Merge remote-tracking branch 'origin/main'

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>

.github/workflows/nightly.yml

@@ -19,13 +19,20 @@ jobs:
         with:
           ref: ${{ matrix.refs }}
           submodules: 'recursive'
+      - name: Restore private key
+        run: |
+          echo "${{ secrets.PRIVATE_KEY_B64 }}" | base64 -d > private.pem
+          chmod 600 private.pem
       - name : Build
         env:
           PICO_SDK_PATH: ../pico-sdk
+          SECURE_BOOT_PKEY: ../private.pem
         run: |
            ./workflows/autobuild.sh pico
            ./build_pico_openpgp.sh --no-eddsa
            ./workflows/autobuild.sh esp32
+      - name: Delete private key
+        run: rm private.pem
       - name: Update nightly release
         uses: pyTooling/Actions/releaser@main
         with:

CMakeLists.txt

@@ -45,6 +45,13 @@ else()
     add_executable(pico_openpgp)
 endif()
 
+set(USB_ITF_CCID 1)
+set(USB_ITF_WCID 1)
+include(pico-keys-sdk/pico_keys_sdk_import.cmake)
+
+if(NOT ESP_PLATFORM)
+    set(SOURCES ${PICO_KEYS_SOURCES})
+endif()
 set(SOURCES ${SOURCES}
         ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/openpgp.c
         ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/files.c
@@ -70,10 +77,6 @@ set(SOURCES ${SOURCES}
         ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/defs.c
 )
 
-set(USB_ITF_CCID 1)
-set(USB_ITF_WCID 1)
-include(pico-keys-sdk/pico_keys_sdk_import.cmake)
-
 SET_VERSION(ver_major ver_minor "${CMAKE_CURRENT_LIST_DIR}/src/openpgp/version.h" 1)
 
 if(ESP_PLATFORM)

build_pico_openpgp.sh

@@ -23,12 +23,13 @@ fi
 cd build_release
 
 PICO_SDK_PATH="${PICO_SDK_PATH:-../../pico-sdk}"
+SECURE_BOOT_PKEY="${SECURE_BOOT_PKEY:-../../ec_private_key.pem}"
 board_dir=${PICO_SDK_PATH}/src/boards/include/boards
 for board in "$board_dir"/*
 do
     board_name="$(basename -- "$board" .h)"
     rm -rf -- ./*
-    PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name -DSECURE_BOOT_PKEY=../../ec_private_key.pem
+    PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name -DSECURE_BOOT_PKEY=${SECURE_BOOT_PKEY}
     make -j`nproc`
     mv pico_openpgp.uf2 ../release/pico_openpgp_$board_name-$SUFFIX.uf2
 done
@@ -40,7 +41,7 @@ if [[ $NO_EDDSA -eq 0 ]]; then
     do
         board_name="$(basename -- "$board" .h)"
         rm -rf -- ./*
-        PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name -DSECURE_BOOT_PKEY=../../ec_private_key.pem -DENABLE_EDDSA=1
+        PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name -DSECURE_BOOT_PKEY=${SECURE_BOOT_PKEY} -DENABLE_EDDSA=1
         make -j`nproc`
         mv pico_openpgp.uf2 ../release_eddsa/pico_openpgp_$board_name-$SUFFIX-eddsa1.uf2
     done

src/openpgp/CMakeLists.txt

@@ -1,6 +1,6 @@
 idf_component_register(
     SRCS ${SOURCES}
     INCLUDE_DIRS . ../../pico-keys-sdk/src ../../pico-keys-sdk/src/fs ../../pico-keys-sdk/src/rng ../../pico-keys-sdk/src/usb ../../pico-keys-sdk/tinycbor/src
-    REQUIRES bootloader_support esp_partition esp_tinyusb zorxx__neopixel mbedtls efuse
+    REQUIRES mbedtls efuse
 )
 idf_component_set_property(${COMPONENT_NAME} WHOLE_ARCHIVE ON)

src/openpgp/piv.c

@@ -218,7 +218,7 @@ static void scan_files_piv() {
             uint8_t *key = (uint8_t *)"\x01\x02\x03\x04\x05\x06\x07\x08\x01\x02\x03\x04\x05\x06\x07\x08\x01\x02\x03\x04\x05\x06\x07\x08";
             file_t *ef = search_by_fid(EF_PIV_KEY_CARDMGM, NULL, SPECIFY_ANY);
             file_put_data(ef, key, 24);
-            uint8_t meta[] = { PIV_ALGO_AES192, PINPOLICY_ALWAYS, TOUCHPOLICY_ALWAYS, ORIGIN_GENERATED };
+            uint8_t meta[] = { PIV_ALGO_AES192, PINPOLICY_ALWAYS, TOUCHPOLICY_ALWAYS };
             meta_add(EF_PIV_KEY_CARDMGM, meta, sizeof(meta));
             has_pwpiv = false;
             memset(session_pwpiv, 0, sizeof(session_pwpiv));
@@ -458,6 +458,7 @@ static int cmd_get_metadata() {
         res_APDU[res_APDU_size++] = 2;
         res_APDU[res_APDU_size++] = meta[1];
         res_APDU[res_APDU_size++] = meta[2];
+        if (key_ref != EF_PIV_KEY_CARDMGM) {
             res_APDU[res_APDU_size++] = 0x3;
             res_APDU[res_APDU_size++] = 1;
             res_APDU[res_APDU_size++] = meta[3];
@@ -523,9 +524,10 @@ static int cmd_get_metadata() {
                 }
             }
         }
+    }
     if (key_ref == EF_PIV_PIN || key_ref == EF_PIV_PUK || key_ref == EF_PIV_KEY_CARDMGM) {
         uint8_t dhash[32];
-        int32_t eq = false;
+        int32_t eq = 0;
         if (key_ref == EF_PIV_PIN) {
             double_hash_pin((const uint8_t *)"\x31\x32\x33\x34\x35\x36\xFF\xFF", 8, dhash);
             eq = memcmp(dhash, file_get_data(ef_key) + 1, file_get_size(ef_key) - 1);
@@ -539,7 +541,7 @@ static int cmd_get_metadata() {
         }
         res_APDU[res_APDU_size++] = 0x5;
         res_APDU[res_APDU_size++] = 1;
-        res_APDU[res_APDU_size++] = eq;
+        res_APDU[res_APDU_size++] = eq == 0;
         if (key_ref == EF_PIV_PIN || key_ref == EF_PIV_PUK) {
             file_t *pw_status;
             if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF))) {
@@ -983,13 +985,14 @@ static int cmd_set_mgmkey() {
     }
     uint8_t touch = P2(apdu);
     if (touch != 0xFF && touch != 0xFE) {
+        return SW_INCORRECT_P1P2();
+    }
     if (touch == 0xFF) {
         touch = TOUCHPOLICY_NEVER;
     }
     else if (touch == 0xFE) {
         touch = TOUCHPOLICY_ALWAYS;
     }
-    }
     uint8_t algo = apdu.data[0], key_ref = apdu.data[1], pinlen = apdu.data[2];
     if ((key_ref != EF_PIV_KEY_CARDMGM) || (!(algo == PIV_ALGO_AES128 && pinlen == 16) && !(algo == PIV_ALGO_AES192 && pinlen == 24) && !(algo == PIV_ALGO_AES256 && pinlen == 32) && !(algo == PIV_ALGO_3DES && pinlen == 24))) {
         return SW_WRONG_DATA();