CAN support for PACE

[TWilb]

You can use the Card Access Number together with PACE.
In the Example App the CAN will be used if entered and is preferred over the MRZ data.

[advatar]

I am testing this with a German Id. It does not work out of the box. These cards have another primary AID E80704007f00070302 that has to be in Info.plist.

When I change this I can get the PACEInfos but fail with:

tagReaderSessionDidBecomeActive
tagReaderSession:didDetect - iso7816(<NFCISO7816Tag: 0x281128f90>)
tagReaderSession:connecting to tag - iso7816(<NFCISO7816Tag: 0x281128f90>)
tagReaderSession:connected to tag - starting authentication
TagReader - Number of data bytes to read - 193
data Optional([49, 129, 193, 48, 13, 6, 8, 4, 0, 127, 0, 7, 2, 2, 2, 2, 1, 2, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 3, 2, 2, 2, 1, 2, 2, 1, 65, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 2, 2, 1, 2, 2, 1, 13, 48, 28, 6, 9, 4, 0, 127, 0, 7, 2, 2, 3, 2, 48, 12, 6, 7, 4, 0, 127, 0, 7, 1, 2, 2, 1, 13, 2, 1, 65, 48, 42, 6, 8, 4, 0, 127, 0, 7, 2, 2, 6, 22, 30, 104, 116, 116, 112, 58, 47, 47, 98, 115, 105, 46, 98, 117, 110, 100, 46, 100, 101, 47, 99, 105, 102, 47, 110, 112, 97, 46, 120, 109, 108, 48, 62, 6, 8, 4, 0, 127, 0, 7, 2, 2, 8, 49, 50, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 3, 2, 2, 2, 1, 2, 2, 1, 69, 48, 28, 6, 9, 4, 0, 127, 0, 7, 2, 2, 3, 2, 48, 12, 6, 7, 4, 0, 127, 0, 7, 1, 2, 2, 1, 13, 2, 1, 69]) error nil
Starting Password Authenticated Connection Establishment (PACE)
Performing PACE with id-PACE-ECDH-GM-AES-CBC-CMAC-128
Error reading tag: sw1 - 0x67, sw2 - 0x00
reason: Wrong length
PACEHandler: MSESatATMutualAuth - Error - Wrong length
   OpenSSLError: 
PACE Failed - Invalid data passed - PACE Failed

[advatar]

By hard coding the APDU with

    `let cmd = NFCISO7816APDU(data: Data([0x00,0x22,0xc1,0xa4,0x12,0x80,0x0a,0x04,0x00,0x7f,0x00,0x07,0x02,0x02,0x04,0x02,0x02,0x83,0x01,0x03,0x84,0x01,0x0d]))!

`
I got this from another working app I manage to do PACE with PIN. But then it fails as the app goes back to BAC later.

