From 08006dc1ac860f83efaadd83f7e3307c29815b97 Mon Sep 17 00:00:00 2001
From: Lemmo Lavonen <lemmo.lavonen@gmail.com>
Date: Mon, 4 Oct 2021 23:50:14 +0300
Subject: [PATCH 1/3] Adds a class for exchanging data with the ID-card over
 NFC.

---
 MobileAuthApp/.idea/gradle.xml                |   1 -
 MobileAuthApp/.idea/misc.xml                  |   2 +-
 MobileAuthApp/app/build.gradle                |   4 +
 .../mobileauthapp/NFC/Comms.java              | 322 ++++++++++++++++++
 4 files changed, 327 insertions(+), 2 deletions(-)
 create mode 100644 MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java

diff --git a/MobileAuthApp/.idea/gradle.xml b/MobileAuthApp/.idea/gradle.xml
index 33e074b..526b4c2 100644
--- a/MobileAuthApp/.idea/gradle.xml
+++ b/MobileAuthApp/.idea/gradle.xml
@@ -7,7 +7,6 @@
         <option name="testRunner" value="GRADLE" />
         <option name="distributionType" value="DEFAULT_WRAPPED" />
         <option name="externalProjectPath" value="$PROJECT_DIR$" />
-        <option name="gradleHome" value="$PROJECT_DIR$/../../../../../../Gradle/gradle-6.6.1" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$" />
diff --git a/MobileAuthApp/.idea/misc.xml b/MobileAuthApp/.idea/misc.xml
index 4c020ed..dade2ba 100644
--- a/MobileAuthApp/.idea/misc.xml
+++ b/MobileAuthApp/.idea/misc.xml
@@ -12,7 +12,7 @@
       </map>
     </option>
   </component>
-  <component name="ProjectRootManager" version="2" languageLevel="JDK_11" default="true" project-jdk-name="1.8" project-jdk-type="JavaSDK">
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_11" default="true" project-jdk-name="11" project-jdk-type="JavaSDK">
     <output url="file://$PROJECT_DIR$/build/classes" />
   </component>
   <component name="ProjectType">
diff --git a/MobileAuthApp/app/build.gradle b/MobileAuthApp/app/build.gradle
index 6584417..6f6625a 100644
--- a/MobileAuthApp/app/build.gradle
+++ b/MobileAuthApp/app/build.gradle
@@ -55,4 +55,8 @@ dependencies {
 
