From d21997764fd8e8feaf53745f02dd940e23200506 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BD=D1=82=D0=BE=D0=BD=20=D0=A2=D1=80=D0=BE=D1=88?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Mon, 24 Aug 2026 21:12:24 +0300 Subject: [PATCH] Client-side SCP80 decryption: pure-JS 3DES/AES with user-supplied keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds optional decryption of ciphered secured packets, entirely in the browser — the key never leaves the frontend. - decode.py: _decode_secured_packet exposes 'cipher_block' (the contiguous on-wire ciphered octets CNTR..end, ready for CBC) and raw kic/kid bytes for algorithm selection. Additive only. - index.html: pure-JS DES/3DES core (FIPS 46-3 bit-array tables, parity ignored) + CBC; AES-CBC via native SubtleCrypto; both with zero IV per TS 102 225. decryptSecured() picks the algorithm from the KIc nibble (02 AES-CBC, 05 3DES-2K, 09 3DES-3K, 01 DES) with key-length validation. - UI: ciphered packets show a key-hex input + Decrypt strip below the detail table; keys are memoized per key-set for the session in an in-memory OTA_KEYS map — never sent to the server, never persisted. - Decrypted results cached by cipher_block (survive live-polling re-renders); plaintext rows rendered as CNTR/PCNTR/RC/Secured data (decrypted) alongside the ciphertext; wrong-key guard via the decrypted padding counter (PCNTR > remaining → "invalid padding"). - 3DES implementation validated byte-identical against openssl des-ede3-cbc (3-key, 2-key ×3 random vectors, single-key). No CC verification (out of scope). Tests: +2 (cipher_block contiguity, AES registry guard) — 350 total. Version 1.19.0, SW cache simtrace-analyser-v27. --- frontend/index.html | 222 ++++++++++++++++++++++++++++- frontend/sw.js | 2 +- pyproject.toml | 2 +- simtrace2_pysniff/__init__.py | 2 +- simtrace2_pysniff/server/decode.py | 6 + tests/test_decode.py | 22 +++ tests/test_pcap_import.py | 2 +- 7 files changed, 253 insertions(+), 5 deletions(-) diff --git a/frontend/index.html b/frontend/index.html index f01e256..f7db758 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -147,6 +147,9 @@ body { font: 14px/1.5 system-ui, sans-serif; background: var(--bg); color: var(- .detail-header { display: flex; align-items: center; justify-content: space-between; padding: 8px 12px; background: var(--bg-input); border-bottom: 1px solid var(--border); } [data-theme="light"] .detail-header { background: #dbeafe; } .detail-header strong { font-size: 13px; } +.decrypt-strip { padding: 6px 12px; border-top: 1px solid var(--border); background: var(--bg-panel); font-size: 12px; display: flex; gap: 6px; align-items: center; flex-wrap: wrap; } +.decrypt-strip input { background: var(--bg-input); color: var(--text); border: 1px solid var(--border); border-radius: 4px; padding: 3px 8px; font-family: monospace; width: 260px; } +.decrypt-strip button { background: var(--accent); color: #fff; border: none; border-radius: 