projects / apple / security.git / blame
| Commit | Line | Data |
|---|---|---|
| 866f8763 A |
1 | // |
| 2 | // Copyright 2016 Apple. All rights reserved. | |
| 3 | // | |
| 4 | ||
| 5 | #import <Foundation/Foundation.h> | |
| 6 | #import <Security/Security.h> | |
| 7 | #import <Security/SecItemPriv.h> | |
| 8 | #import <Security/SecKeyPriv.h> | |
| dbe77505 A |
9 | #import <Security/SecAccessControlPriv.h> |
| 10 | #import <libaks_acl_cf_keys.h> | |
| 866f8763 | 11 | #import "MobileGestalt.h" |
| 866f8763 A |
12 | |
| 13 | #import "shared_regressions.h" | |
| 14 | ||
| d64be36e | 15 | static id generateKey(id keyType, CFStringRef protection, BOOL withACL) { |
| dbe77505 | 16 | id accessControl; |
| d64be36e | 17 | if (!withACL) { |
| dbe77505 A |
18 | accessControl = CFBridgingRelease(SecAccessControlCreate(kCFAllocatorDefault, NULL)); |
| 19 | SecAccessControlSetProtection((__bridge SecAccessControlRef)accessControl, protection, NULL); | |
| 20 | } else { | |
| 21 | accessControl = CFBridgingRelease(SecAccessControlCreateWithFlags(NULL, protection, kSecAccessControlPrivateKeyUsage, NULL)); | |
| 22 | } | |
| 866f8763 A |
23 | NSDictionary *keyAttributes = @{ (id)kSecAttrTokenID : (id)kSecAttrTokenIDAppleKeyStore, |
| 24 | (id)kSecAttrKeyType : keyType, | |
| 25 | (id)kSecAttrAccessControl : accessControl, | |
| 26 | (id)kSecAttrIsPermanent : @NO }; | |
| 27 | NSError *error; | |
| 28 | id key = (__bridge_transfer id)SecKeyCreateRandomKey((CFDictionaryRef)keyAttributes, (void *)&error); | |
| 29 | ok(key, "failed to create random key %@", error); | |
| 30 | return key; | |
| 31 | } | |
| 32 | ||
| 33 | static void secKeySepTest(BOOL testPKA) { | |
| 34 | NSArray *keyTypes; | |
| 35 | if (testPKA) { | |
| 36 | keyTypes = @[(id)kSecAttrKeyTypeECSECPrimeRandom, (id)kSecAttrKeyTypeECSECPrimeRandomPKA, (id)kSecAttrKeyTypeSecureEnclaveAttestation]; | |
| 37 | } else { | |
| 38 | keyTypes = @[(id)kSecAttrKeyTypeECSECPrimeRandom, (id)kSecAttrKeyTypeSecureEnclaveAttestation]; | |
| 39 | } | |
| d64be36e | 40 | BOOL withACL = NO; |
| 866f8763 | 41 | for (id keyType in keyTypes) { |
| d64be36e | 42 | id privateKey = generateKey((id)keyType, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, (withACL = !withACL)); |
| 866f8763 A |
43 | ok(privateKey, "failed to create key '%@'", keyType); |
| 44 | id publicKey = (__bridge_transfer id)SecKeyCopyPublicKey((SecKeyRef)privateKey); | |
| 45 | ||
| 46 | NSArray *attestaionKeyTypes = @[@(kSecKeyAttestationKeyTypeSIK), @(kSecKeyAttestationKeyTypeGID)]; | |
| 47 | for (NSNumber *attestationKeyType in attestaionKeyTypes) { | |
| 48 | id attestationKey = (__bridge_transfer id)SecKeyCopyAttestationKey([attestationKeyType unsignedIntValue], NULL); | |
| 49 | ok(attestationKey, "failed to create attestaion key '%@'", attestationKeyType); | |
| 50 | NSError *error; | |
| 51 | if (![keyType isEqual:(id)kSecAttrKeyTypeSecureEnclaveAttestation]) { | |
| 52 | const char rawData[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9 }; | |
| 53 | NSData *dataToSign = [NSData dataWithBytes:rawData length:sizeof(rawData)]; | |
| 54 | NSData *signedData = (__bridge_transfer NSData*)SecKeyCreateSignature((SecKeyRef)privateKey, kSecKeyAlgorithmECDSASignatureMessageX962SHA256, (__bridge CFDataRef)dataToSign, (void *)&error); | |
| 55 | ok(signedData, "failed to sign data, error %@", error); | |
| 56 | error = nil; | |
| 57 | ok(SecKeyVerifySignature((SecKeyRef)publicKey, kSecKeyAlgorithmECDSASignatureMessageX962SHA256, (__bridge CFDataRef)dataToSign, (__bridge CFDataRef)signedData, (void *)&error), | |
| 58 | "failed to verify data '%@'", error); | |