     //ViewModel
     implementation "androidx.lifecycle:lifecycle-viewmodel-ktx:$lifecycle_version"
+
+    //For cryptography
+    implementation group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
+
 }
\ No newline at end of file
diff --git a/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java b/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
new file mode 100644
index 0000000..9ef2b37
--- /dev/null
+++ b/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
@@ -0,0 +1,322 @@
+package com.tarkvaraprojekt.mobileauthapp.NFC;
+
+import android.nfc.tech.IsoDep;
+import android.util.Log;
+
+import org.bouncycastle.crypto.BlockCipher;
+import org.bouncycastle.crypto.engines.AESEngine;
+import org.bouncycastle.crypto.macs.CMac;
+import org.bouncycastle.crypto.params.KeyParameter;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
+import org.bouncycastle.math.ec.ECPoint;
+import org.bouncycastle.util.encoders.Hex;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.Arrays;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+
+public class Comms {
+    private static final byte[] master = { // select Main AID
+            (byte) 0x00, (byte) 0xA4, (byte) 0x04, (byte) 0x0C, (byte) 0x10,
+            (byte) 0xA0, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x77,
+            (byte) 0x01, (byte) 0x08, (byte) 0x00, (byte) 0x07, (byte) 0x00,
+            (byte) 0x00, (byte) 0xFE, (byte) 0x00, (byte) 0x00, (byte) 0x01,
+            (byte) 0x00,
+    };
+
+    private static final byte[] masterSec = { // select Main AID
+            (byte) 0x0C, (byte) 0xA4, (byte) 0x04, (byte) 0x0C, (byte) 0x2D,
+            (byte) 0x87, (byte) 0x21, (byte) 0x01,
+    };
+
+    private static final byte[] MSESetAT = { // manage security environment: set authentication template
+            (byte) 0x00, (byte) 0x22, (byte) 0xC1, (byte) 0xA4, (byte) 0x0F,
+            (byte) 0x80, (byte) 0x0A, (byte) 0x04, (byte) 0x00, (byte) 0x7F,
+            (byte) 0x00, (byte) 0x07, (byte) 0x02, (byte) 0x02, (byte) 0x04,
+            (byte) 0x02, (byte) 0x04, (byte) 0x83, (byte) 0x01, (byte) 0x02,
+            (byte) 0x00,
+    };
+
+    private static final byte[] GAGetNonce = { // general authenticate: get nonce
+            (byte) 0x10, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x02,
+            (byte) 0x7C, (byte) 0x00, (byte) 0x00,
+    };
+
+    private static final byte[] GAMapNonceIncomplete = {
+            (byte) 0x10, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x45,
+            (byte) 0x7C, (byte) 0x43, (byte) 0x81, (byte) 0x41,
+    };
+
+    private static final byte[] GAKeyAgreementIncomplete = {
+            (byte) 0x10, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x45,
+            (byte) 0x7C, (byte) 0x43, (byte) 0x83, (byte) 0x41,
+    };
+
+    private static final byte[] dataForMACIncomplete = {
+            (byte) 0x7F, (byte) 0x49, (byte) 0x4F, (byte) 0x06, (byte) 0x0A,
+            (byte) 0x04, (byte) 0x00, (byte) 0x7F, (byte) 0x00, (byte) 0x07,
+            (byte) 0x02, (byte) 0x02, (byte) 0x04, (byte) 0x02, (byte) 0x04,
+            (byte) 0x86, (byte) 0x41,
+    };
+
+    private static final byte[] GAMutualAuthenticationIncomplete = {
+            (byte) 0x00, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x0C,
+            (byte) 0x7C, (byte) 0x0A, (byte) 0x85, (byte) 0x08,
+    };
+
+    private static final byte[] personal = { // select personal data DF
+            (byte) 0x0C, (byte) 0xA4, (byte) 0x01, (byte) 0x0C, (byte) 0x1D,
+            (byte) 0x87, (byte) 0x11, (byte) 0x01,
+    };
+
+    private static final byte[] read = { // read binary
+            (byte) 0x0C, (byte) 0xB0, (byte) 0x00, (byte) 0x00, (byte) 0x0D,
+            (byte) 0x97, (byte) 0x01, (byte) 0x00,
+    };
+
+    private byte ssc; // Send sequence counter. Ok as long as the number of sent and received APDUs is <128.
+
+    /**
+     * Calculates the message authentication code
+     * @param keyMAC the cipher key
+     * @param APDU the byte array on which the CMAC algorithm is performed
+     * @return MAC
+     */
+    private byte[] getMAC(byte[] keyMAC, byte[] APDU) {
+        BlockCipher blockCipher = new AESEngine();
+        CMac cmac = new CMac(blockCipher);
+        cmac.init(new KeyParameter(keyMAC));
+        cmac.update(APDU, 0, APDU.length);
+        byte[] MAC = new byte[cmac.getMacSize()];
+        cmac.doFinal(MAC, 0);
+        return Arrays.copyOf(MAC, 8);
+    }
+
+    /**
+     * Creates an application protocol data unit
+     * @param template the byte array to be used as a template
+     * @param data the data necessary for completing the APDU
+     * @param extra the missing length of the APDU being created
+     * @return the complete APDU
+     */
+    private byte[] createAPDU(byte[] template, byte[] data, int extra) {
+        byte[] APDU = Arrays.copyOf(template, template.length + extra);
+        System.arraycopy(data, 0, APDU, template.length, data.length);
+        return APDU;
+    }
+
+    /**
+     * Creates a cipher key
+     * @param unpadded the array to be used as the basis for the key
+     * @param last the last byte in the appended padding
+     * @return the constructed key
+     */
+    private byte[] createKey(byte[] unpadded, byte last) throws NoSuchAlgorithmException {
+        byte[] padded = Arrays.copyOf(unpadded, unpadded.length + 4);
+        padded[padded.length - 1] = last;
+        MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
+        return messageDigest.digest(padded);
+    }
+
+    /**
+     * Decrypts the nonce
+     * @param encryptedNonce the encrypted nonce received from the chip
+     * @param CAN the card access number provided by the user
+     * @return the decrypted nonce
+     */
+    private byte[] decryptNonce(byte[] encryptedNonce, String CAN) throws NoSuchPaddingException, InvalidKeyException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException {
+        byte[] decryptionKey = createKey(CAN.getBytes(StandardCharsets.UTF_8), (byte) 3);
+        Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding");
+        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(decryptionKey, "AES"), new IvParameterSpec(new byte[16]));
+        return cipher.doFinal(encryptedNonce);
+    }
+
+    /**
+     * Attempts to use the PACE protocol to create a secure channel with an Estonian ID-card
+     * @param idCard the IsoDep link to the card
+     * @param CAN the card access number
+     * @return session keys if authentication succeeds, otherwise null
+     */
+    public byte[][] PACE(IsoDep idCard, String CAN) throws IOException, NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
+
+        byte[] response;
+        byte[] APDU;
+        byte[] decryptedNonce;
+        byte[] encodedSecret;
+        byte[] keyEnc;
+        byte[] keyMAC;
+        byte[] MAC;
+        BigInteger privateKey;
+        ECPoint publicKey;
+        ECPoint cardPublicKey;
+        ECPoint sharedSecret;
+        ECPoint mappedECBasePoint;
+        ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec("secp256r1");
+
+        // select the ECC applet on the chip
+        response = idCard.transceive(master);
+        Log.i("Select applet", Hex.toHexString(response));
+
+        // initiate PACE
+        response = idCard.transceive(MSESetAT);
+        Log.i("Authentication template", Hex.toHexString(response));
