![]() |
Deeptrust for PCI security architecture
SPEC98T17 rev E
Specification of Deeptrust, the Security Architecture for Cortex-M.
|
List of functions | |
int | pci_authenticate_issuer_and_icc_public_key (unsigned char *issuer_certificate, int issuer_certificate_len, unsigned char *issuer_remainder, int issuer_remainder_len, unsigned char *issuer_exponent, int issuer_exponent_len, unsigned char *icc_certificate, int icc_certificate_len, unsigned char *icc_remainder, int icc_remainder_len, unsigned char *icc_exponent, int icc_exponent_len, CertificationAuthorities *CA_key) |
Authenticates both issuer public key and ICC public key. More... | |
int | pci_get_online_pin (unsigned char pan[], int pan_len, unsigned char encrypted_pin[], int *encrypted_pin_len) |
Gets the "online" PIN, i.e. encrypted with the DUKPT algorithm. The resulting encrypted PIN block is encoded into ISO 9564 Format 0. More... | |
int | pci_pin_entry (int timeout_entry, int entry_device, int display_device) |
Displays a message to the user instructing to enter the PIN. Then gets the pin from the specified entry device. More... | |
int | pci_verify_offline_pin (unsigned char challenge[], int challenge_len, int encrypt_mode, unsigned int timeout) |
Verifies user PIN using the Smart Card. More... | |
This module is in charge of handling PIN entry and processing according to the applicable PCT-PTS-POI standard.
int pci_authenticate_issuer_and_icc_public_key | ( | unsigned char * | issuer_certificate, |
int | issuer_certificate_len, | ||
unsigned char * | issuer_remainder, | ||
int | issuer_remainder_len, | ||
unsigned char * | issuer_exponent, | ||
int | issuer_exponent_len, | ||
unsigned char * | icc_certificate, | ||
int | icc_certificate_len, | ||
unsigned char * | icc_remainder, | ||
int | icc_remainder_len, | ||
unsigned char * | icc_exponent, | ||
int | icc_exponent_len, | ||
CertificationAuthorities * | CA_key | ||
) |
Authenticates both issuer public key and ICC public key.
This function authenticates both issuer public key and ICC public key by a hardcoded Certification Authority Public key.
As per EMV Book2, ICC can use either ICC Public Key or ICC PIN Encipherment Key for Offline Pin Authentication.
EMV Application kernel Identifies which ICC Public key to be used for Offline PIN Encipherment. But, SHIDDaemon uses ICC key only after Successful Authentication. Since CA key is hard coded inside SHIDDaemon, Security is not compromised even when Application kernel provides part of keys and certificate as input to SHIDDaemon.
After use, the PIN buffered gets zeroed using memset.
[in] | issuer_certificate | Issuer Public key certificate |
[in] | issuer_certificate_len | Issuer Public key certificate length |
[in] | icc_certificate | ICC Public key certificate |
[in] | icc_certificate_len | ICC Public key certificate length |
int pci_get_online_pin | ( | unsigned char | pan[], |
int | pan_len, | ||
unsigned char | encrypted_pin[], | ||
int * | encrypted_pin_len | ||
) |
Gets the "online" PIN, i.e. encrypted with the DUKPT algorithm. The resulting encrypted PIN block is encoded into ISO 9564 Format 0.
It uses the PIN buffered using pci_pin_entry.
The context is checked so that only the right caller that has started the PIN entry process can call this function.
After use, the PIN buffered gets zeroed using memset, as well as DUKPT temporary buffers
[in] | store_id | The DUKPT store identifier |
PIN | The clear-text PIN | |
PAN | The PAN | |
[in] | PAN_len | The PAN length |
int pci_pin_entry | ( | int | timeout_entry, |
int | entry_device, | ||
int | display_device | ||
) |
Displays a message to the user instructing to enter the PIN. Then gets the pin from the specified entry device.
The PIN must be entered before a certain amount of time. If not, the function returns.
In case of error, no PIN data remains anywhere in memory. In case of success, the PIN data is kept during at most timeout_pin
[in] | timeout_entry | The timeout for the entry of the PIN by the user |
[in] | timeout_pin | The maximum time during which the PIN is kept in memory. Otherwise it gets zeroed using memset. |
[in] | entry_device | The entry device |
[in] | display_device | The display device |
int pci_verify_offline_pin | ( | unsigned char | challenge[], |
int | challenge_len, | ||
int | encrypt_mode, | ||
unsigned int | timeout | ||
) |
Verifies user PIN using the Smart Card.
This function verifies encrypted pin block with ICC. This function receives Verify APDU header and embedded encrypted pin block before sending it to ICC.
[out] | Verify_APDU_Res | APDU response |
Verify_APDU_Res_len | The verify apdu resource length | |
[in] | timeout | Maximum time allowed for APDU transaction. This value should be in Seconds. |
Verify_APDU_Req | The verify apdu request | |
[out] | Verify_APDU_len | APDU response length |