@vppos/react-native-nfc 1.0.0

package/vendor/ios-passport-reader/Sources/NFCPassportReader/ChipAuthenticationHandler.swift

@@ -0,0 +1,224 @@
+//
+//  ChipAuthenticationHandler.swift
+//  NFCPassportReader
+//
+//  Created by Andy Qua on 25/02/2021.
+//
+
+import Foundation
+import OSLog
+import OpenSSL
+
+#if !os(macOS)
+import CoreNFC
+import CryptoKit
+
+@available(iOS 15, *)
+class ChipAuthenticationHandler {
+    
+    private static let NO_PACE_KEY_REFERENCE : UInt8 = 0x00
+    private static let ENC_MODE : UInt8 = 0x1
+    private static let MAC_MODE : UInt8 = 0x2
+    private static let PACE_MODE : UInt8 = 0x3
+
+    private static let COMMAND_CHAINING_CHUNK_SIZE = 224
+
+    var tagReader : TagReader?
+    var gaSegments = [[UInt8]]()
+    
+    var chipAuthInfos = [Int:ChipAuthenticationInfo]()
+    var chipAuthPublicKeyInfos = [ChipAuthenticationPublicKeyInfo]()
+    
+    var isChipAuthenticationSupported : Bool = false
+    
+    public init(dg14 : DataGroup14, tagReader: TagReader) {
+        self.tagReader = tagReader
+        
+        for secInfo in dg14.securityInfos {
+            if let cai = secInfo as? ChipAuthenticationInfo {
+                let keyId = cai.getKeyId()
+                chipAuthInfos[keyId] = cai
+            } else if let capki = secInfo as? ChipAuthenticationPublicKeyInfo {
+                chipAuthPublicKeyInfos.append(capki)
+            }
+        }
+        
+        if chipAuthPublicKeyInfos.count > 0 {
+            isChipAuthenticationSupported = true
+        }
+    }
+
+    public func doChipAuthentication() async throws  {
+                
+        Logger.chipAuth.info( "Performing Chip Authentication - number of public keys found - \(self.chipAuthPublicKeyInfos.count)" )
+        guard isChipAuthenticationSupported else {
+            throw NFCPassportReaderError.NotYetSupported( "ChipAuthentication not supported" )
+        }
+        
+        var success = false
+        for pubKey in chipAuthPublicKeyInfos {
+            do {
+                success = try await self.doChipAuthentication( with: pubKey)
+                if success {
+                    break
+                }
+            } catch {
+                // try next key
+            }
+        }
+        
+        if !success {
+            throw NFCPassportReaderError.ChipAuthenticationFailed
+        }
+    }
+    
+    private func doChipAuthentication( with chipAuthPublicKeyInfo : ChipAuthenticationPublicKeyInfo ) async throws -> Bool {
+        
+        // So it turns out that some passports don't have ChipAuthInfo items.
+        // So if we do have a ChipAuthInfo the we take the keyId (if present) and OID from there,
+        // BUT if we don't then we will try to infer the OID from the public key
+        let keyId = chipAuthPublicKeyInfo.keyId
+        let chipAuthInfoOID : String
+        if let chipAuthInfo = chipAuthInfos[keyId ?? 0] {
+            chipAuthInfoOID = chipAuthInfo.oid
+        } else {
+            if let oid = inferOID( fromPublicKeyOID:chipAuthPublicKeyInfo.oid) {
+                chipAuthInfoOID = oid
+            } else {
+                return false
+            }
+        }
+        
+        try await self.doCA( keyId: keyId, encryptionDetailsOID: chipAuthInfoOID, publicKey: chipAuthPublicKeyInfo.pubKey )
+        return true
+    }