+
+        // get nonce
+        response = idCard.transceive(GAGetNonce);
+        Log.i("Get nonce", Hex.toHexString(response));
+        decryptedNonce = decryptNonce(Arrays.copyOfRange(response, 4, response.length - 2), CAN);
+
+        // generate an EC keypair and exchange public keys with the chip
+        privateKey = new BigInteger(255, new SecureRandom()).add(BigInteger.ONE); // should be in [1, spec.getN()-1], but this is good enough for this application
+        publicKey = spec.getG().multiply(privateKey).normalize();
+        APDU = createAPDU(GAMapNonceIncomplete, publicKey.getEncoded(false), 66);
+        response = idCard.transceive(APDU);
+        Log.i("Map nonce", Hex.toHexString(response));
+        cardPublicKey = spec.getCurve().decodePoint(Arrays.copyOfRange(response, 4, 69));
+
+        // calculate the new base point, use it to generate a new keypair, and exchange public keys
+        sharedSecret = cardPublicKey.multiply(privateKey);
+        mappedECBasePoint = spec.getG().multiply(new BigInteger(1, decryptedNonce)).add(sharedSecret).normalize();
+        privateKey = new BigInteger(255, new SecureRandom()).add(BigInteger.ONE);
+        publicKey = mappedECBasePoint.multiply(privateKey).normalize();
+        APDU = createAPDU(GAKeyAgreementIncomplete, publicKey.getEncoded(false), 66);
+        response = idCard.transceive(APDU);
+        Log.i("Key agreement", Hex.toHexString(response));
+        cardPublicKey = spec.getCurve().decodePoint(Arrays.copyOfRange(response, 4, 69));
+
+        // generate the session keys and exchange MACs to verify them
+        sharedSecret = cardPublicKey.multiply(privateKey).normalize();
+        encodedSecret = sharedSecret.getAffineXCoord().getEncoded();
+        keyEnc = createKey(encodedSecret, (byte) 1);
+        keyMAC = createKey(encodedSecret, (byte) 2);
+        APDU = createAPDU(dataForMACIncomplete, cardPublicKey.getEncoded(false), 65);
+        MAC = getMAC(keyMAC, APDU);
+        APDU = createAPDU(GAMutualAuthenticationIncomplete, MAC, 9);
+        response = idCard.transceive(APDU);
+        Log.i("Mutual authentication", Hex.toHexString(response));
+
+        // if the chip-side verification fails, return null
+        if (response.length == 2) return null;
+
+        // otherwise verify chip's MAC and return session keys
+        APDU = createAPDU(dataForMACIncomplete, publicKey.getEncoded(false), 65);
+        MAC = getMAC(keyMAC, APDU);
+        assert (Hex.toHexString(response, 4, 8).equals(Hex.toHexString(MAC)));
+        return new byte[][]{keyEnc, keyMAC};
+
+    }
+
+    /**
+     * Encrypts or decrypts the APDU data
+     * @param data the array containing the data to be processed
+     * @param keyEnc the cipher key
+     * @param mode indicates whether to en- or decrypt the data
+     * @return the result of encryption or decryption
+     */
+    private byte[] encryptDecryptData(byte[] data, byte[] keyEnc, int mode) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, InvalidAlgorithmParameterException {
+        SecretKeySpec secretKeySpec = new SecretKeySpec(keyEnc, "AES");
+        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
+        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
+        byte[] iv = Arrays.copyOf(cipher.doFinal(new byte[]{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ssc}), 16);
+        cipher = Cipher.getInstance("AES/CBC/NoPadding");
+        cipher.init(mode, secretKeySpec, new IvParameterSpec(iv));
+        return cipher.doFinal(data);
+    }
+
+    /**
+     * Constructs APDUs suitable for the secure channel.
+     * @param data the data to be encrypted
+     * @param keyEnc the encryption key
+     * @param keyMAC the MAC key
+     * @param incomplete the array to be used as a template
+     * @return the constructed APDU
+     */
+    private byte[] createSecureAPDU(byte[] data, byte[] keyEnc, byte[] keyMAC, byte[] incomplete) throws NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
+
+        ssc++;
+        byte[] encryptedData = new byte[0];
+        int length = 16 * (1 + data.length / 16);
+
+        // construct the required array and calculate the MAC based on it
+        byte[] macData = new byte[data.length > 0 ? 48 + length : 48];
+        macData[15] = ssc; // first block contains the ssc
+        System.arraycopy(incomplete, 0, macData, 16, 4); // second block has the command
+        macData[20] = -128; // elements are terminated by 0x80 and zero-padded to the next block
+        System.arraycopy(incomplete, 5, macData, 32, 3); // third block contains appropriately encapsulated data/Le
+        if (data.length > 0) { // if the APDU has data, add padding and encrypt it
+            byte[] paddedData = Arrays.copyOf(data, length);
+            paddedData[data.length] = -128;
+            encryptedData = encryptDecryptData(paddedData, keyEnc, Cipher.ENCRYPT_MODE);
+            System.arraycopy(encryptedData, 0, macData, 35, encryptedData.length);
+        }
+        macData[35 + encryptedData.length] = -128;
+        byte[] MAC = getMAC(keyMAC, macData);
+
+        // construct the APDU using the encrypted data and the MAC
+        byte[] APDU = new byte[incomplete.length + encryptedData.length + MAC.length + 3];
+        System.arraycopy(incomplete, 0, APDU, 0, incomplete.length);
+        if (encryptedData.length > 0) {
+            System.arraycopy(encryptedData, 0, APDU, incomplete.length, encryptedData.length);
+        }
+        System.arraycopy(new byte[]{-114, 8}, 0, APDU, incomplete.length + encryptedData.length, 2); // MAC is encapsulated using the tag 0x8E
+        System.arraycopy(MAC, 0, APDU, incomplete.length + encryptedData.length + 2, MAC.length);
+
+        ssc++;
+        return APDU;
+
+    }
+
+    /**
+     * Gets contents of the personal data dedicated file
+     * @param idCard link to the ID-card
+     * @param keyEnc the encryption key
+     * @param keyMAC the MAC key
+     * @return an array containing personal data
+     */
+    public byte[][] readPersonalData(IsoDep idCard, byte[] keyEnc, byte[] keyMAC) throws NoSuchPaddingException, InvalidKeyException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException, IOException {
+
+        byte[][] personalData = new byte[8][];
+        byte[] data;
+        byte[] APDU;
+        byte[] response;
+
+        // select the personal data dedicated file
+        data = new byte[]{80, 0}; // personal data DF FID
+        APDU = createSecureAPDU(data, keyEnc, keyMAC, personal);
+        response = idCard.transceive(APDU);
+        Log.i("Select personal data DF", Hex.toHexString(response));
+
+        // select and read the first 8 elementary files in the DF
+        for (byte i = 0; i < 8; i++) {
+
+            data[1] = (byte) (i + 1);
+            APDU = createSecureAPDU(data, keyEnc, keyMAC, personal);
+            response = idCard.transceive(APDU);
+            Log.i(String.format("Select EF 500%d", i + 1), Hex.toHexString(response));
+
+            APDU = createSecureAPDU(new byte[0], keyEnc, keyMAC, read);
+            response = idCard.transceive(APDU);
+            Log.i(String.format("Read binary EF 500%d", i + 1), Hex.toHexString(response));
+
+            // store the decrypted datum
+            personalData[i] = encryptDecryptData(Arrays.copyOfRange(response, 3, 19), keyEnc, Cipher.DECRYPT_MODE);
+        }
+
+        return personalData;
+
+    }
+}

