global_platform/scp: fix dek_encrypt/dek_decrypt for SCP02

The methods dek_encrypt/dek_decrypt use the wrong algorithm and the
wrong key material. The algorithm should be 3DES rather then single
DES and the key must be the DEK session key instead of the static
DEK key from which the DEK session key is derived.

Related: SYS#7902
Change-Id: I3d0cc7378680b346fa39152c8b7074446d2c869d

contrib/smpp-ota-tool.py

@@ -141,7 +141,7 @@ class SmppHandler:
                 tuple containing the last response data and the last status word as byte strings
         """
 
-        logger.info("C-APDU sending: %s..." % b2h(apdu))
+        logger.info("C-APDU sending: %s...", b2h(apdu))
 
         # translate to Secured OTA RFM
         secured = self.ota_dialect.encode_cmd(self.ota_keyset, self.tar, self.spi, apdu=apdu)
@@ -194,19 +194,19 @@ if __name__ == '__main__':
     option_parser.add_argument('--tar', required=True, type=is_hexstr, help='Toolkit Application Reference')
     option_parser.add_argument("--cntr_req", choices=CNTR_REQ.decmapping.values(), default='no_counter',
                                help="Counter requirement")
-    option_parser.add_argument('--ciphering', default=True, type=bool, help='Enable ciphering')
+    option_parser.add_argument('--no-ciphering', action='store_true', default=False, help='Disable ciphering')
     option_parser.add_argument("--rc-cc-ds", choices=RC_CC_DS.decmapping.values(), default='cc',
                                help="message check (rc=redundency check, cc=crypt. checksum, ds=digital signature)")
-    option_parser.add_argument('--por-in-submit', default=False, type=bool,
+    option_parser.add_argument('--por-in-submit', action='store_true', default=False,
                                help='require PoR to be sent via SMS-SUBMIT')
-    option_parser.add_argument('--por-shall-be-ciphered', default=True, type=bool, help='require encrypted PoR')
+    option_parser.add_argument('--por-no-ciphering', action='store_true', default=False, help='Disable ciphering (PoR)')
     option_parser.add_argument("--por-rc-cc-ds", choices=RC_CC_DS.decmapping.values(), default='cc',
                                help="PoR check (rc=redundency check, cc=crypt. checksum, ds=digital signature)")
     option_parser.add_argument("--por_req", choices=POR_REQ.decmapping.values(), default='por_required',
                                help="Proof of Receipt requirements")
-    option_parser.add_argument('--src-addr', default='12', type=str, help='TODO')
-    option_parser.add_argument('--dest-addr', default='23', type=str, help='TODO')
-    option_parser.add_argument('--timeout', default=10, type=int, help='TODO')
+    option_parser.add_argument('--src-addr', default='12', type=str, help='SMS source address (MSISDN)')
+    option_parser.add_argument('--dest-addr', default='23', type=str, help='SMS destination address (MSISDN)')
+    option_parser.add_argument('--timeout', default=10, type=int, help='Maximum response waiting time')
     option_parser.add_argument('-a', '--apdu', action='append', required=True, type=is_hexstr, help='C-APDU to send')
     opts = option_parser.parse_args()
 
@@ -214,18 +214,22 @@ if __name__ == '__main__':
                         format='%(asctime)s %(levelname)s %(message)s',
                         datefmt='%Y-%m-%d %H:%M:%S')
 
+    if opts.kic_idx != opts.kid_idx:
+        logger.warning("KIC index (%s) and KID index (%s) are different (security violation, card should reject message)",
+                       opts.kic_idx, opts.kid_idx)
+
     ota_keyset = OtaKeyset(algo_crypt=opts.algo_crypt,
                            kic_idx=opts.kic_idx,
                            kic=h2b(opts.kic),
                            algo_auth=opts.algo_auth,
-                           kid_idx=opts.kic_idx,
+                           kid_idx=opts.kid_idx,
                            kid=h2b(opts.kid),
                            cntr=opts.cntr)
     spi = {'counter' : opts.cntr_req,
-           'ciphering' : opts.ciphering,
+           'ciphering' : not opts.no_ciphering,
            'rc_cc_ds': opts.rc_cc_ds,
-           'por_in_submit':opts.por_in_submit,
-           'por_shall_be_ciphered':opts.por_shall_be_ciphered,
+           'por_in_submit': opts.por_in_submit,
+           'por_shall_be_ciphered': not opts.por_no_ciphering,
            'por_rc_cc_ds': opts.por_rc_cc_ds,
            'por': opts.por_req}
     apdu = h2b("".join(opts.apdu))

pySim/esim/saip/personalization.py

@@ -352,6 +352,7 @@ class SmspTpScAddr(ConfigurableParameter):
     strip_chars = ' \t\r\n'
     max_len = 21 # '+' and 20 digits
     min_len = 1
+    example_input = '+49301234567'
 
     @classmethod
     def validate_val(cls, val):
@@ -627,7 +628,7 @@ class MilenageRotationConstants(BinaryParam, AlgoConfig):
     name = 'MilenageRotation'
     algo_config_key = 'rotationConstants'
     allow_len = 5 # length in bytes (from BinaryParam)
-    example_input = '0a 0b 0c 0d 0e'
+    example_input = '40 00 20 40 60'
 
     @classmethod
     def validate_val(cls, val):

pySim/global_platform/scp.py

@@ -266,11 +266,13 @@ class SCP02(SCP):
         super().__init__(*args, **kwargs)
 
     def dek_encrypt(self, plaintext:bytes) -> bytes:
-        cipher = DES.new(self.card_keys.dek[:8], DES.MODE_ECB)
+        # See also GPC section B.1.1.2, E.4.7, and E.4.1
+        cipher = DES3.new(self.sk.data_enc, DES.MODE_ECB)
         return cipher.encrypt(plaintext)
 
     def dek_decrypt(self, ciphertext:bytes) -> bytes:
-        cipher = DES.new(self.card_keys.dek[:8], DES.MODE_ECB)
+        # See also GPC section B.1.1.2, E.4.7, and E.4.1
+        cipher = DES3.new(self.sk.data_enc, DES.MODE_ECB)
         return cipher.decrypt(ciphertext)
 
     def _compute_cryptograms(self, card_challenge: bytes, host_challenge: bytes):