ios - 智能卡 - 常规验证命令 6A 80

Question

我们尝试在 iPhone 上连接 PIV 智能卡。我们已经加载了必要的库并且可以发送命令。使用获取数据和获取响应命令的组合，我们能够从智能卡检索所有相关证书。我们现在尝试发送通用身份验证命令来签署一些数据，但收到 6A80 。我们正在链接这个命令。链的第一部分成功执行，返回代码为 90 00，但第二个命令给出 6a80。

我们的卡片说明显示

1. 具有 SHA-256 签名的 RSA PKCS #1 v 1.5
2. RSA 2048 位 key

我们使用 SHA1 256 对数据进行哈希处理，并使用 pkcs v 1.5 padding 进行填充。我们还使用 DER 编码对哈希进行编码。但无论哪种方式(有或没有 der 编码)我们都会收到 6a80 错误。这是我们的代码，

// gets data signed from the smart card
-(void) signData:(unsigned char *)origdata:(int) origdatalen:(int) key_reference :(int)        key_size:(int) hash_reference
{
    bool debug=false;
    unsigned char * encodedandpadded;
unsigned char * digest;
NSMutableString* cplc = [[NSMutableString alloc]init];
int derHeaderLen=0;
int keyModulo=0;
int digestLen=0;
if (key_size==2048){
    keyModulo=256;
} else if (key_size==1024){
    keyModulo=128;
}
unsigned char * derHeader=nil;

switch (hash_reference){

    case SHA1:
        derHeaderLen=15;
        derHeader=(unsigned char *) calloc(derHeaderLen,sizeof(unsigned char));
        derHeader[0]=0x30;
        derHeader[1]=0x21;
        derHeader[2]=0x30;
        derHeader[3]=0x09;
        derHeader[4]=0x06;
        derHeader[5]=0x05;
        derHeader[6]=0x2b;
        derHeader[7]=0x0e;
        derHeader[8]=0x03;
        derHeader[9]=0x02;
        derHeader[10]=0x1a;
        derHeader[11]=0x05;
        derHeader[12]=0x00;
        derHeader[13]=0x04;
        derHeader[14]=0x14;
        digestLen=CC_SHA1_DIGEST_LENGTH;
        digest = (unsigned char*) calloc(digestLen,sizeof(unsigned char));
        CC_SHA1(origdata, origdatalen,digest);

        break;
    case SHA256:
        derHeaderLen=19;
        derHeader=(unsigned char *) calloc(derHeaderLen,sizeof(unsigned char));
        derHeader[0]=0x30;
        derHeader[1]=0x31;
        derHeader[2]=0x30;
        derHeader[3]=0x09;
        derHeader[4]=0x06;
        derHeader[5]=0x09;
        derHeader[6]=0x60;
        derHeader[7]=0x86;
        derHeader[8]=0x48;
        derHeader[9]=0x01;
        derHeader[10]=0x65;
        derHeader[11]=0x03;
        derHeader[12]=0x04;
        derHeader[13]=0x02;
        derHeader[14]=0x01;
        derHeader[15]=0x05;
        derHeader[16]=0x00;
        derHeader[17]=0x04;
        derHeader[18]=0x20;
        digestLen=CC_SHA256_DIGEST_LENGTH;
        digest = (unsigned char*) calloc(digestLen,sizeof(unsigned char));
        CC_SHA256(origdata, origdatalen,digest);

        break;
    case SHA512:
        derHeaderLen=19;
        derHeader=(unsigned char *) calloc(derHeaderLen,sizeof(unsigned char));
        derHeader[0]=0x30;
        derHeader[1]=0x51;
        derHeader[2]=0x30;
        derHeader[3]=0x09;
        derHeader[4]=0x06;
        derHeader[5]=0x09;
        derHeader[6]=0x60;
        derHeader[7]=0x86;
        derHeader[8]=0x48;
        derHeader[9]=0x01;
        derHeader[10]=0x65;
        derHeader[11]=0x03;
        derHeader[12]=0x04;
        derHeader[13]=0x02;
        derHeader[14]=0x03;
        derHeader[15]=0x05;
        derHeader[16]=0x00;
        derHeader[17]=0x04;
        derHeader[18]=0x40;

        break;
    default:

        break;

}

   // {0x00, 0x01, PS, 0x00, T},
   bool derEncoding=true;
int psLen;
int finalLen;
if (derEncoding){
    psLen=keyModulo-3-(derHeaderLen+digestLen);
    finalLen=3+psLen+derHeaderLen+digestLen;

} else {
   psLen=keyModulo-3-(digestLen);
   finalLen=3+psLen+digestLen;
}
    encodedandpadded =(unsigned char *) calloc(finalLen,sizeof(unsigned char));
    int count=0;
    encodedandpadded[count++]=0x00;
    encodedandpadded[count++]=0x01;
   for (int i=0;i<psLen;i++){
       encodedandpadded[count++]=0xFF;
   }
   encodedandpadded[count++]=0x00;
   if (derEncoding) {
    for (int i=0;i<derHeaderLen;i++){
        encodedandpadded[count++]=derHeader[i];
    }
}

for (int i=0;i<digestLen;i++){
    encodedandpadded[count++]=digest[i];
}

if (debug){
     [cplc appendString:[NSString stringWithFormat:@" psLen=%d derHeaderLen=%d digestlent=%d finalLen=%d count=%d",psLen,derHeaderLen,digestLen,finalLen,count]];
    for (int i=0;i<finalLen;i++){
         [cplc appendString:[NSString stringWithFormat:@" %02x ",encodedandpadded[i]]];
    }
    [self printData:cplc];
}