From c30fff7a6f948cb8305d17dd2c8ca4134e69f5a5 Mon Sep 17 00:00:00 2001
From: Lemmo Lavonen <lemmo.lavonen@gmail.com>
Date: Tue, 5 Oct 2021 19:58:27 +0300
Subject: [PATCH 2/3] Adds a constructor for convenience in setting up Comms.

---
 .../mobileauthapp/NFC/Comms.java              | 208 +++++++++---------
 1 file changed, 105 insertions(+), 103 deletions(-)

diff --git a/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java b/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
index 9ef2b37..c434a80 100644
--- a/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
+++ b/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
@@ -1,4 +1,4 @@
-package com.tarkvaraprojekt.mobileauthapp.NFC;
+package ee.ut.math.lemmo.readnfctag;
 
 import android.nfc.tech.IsoDep;
 import android.util.Log;
@@ -31,72 +31,78 @@ import javax.crypto.spec.SecretKeySpec;
 
 public class Comms {
     private static final byte[] master = { // select Main AID
-            (byte) 0x00, (byte) 0xA4, (byte) 0x04, (byte) 0x0C, (byte) 0x10,
-            (byte) 0xA0, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x77,
-            (byte) 0x01, (byte) 0x08, (byte) 0x00, (byte) 0x07, (byte) 0x00,
-            (byte) 0x00, (byte) 0xFE, (byte) 0x00, (byte) 0x00, (byte) 0x01,
-            (byte) 0x00,
-    };
-
-    private static final byte[] masterSec = { // select Main AID
-            (byte) 0x0C, (byte) 0xA4, (byte) 0x04, (byte) 0x0C, (byte) 0x2D,
-            (byte) 0x87, (byte) 0x21, (byte) 0x01,
+            0, -92, 4, 12, 16, -96, 0, 0, 0, 119, 1, 8, 0, 7, 0, 0, -2, 0, 0, 1, 0
     };
 
     private static final byte[] MSESetAT = { // manage security environment: set authentication template
-            (byte) 0x00, (byte) 0x22, (byte) 0xC1, (byte) 0xA4, (byte) 0x0F,
-            (byte) 0x80, (byte) 0x0A, (byte) 0x04, (byte) 0x00, (byte) 0x7F,
-            (byte) 0x00, (byte) 0x07, (byte) 0x02, (byte) 0x02, (byte) 0x04,
-            (byte) 0x02, (byte) 0x04, (byte) 0x83, (byte) 0x01, (byte) 0x02,
-            (byte) 0x00,
+            0, 34, -63, -92, 15, -128, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 4, -125, 1, 2, 0
     };
 
     private static final byte[] GAGetNonce = { // general authenticate: get nonce
-            (byte) 0x10, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x02,
-            (byte) 0x7C, (byte) 0x00, (byte) 0x00,
+            16, -122, 0, 0, 2, 124, 0, 0
     };
 
     private static final byte[] GAMapNonceIncomplete = {
-            (byte) 0x10, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x45,
-            (byte) 0x7C, (byte) 0x43, (byte) 0x81, (byte) 0x41,
+            16, -122, 0, 0, 69, 124, 67, -127, 65
     };
 
     private static final byte[] GAKeyAgreementIncomplete = {
-            (byte) 0x10, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x45,
-            (byte) 0x7C, (byte) 0x43, (byte) 0x83, (byte) 0x41,
-    };
-
-    private static final byte[] dataForMACIncomplete = {
-            (byte) 0x7F, (byte) 0x49, (byte) 0x4F, (byte) 0x06, (byte) 0x0A,
-            (byte) 0x04, (byte) 0x00, (byte) 0x7F, (byte) 0x00, (byte) 0x07,
-            (byte) 0x02, (byte) 0x02, (byte) 0x04, (byte) 0x02, (byte) 0x04,
-            (byte) 0x86, (byte) 0x41,
+            16, -122, 0, 0, 69, 124, 67, -125, 65
     };
 
