cryptnox-id-cli 1.0.2__py3-none-any.whl

cryptnox_id_cli/transport/scp03.py

@@ -0,0 +1,213 @@
+"""SCP03 secure channel (GlobalPlatform Amendment D), used for PIV admin commands.
+
+Implements the SP 800-108 counter-mode KDF (AES-CMAC PRF), session-key derivation,
+card/host cryptograms, C-MAC chaining and C-ENC command wrapping. Response security
+(R-MAC/R-ENC) is not requested by default (security level 0x03 = C-MAC + C-DECRYPTION).
+
+Correctness is proven end-to-end by the card: if our derived keys are wrong, the card
+cryptogram check fails locally and EXTERNAL AUTHENTICATE is refused by the card.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from cryptography.hazmat.primitives.cmac import CMAC
+
+from cryptnox_id_cli.transport.apdu import APDU, Response
+from cryptnox_id_cli.transport.errors import Scp03Error
+
+_BLOCK = 16
+
+# KDF derivation constants (GP Amd D, Table 4-1).
+_DERIV_CARD_CRYPTOGRAM = 0x00
+_DERIV_HOST_CRYPTOGRAM = 0x01
+_DERIV_S_ENC = 0x04
+_DERIV_S_MAC = 0x06
+_DERIV_S_RMAC = 0x07
+
+# Security-level bits (EXTERNAL AUTHENTICATE P1).
+SL_C_MAC = 0x01
+SL_C_DECRYPTION = 0x02
+SL_R_MAC = 0x10
+SL_R_ENCRYPTION = 0x20
+SL_CMAC_CENC = SL_C_MAC | SL_C_DECRYPTION  # 0x03
+
+
+def _aes_cmac(key: bytes, data: bytes) -> bytes:
+    c = CMAC(algorithms.AES(key))
+    c.update(data)
+    return c.finalize()
+
+
+def _aes_ecb(key: bytes, block: bytes) -> bytes:
+    enc = Cipher(algorithms.AES(key), modes.ECB()).encryptor()  # noqa: S305 - single-block ICV
+    return enc.update(block) + enc.finalize()
+
+
+def _aes_cbc_encrypt(key: bytes, iv: bytes, data: bytes) -> bytes:
+    enc = Cipher(algorithms.AES(key), modes.CBC(iv)).encryptor()
+    return enc.update(data) + enc.finalize()
+
+
+def _kdf(key: bytes, constant: int, context: bytes, length_bits: int) -> bytes:
+    """SP 800-108 counter-mode KDF with an AES-CMAC PRF (SCP03 flavour)."""
+    out = b""
+    counter = 1
+    while len(out) * 8 < length_bits:
+        block = (
+            b"\x00" * 11
+            + bytes([constant])
+            + b"\x00"
+            + length_bits.to_bytes(2, "big")
+            + bytes([counter])
+            + context
+        )
+        out += _aes_cmac(key, block)
+        counter += 1
+    return out[: length_bits // 8]
+
+
+def _pad80(data: bytes) -> bytes:
+    """ISO 7816-4 / SCP03 padding: 0x80 then 0x00s to the next block boundary."""
+    padded = data + b"\x80"
+    if len(padded) % _BLOCK:
+        padded += b"\x00" * (_BLOCK - len(padded) % _BLOCK)
+    return padded
+
+
+@dataclass
+class Scp03Keys:
+    enc: bytes
+    mac: bytes
+    dek: bytes
+
+    @classmethod
+    def same(cls, key: bytes) -> Scp03Keys:
+        return cls(key, key, key)
+
+    @property
+    def key_bits(self) -> int:
+        return len(self.enc) * 8
+
+
+class Scp03Session:
+    """An open SCP03 session: holds session keys and wraps/unwraps command APDUs."""
+
+    def __init__(self, s_enc: bytes, s_mac: bytes, s_rmac: bytes, security_level: int) -> None:
+        self.s_enc = s_enc
+        self.s_mac = s_mac
+        self.s_rmac = s_rmac
+        self.security_level = security_level
+        self.mac_chaining = b"\x00" * _BLOCK
+        self.encrypt_counter = 1
+
+    def _encrypt(self, data: bytes) -> bytes:
+        if not data:
+            return data
+        icv = _aes_ecb(self.s_enc, self.encrypt_counter.to_bytes(_BLOCK, "big"))
+        return _aes_cbc_encrypt(self.s_enc, icv, _pad80(data))
+
+    def wrap(self, apdu: APDU) -> bytes:
+        """Return the wrapped command bytes (CLA|0x04, optional C-ENC, C-MAC appended).
+
+        Supports short and extended Lc (the pre-perso BULK is ~316 bytes -> extended).
+        The C-MAC is computed over the command exactly as transmitted (incl. the Lc
+        field), then its first 8 bytes are appended.
+        """
+        data = apdu.data
+        if self.security_level & SL_C_DECRYPTION:
+            data = self._encrypt(data)
