cryptnox-id-cli 1.0.2__py3-none-any.whl

cryptnox_id_cli/__init__.py

@@ -0,0 +1,22 @@
+"""cryptnox-id — CLI for the Cryptnox multi-applet smartcard.
+
+Three independent functions live on one physical card and are managed by
+separate, isolated modules (see ``applets/``):
+
+* PIV     — OpenFIPS201 2.0.0 FIPS JavaCard applet (contact).
+* FIDO2   — CTAP 2.1 JavaCard applet (needs Administrator elevation on Windows).
+* DESFire — MIFARE DESFire EV2/EV3 contactless function (needs a contactless reader).
+
+Covered: PC/SC transport and diagnostics (``readers``/``info``/``doctor``), full
+PIV personalization and factory pre-personalization over SCP02/SCP03, FIDO2
+credential and policy management, DESFire application/file/key operations
+including EV3 Secure Dynamic Messaging, and read-only genuineness/attestation
+verification.
+"""
+
+__version__ = "1.0.2"
+
+#: Primary console command name. Single source of truth for every user-facing
+#: render of the CLI's name (usage/version, prompt, banner, messages). The
+#: ``cnx-id`` and ``cryptnox-id-card`` aliases are declared in pyproject.
+CLI_NAME = "cryptnox-id"

cryptnox_id_cli/__main__.py

@@ -0,0 +1,6 @@
+"""Allow ``python -m cryptnox_id_cli`` to invoke the CLI."""
+
+from cryptnox_id_cli.cli.main import main
+
+if __name__ == "__main__":
+    main()

cryptnox_id_cli/applets/__init__.py

@@ -0,0 +1,2 @@
+"""Per-applet modules. The three applets are independent and isolated:
+``piv`` (this phase), ``fido`` and ``mifare`` (later phases)."""

cryptnox_id_cli/applets/fido/__init__.py

@@ -0,0 +1,7 @@
+"""FIDO2 / CTAP 2.1 applet support (Cryptnox NXP applet).
+
+Phase 7A scope is read-only: SELECT, authenticatorGetInfo, ping, clientPIN status,
+and CTAP error decoding. On Windows the OS blocks PC/SC access to the FIDO CTAP
+AID for non-elevated processes, so these commands require an Administrator
+terminal (the CLI detects the block and says so).
+"""

cryptnox_id_cli/applets/fido/authdata.py

@@ -0,0 +1,81 @@
+"""Parse CTAP2 authenticatorData (the signed structure inside make/getAssertion).
+
+Layout: ``rpIdHash(32) || flags(1) || signCount(4 BE) || [attestedCredentialData] ||
+[extensions]``. Attested credential data (present when the AT flag 0x40 is set) is
+``aaguid(16) || credentialIdLength(2 BE) || credentialId || credentialPublicKey(COSE)``.
+"""
+
+from __future__ import annotations
+
+import io
+from dataclasses import dataclass
+
+import cbor2
+
+FLAG_UP = 0x01  # user present
+FLAG_UV = 0x04  # user verified
+FLAG_AT = 0x40  # attested credential data included
+FLAG_ED = 0x80  # extension data included
+
+
+@dataclass
+class AuthenticatorData:
+    rp_id_hash: bytes
+    flags: int
+    sign_count: int
+    aaguid: bytes | None = None
+    credential_id: bytes | None = None
+    credential_public_key: dict | None = None
+
+    @property
+    def user_present(self) -> bool:
+        return bool(self.flags & FLAG_UP)
+
+    @property
+    def user_verified(self) -> bool:
+        return bool(self.flags & FLAG_UV)
+
+
+def parse_authenticator_data(data: bytes) -> AuthenticatorData:
+    if len(data) < 37:
+        raise ValueError(f"authenticatorData too short ({len(data)} bytes)")
+    ad = AuthenticatorData(
+        rp_id_hash=data[:32],
+        flags=data[32],
+        sign_count=int.from_bytes(data[33:37], "big"),
+    )
+    rest = data[37:]
+    if ad.flags & FLAG_AT:
+        if len(rest) < 18:
+            raise ValueError("attested credential data truncated")
+        ad.aaguid = rest[:16]
+        cid_len = int.from_bytes(rest[16:18], "big")
+        if len(rest) < 18 + cid_len:
+            raise ValueError("credentialId truncated")
+        ad.credential_id = rest[18 : 18 + cid_len]
+        # The COSE public key is one CBOR item; extensions (if any) follow it.
+        decoder = cbor2.CBORDecoder(io.BytesIO(rest[18 + cid_len :]))
+        key = decoder.decode()
+        if not isinstance(key, dict):
+            raise ValueError("credentialPublicKey is not a COSE map")
+        ad.credential_public_key = key
+    return ad
+
+
+def verify_es256_assertion(
+    cose_public_key: dict, auth_data: bytes, client_data_hash: bytes, signature: bytes
+) -> bool:
+    """Verify a getAssertion ES256 signature over ``authData || clientDataHash``."""
+    from cryptography.exceptions import InvalidSignature
+    from cryptography.hazmat.primitives import hashes
+    from cryptography.hazmat.primitives.asymmetric import ec
+
+    from cryptnox_id_cli.applets.fido.pinproto import cose_to_public_key
+
+    try:
+        cose_to_public_key(cose_public_key).verify(
+            signature, auth_data + client_data_hash, ec.ECDSA(hashes.SHA256())
+        )
+        return True
+    except InvalidSignature:
+        return False