     private static final byte[] GAMutualAuthenticationIncomplete = {
-            (byte) 0x00, (byte) 0x86, (byte) 0x00, (byte) 0x00, (byte) 0x0C,
-            (byte) 0x7C, (byte) 0x0A, (byte) 0x85, (byte) 0x08,
+            0, -122, 0, 0, 12, 124, 10, -123, 8
+    };
+
+    private static final byte[] dataForMACIncomplete = {
+            127, 73, 79, 6, 10, 4, 0, 127, 0, 7, 2, 2, 4, 2, 4, -122, 65
+    };
+
+    private static final byte[] masterSec = {
+            12, -92, 4, 12, 45, -121, 33, 1
     };
 
     private static final byte[] personal = { // select personal data DF
-            (byte) 0x0C, (byte) 0xA4, (byte) 0x01, (byte) 0x0C, (byte) 0x1D,
-            (byte) 0x87, (byte) 0x11, (byte) 0x01,
+            12, -92, 1, 12, 29, -121, 17, 1
     };
 
     private static final byte[] read = { // read binary
-            (byte) 0x0C, (byte) 0xB0, (byte) 0x00, (byte) 0x00, (byte) 0x0D,
-            (byte) 0x97, (byte) 0x01, (byte) 0x00,
+            12, -80, 0, 0, 13, -105, 1, 0
     };
 
-    private byte ssc; // Send sequence counter. Ok as long as the number of sent and received APDUs is <128.
+    private IsoDep idCard;
+    private final byte[] keyEnc;
+    private final byte[] keyMAC;
+    private byte ssc; // Send sequence counter.
+
+    /**
+     * The constructor performs PACE and stores the session keys
+     *
+     * @param idCard link to the card
+     * @param CAN the card authentication number
+     */
+    public Comms(IsoDep idCard, String CAN) throws IOException, NoSuchPaddingException, InvalidKeyException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException {
+
+        idCard.connect();
+
+        this.idCard = idCard;
+
+        long start = System.currentTimeMillis();
+        byte[][] keys = PACE(CAN);
+        Log.i("Pace duration", String.valueOf(System.currentTimeMillis() - start));
+
+        keyEnc = keys[0];
+        keyMAC = keys[1];
+    }
 
     /**
      * Calculates the message authentication code
-     * @param keyMAC the cipher key
-     * @param APDU the byte array on which the CMAC algorithm is performed
+     *
+     * @param APDU   the byte array on which the CMAC algorithm is performed
+     * @param keyMAC the key for performing CMAC
      * @return MAC
      */
-    private byte[] getMAC(byte[] keyMAC, byte[] APDU) {
+    private byte[] getMAC(byte[] APDU, byte[] keyMAC) {
         BlockCipher blockCipher = new AESEngine();
         CMac cmac = new CMac(blockCipher);
         cmac.init(new KeyParameter(keyMAC));
@@ -108,9 +114,10 @@ public class Comms {
 
     /**
      * Creates an application protocol data unit
+     *
      * @param template the byte array to be used as a template
-     * @param data the data necessary for completing the APDU
-     * @param extra the missing length of the APDU being created
+     * @param data     the data necessary for completing the APDU
+     * @param extra    the missing length of the APDU being created
      * @return the complete APDU
      */
     private byte[] createAPDU(byte[] template, byte[] data, int extra) {
@@ -121,8 +128,9 @@ public class Comms {
 
     /**
      * Creates a cipher key
+     *
      * @param unpadded the array to be used as the basis for the key
-     * @param last the last byte in the appended padding
+     * @param last     the last byte in the appended padding
      * @return the constructed key
      */
     private byte[] createKey(byte[] unpadded, byte last) throws NoSuchAlgorithmException {
@@ -134,8 +142,9 @@ public class Comms {
 
     /**
      * Decrypts the nonce
+     *
      * @param encryptedNonce the encrypted nonce received from the chip
-     * @param CAN the card access number provided by the user
+     * @param CAN            the card access number provided by the user
      * @return the decrypted nonce
      */
     private byte[] decryptNonce(byte[] encryptedNonce, String CAN) throws NoSuchPaddingException, InvalidKeyException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException {
@@ -147,28 +156,13 @@ public class Comms {
 
     /**
      * Attempts to use the PACE protocol to create a secure channel with an Estonian ID-card
-     * @param idCard the IsoDep link to the card
-     * @param CAN the card access number
-     * @return session keys if authentication succeeds, otherwise null
+     *
+     * @param CAN    the card access number
      */
-    public byte[][] PACE(IsoDep idCard, String CAN) throws IOException, NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
-
-        byte[] response;
-        byte[] APDU;
-        byte[] decryptedNonce;
-        byte[] encodedSecret;
-        byte[] keyEnc;
-        byte[] keyMAC;
-        byte[] MAC;
-        BigInteger privateKey;
-        ECPoint publicKey;
-        ECPoint cardPublicKey;
-        ECPoint sharedSecret;
-        ECPoint mappedECBasePoint;
-        ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec("secp256r1");
+    private byte[][] PACE(String CAN) throws IOException, NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
 