| 59 | ||
| 60 | // Try signing large data. | |
| 61 | dataToSign = [NSMutableData dataWithLength:10 * 1024 * 1024]; | |
| 62 | error = nil; | |
| 63 | signedData = (__bridge_transfer NSData*)SecKeyCreateSignature((SecKeyRef)privateKey, kSecKeyAlgorithmECDSASignatureMessageX962SHA256, (__bridge CFDataRef)dataToSign, (void *)&error); | |
| 64 | ok(signedData, "failed to sign data, error %@", error); | |
| 65 | error = nil; | |
| 66 | ok(SecKeyVerifySignature((SecKeyRef)publicKey, kSecKeyAlgorithmECDSASignatureMessageX962SHA256, (__bridge CFDataRef)dataToSign, (__bridge CFDataRef)signedData, (void *)&error), | |
| 67 | "failed to verify data '%@'", error); | |
| 68 | } | |
| 69 | NSData *attestationData = (__bridge_transfer NSData *)SecKeyCreateAttestation((__bridge SecKeyRef)attestationKey, (__bridge SecKeyRef)privateKey, (void *)&error); | |
| 70 | ok(attestationData, "failed to attest key '%@'", error); | |
| 71 | } | |
| 72 | ||
| 73 | NSDictionary *keyAttrs = (__bridge_transfer NSDictionary *)SecKeyCopyAttributes((SecKeyRef)privateKey); | |
| 74 | NSData *keyBlob = keyAttrs[(id)kSecAttrTokenOID]; | |
| 75 | ||
| 76 | NSDictionary *params = @{ (id)kSecAttrTokenID : (id)kSecAttrTokenIDAppleKeyStore, | |
| 77 | (id)kSecAttrTokenOID : keyBlob, | |
| 78 | (id)kSecReturnRef : @YES }; | |
| 79 | ||
| 80 | privateKey = nil; | |
| 81 | NSError *error; | |
| 82 | privateKey = (__bridge_transfer id)SecKeyCreateWithData((__bridge CFDataRef)keyBlob, (__bridge CFDictionaryRef)params, (void *)&error); | |
| 83 | ok(privateKey, "failed to create key with data '%@'", error); | |
| 84 | // <rdar://problem/30651629> SecItemAdd fails to create SecKey from aks key blob | |
| 85 | // | |
| 86 | // ok_status(SecItemAdd((__bridge CFDictionaryRef)params, (void *)&privateKey), "failed to create key from aks blob"); | |
| 87 | // ok_status(SecItemDelete((__bridge CFDictionaryRef) @{(id)kSecValueRef : privateKey}), "failed to delete key from aks blob"); | |
| 88 | } | |
| 89 | } | |
| 90 | ||
| d64be36e | 91 | static void attestationTest(CFStringRef protection, BOOL withACL) { |
| 866f8763 | 92 | NSError *error; |
| d64be36e A |
93 | id privKey = generateKey((id)kSecAttrKeyTypeECSECPrimeRandom, protection, withACL); |
| 94 | id uik = generateKey((id)kSecAttrKeyTypeSecureEnclaveAttestation, protection, withACL); | |
| 866f8763 | 95 | id sik = CFBridgingRelease(SecKeyCopyAttestationKey(kSecKeyAttestationKeyTypeSIK, (void *)&error)); |
| 0e1db9d1 | 96 | ok(sik != nil, "get SIK key: %@", error); |
| 866f8763 A |
97 | |
| 98 | error = nil; | |
| 99 | NSData *attSIKPlain = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sik, (__bridge SecKeyRef)uik, (void *)&error)); | |
| 100 | ok(attSIKPlain != nil, "SIK attesting UIK, no nonce: %@", error); | |
| 101 | ||
| 102 | error = nil; | |
| 103 | NSData *attUIKPlain = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)uik, (__bridge SecKeyRef)privKey, (void *)&error)); | |
| 104 | ok(attUIKPlain != nil, "UIK attesting privKey, no nonce: %@", error); | |
| 105 | ||
| 106 | error = nil; | |
| 107 | NSData *nonce = [@"TESTnonce" dataUsingEncoding:NSUTF8StringEncoding]; | |
| 108 | ok(SecKeySetParameter((__bridge SecKeyRef)sik, kSecKeyParameterSETokenAttestationNonce, (__bridge CFPropertyListRef)nonce, (void *)&error), "Set nonce to SIK: %@", error); | |
| 109 | NSData *attSIKNonce = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sik, (__bridge SecKeyRef)uik, (void *)&error)); | |
| 110 | ok(attSIKNonce != nil, "SIK attesting UIK, with nonce: %@", error); | |
| 866f8763 A |
111 | |
| 112 | error = nil; | |
