diff --git a/CHANGELOG.md b/CHANGELOG.md index ed9d98372..bde6f042f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] +- Added `hf mdfes leaf` command (@pcunning) - Added `hf mfdes vdesign` command (@kormax) - Added `hf iclass liberate` - simple command to remove changes to MKF or Icopy-X iclass tags (@iceman1001) - Fixed `mfpReadSector` function to decrypt received data, fixing commands like `hf mfp dump` (@team-orangeBlue) diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c index a6e34d436..04e10ffb8 100644 --- a/client/src/cmdhfmfdes.c +++ b/client/src/cmdhfmfdes.c @@ -50,6 +50,9 @@ #include "mifare/prime.h" #include "util.h" #include "crypto/originality.h" +#include "x509_crt.h" +#include "mbedtls/oid.h" +#include "mbedtls/sha256.h" #define MAX_KEY_LEN 24 #define MAX_KEYS_LIST_LEN 1024 @@ -80,6 +83,21 @@ #define DUOX_INTAUTH_MSG_PREFIX 0xF0 #define DUOX_VDE_DEFAULT_AID 0x1010F6U +// LEAF Verified Open Application +#define LEAF_VERIFIED_DEFAULT_AID 0xF51CD6U // 0xD61CF5 in user-facing (wire bytes D6 1C F5) +#define LEAF_VERIFIED_CERT_FILE 0x02 +#define LEAF_VERIFIED_MAX_CERT_LEN 4096 + +// LEAF Root CA public key (P-256, uncompressed: 04 || X(32) || Y(32)) +// https://github.com/LEAF-Community/leaf-verified-device-onboarding-guide/blob/82b51a1958a0f9eedaa2f97b7f533490bc108463/detect_and_select.py#L95 +static const uint8_t kLeafRootP256PubKey[65] = { + 0x04, + 0x2D, 0x27, 0x81, 0xBE, 0x41, 0xC2, 0x27, 0x58, 0xA6, 0x13, 0x81, 0x0F, 0x67, 0xEC, 0x78, 0xDF, + 0x11, 0x76, 0xC4, 0x76, 0x5B, 0x21, 0x2B, 0x49, 0x21, 0x8C, 0x6C, 0x58, 0x40, 0x8A, 0x5A, 0xDA, + 0x3D, 0x99, 0x73, 0x20, 0x9D, 0x82, 0x28, 0x91, 0x3A, 0x88, 0x16, 0x97, 0x3C, 0xFE, 0x5C, 0x9E, + 0xBF, 0xD8, 0xC6, 0x69, 0x75, 0x32, 0xCD, 0xD5, 0xB5, 0x3E, 0xE1, 0x34, 0xD2, 0xF1, 0x1B, 0x3C +}; + static const uint8_t kDuoxVDEDefaultDFName[] = { 0xA0, 0x00, 0x00, 0x08, 0x45, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 @@ -206,6 +224,7 @@ static const mfdesCommonAID_t commonAids[] = { { 0xF4812F, "\xf4\x81\x2f", "Gallagher card data application" }, { 0xF48120, "\xf4\x81\x20", "Gallagher card application directory" }, // Can be 0xF48120 - 0xF4812B, but I've only ever seen 0xF48120 { 0xF47300, "\xf4\x73\x00", "Inner Range card application" }, + { 0xF51CD6, "\xF5\x1C\xD6", "LEAF Verified Open Application" }, }; typedef enum { @@ -7423,6 +7442,176 @@ static int CmdHF14ADesDump(const char *Cmd) { return PM3_SUCCESS; } +// Generate `len` random bytes using the CSPRNG. +static int duox_gen_random(uint8_t *buf, size_t len, const char *pers) { + pcrypto_rng_t rng = {0}; + int res = pcrypto_rng_init(&rng, (const uint8_t *)pers, strlen(pers)); + if (res != PM3_SUCCESS) { + PrintAndLogEx(ERR, "Failed to initialize RNG"); + return res; + } + res = pcrypto_rng_fill(&rng, buf, len); + pcrypto_rng_free(&rng); + if (res != PM3_SUCCESS) + PrintAndLogEx(ERR, "Failed to generate random bytes"); + return res; +} + +// Build and send ISO Internal Authenticate (INS 88), then parse the TLV response. +// Assumes the application is already selected (field on). Calls DropField before returning. +// On PM3_SUCCESS: out_card_random[DUOX_INTAUTH_CHALLENGE_LEN] and out_sig_rs[DUOX_INTAUTH_SIG_LEN] are filled. +static int duox_intauth_exchange(bool