[self generalAuthenticate:encodedandpadded :256];


}   


- (void) generalAuthenticate:(unsigned char *) paddeddata:(int) paddeddatalen{

bool debug=true;



PBSmartcardStatus result;

// the first command in the chain , we will send first 128 bytes in this command
unsigned char dat[] = {0x10, 0x87, 0x07, 0x9C};
NSMutableData * prepCommand1 = [[NSMutableData alloc] initWithBytes:dat length:4];
unsigned char dat2[] = {0x86,0x7C,0x84};
[prepCommand1 appendBytes:dat2 length:3];
unsigned char dat3[] = {0x82,0x00,0x81,0x80};
[prepCommand1 appendBytes:dat3 length:4];

unsigned char * part1 =(unsigned char *) calloc((paddeddatalen/2),sizeof(unsigned char));
unsigned char * part2=(unsigned char *) calloc((paddeddatalen/2),sizeof(unsigned char));
int count=0;
for(int i=0;i<(paddeddatalen/2);i++){
    part1[i]=paddeddata[count++];
}

[prepCommand1 appendBytes:part1 length:(paddeddatalen/2)];
for(int i=0;i<(paddeddatalen/2);i++){
    part2[i]=paddeddata[count++];
}
//the second command in the chain, we will send rest of 128 bytes in this command
unsigned char dat4[]={0x00, 0x87, 0x07, 0x9C, 0x80};
NSMutableData * prepCommand2 = [[NSMutableData alloc] initWithBytes:dat4 length:5];

[prepCommand2 appendBytes:part2 length:(paddeddatalen/2)];

unsigned char dat5[]={0x00};
[prepCommand2 appendBytes:dat5 length:1];



//unsigned char get_cplc_command[] = {0x10, 0x87, 0x07, 0x9C,(macOut.length+4),0x82,0x00,0x81,macOut.length};

NSMutableString* cplc = [[NSMutableString alloc]init];

unsigned char received_data[255] = {0};
unsigned short received_data_length;


// on input received_data_length holds the size of the receive buffer.
received_data_length = sizeof(received_data);
unsigned char * prepCmd1=(unsigned char *)[prepCommand1 bytes];
int prepCmd1Len=[prepCommand1 length];
// send the command APDU and get the response from the card.
if (debug){
    [cplc appendString:[NSString stringWithFormat:@"Length %d %d",prepCmd1Len,(paddeddatalen/2), count]];
    [self printData:cplc];
    for (int i=0;i<prepCmd1Len;i++){
            [cplc appendString:[NSString stringWithFormat:@"%02x",prepCmd1[i]]];
    }
    [self printData:cplc];

}
result = [smartcard transmit:prepCmd1
           withCommandLength:prepCmd1Len

           andResponseBuffer:received_data
           andResponseLength:&received_data_length];

LOG(@"transmit = %d", result);


// check if the command was succefully sent to the card
//    if(result != PBSmartcardStatusSuccess)
//    {
//        goto done;
//    }
if (debug){
[cplc appendString:[NSString stringWithFormat:@"Response bytes from card for general authenticate command %02X %02X length %d\n",received_data[received_data_length-2],received_data[received_data_length-1],received_data_length]];
[self printData:cplc];
}

unsigned char received_data_2[300] = {0};
unsigned short received_data_length_2;


// on input received_data_length holds the size of the receive buffer.
received_data_length_2 = sizeof(received_data_2);
unsigned char * prepCmd2=(unsigned char *)[prepCommand2 bytes];
int prepCmd2Len=[prepCommand2 length];
// send the command APDU and get the response from the card.
if (debug){
    [cplc appendString:[NSString stringWithFormat:@"Length %d",prepCmd2Len]];
    [self printData:cplc];
    for (int i=0;i<prepCmd2Len;i++){
        [cplc appendString:[NSString stringWithFormat:@"%02x",prepCmd2[i]]];
    }
    [self printData:cplc];

}
result = [smartcard transmit:prepCmd2
           withCommandLength:prepCmd2Len

           andResponseBuffer:received_data_2
           andResponseLength:&received_data_length_2];

if (debug){
    [cplc appendString:[NSString stringWithFormat:@"Response bytes from card for general authenticate command %02X %02X length %d\n",received_data_2[received_data_length_2-2],received_data_2[received_data_length_2-1],received_data_length_2]];
    [self printData:cplc];
}

}

Answer 1

仅发送命令数据字段中的哈希值，而不是 PKCS#1 填充的哈希值。作为签名操作的一部分，卡可能会进行填充。