4px; padding: 4px 10px; cursor: pointer; font-weight: 600; } .detail-body { padding: 8px 12px; font-family: monospace; font-size: 12px; line-height: 1.6; } .detail-body table { width: 100%; border-collapse: collapse; } .detail-body td { padding: 1px 8px; vertical-align: top; } @@ -485,6 +488,171 @@ function detail_time_html(msg) { return abs ? `${fmt_elapsed(msg.elapsed)} · ${abs}` : fmt_elapsed(msg.elapsed); } +// ──────────────────── SCP80 decryption (client-side only) ──────────────────── +// Keys are entered per packet, memoized by key-set for the session, held +// in-memory only and never sent to the server. +const OTA_KEYS = {}; // key-set number -> key hex +const DECRYPT_CACHE = {}; // cipher_block hex -> {cntr,pcntr,rc,data,pad} | {error} + +function hexToBytes(h) { + const o = []; + for (let i = 0; i + 1 < h.length; i += 2) o.push(parseInt(h.substr(i, 2), 16)); + return o; +} +function bytesToHex(b) { + return (b || []).map(x => x.toString(16).padStart(2, '0')).join('').toUpperCase(); +} + +// ── DES / 3DES core (FIPS 46-3 tables, bit-array implementation) ── +const _PC1 = [57,49,41,33,25,17,9,1,58,50,42,34,26,18,10,2,59,51,43,35,27,19,11,3,60,52,44,36,63,55,47,39,31,23,15,7,62,54,46,38,30,22,14,6,61,53,45,37,29,21,13,5,28,20,12,4]; +const _PC2 = [14,17,11,24,1,5,3,28,15,6,21,10,23,19,12,4,26,8,16,7,27,20,13,2,41,52,31,37,47,55,30,40,51,45,33,48,44,49,39,56,34,53,46,42,50,36,29,32]; +const _SHIFTS = [1,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1]; +const _IP = [58,50,42,34,26,18,10,2,60,52,44,36,28,20,12,4,62,54,46,38,30,22,14,6,64,56,48,40,32,24,16,8,57,49,41,33,25,17,9,1,59,51,43,35,27,19,11,3,61,53,45,37,29,21,13,5,63,55,47,39,31,23,15,7]; +const _FP = [40,8,48,16,56,24,64,32,39,7,47,15,55,23,63,31,38,6,46,14,54,22,62,30,37,5,45,13,53,21,61,29,36,4,44,12,52,20,60,28,35,3,43,11,51,19,59,27,34,2,42,10,50,18,58,26,33,1,41,9,49,17,57,25]; +const _EXP = [32,1,2,3,4,5,4,5,6,7,8,9,8,9,10,11,12,13,12,13,14,15,16,17,16,17,18,19,20,21,20,21,22,23,24,25,24,25,26,27,28,29,28,29,30,31,32,1]; +const _PP = [16,7,20,21,29,12,28,17,1,15,23,26,5,18,31,10,2,8,24,14,32,27,3,9,19,13,30,6,22,11,4,25]; +const _SB = [ + [14,4,13,1,2,15,11,8,3,10,6,12,5,9,0,7,0,15,7,4,14,2,13,1,10,6,12,11,9,5,3,8,4,1,14,8,13,6,2,11,15,12,9,7,3,10,5,0,15,12,8,2,4,9,1,7,5,11,3,14,10,0,6,13], + [15,1,8,14,6,11,3,4,9,7,2,13,12,0,5,10,3,13,4,7,15,2,8,14,12,0,1,10,6,9,11,5,0,14,7,11,10,4,13,1,5,8,12,6,9,3,2,15,13,8,10,1,3,15,4,2,11,6,7,12,0,5,14,9], + [10,0,9,14,6,3,15,5,1,13,12,7,11,4,2,8,13,7,0,9,3,4,6,10,2,8,5,14,12,11,15,1,13,6,4,9,8,15,3,0,11,1,2,12,5,10,14,7,1,10,13,0,6,9,8,7,4,15,14,3,11,5,2,12], + [7,13,14,3,0,6,9,10,1,2,8,5,11,12,4,15,13,8,11,5,6,15,0,3,4,7,2,12,1,10,14,9,10,6,9,0,12,11,7,13,15,1,3,14,5,2,8,4,3,15,0,6,10,1,13,8,9,4,5,11,12,7,2,14], + [2,12,4,1,7,10,11,6,8,5,3,15,13,0,14,9,14,11,2,12,4,7,13,1,5,0,15,10,3,9,8,6,4,2,1,11,10,13,7,8,15,9,12,5,6,3,0,14,11,8,12,7,1,14,2,13,6,15,0,9,10,4,5,3], + [12,1,10,15,9,2,6