cryptnox_id_cli/applets/fido/constants.py

@@ -0,0 +1,155 @@
+"""FIDO2 / CTAP2 constants (verified against the applet source + Android client)."""
+
+from __future__ import annotations
+
+FIDO_AID = bytes.fromhex("A0000006472F0001")
+
+# APDU instructions (CLA 0x80).
+INS_CTAP_MSG = 0x10
+INS_CTAP_GET_RESPONSE = 0x11
+
+# CTAP2 command bytes.
+CTAP_MAKE_CREDENTIAL = 0x01
+CTAP_GET_ASSERTION = 0x02
+CTAP_GET_INFO = 0x04
+CTAP_CLIENT_PIN = 0x06
+CTAP_RESET = 0x07
+CTAP_GET_NEXT_ASSERTION = 0x08
+CTAP_CREDENTIAL_MANAGEMENT = 0x0A
+CTAP_AUTHENTICATOR_CONFIG = 0x0D
+
+# authenticatorClientPIN sub-commands.
+PIN_GET_RETRIES = 0x01
+PIN_GET_KEY_AGREEMENT = 0x02
+PIN_SET_PIN = 0x03
+PIN_CHANGE_PIN = 0x04
+PIN_GET_PIN_TOKEN = 0x05
+PIN_GET_UV_RETRIES = 0x07
+PIN_GET_TOKEN_USING_PIN = 0x09  # getPinUvAuthTokenUsingPinWithPermissions
+
+# authenticatorClientPIN request map keys.
+CP_PROTOCOL = 0x01
+CP_SUBCOMMAND = 0x02
+CP_KEY_AGREEMENT = 0x03
+CP_PIN_UV_AUTH_PARAM = 0x04
+CP_NEW_PIN_ENC = 0x05
+CP_PIN_HASH_ENC = 0x06
+CP_PERMISSIONS = 0x09
+CP_RP_ID = 0x0A
+
+# authenticatorClientPIN response map keys.
+CPR_KEY_AGREEMENT = 0x01
+CPR_PIN_UV_AUTH_TOKEN = 0x02
+CPR_PIN_RETRIES = 0x03
+CPR_POWER_CYCLE_STATE = 0x04
+CPR_UV_RETRIES = 0x05
+
+# pinUvAuthToken permissions.
+PERM_MAKE_CREDENTIAL = 0x01
+PERM_GET_ASSERTION = 0x02
+PERM_CREDENTIAL_MGMT = 0x04
+PERM_BIO_ENROLLMENT = 0x08
+PERM_LARGE_BLOB = 0x10
+PERM_AUTHENTICATOR_CONFIG = 0x20
+
+# authenticatorCredentialManagement (0x0A) request map keys.
+CM_SUBCOMMAND = 0x01
+CM_SUBCOMMAND_PARAMS = 0x02
+CM_PIN_UV_AUTH_PROTOCOL = 0x03
+CM_PIN_UV_AUTH_PARAM = 0x04
+# sub-commands
+CM_GET_CREDS_METADATA = 0x01
+CM_ENUMERATE_RPS_BEGIN = 0x02
+CM_ENUMERATE_RPS_NEXT = 0x03
+CM_ENUMERATE_CREDS_BEGIN = 0x04
+CM_ENUMERATE_CREDS_NEXT = 0x05
+CM_DELETE_CREDENTIAL = 0x06
+CM_UPDATE_USER_INFO = 0x07
+# sub-command params keys
+CMP_RP_ID_HASH = 0x01
+CMP_CREDENTIAL_ID = 0x02
+CMP_USER = 0x03
+# response keys
+CMR_EXISTING_RESIDENT_COUNT = 0x01