+    
+    /// Infer OID from public key type - Best guess seems to be to use 3DES_CBC_CBC for both ECDH and DH keys
+    /// Apparently works for French passports
+    private func inferOID(fromPublicKeyOID: String ) -> String? {
+        if fromPublicKeyOID == SecurityInfo.ID_PK_ECDH_OID {
+            Logger.chipAuth.warning("No ChipAuthenticationInfo - guessing its id-CA-ECDH-3DES-CBC-CBC");
+            return SecurityInfo.ID_CA_ECDH_3DES_CBC_CBC_OID
+        } else if fromPublicKeyOID == SecurityInfo.ID_PK_DH_OID {
+            Logger.chipAuth.warning("No ChipAuthenticationInfo - guessing its id-CA-DH-3DES-CBC-CBC");
+            return SecurityInfo.ID_CA_DH_3DES_CBC_CBC_OID
+        }
+        
+        Logger.chipAuth.warning("No ChipAuthenticationInfo and unsupported ChipAuthenticationPublicKeyInfo public key OID \(fromPublicKeyOID)")
+        return nil;
+    }
+    
+    private func doCA( keyId: Int?, encryptionDetailsOID oid: String, publicKey: OpaquePointer) async throws {
+        
+        // Generate Ephemeral Keypair from parameters from DG14 Public key
+        // This should work for both EC and DH keys
+        var ephemeralKeyPair : OpaquePointer? = nil
+        let pctx = EVP_PKEY_CTX_new(publicKey, nil)
+        EVP_PKEY_keygen_init(pctx)
+        EVP_PKEY_keygen(pctx, &ephemeralKeyPair)
+        EVP_PKEY_CTX_free(pctx)
+        
+        // Send the public key to the passport
+        try await sendPublicKey(oid: oid, keyId: keyId, pcdPublicKey: ephemeralKeyPair!)
+            
+        Logger.chipAuth.debug( "Public Key successfully sent to passport!" )
+        
+        // Use our ephemeral private key and the passports public key to generate a shared secret
+        // (the passport with do the same thing with their private key and our public key)
+        let sharedSecret = OpenSSLUtils.computeSharedSecret(privateKeyPair:ephemeralKeyPair!, publicKey:publicKey)
+        
+        // Now try to restart Secure Messaging using the new shared secret and
+        try restartSecureMessaging( oid : oid, sharedSecret : sharedSecret, maxTranceiveLength : 1, shouldCheckMAC : true)
+    }
+    
+    private func sendPublicKey(oid : String, keyId : Int?, pcdPublicKey : OpaquePointer) async throws {
+        let cipherAlg = try ChipAuthenticationInfo.toCipherAlgorithm(oid: oid)
+        guard let keyData = OpenSSLUtils.getPublicKeyData(from: pcdPublicKey) else {
+            throw NFCPassportReaderError.InvalidDataPassed("Unable to get public key data from public key" )
+        }
+        
+        if cipherAlg.hasPrefix("DESede") {
+        
+            var idData : [UInt8] = []
+            if let keyId = keyId {
+                idData = intToBytes( val:keyId, removePadding:true)
+                idData = wrapDO( b:0x84, arr:idData)
+            }
+            let wrappedKeyData = wrapDO( b:0x91, arr:keyData)
+            _ = try await self.tagReader?.sendMSEKAT(keyData: Data(wrappedKeyData), idData: Data(idData))
+        } else if cipherAlg.hasPrefix("AES") {
+            _ = try await self.tagReader?.sendMSESetATIntAuth(oid: oid, keyId: keyId)
+            let data = wrapDO(b: 0x80, arr:keyData)
+            gaSegments = self.chunk(data: data, segmentSize: ChipAuthenticationHandler.COMMAND_CHAINING_CHUNK_SIZE )
+            try await self.handleGeneralAuthentication()