         // select the ECC applet on the chip
-        response = idCard.transceive(master);
+        byte[] response = idCard.transceive(master);
         Log.i("Select applet", Hex.toHexString(response));
 
         // initiate PACE
@@ -178,19 +172,20 @@ public class Comms {
         // get nonce
         response = idCard.transceive(GAGetNonce);
         Log.i("Get nonce", Hex.toHexString(response));
-        decryptedNonce = decryptNonce(Arrays.copyOfRange(response, 4, response.length - 2), CAN);
+        byte[] decryptedNonce = decryptNonce(Arrays.copyOfRange(response, 4, response.length - 2), CAN);
 
         // generate an EC keypair and exchange public keys with the chip
-        privateKey = new BigInteger(255, new SecureRandom()).add(BigInteger.ONE); // should be in [1, spec.getN()-1], but this is good enough for this application
-        publicKey = spec.getG().multiply(privateKey).normalize();
-        APDU = createAPDU(GAMapNonceIncomplete, publicKey.getEncoded(false), 66);
+        ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec("secp256r1");
+        BigInteger privateKey = new BigInteger(255, new SecureRandom()).add(BigInteger.ONE); // should be in [1, spec.getN()-1], but this is good enough for this application
+        ECPoint publicKey = spec.getG().multiply(privateKey).normalize();
+        byte[] APDU = createAPDU(GAMapNonceIncomplete, publicKey.getEncoded(false), 66);
         response = idCard.transceive(APDU);
         Log.i("Map nonce", Hex.toHexString(response));
-        cardPublicKey = spec.getCurve().decodePoint(Arrays.copyOfRange(response, 4, 69));
+        ECPoint cardPublicKey = spec.getCurve().decodePoint(Arrays.copyOfRange(response, 4, 69));
 
         // calculate the new base point, use it to generate a new keypair, and exchange public keys
-        sharedSecret = cardPublicKey.multiply(privateKey);
-        mappedECBasePoint = spec.getG().multiply(new BigInteger(1, decryptedNonce)).add(sharedSecret).normalize();
+        ECPoint sharedSecret = cardPublicKey.multiply(privateKey);
+        ECPoint mappedECBasePoint = spec.getG().multiply(new BigInteger(1, decryptedNonce)).add(sharedSecret).normalize();
         privateKey = new BigInteger(255, new SecureRandom()).add(BigInteger.ONE);
         publicKey = mappedECBasePoint.multiply(privateKey).normalize();
         APDU = createAPDU(GAKeyAgreementIncomplete, publicKey.getEncoded(false), 66);
@@ -200,34 +195,36 @@ public class Comms {
 
         // generate the session keys and exchange MACs to verify them
         sharedSecret = cardPublicKey.multiply(privateKey).normalize();
-        encodedSecret = sharedSecret.getAffineXCoord().getEncoded();
-        keyEnc = createKey(encodedSecret, (byte) 1);
-        keyMAC = createKey(encodedSecret, (byte) 2);
+        byte[] encodedSecret = sharedSecret.getAffineXCoord().getEncoded();
+        byte[] keyEnc = createKey(encodedSecret, (byte) 1);
+        byte[] keyMAC = createKey(encodedSecret, (byte) 2);
         APDU = createAPDU(dataForMACIncomplete, cardPublicKey.getEncoded(false), 65);
-        MAC = getMAC(keyMAC, APDU);
+        byte[] MAC = getMAC(APDU, keyMAC);
         APDU = createAPDU(GAMutualAuthenticationIncomplete, MAC, 9);
         response = idCard.transceive(APDU);
         Log.i("Mutual authentication", Hex.toHexString(response));
 
-        // if the chip-side verification fails, return null
-        if (response.length == 2) return null;
+        // if the chip-side verification fails, crash and burn
+        if (response.length == 2) throw new RuntimeException("Invalid CAN.");
 
         // otherwise verify chip's MAC and return session keys
         APDU = createAPDU(dataForMACIncomplete, publicKey.getEncoded(false), 65);
-        MAC = getMAC(keyMAC, APDU);
-        assert (Hex.toHexString(response, 4, 8).equals(Hex.toHexString(MAC)));
+        MAC = getMAC(APDU, keyMAC);
+        if (!Hex.toHexString(response, 4, 8).equals(Hex.toHexString(MAC))) {
+            throw new RuntimeException("Could not verify chip's MAC."); // Should never happen.
+        }
         return new byte[][]{keyEnc, keyMAC};
 
     }
 
     /**
      * Encrypts or decrypts the APDU data
-     * @param data the array containing the data to be processed
-     * @param keyEnc the cipher key
-     * @param mode indicates whether to en- or decrypt the data
+     *
+     * @param data   the array containing the data to be processed
+     * @param mode   indicates whether to en- or decrypt the data
      * @return the result of encryption or decryption
      */
-    private byte[] encryptDecryptData(byte[] data, byte[] keyEnc, int mode) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, InvalidAlgorithmParameterException {
+    private byte[] encryptDecryptData(byte[] data, int mode) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, InvalidAlgorithmParameterException {
         SecretKeySpec secretKeySpec = new SecretKeySpec(keyEnc, "AES");
         Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
         cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
@@ -239,13 +236,12 @@ public class Comms {
 
