@trustchex/react-native-sdk 1.409.0 → 1.464.0

package/lib/module/Shared/EIDReader/paceKeySpec.js

@@ -0,0 +1,51 @@
+"use strict";
+
+import { EID_CONSTANTS } from "./constants/eidConstants.js";
+
+/**
+ * A key specification for PACE authentication.
+ * Supports MRZ, CAN, PIN, and PUK key types.
+ */
+export class PACEKeySpec {
+  constructor(key, keyReference) {
+    this.key = key;
+    this.keyReference = keyReference;
+  }
+  getAlgorithm() {
+    return 'PACE';
+  }
+  getKey() {
+    return this.key;
+  }
+  getKeyReference() {
+    return this.keyReference;
+  }
+
+  /**
+   * Creates a PACE key from a Card Access Number (CAN).
+   */
+  static createCANKey(can) {
+    return new PACEKeySpec(can, EID_CONSTANTS.CAN_PACE_KEY_REFERENCE);
+  }
+
+  /**
+   * Creates a PACE key from a PIN.
+   */
+  static createPINKey(pin) {
+    return new PACEKeySpec(pin, EID_CONSTANTS.PIN_PACE_KEY_REFERENCE);
+  }
+
+  /**
+   * Creates a PACE key from a PUK.
+   */
+  static createPUKKey(puk) {
+    return new PACEKeySpec(puk, EID_CONSTANTS.PUK_PACE_KEY_REFERENCE);
+  }
+
+  /**
+   * Creates an MRZ-based PACE key from BAC key seed bytes.
+   */
+  static createMRZKey(keySeed) {
+    return new PACEKeySpec(keySeed, EID_CONSTANTS.MRZ_PACE_KEY_REFERENCE);
+  }
+}

package/lib/module/Shared/EIDReader/protocol/paceAPDUSender.js

@@ -0,0 +1,100 @@
+"use strict";
+
+import { Buffer } from 'buffer';
+import { CommandAPDU } from "../smartcards/commandAPDU.js";
+import { ISO7816_CLA, ISO7816_INS, ISO7816_SW } from "../smartcards/iso7816.js";
+import { SecureMessagingAPDUSender } from "./secureMessagingAPDUSender.js";
+import TLVUtil from "../tlv/tlv.utils.js";
+const INS_PACE_GENERAL_AUTHENTICATE = 0x86;
+
+/**
+ * Low-level APDU sender to support the PACE protocol.
+ */
+export class PACEAPDUSender {
+  constructor(service) {
+    this.secureMessagingSender = new SecureMessagingAPDUSender(service);
+  }
+  async sendMSESetATMutualAuth(wrapper, oid, refPublicKeyOrSecretKey, refPrivateKeyOrForComputingSessionKey) {
+    if (oid == null) {
+      throw new Error('OID cannot be null');
+    }
+    const oidBytes = PACEAPDUSender.toOIDBytes(oid);
+
+    // 0x83: Reference of a public key / secret key
+    const refBytes = Array.from(TLVUtil.wrapDO(0x83, [refPublicKeyOrSecretKey]));
+
+    // Build data
+    const data = [...oidBytes, ...refBytes];
+
+    // 0x84: Reference of a private key / Reference for computing a session key (optional)
+    if (refPrivateKeyOrForComputingSessionKey != null) {
+      const refPrivateBytes = Array.from(TLVUtil.wrapDO(0x84, refPrivateKeyOrForComputingSessionKey));
+      data.push(...refPrivateBytes);
+    }
+    const commandAPDU = new CommandAPDU(ISO7816_CLA.ISO7816, ISO7816_INS.MSE, 0xc1, 0xa4, Uint8Array.from(data), 0, data.length, -1);
+    const responseAPDU = await this.secureMessagingSender.transmit(wrapper, commandAPDU);
+    const sw = responseAPDU.getSW();
+    if (sw !== ISO7816_SW.NO_ERROR) {
+      throw new Error(`Sending MSE AT failed, SW = ${sw.toString(16).padStart(4, '0')}`);
+    }
+  }
+  async sendGeneralAuthenticate(wrapper, data, le, isLast) {
+    // Wrap data in 0x7C
+    const commandData = Array.from(TLVUtil.wrapDO(0x7c, data));
+    const cla = isLast ? ISO7816_CLA.ISO7816 : ISO7816_CLA.COMMAND_CHAINING;
+    const commandAPDU = new CommandAPDU(cla, INS_PACE_GENERAL_AUTHENTICATE, 0x00, 0x00, Uint8Array.from(commandData), 0, commandData.length, le);
+    console.debug(`[PACE APDU] >> CLA=${cla.toString(16)} INS=86 Lc=${commandData.length} Le=${le} data(first32)=${Buffer.from(commandData.slice(0, 32)).toString('hex')}`);
+    const responseAPDU = await this.secureMessagingSender.transmit(wrapper, commandAPDU);
+    const sw = responseAPDU.getSW();
+    console.debug(`[PACE APDU] << SW=${sw.toString(16).padStart(4, '0')} dataLen=${responseAPDU.getData()?.length ?? 0}`);
+    if (sw !== ISO7816_SW.NO_ERROR) {
+      throw new Error(`Sending general authenticate failed, SW = ${sw.toString(16).padStart(4, '0')}`);
+    }
+    const responseData = responseAPDU.getData();
+    if (responseData == null || responseData.length === 0) {
+      return [];
+    }
+
+    // Unwrap 0x7C
+    return await TLVUtil.unwrapDO(0x7c, Array.from(responseData));
+  }
+
+  /**
+   * Encodes an OID string to its ASN.1 byte representation wrapped in tag 0x80.
+   */
+  static toOIDBytes(oid) {
+    const components = oid.split('.').map(Number);
+    if (components.length < 2) {
+      throw new Error(`Invalid OID: ${oid}`);
+    }
+
+    // First two components encoded as (first * 40 + second)
+    const encodedComponents = [];
+    const firstByte = components[0] * 40 + components[1];
+    encodedComponents.push(firstByte);
+
+    // Remaining components use base-128 encoding
+    for (let i = 2; i < components.length; i++) {
+      const value = components[i];
+      if (value < 128) {
+        encodedComponents.push(value);
+      } else {
+        const bytes = [];
+        let v = value;
+        bytes.push(v & 0x7f);
+        v >>= 7;
+        while (v > 0) {
+          bytes.push(v & 0x7f | 0x80);
+          v >>= 7;
+        }
+        bytes.reverse();
+        encodedComponents.push(...bytes);
+      }
+    }
+
+    // Wrap with tag 0x80 (TLV)
+    const oidContent = Uint8Array.from(encodedComponents);
+    const result = [0x80, oidContent.length, ...oidContent];
+    return result;
+  }
+}