+        } else {
+            throw NFCPassportReaderError.InvalidDataPassed("Cipher Algorithm \(cipherAlg) not supported")
+        }
+    }
+    
+    private func handleGeneralAuthentication() async throws {
+        repeat {
+            // Pull next segment from list
+            let segment = gaSegments.removeFirst()
+            let isLast = gaSegments.isEmpty
+        
+            // send it
+            _ = try await self.tagReader?.sendGeneralAuthenticate(data: segment, isLast: isLast)
+        } while ( !gaSegments.isEmpty )
+    }
+        
+    private func restartSecureMessaging( oid : String, sharedSecret : [UInt8], maxTranceiveLength : Int, shouldCheckMAC : Bool) throws  {
+        let cipherAlg = try ChipAuthenticationInfo.toCipherAlgorithm(oid: oid)
+        let keyLength = try ChipAuthenticationInfo.toKeyLength(oid: oid)
+        
+        // Start secure messaging.
+        let smskg = SecureMessagingSessionKeyGenerator()
+        let ksEnc = try smskg.deriveKey(keySeed: sharedSecret, cipherAlgName: cipherAlg, keyLength: keyLength, mode: .ENC_MODE)
+        let ksMac = try smskg.deriveKey(keySeed: sharedSecret, cipherAlgName: cipherAlg, keyLength: keyLength, mode: .MAC_MODE)
+        
+        let ssc = withUnsafeBytes(of: 0.bigEndian, Array.init)
+        if (cipherAlg.hasPrefix("DESede")) {
+            Logger.chipAuth.info( "Restarting secure messaging using DESede encryption")
+            let sm = SecureMessaging(encryptionAlgorithm: .DES, ksenc: ksEnc, ksmac: ksMac, ssc: ssc)
+            tagReader?.secureMessaging = sm
+        } else if (cipherAlg.hasPrefix("AES")) {
+            Logger.chipAuth.info( "Restarting secure messaging using AES encryption")
+            let sm = SecureMessaging(encryptionAlgorithm: .AES, ksenc: ksEnc, ksmac: ksMac, ssc: ssc)
+            tagReader?.secureMessaging = sm
+        } else {
+            Logger.chipAuth.error( "Not restarting secure messaging as unsupported cipher algorithm requested - \(cipherAlg)")
+            throw NFCPassportReaderError.InvalidDataPassed("Unsupported cipher algorithm \(cipherAlg)" )
+        }
+    }
+    
+    
+    func inferDigestAlgorithmFromCipherAlgorithmForKeyDerivation( cipherAlg : String, keyLength : Int) throws -> String {
+        if cipherAlg == "DESede" || cipherAlg == "AES-128" {
+            return "SHA1"
+        }
+        if cipherAlg == "AES" && keyLength == 128 {
+            return "SHA1"
+        }
+        if cipherAlg == "AES-256" || cipherAlg ==  "AES-192" {
+            return "SHA256"
+        }
+        if cipherAlg == "AES" && (keyLength == 192 || keyLength == 256) {
+            return "SHA256"
+        }
+        
+        throw NFCPassportReaderError.InvalidDataPassed("Unsupported cipher algorithm or key length")
+    }
+    
+    /// Chunks up a byte array into a number of segments of the given size,
+    /// and a final segment if there is a remainder.
+    /// - Parameter segmentSize the number of bytes per segment
+    /// - Parameter data the data to be partitioned
+    /// - Parameter a list with the segments
+    func chunk( data : [UInt8], segmentSize: Int ) -> [[UInt8]] {
+        return stride(from: 0, to: data.count, by: segmentSize).map {
+            Array(data[$0 ..< Swift.min($0 + segmentSize, data.count)])
+        }
+    }
+}
+
+#endif