,8,0,13,3,4,14,7,5,11,10,15,4,2,7,12,9,5,6,1,13,14,0,11,3,8,9,14,15,5,2,8,12,3,7,0,4,10,1,13,11,6,4,3,2,12,9,5,15,10,11,14,1,7,6,0,8,13], + [4,11,2,14,15,0,8,13,3,12,9,7,5,10,6,1,13,0,11,7,4,9,1,10,14,3,5,12,2,15,8,6,1,4,11,13,12,3,7,14,10,15,6,8,0,5,9,2,6,11,13,8,1,4,10,7,9,5,0,15,14,2,3,12], + [13,2,8,4,6,15,11,1,10,9,3,14,5,0,12,7,1,15,13,8,10,3,7,4,12,5,6,11,0,14,9,2,7,11,4,1,9,12,14,2,0,6,10,13,15,3,5,8,2,1,14,7,4,10,8,13,15,12,9,0,3,5,6,11], +]; + +function _permute(tab, bits) { + const out = new Array(tab.length); + for (let i = 0; i < tab.length; i++) out[i] = bits[tab[i] - 1]; + return out; +} +function _xorArr(a, b) { + const o = new Array(a.length); + for (let i = 0; i < a.length; i++) o[i] = a[i] ^ b[i]; + return o; +} +function _rol28(bits, n) { + const o = new Array(28); + for (let i = 0; i < 28; i++) o[i] = bits[(i + n) % 28]; + return o; +} +function _bytesToBits(bytes) { + const bits = []; + for (const b of bytes) for (let j = 7; j >= 0; j--) bits.push((b >> j) & 1); + return bits; +} +function _bitsToBytes(bits) { + const out = []; + for (let i = 0; i + 8 <= bits.length; i += 8) { + let b = 0; + for (let j = 0; j < 8; j++) b = (b << 1) | bits[i + j]; + out.push(b); + } + return out; +} +function _desKeySchedule(keyBytes) { + const k = _permute(_PC1, _bytesToBits(keyBytes)); + let c = k.slice(0, 28), d = k.slice(28); + const subkeys = []; + for (let r = 0; r < 16; r++) { + c = _rol28(c, _SHIFTS[r]); + d = _rol28(d, _SHIFTS[r]); + subkeys.push(_permute(_PC2, c.concat(d))); + } + return subkeys; +} +function _desF(R, sk) { + const x = _xorArr(_permute(_EXP, R), sk); + const sOut = []; + for (let i = 0; i < 8; i++) { + const b = x.slice(i * 6, i * 6 + 6); + const row = (b[0] << 1) | b[5]; + const col = (b[1] << 3) | (b[2] << 2) | (b[3] << 1) | b[4]; + const v = _SB[i][row * 16 + col]; + sOut.push((v >> 3) & 1, (v >> 2) & 1, (v >> 1) & 1, v & 1); + } + return _permute(_PP, sOut); +} +function _desBlock(bits, subkeys, decrypt) { + const b = _permute(_IP, bits); + let L = b.slice(0, 32), R = b.slice(32); + for (let r = 0; r < 16; r++) { + const sk = decrypt ? subkeys[15 - r] : subkeys[r]; + const newR = _xorArr(L, _desF(R, sk)); + L = R; + R = newR; + } + return _permute(_FP, R.concat(L)); +} +// 3DES-CBC decrypt — keyBytes: 16 (K3=K1) or 24 octets; ivBytes: 8 zero octets. +function des3CbcDecrypt(keyBytes, ivBytes, ctBytes) { + const s1 = _desKeySchedule(keyBytes.slice(0, 8)); + const s2 = _desKeySchedule(keyBytes.slice(8, 16)); + const s3 = _desKeySchedule(keyBytes.length >= 24 ? keyBytes.slice(16, 24) : keyBytes.slice(0, 8)); + let prev = ivBytes.slice(); + const out = []; + for (let i = 0; i + 8 <= ctBytes.length; i += 8) { + const block = _bytesToBits(ctBytes.slice(i, i + 8)); + let b = _desBlock(block, s3, true); // D_K3 + b = _desBlock(b, s2, false); // E_K2 + b = _desBlock(b, s1, true); // D_K1 + out.push(..._bitsToBytes(_xorArr(b, _bytesToBits(prev)))); + prev = ctBytes.slice(i, i + 