apdu_logging, bool verbose, uint8_t keynum, + const uint8_t *challenge, + uint8_t *out_card_random, uint8_t *out_sig_rs) { + // Build ISO Internal Authenticate APDU + // + // Data field: + // 80 00 - OptsA TLV (tag=0x80, len=0x00, empty value) + // 7C 12 - Dynamic Authentication Data wrapper (tag=0x7C, len=18) + // 81 10 [16B] - Challenge TLV (tag=0x81, len=16, value=RndA) + // + // APDU: CLA=00 INS=88 P1=00 P2=00 Lc=16 [data] Le=00 + static const uint8_t optsa_tlv[] = {DUOX_TAG_OPTSA, 0x00}; + uint8_t apdu_data[22]; + size_t apdu_data_len = 0; + + memcpy(apdu_data, optsa_tlv, 2); + apdu_data_len += 2; + apdu_data[apdu_data_len++] = DUOX_TAG_DYNAMIC_AUTH_DATA; + apdu_data[apdu_data_len++] = 2 + DUOX_INTAUTH_CHALLENGE_LEN; + apdu_data[apdu_data_len++] = DUOX_TAG_CHALLENGE; + apdu_data[apdu_data_len++] = DUOX_INTAUTH_CHALLENGE_LEN; + memcpy(apdu_data + apdu_data_len, challenge, DUOX_INTAUTH_CHALLENGE_LEN); + apdu_data_len += DUOX_INTAUTH_CHALLENGE_LEN; + + // Encode full APDU: 00 88 00 [keynum] [Lc] [data] 00 + sAPDU_t apdu = {0x00, ISO7816_INTERNAL_AUTHENTICATION, 0x00, keynum, apdu_data_len, apdu_data}; + uint8_t encoded[50] = {0}; + int encoded_len = 0; + if (APDUEncodeS(&apdu, false, APDU_INCLUDE_LE_00, encoded, &encoded_len)) { + PrintAndLogEx(ERR, "APDU encoding error"); + DropField(); + return PM3_ESOFT; + } + + if (apdu_logging) + PrintAndLogEx(SUCCESS, ">>>> %s", sprint_hex(encoded, encoded_len)); + + uint8_t response[PM3_CMD_DATA_SIZE] = {0}; + int resplen = 0; + int res = ExchangeAPDU14a(encoded, encoded_len, false, true, response, sizeof(response), &resplen); + if (res != PM3_SUCCESS) { + PrintAndLogEx(ERR, "APDU exchange " _RED_("failed") " (%d)", res); + DropField(); + return res; + } + + if (apdu_logging) + PrintAndLogEx(SUCCESS, "<<<< %s", sprint_hex(response, resplen)); + + DropField(); + + // Check status word + if (resplen < 2) { + PrintAndLogEx(ERR, "Response too short"); + return PM3_ESOFT; + } + + uint16_t sw = get_sw(response, resplen); + if (sw != ISO7816_OK) { + PrintAndLogEx(ERR, "Internal Authenticate " _RED_("failed") " (SW=%04X)", sw); + return PM3_ESOFT; + } + + // Strip SW from response data + int resp_data_len = resplen - 2; + PrintAndLogEx(SUCCESS, "Internal Authenticate " _GREEN_("ok") " (SW=%04X)", sw); + + if (verbose) + PrintAndLogEx(INFO, "Response data: %s", sprint_hex(response, resp_data_len)); + + // Parse TLV response + // Expected: 7C [len] 81 10 [card_random(16)] 82 [sig_len] [signature] + uint8_t *resp = response; + if (resp_data_len < 4 || resp[0] != DUOX_TAG_DYNAMIC_AUTH_DATA) { + PrintAndLogEx(ERR, "Invalid response: missing 0x7C tag"); + return PM3_ESOFT; + } + + uint8_t outer_len = resp[1]; + if (outer_len + 2 > resp_data_len) { + PrintAndLogEx(ERR, "Invalid response: truncated 0x7C data"); + return PM3_ESOFT; + } + + uint8_t *inner = resp + 2; + int inner_len = outer_len; + int idx = 0; + + bool card_random_found = false; + bool signature_found = false; + + while (idx < inner_len) { + if (idx + 2 > inner_len) break; + uint8_t tag = inner[idx++]; + uint8_t tlen = inner[idx++]; + if (idx + tlen > inner_len) break; + + if (tag == DUOX_TAG_CHALLENGE && tlen == DUOX_INTAUTH_CHALLENGE_LEN) { + memcpy(out_card_random, inner + idx, DUOX_INTAUTH_CHALLENGE_LEN); + card_random_found = true; + } else if (tag == DUOX_TAG_SIGNATURE) { + // Signature: raw r||s. Some implementations may return 0x44 bytes with padding. + if (tlen >= DUOX_INTAUTH_SIG_LEN) { + memcpy(out_sig_rs, inner + idx + (tlen - DUOX_INTAUTH_SIG_LEN), DUOX_INTAUTH_SIG_LEN); + signature_found = true; + } + } + idx += tlen; + } + if (!card_random_found) { + PrintAndLogEx(ERR, "Failed to parse card random (tag 0x81) from response"); + return PM3_ESOFT; + } + if (!signature_found) { + PrintAndLogEx(ERR, "Failed to parse signature (tag 0x82) from response"); + return PM3_ESOFT; + } + + PrintAndLogEx(INFO, "Card random.. " _YELLOW_("%s"), sprint_hex_inrow(out_card_random, DUOX_INTAUTH_CHALLENGE_LEN)); + PrintAndLogEx(INFO, "Signature r.. " _YELLOW_("%s"), sprint_hex_inrow(out_sig_rs, DUOX_INTAUTH_SIG_LEN / 2)); + PrintAndLogEx(INFO, "Signature s.. " _YELLOW_("%s"), sprint_hex_inrow(out_sig_rs + DUOX_INTAUTH_SIG_LEN / 2, DUOX_INTAUTH_SIG_LEN / 2)); + return PM3_SUCCESS; +} + +// Build the Internal Authenticate verify message (F0F0 || OptsA || RndB || RndA) +// and verify the ECDSA-P256-SHA256 signature. Returns PM3_SUCCESS if valid. +static int duox_intauth_verify_sig(bool verbose, const uint8_t *pubkey_point, + const uint8_t *challenge, const uint8_t *card_random, + const uint8_t *sig_rs) { + // Message = F0F0 || OptsA TLV || RndB (card random) || RndA (our challenge) + static const uint8_t optsa_tlv[] = {DUOX_TAG_OPTSA, 0x00}; + uint8_t message[2 + 2 + DUOX_INTAUTH_CHALLENGE_LEN + DUOX_INTAUTH_CHALLENGE_LEN]; + message[0] = DUOX_INTAUTH_MSG_PREFIX; + message[1] = DUOX_INTAUTH_MSG_PREFIX; + memcpy(message + 2, optsa_tlv, 2); + memcpy(message + 4, card_random, DUOX_INTAUTH_CHALLENGE_LEN); + memcpy(message + 20, challenge, DUOX_INTAUTH_CHALLENGE_LEN); + + if (verbose) + PrintAndLogEx(INFO, "Verify msg... %s", sprint_hex_inrow(message, sizeof(message))); + + return ecdsa_signature_r_s_verify( + MBEDTLS_ECP_DP_SECP256R1, + (uint8_t *)pubkey_point, + message, + (int)sizeof(message), + (uint8_t *)sig_rs, + DUOX_INTAUTH_SIG_LEN, + true // hash message with SHA-256 before verifying + ); +} + static int CmdHF14ADesIntAuth(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "hf mfdes intauth", @@ -7515,19 +7704,8 @@ static int CmdHF14ADesIntAuth(const char *Cmd) { // Generate random challenge if not provided if (!challenge_provided) { - pcrypto_rng_t rng = {0}; - const uint8_t pers[] = "hf_mfdes_intauth"; - int res = pcrypto_rng_init(&rng, pers, sizeof(pers) - 1); - if (res != PM3_SUCCESS) { - PrintAndLogEx(ERR, "Failed to initialize RNG"); - return res; - } - res = pcrypto_rng_fill(&rng, challenge, sizeof(challenge)); - pcrypto_rng_free(&rng); - if (res != PM3_SUCCESS) { - PrintAndLogEx(ERR, "Failed to generate random challenge"); - return res; - } + int res = duox_gen_random(challenge, sizeof(challenge), "hf_mfdes_intauth"); + if (res != PM3_SUCCESS) return res; } // AID is stored little-endian in DESFire protocol @@ -7574,155 +7752,19 @@ static int CmdHF14ADesIntAuth(const char *Cmd) { } if (verbose) PrintAndLogEx(SUCCESS, "Application selected " _GREEN_("ok")); - // Step 2: Build ISO Internal Authenticate APDU - // - // Data field: - // 80 00 - OptsA TLV (tag=0x80, len=0x00, empty value) - // 7C 12 - Dynamic Authentication Data wrapper (tag=0x7C, len=18) - // 81 10 [16B] - Challenge TLV (tag=0x81, len=16, value=RndA) - // - // APDU: CLA=00 INS=88 P1=00 P2=00 Lc=16 [data] Le=00 - uint8_t optsa_tlv[] = {DUOX_TAG_OPTSA, 0x00}; - uint8_t apdu_data[22]; // 2 (optsa) + 2 (7C tag+len) + 2 (81 tag+len) + 16 (challenge) - size_t apdu_data_len = 0; - - memcpy(apdu_data, optsa_tlv, 2); - apdu_data_len += 2; - apdu_data[apdu_data_len++] = DUOX_TAG_DYNAMIC_AUTH_DATA; - apdu_data[apdu_data_len++] = 2 + DUOX_INTAUTH_CHALLENGE_LEN; // tag+len + challenge - apdu_data[apdu_data_len++] = DUOX_TAG_CHALLENGE; - apdu_data[apdu_data_len++] = DUOX_INTAUTH_CHALLENGE_LEN; - memcpy(apdu_data + apdu_data_len, challenge, DUOX_INTAUTH_CHALLENGE_LEN); - apdu_data_len += DUOX_INTAUTH_CHALLENGE_LEN; - - // Encode full APDU: 00 88 00 [keynum] [Lc] [data] 00 - sAPDU_t apdu = {0x00, ISO7816_INTERNAL_AUTHENTICATION, 0x00, (uint8_t)keynum, apdu_data_len, apdu_data}; - uint8_t encoded[50] = {0}; - int encoded_len = 0; - if (APDUEncodeS(&apdu, false, APDU_INCLUDE_LE_00, encoded, &encoded_len)) { - PrintAndLogEx(ERR, "APDU encoding error"); - DropField(); - return PM3_ESOFT; - } - - if (APDULogging) - PrintAndLogEx(SUCCESS, ">>>> %s", sprint_hex(encoded, encoded_len)); - - uint8_t response[PM3_CMD_DATA_SIZE] = {0}; - int resplen = 0; - res = ExchangeAPDU14a(encoded, encoded_len, false, true, response, sizeof(response), &resplen); - if (res != PM3_SUCCESS) { - PrintAndLogEx(ERR, "APDU exchange " _RED_("failed") " (%d)", res); - DropField(); - return res; - } - - if (APDULogging) - PrintAndLogEx(SUCCESS, "<<<< %s", sprint_hex(response, resplen)); - - DropField(); - - // Check status word - if (resplen < 2) { - PrintAndLogEx(ERR, "Response too short"); - return PM3_ESOFT; - } - - uint16_t sw = get_sw(response, resplen); - if (sw != ISO7816_OK) { - PrintAndLogEx(ERR, "Internal Authenticate " _RED_("failed") " (SW=%04X)", sw); - return PM3_ESOFT; - } - - // Strip SW from response data - int resp_data_len = resplen - 2; - PrintAndLogEx(SUCCESS, "Internal Authenticate " _GREEN_("ok") " (SW=%04X)", sw); - - if (verbose) - PrintAndLogEx(INFO, "Response data: %s", sprint_hex(response, resp_data_len)); - // Step 3: Parse TLV response - // Expected: 7C [len] 81 10 [card_random(16)] 82 [sig_len] [signature] - uint8_t *resp = response; - if (resp_data_len < 4 || resp[0] != DUOX_TAG_DYNAMIC_AUTH_DATA) { - PrintAndLogEx(ERR, "Invalid response: missing 0x7C tag"); - return PM3_ESOFT; - } - - uint8_t outer_len = resp[1]; - if (outer_len + 2 > resp_data_len) { - PrintAndLogEx(ERR, "Invalid response: truncated 0x7C data"); - return PM3_ESOFT; - } - - uint8_t *inner = resp + 2; - int inner_len = outer_len; - int idx = 0; uint8_t card_random[DUOX_INTAUTH_CHALLENGE_LEN] = {0}; - bool card_random_found = false; uint8_t signature_rs[DUOX_INTAUTH_SIG_LEN] = {0}; - bool signature_found = false; - - while (idx < inner_len) { - if (idx + 2 > inner_len) break; - uint8_t tag = inner[idx++]; - uint8_t tlen = inner[idx++]; - if (idx + tlen > inner_len) break; - - if (tag == DUOX_TAG_CHALLENGE && tlen == DUOX_INTAUTH_CHALLENGE_LEN) { - memcpy(card_random, inner + idx, DUOX_INTAUTH_CHALLENGE_LEN); - card_random_found = true; - } else if (tag == DUOX_TAG_SIGNATURE) { - // Signature: raw r||s. Some implementations may return 0x44 bytes with padding. - if (tlen >= DUOX_INTAUTH_SIG_LEN) { - memcpy(signature_rs, inner + idx + (tlen - DUOX_INTAUTH_SIG_LEN), DUOX_INTAUTH_SIG_LEN); - signature_found = true; - } - } - idx += tlen; - } - - if (!card_random_found) { - PrintAndLogEx(ERR, "Failed to parse card random (tag 0x81) from response"); - return PM3_ESOFT; - } - - if (!signature_found) { - PrintAndLogEx(ERR, "Failed to parse signature (tag 0x82) from response"); - return PM3_ESOFT; - } - - PrintAndLogEx(INFO, "Card random.. " _YELLOW_("%s"), sprint_hex_inrow(card_random, DUOX_INTAUTH_CHALLENGE_LEN)); - PrintAndLogEx(INFO, "Signature r.. " _YELLOW_("%s"), sprint_hex_inrow(signature_rs, DUOX_INTAUTH_SIG_LEN / 2)); - PrintAndLogEx(INFO, "Signature s.. " _YELLOW_("%s"), sprint_hex_inrow(signature_rs + DUOX_INTAUTH_SIG_LEN / 2, DUOX_INTAUTH_SIG_LEN / 2)); + res = duox_intauth_exchange(APDULogging, verbose, (uint8_t)keynum, challenge, card_random, signature_rs); + if (res != PM3_SUCCESS) + return res; // Step 4: Verify signature if public key provided if (pubkey_provided) { PrintAndLogEx(INFO, "--- " _CYAN_("Signature Verification")); - - // Message = F0F0 || OptsA TLV || RndB (card random) || RndA (our challenge) - uint8_t message[2 + 2 + DUOX_INTAUTH_CHALLENGE_LEN + DUOX_INTAUTH_CHALLENGE_LEN]; - message[0] = DUOX_INTAUTH_MSG_PREFIX; - message[1] = DUOX_INTAUTH_MSG_PREFIX; - memcpy(message + 2, optsa_tlv, 2); - memcpy(message + 4, card_random, DUOX_INTAUTH_CHALLENGE_LEN); - memcpy(message + 20, challenge, DUOX_INTAUTH_CHALLENGE_LEN); - - if (verbose) - PrintAndLogEx(INFO, "Verify msg... %s", sprint_hex_inrow(message, sizeof(message))); - - int sig_res = ecdsa_signature_r_s_verify( - MBEDTLS_ECP_DP_SECP256R1, - pubkey_point, - message, - (int)sizeof(message), - signature_rs, - DUOX_INTAUTH_SIG_LEN, - true // hash message with SHA-256 before verifying - ); - + int sig_res = duox_intauth_verify_sig(verbose, pubkey_point, challenge, card_random, signature_rs); if (sig_res == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "ECDSA signature " _GREEN_("verified")); } else { @@ -7741,7 +7783,7 @@ static int CmdHF14ADesVdeSign(const char *Cmd) { "Optionally verifies the returned ECDSA signature with a BrainpoolP256r1 public key.", "hf mfdes vdesign -> sign random 32-byte challenge using default EV DF name\n" "hf mfdes vdesign --aid 1010F6 -> select EV app by native AID\n" - "hf mfdes vdesign --dfname A0000008450000000000000000000001 -> select EV app by ISO DF name\n" + "hf mfdes vdesign --dfname A0000008450000000000000000000001 -> select EV app by ISO DF name\n" "hf mfdes vdesign -d 00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF -> explicit 32-byte challenge\n" "hf mfdes vdesign -p 04A7C6... -> verify signature with given EC public key (hex, PEM, DER, file path)\n"); @@ -7812,19 +7854,8 @@ static int CmdHF14ADesVdeSign(const char *Cmd) { } if (!challenge_provided) { - pcrypto_rng_t rng = {0}; - const uint8_t pers[] = "hf_mfdes_vdesign"; - int res = pcrypto_rng_init(&rng, pers, sizeof(pers) - 1); - if (res != PM3_SUCCESS) { - PrintAndLogEx(ERR, "Failed to initialize RNG"); - return res; - } - res = pcrypto_rng_fill(&rng, challenge, sizeof(challenge)); - pcrypto_rng_free(&rng); - if (res != PM3_SUCCESS) { - PrintAndLogEx(ERR, "Failed to generate random challenge"); - return res; - } + int res = duox_gen_random(challenge, sizeof(challenge), "hf_mfdes_vdesign"); + if (res != PM3_SUCCESS) return res; } uint32_t aid = DUOX_VDE_DEFAULT_AID; @@ -7962,6 +7993,227 @@ static int CmdHF14ADesVdeSign(const char *Cmd) { return PM3_SUCCESS; } +// Look up an attribute in a DN by OID. Returns pointer to mbedtls value buf or NULL. +static const mbedtls_x509_buf *leaf_dn_find_oid(const mbedtls_x509_name *dn, const char *oid_buf, size_t oid_len) { + while (dn != NULL) { + if (dn->oid.len == oid_len && memcmp(dn->oid.p, oid_buf, oid_len) == 0) + return &dn->val; + dn = dn->next; + } + return NULL; +} + +static int CmdHF14ADesLeaf(const char *Cmd) { + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf mfdes leaf", + "Read and verify a LEAF Verified credential on a MIFARE DUOX card.\n" + "Selects the LEAF Verified Open Application, reads the X.509 certificate\n" + "from file 0x02, verifies it was signed by the LEAF Root CA, performs ISO\n" + "Internal Authenticate, and verifies the card signature with the public key\n" + "embedded in the certificate.", + "hf mfdes leaf -> verify with default AID D61CF5\n" + "hf mfdes leaf -v -> verbose output\n" + "hf mfdes leaf --aid D61CF5 -> override AID\n" + "hf mfdes leaf -d 00112233445566778899AABBCCDDEEFF -> explicit 16-byte challenge\n"); + + void *argtable[] = { + arg_param_begin, + arg_lit0("a", "apdu", "Show APDU requests and responses"), // 1 + arg_lit0("v", "verbose", "Verbose output"), // 2 + arg_str0("d", "challenge", "", "Challenge / RndA (16 bytes, random if omitted)"), // 3 + arg_str0(NULL, "aid", "", "Application ID (3 bytes, default D61CF5)"), // 4 + arg_int0("n", "keynum", "", "Key number (P2, default 0)"), // 5 + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + + bool APDULogging = arg_get_lit(ctx, 1); + bool verbose = arg_get_lit(ctx, 2); + + uint8_t challenge[DUOX_INTAUTH_CHALLENGE_LEN] = {0}; + int challenge_len = 0; + CLIGetHexWithReturn(ctx, 3, challenge, &challenge_len); + bool challenge_provided = (challenge_len > 0); + if (challenge_provided && challenge_len != DUOX_INTAUTH_CHALLENGE_LEN) { + PrintAndLogEx(ERR, "Challenge must be exactly 16 bytes, got %d", challenge_len); + CLIParserFree(ctx); + return PM3_EINVARG; + } + + uint8_t aid_bytes[3] = {0xD6, 0x1C, 0xF5}; // little-endian default D61CF5 + int aid_len = 0; + CLIGetHexWithReturn(ctx, 4, aid_bytes, &aid_len); + if (aid_len > 0 && aid_len != 3) { + PrintAndLogEx(ERR, "AID must be exactly 3 bytes, got %d", aid_len); + CLIParserFree(ctx); + return PM3_EINVARG; + } + + int keynum = arg_get_int_def(ctx, 5, 0); + if (keynum < 0 || keynum > 255) { + PrintAndLogEx(ERR, "Key number must be 0..255"); + CLIParserFree(ctx); + return PM3_EINVARG; + } + + SetAPDULogging(APDULogging); + CLIParserFree(ctx); + + if (!challenge_provided) { + int res = duox_gen_random(challenge, sizeof(challenge), "hf_mfdes_leaf"); + if (res != PM3_SUCCESS) return res; + } + + // aid_bytes default {0xD6,0x1C,0xF5} = wire bytes for AID "D61CF5". + // DesfireSelectAIDHex expects LE uint32: byte[2]<<16 | byte[1]<<8 | byte[0]. + uint32_t aid = (aid_bytes[2] << 16) | (aid_bytes[1] << 