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroupHash.swift

@@ -0,0 +1,16 @@
+//
+//  DataGroupHash.swift
+//  NFCPassportReader
+//
+//  Created by Andy Qua on 09/02/2021.
+//  Copyright © 2021 Andy Qua. All rights reserved.
+//
+
+@available(iOS 13, macOS 10.15, *)
+public struct DataGroupHash {
+    public var id: String
+    public var sodHash: String
+    public var computedHash : String
+    public var match : Bool
+}
+

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroupParser.swift

@@ -0,0 +1,36 @@
+//
+//  DataGroupParser.swift
+//
+//  Created by Andy Qua on 14/06/2019.
+//
+
+import OpenSSL
+
+@available(iOS 13, macOS 10.15, *)
+class DataGroupParser {
+    
+    static let dataGroupNames = ["Common", "DG1", "DG2", "DG3", "DG4", "DG5", "DG6", "DG7", "DG8", "DG9", "DG10", "DG11", "DG12", "DG13", "DG14", "DG15", "DG16", "SecurityData"]
+    static let tags : [UInt8] = [0x60, 0x61, 0x75, 0x63, 0x76, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x77]
+    static let classes : [DataGroup.Type] = [COM.self, DataGroup1.self, DataGroup2.self,
+                                      NotImplementedDG.self, NotImplementedDG.self, NotImplementedDG.self,
+                                      NotImplementedDG.self, DataGroup7.self, NotImplementedDG.self,
+                                      NotImplementedDG.self, NotImplementedDG.self, DataGroup11.self,
+                                      DataGroup12.self, NotImplementedDG.self, DataGroup14.self,
+                                      DataGroup15.self, NotImplementedDG.self, SOD.self]
+    
+    
+    func parseDG( data : [UInt8] ) throws -> DataGroup {
+        
+        let header = data[0..<4]
+        
+        let dg = try tagToDG(header[0])
+
+        return try dg.init(data)
+    }
+    
+    
+    func tagToDG( _ tag : UInt8 ) throws -> DataGroup.Type {
+        guard let index = DataGroupParser.tags.firstIndex(of: tag) else { throw NFCPassportReaderError.UnknownTag}
+        return DataGroupParser.classes[index]
+    }
+}

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroups/ActiveAuthenticationInfo.swift

@@ -0,0 +1,69 @@
+//
+//  File.swift
+//  
+//
+//  Created by Paul Philip Mitchell on 06/12/2021.
+//
+
+import Foundation
+
+@available(iOS 13, macOS 10.15, *)
+public class ActiveAuthenticationInfo : SecurityInfo {
+
+    var oid : String
+    var version : Int
+    var signatureAlgorithmOID : String?
+
+    static func checkRequiredIdentifier(_ oid : String) -> Bool {
+        return ID_AA_OID == oid
+    }
+
+    init(oid: String, version: Int, signatureAlgorithmOID: String? = nil) {
+        self.oid = oid
+        self.version = version
+        self.signatureAlgorithmOID = signatureAlgorithmOID
+    }
+
+    public override func getObjectIdentifier() -> String {
+        return oid
+    }
+
+    public override func getProtocolOIDString() -> String {
+        return ActiveAuthenticationInfo.toProtocolOIDString(oid:oid)
+    }
+
+    public func getSignatureAlgorithmOIDString() -> String? {
+        return ActiveAuthenticationInfo.toSignatureAlgorithmOIDString(oid: signatureAlgorithmOID)
+    }
+
+    private static func toProtocolOIDString(oid : String) -> String {
+        if ID_AA_OID == oid {
+            return "id-AA"
+        }
+
+        return oid
+    }
+
+    private static func toSignatureAlgorithmOIDString(oid: String?) -> String? {
+        if (ECDSA_PLAIN_SHA1_OID == oid) {
+            return "ecdsa-plain-SHA1";
+        }
+        if (ECDSA_PLAIN_SHA224_OID == oid) {
+            return "ecdsa-plain-SHA224";
+        }
+        if (ECDSA_PLAIN_SHA256_OID == oid) {
+            return "ecdsa-plain-SHA256";
+        }
+        if (ECDSA_PLAIN_SHA384_OID == oid) {
+            return "ecdsa-plain-SHA384";
+        }
+        if (ECDSA_PLAIN_SHA512_OID == oid) {
+            return "ecdsa-plain-SHA512";
+        }
+        if (ECDSA_PLAIN_RIPEMD160_OID == oid) {
+            return "ecdsa-plain-RIPEMD160";
+        }
+
+        return nil
+    }
+}