+        lc = len(data) + 8  # +8 for the C-MAC
+        cla = apdu.cla | 0x04
+        if lc <= 0xFF:
+            header = bytes([cla, apdu.ins, apdu.p1, apdu.p2, lc])
+            le_bytes = (
+                b"" if apdu.le is None else bytes([0x00 if apdu.le >= 256 else apdu.le & 0xFF])
+            )
+        else:  # extended length
+            header = bytes([cla, apdu.ins, apdu.p1, apdu.p2, 0x00, (lc >> 8) & 0xFF, lc & 0xFF])
+            le_bytes = b"" if apdu.le is None else (apdu.le & 0xFFFF).to_bytes(2, "big")
+        full_mac = _aes_cmac(self.s_mac, self.mac_chaining + header + data)
+        self.mac_chaining = full_mac
+        self.encrypt_counter += 1
+        return header + data + full_mac[:8] + le_bytes
+
+    def unwrap(self, resp: Response) -> Response:
+        """With level 0x03 the response is plaintext; pass it through."""
+        if self.security_level & (SL_R_MAC | SL_R_ENCRYPTION):
+            raise Scp03Error("R-MAC/R-ENC responses are not implemented")
+        return resp
+
+
+def derive_session_keys(
+    keys: Scp03Keys, host_challenge: bytes, card_challenge: bytes
+) -> tuple[bytes, bytes, bytes]:
+    context = host_challenge + card_challenge
+    bits = keys.key_bits
+    s_enc = _kdf(keys.enc, _DERIV_S_ENC, context, bits)
+    s_mac = _kdf(keys.mac, _DERIV_S_MAC, context, bits)
+    s_rmac = _kdf(keys.mac, _DERIV_S_RMAC, context, bits)
+    return s_enc, s_mac, s_rmac
+
+
+def _cryptogram(s_mac: bytes, constant: int, host_challenge: bytes, card_challenge: bytes) -> bytes:
+    return _kdf(s_mac, constant, host_challenge + card_challenge, 64)
+
+
+def open_channel(
+    transmit,
+    keys: Scp03Keys,
+    *,
+    key_version: int = 0,
+    security_level: int = SL_CMAC_CENC,
+    host_challenge: bytes | None = None,
+    init_response: Response | None = None,
+) -> Scp03Session:
+    """Run INITIALIZE UPDATE + EXTERNAL AUTHENTICATE. ``transmit(APDU|bytes)->Response``.
+
+    If ``init_response`` is given (the caller already issued INITIALIZE UPDATE to
+    auto-detect the SCP version), it is reused with the matching ``host_challenge``
+    instead of issuing a second one.
+
+    Raises Scp03Error on a wrong key (card cryptogram mismatch) or a card rejection.
+    """
+    if init_response is None:
+        host_challenge = host_challenge or os.urandom(8)
+        resp = transmit(APDU(0x80, 0x50, key_version, 0x00, data=host_challenge, le=256))
+    else:
+        if host_challenge is None:
+            raise Scp03Error("host_challenge is required when init_response is supplied.")
+        resp = init_response
+    if not resp.ok:
+        raise Scp03Error(f"INITIALIZE UPDATE rejected (SW={resp.sw_hex()}).")
+    body = resp.data
+    if len(body) < 29:
+        raise Scp03Error(f"INITIALIZE UPDATE response too short ({len(body)} bytes).")
+    card_challenge = body[13:21]
+    card_cryptogram = body[21:29]
+
+    s_enc, s_mac, s_rmac = derive_session_keys(keys, host_challenge, card_challenge)
+
+    expected = _cryptogram(s_mac, _DERIV_CARD_CRYPTOGRAM, host_challenge, card_challenge)
+    if expected != card_cryptogram:
+        raise Scp03Error("Card cryptogram mismatch - the SCP03 keys are wrong for this card.")
+
+    session = Scp03Session(s_enc, s_mac, s_rmac, security_level)
+    host_cryptogram = _cryptogram(s_mac, _DERIV_HOST_CRYPTOGRAM, host_challenge, card_challenge)
+
+    # EXTERNAL AUTHENTICATE: CLA 0x84, Lc=0x10 (8-byte host cryptogram + 8-byte C-MAC).
+    header = bytes([0x84, 0x82, security_level, 0x00, 0x10])
+    full_mac = _aes_cmac(session.s_mac, session.mac_chaining + header + host_cryptogram)
+    session.mac_chaining = full_mac
+    ext_auth = header + host_cryptogram + full_mac[:8]
+
+    resp = transmit(ext_auth)
+    if not resp.ok:
+        raise Scp03Error(
+            f"EXTERNAL AUTHENTICATE rejected (SW={resp.sw_hex()}); "
+            "keys or security level may be wrong."
+        )
+    return session