8) | aid_bytes[0]; + + PrintAndLogEx(INFO, "--- " _CYAN_("LEAF Verified Credential Check")); + PrintAndLogEx(INFO, "AID.......... " _YELLOW_("%02X%02X%02X"), aid_bytes[0], aid_bytes[1], aid_bytes[2]); + + // Step 1: Anticollision + select application + DesfireContext_t dctx = {0}; + dctx.commMode = DCMPlain; + dctx.cmdSet = DCCNativeISO; + + int res = DesfireAnticollision(false); + if (res != PM3_SUCCESS) { + PrintAndLogEx(ERR, "Anticollision " _RED_("failed")); + DropField(); + return res; + } + + res = DesfireSelectAIDHex(&dctx, aid, false, 0); + if (res != PM3_SUCCESS) { + PrintAndLogEx(ERR, "Select application %06X " _RED_("failed"), aid); + DropField(); + return res; + } + if (verbose) + PrintAndLogEx(SUCCESS, "Application selected " _GREEN_("ok")); + + // Step 2: Read X.509 certificate from file 0x02 (length=0 reads to EOF) + uint8_t cert_buf[LEAF_VERIFIED_MAX_CERT_LEN] = {0}; + size_t cert_len = 0; + res = DesfireReadFile(&dctx, LEAF_VERIFIED_CERT_FILE, 0, 0, cert_buf, &cert_len); + if (res != PM3_SUCCESS || cert_len == 0) { + PrintAndLogEx(ERR, "Read certificate file 0x%02X " _RED_("failed") " (%d)", LEAF_VERIFIED_CERT_FILE, res); + DropField(); + return PM3_ESOFT; + } + PrintAndLogEx(SUCCESS, "Certificate read " _GREEN_("ok") " (%zu bytes)", cert_len); + if (verbose) + print_hex_break(cert_buf, cert_len, 32); + + // Step 3: Parse certificate + mbedtls_x509_crt cert; + mbedtls_x509_crt_init(&cert); + int xres = mbedtls_x509_crt_parse_der(&cert, cert_buf, cert_len); + if (xres != 0) { + PrintAndLogEx(ERR, "X.509 parse " _RED_("failed") " (-0x%04x)", -xres); + mbedtls_x509_crt_free(&cert); + DropField(); + return PM3_ESOFT; + } + + // Print certificate details + PrintAndLogEx(INFO, "--- " _CYAN_("Certificate")); + + char dnbuf[256] = {0}; + mbedtls_x509_dn_gets(dnbuf, sizeof(dnbuf), &cert.subject); + PrintAndLogEx(INFO, "Subject...... " _YELLOW_("%s"), dnbuf); + mbedtls_x509_dn_gets(dnbuf, sizeof(dnbuf), &cert.issuer); + PrintAndLogEx(INFO, "Issuer....... " _YELLOW_("%s"), dnbuf); + + char idbuf[128] = {0}; + const mbedtls_x509_buf *open_id = leaf_dn_find_oid(&cert.subject, + MBEDTLS_OID_AT_SERIAL_NUMBER, + MBEDTLS_OID_SIZE(MBEDTLS_OID_AT_SERIAL_NUMBER)); + if (open_id != NULL && open_id->len > 0) { + size_t cp = (open_id->len < sizeof(idbuf) - 1) ? open_id->len : sizeof(idbuf) - 1; + memcpy(idbuf, open_id->p, cp); + PrintAndLogEx(INFO, "Open ID...... " _YELLOW_("%s"), idbuf); + } + + PrintAndLogEx(INFO, "Valid from... " _YELLOW_("%04d-%02d-%02d %02d:%02d:%02d"), + cert.valid_from.year, cert.valid_from.mon, cert.valid_from.day, + cert.valid_from.hour, cert.valid_from.min, cert.valid_from.sec); + PrintAndLogEx(INFO, "Valid to..... " _YELLOW_("%04d-%02d-%02d %02d:%02d:%02d"), + cert.valid_to.year, cert.valid_to.mon, cert.valid_to.day, + cert.valid_to.hour, cert.valid_to.min, cert.valid_to.sec); + + if (cert.serial.len > 0) + PrintAndLogEx(INFO, "Serial....... " _YELLOW_("%s"), sprint_hex_inrow(cert.serial.p, cert.serial.len)); + + uint8_t fp[32] = {0}; + if (mbedtls_sha256_ret(cert_buf, cert_len, fp, 0) == 0) + PrintAndLogEx(INFO, "SHA-256...... " _YELLOW_("%s"), sprint_hex_inrow(fp, sizeof(fp))); + + // Step 4: Verify certificate signature against LEAF Root CA public key. + // The