tagReaderSessionDidBecomeActive
tagReaderSession:didDetect - iso7816(<NFCISO7816Tag: 0x2818f5170>)
tagReaderSession:connecting to tag - iso7816(<NFCISO7816Tag: 0x2818f5170>)
tagReaderSession:connected to tag - starting authentication
TagReader - Number of data bytes to read - 193
data Optional([49, 129, 193, 48, 13, 6, 8, 4, 0, 127, 0, 7, 2, 2, 2, 2, 1, 2, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 3, 2, 2, 2, 1, 2, 2, 1, 65, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 2, 2, 1, 2, 2, 1, 13, 48, 28, 6, 9, 4, 0, 127, 0, 7, 2, 2, 3, 2, 48, 12, 6, 7, 4, 0, 127, 0, 7, 1, 2, 2, 1, 13, 2, 1, 65, 48, 42, 6, 8, 4, 0, 127, 0, 7, 2, 2, 6, 22, 30, 104, 116, 116, 112, 58, 47, 47, 98, 115, 105, 46, 98, 117, 110, 100, 46, 100, 101, 47, 99, 105, 102, 47, 110, 112, 97, 46, 120, 109, 108, 48, 62, 6, 8, 4, 0, 127, 0, 7, 2, 2, 8, 49, 50, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 3, 2, 2, 2, 1, 2, 2, 1, 69, 48, 28, 6, 9, 4, 0, 127, 0, 7, 2, 2, 3, 2, 48, 12, 6, 7, 4, 0, 127, 0, 7, 1, 2, 2, 1, 13, 2, 1, 69]) error nil
Starting Password Authenticated Connection Establishment (PACE)
Performing PACE with id-PACE-ECDH-GM-AES-CBC-CMAC-128
CAN_PACE_KEY_REFERENCE
sendMSESetATMutualAuth 2
oidBytes [128, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 2]
keyTypeBytes [131, 1, 3]
cmd [0x00, 0x22, 0xC1, 0xA4, 0x12, 0x80, 0x0A, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x02, 0x83, 0x01, 0x03, 0x84, 0x01, 0x0D]
Doing PACE Step1...
Doing PACE Step2...
   Using General Mapping (GM)...
Generating ECDH mapping keys from parameterSpec - 927
Sending public mapping key to passport..
Received passports public mapping key
Doing ECDH Mapping agreement
Doing PACE Step3 - Key Exchange
Generated Ephemeral key pair
Sending ephemeral public key to passport
Doing PACE Step3 Key Agreement...
Computing shared secret...
Deriving ksEnc and ksMac keys from shared secret
Generating authentication token
Sending auth token to passport
Auth token from passport matches expected token!
Restarting secure messaging using AES encryption
PACE Successful
Re-selecting eMRTD Application
Error reading tag: sw1 - 0x69, sw2 - 0x82
reason: Security status not satisfied
Reading tag - COM
Error reading tag: sw1 - 0x6A, sw2 - 0x82
reason: File not found
ERROR - File not found
Starting Basic Access Control (BAC)
BACHandler - deriving Document Basic Access Keys
BACHandler - Getting initial challenge
BACHandler - Doing mutual authentication
Error reading tag: sw1 - 0x6A, sw2 - 0x88
reason: Referenced data not found
ERROR - Referenced data not found
BAC Failed
tagReaderSession:didInvalidateWithError - Session invalidated by user

[tienngx]

By hard coding the APDU with

    `let cmd = NFCISO7816APDU(data: Data([0x00,0x22,0xc1,0xa4,0x12,0x80,0x0a,0x04,0x00,0x7f,0x00,0x07,0x02,0x02,0x04,0x02,0x02,0x83,0x01,0x03,0x84,0x01,0x0d]))!

`
I got this from another working app I manage to do PACE with PIN. But then it fails as the app goes back to BAC later.

