xFF).
+      commandAPDU = new CommandAPDU(
+        ISO7816_CLA.ISO7816,
+        ISO7816_INS.EXTERNAL_AUTHENTICATE,
+        0x00,
+        0x00,
+        data,
+        0,
+        data.length,
+        le
+      );
+      responseAPDU = await this.service.transmit(commandAPDU);
+
+      responseAPDUBytes = responseAPDU.getBytes();
+      sw = responseAPDU.getSW();
+    }
+
+    if (responseAPDUBytes.length !== 42) {
+      throw new Error(
+        `Mutual authentication failed: expected length: 40 + 2, actual length: ${responseAPDUBytes.length}`
+      );
+    }
+
+    // Decrypt the response.
+    const result = cryptoUtils.decryptWith3DES(
+      Buffer.from(
+        responseAPDUBytes.slice(0, responseAPDUBytes.length - 8 - 2)
+      ).toString('hex'),
+      kEnc
+    );
+    if (result.length !== 64) {
+      // The PICC allowed access, but probably the resulting secure channel will be wrong.
+      throw new Error(
+        `Cryptogram wrong length, was expecting 64, found ${result.length}`
+      );
+    }
+
+    return result;
+  }
+}

package/src/Shared/EIDReader/protocol/bacProtocol.ts

@@ -0,0 +1,121 @@
+import type { AccessKeySpec } from '../accessKeySpec';
+import type { APDULevelBACCapable } from '../apduLevelBACCapable';
+import type { BACKeySpec } from '../bacKeySpec';
+import { SecureMessagingWrapper } from '../secureMessagingWrapper';
+import { TripleDesSecureMessagingWrapper } from '../tripleDesSecureMessagingWrapper';
+import cryptoUtils from '../utils/crypto.utils';
+import { BACResult } from './bacResult';
+import { Buffer } from 'buffer';
+
+export class BACProtocol {
+  private service: APDULevelBACCapable;
+  private maxTransceiveLength: number;
+  private shouldCheckMAC: boolean;
+
+  constructor(
+    service: APDULevelBACCapable,
+    maxTransceiveLength: number,
+    shouldCheckMAC: boolean
+  ) {
+    this.service = service;
+    this.maxTransceiveLength = maxTransceiveLength;
+    this.shouldCheckMAC = shouldCheckMAC;
+  }
+
+  public async doBAC(bacKey: AccessKeySpec): Promise<BACResult> {
+    const keySeed = bacKey.getKey();
+    const kEnc = cryptoUtils.derive3DESKeysFromSeed(keySeed, 'ENC');
+    const kMac = cryptoUtils.derive3DESKeysFromSeed(keySeed, 'MAC');
+
+    const wrapper = await this.doBACStep(kEnc, kMac);
+    return new BACResult(bacKey, wrapper);
+  }
+
+  public async doBACStep(
+    kEnc: string,
+    kMac: string
+  ): Promise<SecureMessagingWrapper> {
+    const rndICC = await this.service.sendGetChallenge();
+    const rndIFD = cryptoUtils.getRandomValues(8);
+    const kIFD = cryptoUtils.getRandomValues(16);
+    const response = await this.service.sendMutualAuth(
+      rndIFD,
+      rndICC,
+      kIFD,
+      kEnc,
+      kMac
+    );
+    const kICC = response.substring(32, 64);
+    const keySeed = Buffer.alloc(16);
+    const kIFDBytes = Buffer.from(kIFD, 'hex');
+    const kICCBytes = Buffer.from(kICC, 'hex');
+    for (let i = 0; i < 16; i++) {
+      keySeed[i] = (kIFDBytes[i] & 0xff) ^ (kICCBytes[i] & 0xff);
+    }
+    const keySeedHex = Buffer.from(keySeed).toString('hex');
+    const ksEncHex = cryptoUtils.derive3DESKeysFromSeed(keySeedHex, 'ENC');
+    const ksMacHex = cryptoUtils.derive3DESKeysFromSeed(keySeedHex, 'MAC');
+
+    const rndICCBytes = Buffer.from(rndICC, 'hex');
+    const rndIFDBytes = Buffer.from(rndIFD, 'hex');
+    const ssc = BACProtocol.computeSendSequenceCounter(
+      rndICCBytes,
+      rndIFDBytes
+    );
+
+    return new TripleDesSecureMessagingWrapper(
+      ksEncHex,
+      ksMacHex,
+      this.maxTransceiveLength,
+      this.shouldCheckMAC,
+      ssc
+    );
+  }
+
+  public static computeKeySeedForBACWithKey(bacKey: BACKeySpec): string {
+    const documentNumber: string = bacKey.getDocumentNumber();
+    const dateOfBirth: string = bacKey.getDateOfBirth();
+    const dateOfExpiry: string = bacKey.getDateOfExpiry();
+
+    if (dateOfBirth == null || dateOfBirth.length !== 6) {
+      throw new Error(
+        `Wrong date format used for date of birth. Expected yyMMdd, found ${dateOfBirth}`
+      );
+    }
+
+    if (dateOfExpiry == null || dateOfExpiry.length !== 6) {
+      throw new Error(
+        `Wrong date format used for date of expiry. Expected yyMMdd, found ${dateOfExpiry}`
+      );
+    }
+
+    if (documentNumber == null) {
+      throw new Error(`Wrong document number. Found ${documentNumber}`);
+    }
+
+    return bacKey.getKey();
+  }
+
+  public static computeSendSequenceCounter(
+    rndICC: Buffer,
+    rndIFD: Buffer
+  ): bigint {
+    if (rndICC.length !== 8 || rndIFD.length !== 8) {
+      throw new Error('Wrong length input');
+    }
+
+    let ssc = 0n;
+
+    for (let i = 4; i < 8; i++) {
+      ssc <<= 8n;
+      ssc += BigInt(rndICC[i] & 0x000000ff);
+    }
+
+    for (let i = 4; i < 8; i++) {
+      ssc <<= 8n;
+      ssc += BigInt(rndIFD[i] & 0x000000ff);
+    }
+
+    return ssc;
+  }
+}

package/src/Shared/EIDReader/protocol/bacResult.ts

@@ -0,0 +1,36 @@
+import type { AccessKeySpec } from '../accessKeySpec';
+import { SecureMessagingWrapper } from '../secureMessagingWrapper';
+
+export class BACResult {
+  private bacKey: AccessKeySpec;
+  private wrapper: SecureMessagingWrapper;
+
+  /**
+   * Creates a BAC result.
+   *
+   * @param bacKey the initial access key
+   * @param wrapper the secure messaging wrapper that resulted from the BAC protocol run
+   */
+  constructor(bacKey: AccessKeySpec, wrapper: SecureMessagingWrapper) {
+    this.bacKey = bacKey;
+    this.wrapper = wrapper;
+  }
+
+  /**
+   * Returns the initial access key or {@code null}.
+   *
+   * @return the initial access key or {@code null}
+   */
+  public getBACKey(): AccessKeySpec {
+    return this.bacKey;
+  }
+
+  /**
+   * Returns the secure messaging wrapper.
+   *
+   * @return the secure messaging wrapper
+   */
+  public getWrapper(): SecureMessagingWrapper {
+    return this.wrapper;
+  }
+}