cryptnox_id_cli/trust/__init__.py

@@ -0,0 +1,90 @@
+"""Pinned trust anchors for offline attestation-chain verification.
+
+PEM certificates dropped into ``trust/genuine/`` are bundled into the package (and the
+PyInstaller binary) and loaded here. Anchors are classified by inspection, not by filename:
+
+* self-issued (issuer == subject) **CA** certificates  -> **roots** (pinned anchors)
+* non-self-issued **CA** certificates                  -> **intermediates**
+
+A relying party trusts a chain only because it terminates at one of these pinned roots — never
+because a root happens to appear in a chain read off a card. If the directory is empty, the
+loaders return empty lists and callers must report that the chain cannot be verified rather
+than silently passing.
+
+The bundled set is the Cryptnox production PKI: ``CN=CRYPTNOX ROOT CA`` (the anchor) plus its
+intermediates. Only the root grants trust; the intermediates are shipped so chain building
+works offline when a card omits part of its chain.
+"""
+
+from __future__ import annotations
+
+import os
+from importlib.resources import files
+from pathlib import Path
+
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+
+_GENUINE_PKG = "cryptnox_id_cli.trust"
+_GENUINE_DIR = "genuine"
+
+#: Point this at a directory of PEM anchors to use a trust store without rebuilding
+#: the package - e.g. anchors fetched from the Cryptnox PKI, or a lab/dev CA. Its
+#: certificates are added to whatever ships bundled; it never disables the bundled set.
+TRUST_DIR_ENV = "CRYPTNOX_TRUST_DIR"
+
+
+def _parse_pem_dir(root) -> list[x509.Certificate]:
+    """Parse every ``*.pem`` in a directory (each file may hold >1 certificate)."""
+    out: list[x509.Certificate] = []
+    if not root.is_dir():
+        return out
+    for entry in sorted(root.iterdir(), key=lambda e: e.name):
+        if entry.name.lower().endswith(".pem") and entry.is_file():
+            out.extend(x509.load_pem_x509_certificates(entry.read_bytes()))
+    return out
+
+
+def _load_all(extra_dir: str | os.PathLike[str] | None = None) -> list[x509.Certificate]:
+    """Bundled anchors, plus any from ``$CRYPTNOX_TRUST_DIR`` and ``extra_dir``."""
+    out = _parse_pem_dir(files(_GENUINE_PKG).joinpath(_GENUINE_DIR))
+    for candidate in (os.environ.get(TRUST_DIR_ENV), extra_dir):
+        if candidate:
+            out.extend(_parse_pem_dir(Path(candidate)))
+    return out
+
+
+def _is_ca(cert: x509.Certificate) -> bool:
+    try:
+        return bool(cert.extensions.get_extension_for_class(x509.BasicConstraints).value.ca)
+    except x509.ExtensionNotFound:
+        return False
+
+
+def _der(cert: x509.Certificate) -> bytes:
+    return cert.public_bytes(serialization.Encoding.DER)
+
+
+def load_anchors(
+    extra_dir: str | os.PathLike[str] | None = None,
+) -> tuple[list[bytes], list[bytes]]:
+    """Return ``(roots_der, intermediates_der)`` from the configured trust store.
+
+    Sources, in order and additive: the bundled ``trust/genuine/``, the directory named
+    by ``$CRYPTNOX_TRUST_DIR``, then ``extra_dir``. Duplicates are collapsed, so the same
+    anchor supplied twice is harmless. Roots are self-issued CAs (the pinned anchors);
+    intermediates are the remaining CAs. An empty result means callers must report that
+    the chain cannot be verified - never that it passed.
+    """
+    roots: list[bytes] = []
+    intermediates: list[bytes] = []
+    seen: set[bytes] = set()
+    for cert in _load_all(extra_dir):
+        if not _is_ca(cert):
+            continue  # ignore non-CA material in the trust dir
+        der = _der(cert)
+        if der in seen:
+            continue
+        seen.add(der)
+        (roots if cert.issuer == cert.subject else intermediates).append(der)
+    return roots, intermediates