     /**
      * Constructs APDUs suitable for the secure channel.
-     * @param data the data to be encrypted
-     * @param keyEnc the encryption key
-     * @param keyMAC the MAC key
+     *
+     * @param data       the data to be encrypted
      * @param incomplete the array to be used as a template
      * @return the constructed APDU
      */
-    private byte[] createSecureAPDU(byte[] data, byte[] keyEnc, byte[] keyMAC, byte[] incomplete) throws NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
+    private byte[] createSecureAPDU(byte[] data, byte[] incomplete) throws NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
 
         ssc++;
         byte[] encryptedData = new byte[0];
@@ -260,11 +256,11 @@ public class Comms {
         if (data.length > 0) { // if the APDU has data, add padding and encrypt it
             byte[] paddedData = Arrays.copyOf(data, length);
             paddedData[data.length] = -128;
-            encryptedData = encryptDecryptData(paddedData, keyEnc, Cipher.ENCRYPT_MODE);
+            encryptedData = encryptDecryptData(paddedData, Cipher.ENCRYPT_MODE);
             System.arraycopy(encryptedData, 0, macData, 35, encryptedData.length);
         }
         macData[35 + encryptedData.length] = -128;
-        byte[] MAC = getMAC(keyMAC, macData);
+        byte[] MAC = getMAC(macData, keyMAC);
 
         // construct the APDU using the encrypted data and the MAC
         byte[] APDU = new byte[incomplete.length + encryptedData.length + MAC.length + 3];
@@ -281,39 +277,45 @@ public class Comms {
     }
 
     /**
-     * Gets contents of the personal data dedicated file
-     * @param idCard link to the ID-card
-     * @param keyEnc the encryption key
-     * @param keyMAC the MAC key
-     * @return an array containing personal data
+     * Gets the contents of the personal data dedicated file
+     *
+     * @param FID   the last bytes of file identifiers being requested
+     * @return array containing the data strings
+     *
      */
-    public byte[][] readPersonalData(IsoDep idCard, byte[] keyEnc, byte[] keyMAC) throws NoSuchPaddingException, InvalidKeyException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException, IOException {
+    public String[] readPersonalData(byte[] FID) throws NoSuchPaddingException, InvalidKeyException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException, IOException {
 
-        byte[][] personalData = new byte[8][];
+        String[] personalData = new String[FID.length];
         byte[] data;
         byte[] APDU;
         byte[] response;
 
         // select the personal data dedicated file
         data = new byte[]{80, 0}; // personal data DF FID
-        APDU = createSecureAPDU(data, keyEnc, keyMAC, personal);
+        APDU = createSecureAPDU(data, personal);
         response = idCard.transceive(APDU);
         Log.i("Select personal data DF", Hex.toHexString(response));
 
         // select and read the first 8 elementary files in the DF
-        for (byte i = 0; i < 8; i++) {
+        for (int i = 0; i < FID.length; i++) {
 
-            data[1] = (byte) (i + 1);
-            APDU = createSecureAPDU(data, keyEnc, keyMAC, personal);
-            response = idCard.transceive(APDU);
-            Log.i(String.format("Select EF 500%d", i + 1), Hex.toHexString(response));
+            byte index = FID[i];
+            if (index > 15 || index < 1) throw new RuntimeException("Invalid personal data FID.");
 
-            APDU = createSecureAPDU(new byte[0], keyEnc, keyMAC, read);
+            data[1] = index;
+            APDU = createSecureAPDU(data, personal);
             response = idCard.transceive(APDU);
-            Log.i(String.format("Read binary EF 500%d", i + 1), Hex.toHexString(response));
+            Log.i(String.format("Select EF 500%d", index), Hex.toHexString(response));
+
+            APDU = createSecureAPDU(new byte[0], read);
+            response = idCard.transceive(APDU);
+            Log.i(String.format("Read binary EF 500%d", index), Hex.toHexString(response));
 
             // store the decrypted datum
-            personalData[i] = encryptDecryptData(Arrays.copyOfRange(response, 3, 19), keyEnc, Cipher.DECRYPT_MODE);
+            byte[] raw = encryptDecryptData(Arrays.copyOfRange(response, 3, 19), Cipher.DECRYPT_MODE);
+            int indexOfTerminator = Hex.toHexString(raw).lastIndexOf("80") / 2;
+            personalData[i] = new String(Arrays.copyOfRange(raw, 0, indexOfTerminator));
+
         }
 
         return personalData;

From c98eb92c2fd5521c7587cfb3cc983610b1467b1e Mon Sep 17 00:00:00 2001
From: Lemmo Lavonen <lemmo.lavonen@gmail.com>
Date: Tue, 5 Oct 2021 23:52:27 +0300
Subject: [PATCH 3/3] Fixes package name.