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroups/COM.swift

@@ -0,0 +1,61 @@
+//
+//  COM.swift
+//
+//  Created by Andy Qua on 01/02/2021.
+//
+
+import Foundation
+import OSLog
+
+@available(iOS 13, macOS 10.15, *)
+public class COM : DataGroup {
+    public private(set) var version : String = "Unknown"
+    public private(set) var unicodeVersion : String = "Unknown"
+    public private(set) var dataGroupsPresent : [String] = []
+
+    public override var datagroupType: DataGroupId { .COM }
+
+    required init( _ data : [UInt8] ) throws {
+        try super.init(data)
+    }
+    
+    override func parse(_ data: [UInt8]) throws {
+        var tag = try getNextTag()
+        try verifyTag(tag, equals: 0x5F01)
+
+        // Version is 4 bytes (ascii) - AABB
+        // AA is major number, BB is minor number
+        // e.g.  48 49 48 55 -> 01 07 -> 1.7
+        var versionBytes = try getNextValue()
+        if versionBytes.count == 4 {
+            let aa = Int( String(cString: Array(versionBytes[0..<2] + [0]) )) ?? -1
+            let bb = Int( String(cString: Array(versionBytes[2...] + [0])) ) ?? -1
+            if aa != -1 && bb != -1 {
+                version = "\(aa).\(bb)"
+            }
+        }
+        tag = try getNextTag()
+        try verifyTag(tag, equals: 0x5F36)
+        
+        versionBytes = try getNextValue()
+        if versionBytes.count == 6 {
+            let aa = Int( String(cString: Array(versionBytes[0..<2] + [0])) ) ?? -1
+            let bb = Int( String(cString: Array(versionBytes[2..<4] + [0])) ) ?? -1
+            let cc = Int( String(cString: Array(versionBytes[4...]) + [0]) ) ?? -1
+            if aa != -1 && bb != -1 && cc != -1 {
+                unicodeVersion = "\(aa).\(bb).\(cc)"
+            }
+        }
+        
+        tag = try getNextTag()
+        try verifyTag(tag, equals: 0x5C)
+        
+        let vals = try getNextValue()
+        for v in vals {
+            if let index = DataGroupParser.tags.firstIndex(of: v) {
+                dataGroupsPresent.append( DataGroupParser.dataGroupNames[index] )
+            }
+        }
+        Logger.passportReader.debug( "DG Found - \(self.dataGroupsPresent)" )
+    }
+}

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroups/CardAccess.swift

@@ -0,0 +1,38 @@
+//
+//  CardAccess.swift
+//  NFCPassportReader
+//
+//  Created by Andy Qua on 03/03/2021.
+//
+
+import Foundation
+
+// SecurityInfos ::= SET of SecurityInfo
+// SecurityInfo ::= SEQUENCE {
+//    protocol OBJECT IDENTIFIER,
+//    requiredData ANY DEFINED BY protocol,
+//    optionalData ANY DEFINED BY protocol OPTIONAL
+@available(iOS 13, macOS 10.15, *)
+public class CardAccess {
+    private var asn1 : ASN1Item!
+    public private(set) var securityInfos : [SecurityInfo] = [SecurityInfo]()
+    
+    var paceInfo : PACEInfo? {
+        get {
+            return (securityInfos.filter { ($0 as? PACEInfo) != nil }).first as? PACEInfo
+        }
+    }
+    
+    required init( _ data : [UInt8] ) throws {
+        let p = SimpleASN1DumpParser()
+        asn1 = try p.parse(data: Data(data))
+        
+        // Bit of a hack at the moment - passing in the body - if we had a decent ASN1 parser then this would be better! ;)
+        for i in 0 ..< asn1.getNumberOfChildren() {
+            if let child = asn1.getChild(i),
+               let secInfo = SecurityInfo.getInstance( object:child, body : data ) {
+                securityInfos.append(secInfo)
+            }
+        }
+    }
+}