8); + } + return out; +} +// Single DES-CBC decrypt (deprecated KIc coding '01'). +function desCbcDecrypt(keyBytes, ivBytes, ctBytes) { + const s = _desKeySchedule(keyBytes.slice(0, 8)); + let prev = ivBytes.slice(); + const out = []; + for (let i = 0; i + 8 <= ctBytes.length; i += 8) { + const b = _desBlock(_bytesToBits(ctBytes.slice(i, i + 8)), s, true); + out.push(..._bitsToBytes(_xorArr(b, _bytesToBits(prev)))); + prev = ctBytes.slice(i, i + 8); + } + return out; +} + +// Decrypt a ciphered secured packet block with the user-supplied key hex. +// Returns {cntr, pcntr, rc, data, pad} byte arrays; throws on bad key/size. +async function decryptSecured(sec, keyHex) { + const nibble = (sec.kic_raw !== undefined ? sec.kic_raw : 0) & 0x0F; + const ct = hexToBytes(sec.cipher_block); + const iv = new Array(8).fill(0); // TS 102 225: CBC initial chaining value = zero + let pt; + if (nibble === 0x02) { // AES-CBC + const key = hexToBytes(keyHex); + if (![16, 24, 32].includes(key.length)) throw new Error('AES key must be 16/24/32 bytes'); + const k = await crypto.subtle.importKey('raw', new Uint8Array(key), 'AES-CBC', false, ['decrypt']); + const buf = await crypto.subtle.decrypt({name: 'AES-CBC', iv: new Uint8Array(16)}, k, new Uint8Array(ct)); + pt = Array.from(new Uint8Array(buf)); + } else if (nibble === 0x05 || nibble === 0x09) { // 3DES-CBC 2/3 keys + const key = hexToBytes(keyHex); + if (nibble === 0x05 && key.length !== 16 && key.length !== 24) + throw new Error('3DES (2 keys) key must be 16 bytes (or 24 with K3=K1)'); + if (nibble === 0x09 && key.length !== 24) + throw new Error('3DES (3 keys) key must be 24 bytes'); + pt = des3CbcDecrypt(key, iv, ct); + } else if (nibble === 0x01) { // single DES (deprecated) + const key = hexToBytes(keyHex); + if (key.length !== 8) throw new Error('DES key must be 8 bytes'); + pt = desCbcDecrypt(key, iv, ct); + } else { + throw new Error('cipher algorithm not supported for decryption'); + } + const rcLen = sec.rc_cc_ds ? sec.rc_cc_ds.length / 2 : 0; + if (pt.length < 6 + rcLen) throw new Error('decrypted block too short'); + const cntr = pt.slice(0, 5); + const pcntr = pt[5]; + const rc = pt.slice(6, 6 + rcLen); + const dataAll = pt.slice(6 + rcLen); + if (pcntr > dataAll.length) throw new Error('invalid padding count — wrong key?'); + const data = dataAll.slice(0, dataAll.length - pcntr); + return {cntr, pcntr, rc, data, pad: pcntr}; +} + function fmt_data(hex, limit) { limit = limit || 32; const pairs = (hex || '').match(/.{1,2}/g) || []; @@ -771,6 +939,20 @@ function cmdRows(cmd) { rows.push(['PCNTR' + enc, sec.pcntr]); if (sec.rc_cc_ds) rows.push(['RC/CC/DS' + enc, sec.rc_cc_ds]); rows.push(['Secured data', sec.data]); + // Decrypted values (client-side, key supplied by the user). + const dec = sec.cipher_block ? DECRYPT_CACHE[sec.cipher_block] : null; + if (dec) { + if (dec.error) { + rows.push(['Decrypt error', dec.error]); + } else { + const cntrHex = bytesToHex(dec.cntr); + const