+CMR_MAX_REMAINING = 0x02
+CMR_RP = 0x03
+CMR_RP_ID_HASH = 0x04
+CMR_TOTAL_RPS = 0x05
+CMR_USER = 0x06
+CMR_CREDENTIAL_ID = 0x07
+CMR_PUBLIC_KEY = 0x08
+CMR_TOTAL_CREDENTIALS = 0x09
+CMR_CRED_PROTECT = 0x0A
+
+# authenticatorConfig (0x0D) request map keys.
+AC_SUBCOMMAND = 0x01
+AC_SUBCOMMAND_PARAMS = 0x02
+AC_PIN_UV_AUTH_PROTOCOL = 0x03
+AC_PIN_UV_AUTH_PARAM = 0x04
+# sub-commands
+AC_ENABLE_ENTERPRISE_ATTESTATION = 0x01
+AC_TOGGLE_ALWAYS_UV = 0x02
+AC_SET_MIN_PIN_LENGTH = 0x03
+# setMinPINLength sub-command params keys
+ACP_NEW_MIN_PIN_LENGTH = 0x01
+ACP_MIN_PIN_LENGTH_RP_IDS = 0x02
+ACP_FORCE_CHANGE_PIN = 0x03
+
+# COSE key labels + values (EC2 / P-256).
+COSE_KTY = 1
+COSE_ALG = 3
+COSE_CRV = -1
+COSE_X = -2
+COSE_Y = -3
+COSE_KTY_EC2 = 2
+COSE_CRV_P256 = 1
+COSE_ALG_ECDH_ES_HKDF256 = -25
+COSE_ALG_ES256 = -7
+
+# authenticatorMakeCredential request map keys.
+MC_CLIENT_DATA_HASH = 0x01
+MC_RP = 0x02
+MC_USER = 0x03
+MC_PUB_KEY_CRED_PARAMS = 0x04
+MC_EXCLUDE_LIST = 0x05
+MC_OPTIONS = 0x07
+MC_PIN_UV_AUTH_PARAM = 0x08
+MC_PIN_UV_AUTH_PROTOCOL = 0x09
+# response keys
+MCR_FMT = 0x01
+MCR_AUTH_DATA = 0x02
+MCR_ATT_STMT = 0x03
+
+# authenticatorGetAssertion request map keys.
+GA_RP_ID = 0x01
+GA_CLIENT_DATA_HASH = 0x02
+GA_ALLOW_LIST = 0x03
+GA_OPTIONS = 0x05
+GA_PIN_UV_AUTH_PARAM = 0x06
+GA_PIN_UV_AUTH_PROTOCOL = 0x07
+# response keys
+GAR_CREDENTIAL = 0x01
+GAR_AUTH_DATA = 0x02
+GAR_SIGNATURE = 0x03
+GAR_USER = 0x04
+GAR_NUMBER_OF_CREDENTIALS = 0x05
+
+# authenticatorGetInfo response map keys (CTAP 2.1).
+INFO_VERSIONS = 0x01
+INFO_EXTENSIONS = 0x02
+INFO_AAGUID = 0x03
+INFO_OPTIONS = 0x04
+INFO_MAX_MSG_SIZE = 0x05
+INFO_PIN_UV_AUTH_PROTOCOLS = 0x06
+INFO_MAX_CREDS_IN_LIST = 0x07
+INFO_MAX_CRED_ID_LENGTH = 0x08
+INFO_TRANSPORTS = 0x09
+INFO_ALGORITHMS = 0x0A
+INFO_MIN_PIN_LENGTH = 0x0D
+INFO_FIRMWARE_VERSION = 0x0E
+
+# Known Cryptnox AAGUIDs (from the Android client).
+CRYPTNOX_AAGUIDS = {
+    "9c835346796b4c278898d6032f515cc5",
+    "1d1b4e3376a147fb97a014b10d0933f1",
+}