cryptnox_id_cli/trust/genuine/cryptnox-attestation-ca.pem

@@ -0,0 +1,18 @@
+# subject     : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX ATTESTATION CA
+# issuer      : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX INTERMEDIATE CA #2
+# not after   : Dec 30 14:55:00 2049 GMT
+# sha256 (DER): DCC01FEBE28E6A5B21AA443B3A5EE0DAEB284F0F5D612AD815586F56EAEC46E5
+-----BEGIN CERTIFICATE-----
+MIICLDCCAbKgAwIBAgIIUEneQtSD39UwCgYIKoZIzj0EAwMwWjELMAkGA1UEBhMC
+Q0gxDzANBgNVBAgTBkdFTkVWQTEUMBIGA1UEChMLQ1JZUFROT1ggU0ExJDAiBgNV
+BAMMG0NSWVBUTk9YIElOVEVSTUVESUFURSBDQSAjMjAeFw0yNjA2MjkxNDU1MDBa
+Fw00OTEyMzAxNDU1MDBaMFYxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIDAZHRU5FVkEx
+FDASBgNVBAoMC0NSWVBUTk9YIFNBMSAwHgYDVQQDDBdDUllQVE5PWCBBVFRFU1RB
+VElPTiBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABM2dnWQbl7PHnP3Y5bMP
+AD3kuhOj28tryE9uZSYcXFYJeqoAegRtMdoN0vzBopeDMevvfHPE5EODpJ5N1q7A
+wrWjZjBkMB8GA1UdIwQYMBaAFLOIBaait0D7A0fxVv5E2aPBeqmZMBIGA1UdEwEB
+/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRK99VS1M/S3cuq
+KYeBk5E0w7TfXzAKBggqhkjOPQQDAwNoADBlAjBLhsipCcuwxUZpGwfNW/UJNdhq
+td4PShNDeOLKS1YG2miJ3Q+HEv9oH4cM9cYV1hwCMQDUEGDsatjZXcnNCN4CFrRO
+sXrBy3Z3Z4Iipw9uFWfCJOLvGQA8cW+tXRFJ+DPxICA=
+-----END CERTIFICATE-----