---
 MobileAuthApp/.idea/.gitignore                |  3 ---
 MobileAuthApp/.idea/.name                     |  1 -
 MobileAuthApp/.idea/compiler.xml              |  6 ------
 MobileAuthApp/.idea/gradle.xml                | 20 ------------------
 MobileAuthApp/.idea/misc.xml                  | 21 -------------------
 MobileAuthApp/.idea/vcs.xml                   |  6 ------
 .../mobileauthapp/NFC/Comms.java              |  2 +-
 gradle.properties                             |  0
 8 files changed, 1 insertion(+), 58 deletions(-)
 delete mode 100644 MobileAuthApp/.idea/.gitignore
 delete mode 100644 MobileAuthApp/.idea/.name
 delete mode 100644 MobileAuthApp/.idea/compiler.xml
 delete mode 100644 MobileAuthApp/.idea/gradle.xml
 delete mode 100644 MobileAuthApp/.idea/misc.xml
 delete mode 100644 MobileAuthApp/.idea/vcs.xml
 create mode 100644 gradle.properties

diff --git a/MobileAuthApp/.idea/.gitignore b/MobileAuthApp/.idea/.gitignore
deleted file mode 100644
index 26d3352..0000000
--- a/MobileAuthApp/.idea/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-# Default ignored files
-/shelf/
-/workspace.xml
diff --git a/MobileAuthApp/.idea/.name b/MobileAuthApp/.idea/.name
deleted file mode 100644
index 611b0d8..0000000
--- a/MobileAuthApp/.idea/.name
+++ /dev/null
@@ -1 +0,0 @@
-Mobile Auth App
\ No newline at end of file
diff --git a/MobileAuthApp/.idea/compiler.xml b/MobileAuthApp/.idea/compiler.xml
deleted file mode 100644
index fb7f4a8..0000000
--- a/MobileAuthApp/.idea/compiler.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="CompilerConfiguration">
-    <bytecodeTargetLevel target="11" />
-  </component>
-</project>
\ No newline at end of file
diff --git a/MobileAuthApp/.idea/gradle.xml b/MobileAuthApp/.idea/gradle.xml
deleted file mode 100644
index 526b4c2..0000000
--- a/MobileAuthApp/.idea/gradle.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="GradleMigrationSettings" migrationVersion="1" />
-  <component name="GradleSettings">
-    <option name="linkedExternalProjectsSettings">
-      <GradleProjectSettings>
-        <option name="testRunner" value="GRADLE" />
-        <option name="distributionType" value="DEFAULT_WRAPPED" />
-        <option name="externalProjectPath" value="$PROJECT_DIR$" />
-        <option name="modules">
-          <set>
-            <option value="$PROJECT_DIR$" />
-            <option value="$PROJECT_DIR$/app" />
-          </set>
-        </option>
-        <option name="resolveModulePerSourceSet" value="false" />
-      </GradleProjectSettings>
-    </option>
-  </component>
-</project>
\ No newline at end of file
diff --git a/MobileAuthApp/.idea/misc.xml b/MobileAuthApp/.idea/misc.xml
deleted file mode 100644
index dade2ba..0000000
--- a/MobileAuthApp/.idea/misc.xml
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="DesignSurface">
-    <option name="filePathToZoomLevelMap">
-      <map>
-        <entry key="..\:/Users/henri/Desktop/Tarkvaraprojekt/Estonian-ID-card-mobile-authenticator-POC/MobileAuthApp/app/src/main/res/layout/activity_main.xml" value="0.17300724637681159" />
-        <entry key="..\:/Users/henri/Desktop/Tarkvaraprojekt/Estonian-ID-card-mobile-authenticator-POC/MobileAuthApp/app/src/main/res/layout/fragment_auth.xml" value="0.264" />
-        <entry key="..\:/Users/henri/Desktop/Tarkvaraprojekt/Estonian-ID-card-mobile-authenticator-POC/MobileAuthApp/app/src/main/res/layout/fragment_can.xml" value="0.1598731884057971" />
-        <entry key="..\:/Users/henri/Desktop/Tarkvaraprojekt/Estonian-ID-card-mobile-authenticator-POC/MobileAuthApp/app/src/main/res/layout/fragment_home.xml" value="0.17300724637681159" />
-        <entry key="..\:/Users/henri/Desktop/Tarkvaraprojekt/Estonian-ID-card-mobile-authenticator-POC/MobileAuthApp/app/src/main/res/layout/fragment_pin.xml" value="0.1598731884057971" />
-        <entry key="..\:/Users/henri/Desktop/Tarkvaraprojekt/Estonian-ID-card-mobile-authenticator-POC/MobileAuthApp/app/src/main/res/layout/fragment_user.xml" value="0.35170603674540685" />
-      </map>
-    </option>
-  </component>
-  <component name="ProjectRootManager" version="2" languageLevel="JDK_11" default="true" project-jdk-name="11" project-jdk-type="JavaSDK">
-    <output url="file://$PROJECT_DIR$/build/classes" />
-  </component>
-  <component name="ProjectType">
-    <option name="id" value="Android" />
-  </component>
-</project>
\ No newline at end of file
diff --git a/MobileAuthApp/.idea/vcs.xml b/MobileAuthApp/.idea/vcs.xml
deleted file mode 100644
index 6c0b863..0000000
--- a/MobileAuthApp/.idea/vcs.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="VcsDirectoryMappings">
-    <mapping directory="$PROJECT_DIR$/.." vcs="Git" />
-  </component>
-</project>
\ No newline at end of file
diff --git a/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java b/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
index c434a80..e9cce29 100644
--- a/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
+++ b/MobileAuthApp/app/src/main/java/com/tarkvaraprojekt/mobileauthapp/NFC/Comms.java
@@ -1,4 +1,4 @@
-package ee.ut.math.lemmo.readnfctag;
+package com.tarkvaraprojekt.mobileauthapp.NFC;
 
 import android.nfc.tech.IsoDep;
 import android.util.Log;
diff --git a/gradle.properties b/gradle.properties
new file mode 100644
index 0000000..e69de29