tagReaderSessionDidBecomeActive
tagReaderSession:didDetect - iso7816(<NFCISO7816Tag: 0x2818f5170>)
tagReaderSession:connecting to tag - iso7816(<NFCISO7816Tag: 0x2818f5170>)
tagReaderSession:connected to tag - starting authentication
TagReader - Number of data bytes to read - 193
data Optional([49, 129, 193, 48, 13, 6, 8, 4, 0, 127, 0, 7, 2, 2, 2, 2, 1, 2, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 3, 2, 2, 2, 1, 2, 2, 1, 65, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 2, 2, 1, 2, 2, 1, 13, 48, 28, 6, 9, 4, 0, 127, 0, 7, 2, 2, 3, 2, 48, 12, 6, 7, 4, 0, 127, 0, 7, 1, 2, 2, 1, 13, 2, 1, 65, 48, 42, 6, 8, 4, 0, 127, 0, 7, 2, 2, 6, 22, 30, 104, 116, 116, 112, 58, 47, 47, 98, 115, 105, 46, 98, 117, 110, 100, 46, 100, 101, 47, 99, 105, 102, 47, 110, 112, 97, 46, 120, 109, 108, 48, 62, 6, 8, 4, 0, 127, 0, 7, 2, 2, 8, 49, 50, 48, 18, 6, 10, 4, 0, 127, 0, 7, 2, 2, 3, 2, 2, 2, 1, 2, 2, 1, 69, 48, 28, 6, 9, 4, 0, 127, 0, 7, 2, 2, 3, 2, 48, 12, 6, 7, 4, 0, 127, 0, 7, 1, 2, 2, 1, 13, 2, 1, 69]) error nil
Starting Password Authenticated Connection Establishment (PACE)
Performing PACE with id-PACE-ECDH-GM-AES-CBC-CMAC-128
CAN_PACE_KEY_REFERENCE
sendMSESetATMutualAuth 2
oidBytes [128, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 2]
keyTypeBytes [131, 1, 3]
cmd [0x00, 0x22, 0xC1, 0xA4, 0x12, 0x80, 0x0A, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x02, 0x83, 0x01, 0x03, 0x84, 0x01, 0x0D]
Doing PACE Step1...
Doing PACE Step2...
   Using General Mapping (GM)...
Generating ECDH mapping keys from parameterSpec - 927
Sending public mapping key to passport..
Received passports public mapping key
Doing ECDH Mapping agreement
Doing PACE Step3 - Key Exchange
Generated Ephemeral key pair
Sending ephemeral public key to passport
Doing PACE Step3 Key Agreement...
Computing shared secret...
Deriving ksEnc and ksMac keys from shared secret
Generating authentication token
Sending auth token to passport
Auth token from passport matches expected token!
Restarting secure messaging using AES encryption
PACE Successful
Re-selecting eMRTD Application
Error reading tag: sw1 - 0x69, sw2 - 0x82
reason: Security status not satisfied
Reading tag - COM
Error reading tag: sw1 - 0x6A, sw2 - 0x82
reason: File not found
ERROR - File not found
Starting Basic Access Control (BAC)
BACHandler - deriving Document Basic Access Keys
BACHandler - Getting initial challenge
BACHandler - Doing mutual authentication
Error reading tag: sw1 - 0x6A, sw2 - 0x88
reason: Referenced data not found
ERROR - Referenced data not found
BAC Failed
tagReaderSession:didInvalidateWithError - Session invalidated by user

I am also learning to implement PACE with PIN. Can you please share with me the sample code you made?
Thanks you very much

[TWilb]

@advatar
I think the German ID is the worst to test with - it is not an ICAO compliant document and you won't be able to read out data without doing EAC2.

@tienngx Do you try to use the German ID as well?

Using the PIN instead of a CAN should not be a big problem. Afaik it is just one different parameter. I will have a look at it.

[tienngx]

@advatar
I think the German ID is the worst to test with - it is not an ICAO compliant document and you won't be able to read out data without doing EAC2.

@tienngx Do you try to use the German ID as well?

Using the PIN instead of a CAN should not be a big problem. Afaik it is just one different parameter. I will have a look at it.

@TWilb I don't use German ID.
I tried many ways with apdu to call the access card but got the error:

cmd: 00 22 C1 A4 80 83 01 02 84

Error reading tag: sw1 - 0x6A, sw2 - 0x88
reason: Referenced data not found

[tienngx]

Thanks Andy.
I have retrieved that copy but can't do it successfully with my ID card.
Best regards!

[zayphong92]

@advatar @tienngx @TWilb

hi` all pro
I'm using readCardAccess and it's an error like this ResponseError("Instruction code not supported or invalid", 109, 0)

=========================

func readCardAccess( completed: @escaping ([UInt8]?, NFCPassportReaderError?)->() ) {

    let cmd : NFCISO7816APDU = NFCISO7816APDU(instructionClass: 0x00, instructionCode: 0xA4, p1Parameter: 0x00, p2Parameter: 0x0C, data: Data([0x3f,0x00]), expectedResponseLength: 256)
    
    send( cmd: cmd) { response, error in
        if let error = error {
            completed( nil, error )
            return
        }
        
        // Now read EC.CardAccess
        self.selectFileAndRead(tag: [0x01,0x1C]) { data, error in
            completed( data, error)
        }
    }
}
        
        // Now read EC.CardAccess
        self.selectFileAndRead(tag: [0x01,0x1C]) { data, error in
            completed( data, error)
        }
    }
}