cryptnox_id_cli/trust/genuine/cryptnox-dlt-cards-ca.pem

@@ -0,0 +1,17 @@
+# subject     : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX DLT CARDS CA
+# issuer      : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX INTERMEDIATE CA #2
+# not after   : Dec 30 23:59:00 2049 GMT
+# sha256 (DER): 474A05AB2FA4543CD4C03C2EBDC8140A29496E97F6D0F53FF72FEDC9D10BE3E0
+-----BEGIN CERTIFICATE-----
+MIICBDCCAYmgAwIBAgIIE3MdP3JzJZMwCgYIKoZIzj0EAwQwWjELMAkGA1UEBhMC
+Q0gxDzANBgNVBAgTBkdFTkVWQTEUMBIGA1UEChMLQ1JZUFROT1ggU0ExJDAiBgNV
+BAMMG0NSWVBUTk9YIElOVEVSTUVESUFURSBDQSAjMjAeFw0yMzA0MDkxNjQ4MDBa
+Fw00OTEyMzAyMzU5MDBaMFQxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIEwZHRU5FVkEx
+FDASBgNVBAoTC0NSWVBUTk9YIFNBMR4wHAYDVQQDExVDUllQVE5PWCBETFQgQ0FS
+RFMgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARkehEsKs9aSbUrMhy9z1qe
+owf8TM0zqni5uAVd2E0DrtqwLMcgp4DLH/KAr1B3SmzcFX76I16iUxGkK0z1fYhh
+oz8wPTAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBRgo23D82CwTUbrY+ZzvVla
+jaO+RjALBgNVHQ8EBAMCAQYwCgYIKoZIzj0EAwQDaQAwZgIxANVDF6ucXBS9+KlA
+3Po/tlMbVz5qttJgTGJhiGIbUqdIcSj5O9EdqBc0cl+G/bYZywIxAJSjBG01D0Qa
+L1qs8BGfmndV6g0vISjQYhXuwDQxVewN5It12yHlzlx0o+AIETxu+A==
+-----END CERTIFICATE-----

cryptnox_id_cli/trust/genuine/cryptnox-genuineness-ca.pem

@@ -0,0 +1,18 @@
+# subject     : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX GENUINENESS CA
+# issuer      : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX INTERMEDIATE CA #2
+# not after   : Dec 30 15:07:00 2049 GMT
+# sha256 (DER): 6B4F7DDE0366DF547FEB4AC66F79CD7C5AD56AB4A8EAD678EEBA293F48DBFDBB
+-----BEGIN CERTIFICATE-----
+MIICKzCCAbKgAwIBAgIIGQjzKGS8xbMwCgYIKoZIzj0EAwMwWjELMAkGA1UEBhMC
+Q0gxDzANBgNVBAgTBkdFTkVWQTEUMBIGA1UEChMLQ1JZUFROT1ggU0ExJDAiBgNV
+BAMMG0NSWVBUTk9YIElOVEVSTUVESUFURSBDQSAjMjAeFw0yNjA2MjkxNTA3MDBa
+Fw00OTEyMzAxNTA3MDBaMFYxCzAJBgNVBAYTAkNIMQ8wDQYDVQQIDAZHRU5FVkEx
+FDASBgNVBAoMC0NSWVBUTk9YIFNBMSAwHgYDVQQDDBdDUllQVE5PWCBHRU5VSU5F
+TkVTUyBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABEs4rWlxYxtChOWR3mTO
+9P1jlthn2Cv8p4mCOMI/uvm+bjbUVrtozu9wbtcY2kJUaRqKVzOI3H8enCea5L+v
+X/ujZjBkMB8GA1UdIwQYMBaAFLOIBaait0D7A0fxVv5E2aPBeqmZMBIGA1UdEwEB
+/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTx6oiDpR/k6AzR
+BjV2/PYc4viJrzAKBggqhkjOPQQDAwNnADBkAjBYqQrqfT/RvWzd4VmstWLf2Sba
+WAyoTW1VOD6YlJkAt/WlWa5xXFH5oSTjS7io3sMCMHsF+jDdVUe+3DmzOhJZa70b
++b0n0wAG9cWuGqUp9u1bqpYbvVIqXSKqFzG5vcpTMw==
+-----END CERTIFICATE-----