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroups/ChipAuthenticationInfo.swift

@@ -0,0 +1,135 @@
+//
+//  ChipAuthenticationInfo.swift
+//  NFCPassportReader
+//
+//  Created by Andy Qua on 25/02/2021.
+//
+
+import Foundation
+
+@available(iOS 13, macOS 10.15, *)
+public class ChipAuthenticationInfo : SecurityInfo {
+    
+    var oid : String
+    var version : Int
+    var keyId : Int?
+    
+    static func checkRequiredIdentifier(_ oid : String) -> Bool {
+        return ID_CA_DH_3DES_CBC_CBC_OID == oid
+            || ID_CA_ECDH_3DES_CBC_CBC_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_128_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_192_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_256_OID == oid
+            || ID_CA_ECDH_AES_CBC_CMAC_128_OID == oid
+            || ID_CA_ECDH_AES_CBC_CMAC_192_OID == oid
+            || ID_CA_ECDH_AES_CBC_CMAC_256_OID == oid
+    }
+    
+    init(oid: String, version: Int, keyId: Int? = nil) {
+        self.oid = oid
+        self.version = version
+        self.keyId = keyId
+    }
+    
+    public override func getObjectIdentifier() -> String {
+        return oid
+    }
+    
+    public override func getProtocolOIDString() -> String {
+        return ChipAuthenticationInfo.toProtocolOIDString(oid:oid)
+    }
+    
+    // The keyid refers to a specific key if there are multiple otherwise if not set, only one key is present so set to 0
+    public func getKeyId() -> Int {
+        return keyId ?? 0
+    }
+    
+    /// Returns the key agreement algorithm - DH or ECDH for the given Chip Authentication oid
+    /// - Parameter oid: the object identifier
+    /// - Returns: key agreement algorithm
+    /// - Throws: InvalidDataPassed error if invalid oid specified
+    public static func toKeyAgreementAlgorithm( oid : String ) throws -> String {
+        if ID_CA_DH_3DES_CBC_CBC_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_128_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_192_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_256_OID == oid {
+            return "DH";
+        } else if ID_CA_ECDH_3DES_CBC_CBC_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_128_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_192_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_256_OID == oid {
+            return "ECDH";
+        }
+        
+        throw NFCPassportReaderError.InvalidDataPassed( "Unable to lookup key agreement algorithm - invalid oid" )
+    }
+    
+    /// Returns the cipher algorithm - DESede or AES for the given Chip Authentication oid
+    /// - Parameter oid: the object identifier
+    /// - Returns: the cipher algorithm type
+    /// - Throws: InvalidDataPassed error if invalid oid specified
+    public static func toCipherAlgorithm( oid : String ) throws -> String {
+        if ID_CA_DH_3DES_CBC_CBC_OID == oid
+            || ID_CA_ECDH_3DES_CBC_CBC_OID == oid {
+            return "DESede";
+        } else if ID_CA_DH_AES_CBC_CMAC_128_OID == oid
+                    || ID_CA_DH_AES_CBC_CMAC_192_OID == oid
+                    || ID_CA_DH_AES_CBC_CMAC_256_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_128_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_192_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_256_OID == oid {
+            return "AES";
+        }
+        throw NFCPassportReaderError.InvalidDataPassed( "Unable to lookup cipher algorithm - invalid oid" )
+    }
+    
+    /// Returns the key length in bits (128, 192, or 256) for the given Chip Authentication oid
+    /// - Parameter oid: the object identifier
+    /// - Returns: the key length in bits
+    /// - Throws: InvalidDataPassed error if invalid oid specified
+    public static func toKeyLength( oid : String ) throws -> Int {
+        if ID_CA_DH_3DES_CBC_CBC_OID == oid
+            || ID_CA_ECDH_3DES_CBC_CBC_OID == oid
+            || ID_CA_DH_AES_CBC_CMAC_128_OID == oid
+            || ID_CA_ECDH_AES_CBC_CMAC_128_OID == oid {
+            return 128;
+        } else if ID_CA_DH_AES_CBC_CMAC_192_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_192_OID == oid {
+            return 192;
+        } else if ID_CA_DH_AES_CBC_CMAC_256_OID == oid
+                    || ID_CA_ECDH_AES_CBC_CMAC_256_OID == oid {
+            return 256;
+        }
+        
+        throw NFCPassportReaderError.InvalidDataPassed( "Unable to get key length - invalid oid" )
+    }
+    
+    private static func toProtocolOIDString(oid : String) -> String {
+        if ID_CA_DH_3DES_CBC_CBC_OID == oid {
+            return "id-CA-DH-3DES-CBC-CBC"
+        }
+        if ID_CA_DH_AES_CBC_CMAC_128_OID == oid {
+            return "id-CA-DH-AES-CBC-CMAC-128"
+        }
+        if ID_CA_DH_AES_CBC_CMAC_192_OID == oid {
+            return "id-CA-DH-AES-CBC-CMAC-192"
+        }
+        if ID_CA_DH_AES_CBC_CMAC_256_OID == oid {
+            return "id-CA-DH-AES-CBC-CMAC-256"
+        }
+        if ID_CA_ECDH_3DES_CBC_CBC_OID == oid {
+            return "id-CA-ECDH-3DES-CBC-CBC"
+        }
+        if ID_CA_ECDH_AES_CBC_CMAC_128_OID == oid {
+            return "id-CA-ECDH-AES-CBC-CMAC-128"
+        }
+        if ID_CA_ECDH_AES_CBC_CMAC_192_OID == oid {
+            return "id-CA-ECDH-AES-CBC-CMAC-192"
+        }
+        if ID_CA_ECDH_AES_CBC_CMAC_256_OID == oid {
+            return "id-CA-ECDH-AES-CBC-CMAC-256"
+        }
+        
+        return oid
+    }
+}