cntrDec = BigInt('0x' + cntrHex).toString(); + rows.push(['CNTR (decrypted)', '0x' + cntrHex + ' (' + cntrDec + ')']); + rows.push(['PCNTR (decrypted)', dec.pcntr]); + if (dec.rc.length) rows.push(['RC/CC/DS (decrypted)', bytesToHex(dec.rc)]); + rows.push(['Secured data (decrypted)', bytesToHex(dec.data)]); + } + } } const rp = t.response_packet; @@ -1065,6 +1247,44 @@ function showDetail(msg, entry) { ${decoded.errors ? `Errors${decoded.errors.join(', ')}` : ''} `; + + // Ciphered SCP80 command packet → client-side decrypt strip (the key + // never leaves the browser; memoized per key-set for the session). + const secured = ((decoded.cmd || {}).tpdu || {}).secured; + if (secured && secured.ciphered && secured.cipher_block) { + const strip = document.createElement('div'); + strip.className = 'decrypt-strip'; + const keySet = secured.kic ? secured.kic.key : 0; + strip.innerHTML = `Ciphered packet — 3DES/AES key (hex) for key set ${keySet}: ` + + ` ` + + ` ` + + ``; + d.appendChild(strip); + const input = strip.querySelector('.decrypt-key'); + const status = strip.querySelector('.decrypt-status'); + const btn = strip.querySelector('.decrypt-btn'); + const run = async () => { + const keyHex = input.value.trim().toLowerCase(); + if (!keyHex) return; + try { + const parsed = await decryptSecured(secured, keyHex); + OTA_KEYS[keySet] = keyHex; + DECRYPT_CACHE[secured.cipher_block] = parsed; + status.textContent = '✓ decrypted'; + status.style.color = 'var(--green)'; + showDetail(msg, entry); // re-render with decrypted rows + } catch (e) { + status.textContent = '✗ ' + e.message; + status.style.color = 'var(--error)'; + } + }; + btn.addEventListener('click', run); + input.addEventListener('keydown', ev => { if (ev.key === 'Enter') run(); }); + if (OTA_KEYS[keySet] && !DECRYPT_CACHE[secured.cipher_block]) { + input.value = OTA_KEYS[keySet]; + run(); + } + } } function buildTypeCounts() { const counts = {}; @@ -1906,7 +2126,7 @@ function onFilterChange() { } // ──────────────────── Versioning ──────────────────── -const PWA_VERSION = '1.18.0'; +const PWA_VERSION = '1.19.0'; const MIN_SERVER_VERSION = '1.0.0'; function parseVersion(v) { diff --git a/frontend/sw.js b/frontend/sw.js index 557cd4e..83385e7 100644 --- a/frontend/sw.js +++ b/frontend/sw.js @@ -1,4 +1,4 @@ -const CACHE = 'simtrace-analyser-v26'; +const CACHE = 'simtrace-analyser-v27'; const PRECACHE = [ 'index.html', diff --git a/pyproject.toml b/pyproject.toml index eca3e03..3c109fd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.backends._legacy:_Backend" [project] name = "simtrace2-pysniff" -version = "1.18.0" +version = "1.19.0" description = "Python-based sniffing tool for SIMtrace2 hardware (SIM card communication sniffer)" readme = {file = "README.md", content-type = "text/markdown"} license = {text = "GPL-2.0-or-later"} diff --git a/simtrace2_pysniff/__init__.py b/simtrace2_pysniff/__init__.py index 7a2759a..faf65cd 100644 --- a/simtrace2_pysniff/__init__.py +++ b/simtrace2_pysniff/__init__.py @@ -6,7 +6,7 @@ from .gsmtap import GsmtapSender, GsmtapReceiver from .pcap import PcapWriter from .dump import FileDumper, format_message -__version__ = '1.18.0' +__version__ = '1.19.0' __all__ = [ 'SniffSession', 'DeviceDisconnected', diff --git a/simtrace2_pysniff/server/decode.py b/simtrace2_pysniff/server/decode.py index 6365c07..d535cf5 100644 --- a/simtrace2_pysniff/server/decode.py +++ b/simtrace2_pysniff/server/decode.py @@ -2335,6 +2335,12 @@ def _decode_secured_packet(body): 'cntr': cntr.hex().upper(), 'pcntr': pcntr, 'data': data.hex().upper(), + # Contiguous ciphered on-wire octets (CNTR ‖ PCNTR ‖ RC/CC/DS ‖ + # secured data + padding) — the block a client-side decryptor + # feeds to 3DES/AES-CBC with a zero IV (TS 102 225 Table 2 n.1). + 'cipher_block': body[10:].hex().upper(), + 'kic_raw': kic, + 'kid_raw': kid, } kic_algo = _KIC_ALGO.get(kic & 0x0F, 'reserved') if not (spi1 & 0x04): # SPI says no ciphering → KIc unused diff --git a/tests/test_decode.py b/tests/test_decode.py index b16cf72..085c135 100644 --- a/tests/test_decode.py +++ b/tests/test_decode.py @@ -2127,6 +2127,28 @@ class TestSecuredCiphering(unittest.TestCase): r = decode_message(raw, prev=prev) self.assertTrue(r['response']['ciphered']) + def test_cipher_block_contiguous(self): + # cipher_block = the on-wire ciphered octets (CNTR..end) and equals + # the reassembled cntr+pcntr+rc+data — what a client-side decryptor + # feeds to 3DES/AES-CBC. + from simtrace2_pysniff.server.decode import _decode_secured_packet + sec = bytes.fromhex('00381516011515b000011830a44e4191ad45d0ec' + '2a291315986468a539d248fcdce7952c31cd635baec' + '7e93a5d567b59f6283316c0dad8603bf3'.replace(' ', '')) + r = _decode_secured_packet(sec) + self.assertEqual(len(r['cipher_block']) // 2, 48) + self.assertEqual(r['cipher_block'], + (r['cntr'] + f'{r["pcntr"]:02X}' + r['rc_cc_ds'] + r['data'])) + self.assertEqual(r['kic_raw'], 0x15) + self.assertEqual(r['kid_raw'], 0x15) + + def test_aes_algorithm_recognized(self): + # AES must stay recognized for ciphering (KIc nibble 2) and for the + # CC (KID nibble 2 = AES-CMAC) — the client-side decryptor relies on it. + from simtrace2_pysniff.server.decode import _KIC_ALGO, _KID_CC_ALGO + self.assertEqual(_KIC_ALGO[0x02], 'AES-CBC') + self.assertEqual(_KID_CC_ALGO[0x02], 'AES-CMAC') + class TestSpiBits(unittest.TestCase): """TS 102 225 §5.1.1: SPI1 b3 = ciphering, SPI2 b5 = PoR ciphering.""" diff --git a/tests/test_pcap_import.py b/tests/test_pcap_import.py index b9fe5ef..11639cb 100644 --- a/tests/test_pcap_import.py +++ b/tests/test_pcap_import.py @@ -197,7 +197,7 @@ class TestImportEndpoint(unittest.TestCase): class TestVersion(unittest.TestCase): def test_package_version(self): from simtrace2_pysniff import __version__ - self.assertEqual(__version__, '1.18.0') + self.assertEqual(__version__, '1.19.0') def test_status_includes_version(self): import os