cryptnox_id_cli/trust/genuine/cryptnox-intermediate-ca-2.pem

@@ -0,0 +1,19 @@
+# subject     : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX INTERMEDIATE CA #2
+# issuer      : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX ROOT CA
+# not after   : Dec 30 23:59:00 2049 GMT
+# sha256 (DER): 94DB7D0A3EE6FAAB717C249E28370EF50E6CDF57DC930C878641D57E989B69BC
+-----BEGIN CERTIFICATE-----
+MIICPzCCAaGgAwIBAgIIXrvLbag/zUAwCgYIKoZIzj0EAwMwTzELMAkGA1UEBhMC
+Q0gxDzANBgNVBAgTBkdFTkVWQTEUMBIGA1UEChMLQ1JZUFROT1ggU0ExGTAXBgNV
+BAMTEENSWVBUTk9YIFJPT1QgQ0EwHhcNMjMwNDA5MTY0MjAwWhcNNDkxMjMwMjM1
+OTAwWjBaMQswCQYDVQQGEwJDSDEPMA0GA1UECBMGR0VORVZBMRQwEgYDVQQKEwtD
+UllQVE5PWCBTQTEkMCIGA1UEAwwbQ1JZUFROT1ggSU5URVJNRURJQVRFIENBICMy
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEEflDieulDZW610ppouL3ISytLWoUFbKl
+03SZDujzHps/mRbR2VGCn385vOHzEY+4LpB1aS8uhYwrOt5ELJtMpM1M0JIKwr2S
+dtOSv3iAzy0yAZq25id61an56sVZ/FP8oz8wPTALBgNVHQ8EBAMCAQYwDwYDVR0T
+BAgwBgEB/wIBATAdBgNVHQ4EFgQUs4gFpqK3QPsDR/FW/kTZo8F6qZkwCgYIKoZI
+zj0EAwMDgYsAMIGHAkIAwY7rXvM4h4XXMuXnZe/wjLc8kbPb8fx26v3ARY1ymb61
+G62WutOrEUG0SJr2qzwyyWBh6SSaz2W/PnTXGGCysM0CQU4IZwYuY2uW5c0fGKnK
+ecWkXTtARXiIjFn33zIbIcpwPHZ02zI2SH1pWSj6uRZBXqBQmtQY46nsNzjgUWge
++8vv
+-----END CERTIFICATE-----

cryptnox_id_cli/trust/genuine/cryptnox-intermediate-ca.pem

@@ -0,0 +1,19 @@
+# subject     : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX INTERMEDIATE CA
+# issuer      : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX ROOT CA
+# not after   : Dec 29 23:59:59 2049 GMT
+# sha256 (DER): 8CCF5B7AE498A2E3B7C21E9EB80843198380202C5AB57E60D2C1240587A050CA
+-----BEGIN CERTIFICATE-----
+MIICQTCCAaKgAwIBAgIGAIFDUXQrMAoGCCqGSM49BAMDME8xCzAJBgNVBAYTAkNI
+MQ8wDQYDVQQIEwZHRU5FVkExFDASBgNVBAoTC0NSWVBUTk9YIFNBMRkwFwYDVQQD
+ExBDUllQVE5PWCBST09UIENBMB4XDTIwMDYxNDAwMDAwMFoXDTQ5MTIyOTIzNTk1
+OVowVzELMAkGA1UEBhMCQ0gxDzANBgNVBAgTBkdFTkVWQTEUMBIGA1UEChMLQ1JZ
+UFROT1ggU0ExITAfBgNVBAMTGENSWVBUTk9YIElOVEVSTUVESUFURSBDQTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABGhcikuRYgNkak0pO8XgPWwG9RZXLQeqQEvKHfCn
+37gaR5U9rhp4W8JTbfU9t8CFgD0DxNXEJE9KGNnLAtL708hCHeo6S5oeznGDFn9J
+80bO7bdSDYHS5bzkEKPLNuamWKNFMEMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNV
+HQ4EFgQUdrEtUyWaMtpVAQ7JGqQp3jzNShcwDgYDVR0PAQH/BAQDAgEGMAoGCCqG
+SM49BAMDA4GMADCBiAJCAbWa/xcKx7KCcoUsp8SVZnWSxD8n91TqCJKajs7kJBz2
+DzvZZtPxKsMY38lH/8MYTC3wlRwdZc5s61EhlbdnOguBAkIBFmJLsOPyMQWUxmWl
+2zuAS7ctqU03U74C3UUHSKDH3WSJH+y3i/XsCs/FM+Dk/3FjOgQTxioaqIc3hrwh
+PlmorNo=
+-----END CERTIFICATE-----