package/vendor/ios-passport-reader/Sources/NFCPassportReader/DataGroups/ChipAuthenticationPublicKeyInfo.swift

@@ -0,0 +1,53 @@
+//
+//  ChipAuthenticationPublicKeyInfo.swift
+//  NFCPassportReader
+//
+//  Created by Andy Qua on 25/02/2021.
+//
+
+import Foundation
+
+@available(iOS 13, macOS 10.15, *)
+public class ChipAuthenticationPublicKeyInfo : SecurityInfo {
+    var oid : String
+    var pubKey : OpaquePointer
+    var keyId : Int?
+    
+    
+    static func checkRequiredIdentifier(_ oid : String) -> Bool {
+        return ID_PK_DH_OID == oid
+            || ID_PK_ECDH_OID == oid
+    }
+    
+    init(oid:String, pubKey:OpaquePointer, keyId: Int? = nil) {
+        self.oid = oid
+        self.pubKey = pubKey
+        self.keyId = keyId
+    }
+    
+    public override func getObjectIdentifier() -> String {
+        return oid
+    }
+    
+    public override func getProtocolOIDString() -> String {
+        return ChipAuthenticationPublicKeyInfo.toProtocolOIDString(oid:oid)
+    }
+
+    // The keyid refers to a specific key if there are multiple otherwise if not set, only one key is present so set to 0
+    public func getKeyId() -> Int {
+        return keyId ?? 0
+    }
+    
+
+    private static func toProtocolOIDString(oid : String) -> String {
+        if ID_PK_DH_OID == oid {
+            return "id-PK-DH"
+        }
+        if ID_PK_ECDH_OID == oid {
+            return "id-PK-ECDH"
+        }
+        
+        return oid
+    }
+
+}