certificate uses ECDSA-SHA256 over secp256r1; ecdsa_signature_verify + // accepts the DER-encoded signature stored in cert.sig. + PrintAndLogEx(INFO, "--- " _CYAN_("Root CA Verification")); + bool root_ok = false; + int rres = ecdsa_signature_verify( + MBEDTLS_ECP_DP_SECP256R1, + (uint8_t *)kLeafRootP256PubKey, + cert.tbs.p, + (int)cert.tbs.len, + cert.sig.p, + cert.sig.len, + true); + if (rres == PM3_SUCCESS) { + PrintAndLogEx(SUCCESS, "Root signature " _GREEN_("verified") " (LEAF Root CA P-256)"); + root_ok = true; + } else { + PrintAndLogEx(ERR, "Root signature " _RED_("verification failed") " (%d)", rres); + } + + // Extract card public key (P-256, uncompressed) + uint8_t card_pubkey[65] = {0}; + int kres = ecdsa_public_key_from_pk(&cert.pk, MBEDTLS_ECP_DP_SECP256R1, card_pubkey, sizeof(card_pubkey)); + mbedtls_x509_crt_free(&cert); + if (kres != 0) { + PrintAndLogEx(ERR, "Failed to extract card public key (-0x%04x)", -kres); + DropField(); + return PM3_ESOFT; + } + if (verbose) + PrintAndLogEx(INFO, "Card pubkey.. %s", sprint_hex_inrow(card_pubkey, sizeof(card_pubkey))); + + // Step 5: ISO Internal Authenticate + PrintAndLogEx(INFO, "--- " _CYAN_("ISO Internal Authenticate")); + PrintAndLogEx(INFO, "Challenge.... " _YELLOW_("%s"), sprint_hex_inrow(challenge, sizeof(challenge))); + uint8_t card_random[DUOX_INTAUTH_CHALLENGE_LEN] = {0}; + uint8_t signature_rs[DUOX_INTAUTH_SIG_LEN] = {0}; + res = duox_intauth_exchange(APDULogging, verbose, (uint8_t)keynum, challenge, card_random, signature_rs); + if (res != PM3_SUCCESS) + return res; + + // Step 6: Verify card signature with extracted public key. + PrintAndLogEx(INFO, "--- " _CYAN_("Signature Verification")); + bool card_ok = false; + int sig_res = duox_intauth_verify_sig(verbose, card_pubkey, challenge, card_random, signature_rs); + if (sig_res == PM3_SUCCESS) { + PrintAndLogEx(SUCCESS, "Card signature " _GREEN_("verified")); + card_ok = true; + } else { + PrintAndLogEx(ERR, "Card signature " _RED_("verification failed")); + } + + PrintAndLogEx(NORMAL, ""); + if (root_ok && card_ok) { + PrintAndLogEx(SUCCESS, "LEAF Verified credential " _GREEN_("AUTHENTIC")); + if (idbuf[0] != '\0') + PrintAndLogEx(SUCCESS, "Open ID...... " _GREEN_("%s"), idbuf); + } else { + PrintAndLogEx(ERR, "LEAF Verified credential " _RED_("FAILED") " (root=%s, card=%s)", + root_ok ? "ok" : "fail", card_ok ? "ok" : "fail"); + } + + return (root_ok && card_ok) ? PM3_SUCCESS : PM3_ESOFT; +} + static int CmdHF14ADesTest(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "hf mfdes test", @@ -8030,6 +8282,7 @@ static command_t CommandTable[] = { {"-----------", CmdHelp, IfPm3Iso14443a, "----------------------- " _CYAN_("DUOX") " ------------------------"}, {"intauth", CmdHF14ADesIntAuth, IfPm3Iso14443a, "ISO Internal Authenticate (ECDSA challenge-response)"}, {"vdesign", CmdHF14ADesVdeSign, IfPm3Iso14443a, "VDE ECDSASign (EV charging signature over 32-byte challenge)"}, + {"leaf", CmdHF14ADesLeaf, IfPm3Iso14443a, "LEAF Verified credential read + cert + auth check"}, {"-----------", CmdHelp, IfPm3Iso14443a, "----------------------- " _CYAN_("System") " -----------------------"}, {"test", CmdHF14ADesTest, AlwaysAvailable, "Regression crypto tests"}, {NULL, NULL, NULL, NULL}