cryptnox_id_cli/trust/genuine/cryptnox-root-ca.pem

@@ -0,0 +1,19 @@
+# subject     : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX ROOT CA
+# issuer      : C=CH, ST=GENEVA, O=CRYPTNOX SA, CN=CRYPTNOX ROOT CA
+# not after   : Dec 30 23:59:59 2049 GMT
+# sha256 (DER): 9EA907A7CBDA4E3D7F8EA06E6B6B759320DFE6F09272101F5E8EA85B3433EE2E
+-----BEGIN CERTIFICATE-----
+MIICWTCCAbqgAwIBAgIGAIFDUXQpMAoGCCqGSM49BAMEME8xCzAJBgNVBAYTAkNI
+MQ8wDQYDVQQIEwZHRU5FVkExFDASBgNVBAoTC0NSWVBUTk9YIFNBMRkwFwYDVQQD
+ExBDUllQVE5PWCBST09UIENBMB4XDTIwMDYxNDAwMDAwMFoXDTQ5MTIzMDIzNTk1
+OVowTzELMAkGA1UEBhMCQ0gxDzANBgNVBAgTBkdFTkVWQTEUMBIGA1UEChMLQ1JZ
+UFROT1ggU0ExGTAXBgNVBAMTEENSWVBUTk9YIFJPT1QgQ0EwgZswEAYHKoZIzj0C
+AQYFK4EEACMDgYYABAEJtmrMYc48nPSp0RRmEwT2U5aq0D1b3URLpmJP277ImEXK
+EbjVQA8P3UyTdZinELTQ5g6E+lnN3GhUWif2/VmSbQDnu9f+ebyIZfBabosKK3SQ
+Vv4KmuP9pb0f7P2vMPAUFJNZvKeH1DPtaZkFybMKZsg8CJEs7A9KW3RI/8QDpN1n
+J6M/MD0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUUnfLODDaku1o8CSuwWfWylj4
+OvAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMEA4GMADCBiAJCAKd8DeNhbPey
+fh7UD3M9lPp5a77M1LmC2M2o7zRiHlePt+Xcr/I/xGK124gEuHjbOfyanre63EMT
+uVW8ts5kR906AkIBgSIhJoENkMVFbeMRUDnDtbv+gKi+htqORGysid5sg2VvCX9Q
+fnUqBKtZVUBeQVPk3E5GUEamLk4jljdvlDGSXpU=
+-----END CERTIFICATE-----

cryptnox_id_cli/util/__init__.py

@@ -0,0 +1 @@
+"""Low-level utilities shared across the CLI (hex, BER-TLV)."""

cryptnox_id_cli/util/hexutil.py

@@ -0,0 +1,36 @@
+"""Hex helpers. Centralised so formatting stays consistent everywhere."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+
+def to_hex(data: Iterable[int] | bytes | bytearray, *, sep: str = "") -> str:
+    """Render bytes as uppercase hex, optionally separated (e.g. ``sep=" "``)."""
+    b = bytes(data)
+    if sep:
+        return sep.join(f"{x:02X}" for x in b)
+    return b.hex().upper()
+
+
+def from_hex(text: str) -> bytes:
+    """Parse a hex string, tolerating spaces, colons and ``0x`` prefixes."""
+    cleaned = (
+        text.strip()
+        .replace("0x", "")
+        .replace("0X", "")
+        .replace(" ", "")
+        .replace(":", "")
+        .replace("-", "")
+    )
+    if len(cleaned) % 2 != 0:
+        raise ValueError(f"hex string has an odd number of digits: {text!r}")
+    try:
+        return bytes.fromhex(cleaned)
+    except ValueError as exc:
+        raise ValueError(f"invalid hex string: {text!r}") from exc
+
+
+def to_list(data: bytes | bytearray | Iterable[int]) -> list[int]:
+    """pyscard wants ``list[int]`` for APDUs."""
+    return list(bytes(data))

cryptnox_id_cli/util/tlv.py

@@ -0,0 +1,144 @@
+"""A small, dependency-free BER-TLV parser.
+
+PIV data objects and the Application Property Template use BER-TLV with
+multi-byte tags (e.g. ``5FC102``, ``7F61``) and short/long length forms. We need
+read-only parsing only; this stays intentionally minimal and well-tested.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+@dataclass
+class TLV:
+    tag: int
+    value: bytes
+    children: list[TLV] = field(default_factory=list)
+
+    @property
+    def constructed(self) -> bool:
+        """True if the tag's constructed bit (0x20 in the leading byte) is set."""
+        lead = self.tag
+        while lead > 0xFF:
+            lead >>= 8
+        return bool(lead & 0x20)
+
+    def tag_hex(self) -> str:
+        length = max(1, (self.tag.bit_length() + 7) // 8)
+        return self.tag.to_bytes(length, "big").hex().upper()
+
+
+def _read_tag(data: bytes, off: int) -> tuple[int, int]:
+    if off >= len(data):
+        raise ValueError("truncated tag")
+    start = off
+    first = data[off]
+    off += 1
+    tag = first
+    if (first & 0x1F) == 0x1F:  # multi-byte tag
+        while True:
+            if off >= len(data):
+                raise ValueError("truncated multi-byte tag")
+            b = data[off]
+            tag = (tag << 8) | b
+            off += 1
+            if not (b & 0x80):
+                break
+    _ = start
+    return tag, off
+
+
+def _read_len(data: bytes, off: int) -> tuple[int, int]:
+    if off >= len(data):
+        raise ValueError("truncated length")
+    first = data[off]
+    off += 1
+    if first < 0x80:
+        return first, off
+    num = first & 0x7F
+    if num == 0 or num > 4:
+        raise ValueError(f"unsupported BER length form: 0x{first:02X}")
+    if off + num > len(data):
+        raise ValueError("truncated length field")
+    length = int.from_bytes(data[off : off + num], "big")
+    return length, off + num
+
+
+def parse(data: bytes | bytearray, *, recurse: bool = True) -> list[TLV]:
+    """Parse a concatenation of TLVs at the top level."""
+    data = bytes(data)
+    out: list[TLV] = []
+    off = 0
+    n = len(data)
+    while off < n:
+        tag, off = _read_tag(data, off)
+        length, off = _read_len(data, off)
+        if off + length > n:
+            raise ValueError("TLV value extends beyond buffer")
+        value = data[off : off + length]
+        off += length
+        node = TLV(tag=tag, value=value)
+        if recurse and node.constructed:
+            try:
+                node.children = parse(value, recurse=True)
+            except ValueError:
+                node.children = []  # not actually constructed payload; keep raw value
+        out.append(node)
+    return out
+
+
+def find(tlvs: list[TLV], tag: int) -> TLV | None:
+    """Depth-first search for the first TLV with ``tag``."""
+    for t in tlvs:
+        if t.tag == tag:
+            return t
+        if t.children:
+            hit = find(t.children, tag)
+            if hit is not None:
+                return hit
+    return None
+
+
+# --------------------------------------------------------------------------- #
+# Encoders (BER-TLV) — mirror the applet's perso toolkit byte-for-byte.        #
+# --------------------------------------------------------------------------- #
+def encode_tag(tag: int) -> bytes:
+    """Encode a numeric tag big-endian by its natural byte width (1..3 bytes)."""
+    if tag < 0:
+        raise ValueError("tag must be non-negative")
+    if tag <= 0xFF:
+        return bytes([tag])
+    if tag <= 0xFFFF:
+        return bytes([(tag >> 8) & 0xFF, tag & 0xFF])
+    if tag <= 0xFFFFFF:
+        return bytes([(tag >> 16) & 0xFF, (tag >> 8) & 0xFF, tag & 0xFF])
+    raise ValueError(f"tag too large: {tag:#x}")
+
+
+def encode_length(n: int) -> bytes:
+    """BER length: short form < 0x80, else long form (0x81/0x82/0x83 + bytes)."""
+    if n < 0x80:
+        return bytes([n])
+    if n < 0x100:
+        return bytes([0x81, n])
+    if n < 0x10000:
+        return bytes([0x82, (n >> 8) & 0xFF, n & 0xFF])
+    if n < 0x1000000:
+        return bytes([0x83, (n >> 16) & 0xFF, (n >> 8) & 0xFF, n & 0xFF])
+    raise ValueError(f"value too long: {n}")
+
+
+def build(tag: int, value: bytes = b"") -> bytes:
+    """Build a single primitive/constructed TLV."""
+    value = bytes(value)
+    return encode_tag(tag) + encode_length(len(value)) + value
+
+
+def concat(*parts: bytes) -> bytes:
+    return b"".join(bytes(p) for p in parts)
+
+
+def build_constructed(tag: int, *children: bytes) -> bytes:
+    """Build a constructed TLV whose value is the concatenation of children."""
+    return build(tag, concat(*children))