| 113 | ok(SecKeySetParameter((__bridge SecKeyRef)uik, kSecKeyParameterSETokenAttestationNonce, (__bridge CFPropertyListRef)nonce, (void *)&error), "Set nonce to UIK: %@", error); | |
| 114 | NSData *attUIKNonce = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)uik, (__bridge SecKeyRef)privKey, (void *)&error)); | |
| 115 | ok(attUIKNonce != nil, "SIK attesting UIK, with nonce: %@", error); | |
| d64be36e A |
116 | } |
| 117 | ||
| 118 | static void sysKeyAttestationTest(CFStringRef protection, BOOL withACL, const char *name, SecKeyAttestationKeyType committed, SecKeyAttestationKeyType proposed, BOOL canAttest) { | |
| 119 | NSError *error; | |
| 120 | id privKey = generateKey((id)kSecAttrKeyTypeECSECPrimeRandom, protection, withACL); | |
| 121 | id sik = CFBridgingRelease(SecKeyCopyAttestationKey(kSecKeyAttestationKeyTypeSIK, (void *)&error)); | |
| 122 | ok(sik != nil, "get SIK key: %@", error); | |
| 123 | ||
| 124 | id pubSIK = CFBridgingRelease(SecKeyCopyPublicKey((__bridge SecKeyRef)sik)); | |
| 125 | ok(pubSIK != nil, "get SIK pubkey"); | |
| 126 | ||
| 127 | id sysKeyC = CFBridgingRelease(SecKeyCopyAttestationKey(committed, (void *)&error)); | |
| 128 | if (sysKeyC == nil) { | |
| 129 | diag("skipping attestation test, platform does not support key %s-committed", name); | |
| 130 | return; | |
| 131 | } | |
| 79b9da22 A |
132 | |
| 133 | error = nil; | |
| d64be36e A |
134 | id sysKeyP = CFBridgingRelease(SecKeyCopyAttestationKey(proposed, (void *)&error)); |
| 135 | ok(sysKeyP != nil, "unable to get proposed key, but successfully got committed key"); | |
| 79b9da22 | 136 | |
| d64be36e | 137 | if (canAttest) { |
| 79b9da22 | 138 | error = nil; |
| d64be36e A |
139 | NSData *attSysKeyC = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sysKeyC, (__bridge SecKeyRef)privKey, (void *)&error)); |
| 140 | ok(attSysKeyC != nil, "%s-committed attesting privKey: %@", name, error); | |
| 79b9da22 A |
141 | |
| 142 | error = nil; | |
| d64be36e A |
143 | NSData *attSysKeyP = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sysKeyP, (__bridge SecKeyRef)privKey, (void *)&error)); |
| 144 | ok(attSysKeyP != nil, "%s-proposed attesting privKey: %@", name, error); | |
| 145 | } | |
| 79b9da22 | 146 | |
| d64be36e A |
147 | id pubSysKeyP = CFBridgingRelease(SecKeyCopyPublicKey((__bridge SecKeyRef)sysKeyP)); |
| 148 | ok(pubSysKeyP != nil, "%s-proposed copy public key", name); | |
| 149 | id pubSysKeyC = CFBridgingRelease(SecKeyCopyPublicKey((__bridge SecKeyRef)sysKeyC)); | |
| 150 | ok(pubSysKeyC != nil, "%s-committed copy public key", name); | |
| 79b9da22 | 151 | |
| d64be36e A |
152 | BOOL res = SecKeyControlLifetime((__bridge SecKeyRef)sysKeyC, kSecKeyControlLifetimeTypeBump, (void *)&error); |
| 153 | ok(res, "bumping %s: %@", name, error); | |
| 79b9da22 | 154 | |
| d64be36e | 155 | if (canAttest) { |
| 79b9da22 | 156 | error = nil; |
| d64be36e A |
157 | NSData *attSysKeyCN = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sysKeyC, (__bridge SecKeyRef)privKey, (void *)&error)); |
| 158 | ok(attSysKeyCN != nil, "%s-committed attesting privKey: %@", name, error); | |
| 79b9da22 A |
159 | |
| 160 | error = nil; | |
| d64be36e A |
161 | NSData *attSysKeyPN = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sysKeyP, (__bridge SecKeyRef)privKey, (void *)&error)); |
| 162 | ok(attSysKeyPN != nil, "%s-proposed attesting privKey: %@", name, error); | |
| 163 | } | |
| 79b9da22 | 164 | |
| d64be36e A |
165 | id pubSysKeyPN = CFBridgingRelease(SecKeyCopyPublicKey((__bridge SecKeyRef)sysKeyP)); |
| 166 | ok(pubSysKeyPN != nil, "%s-proposed copy public key", name); | |
| 167 | ok(![pubSysKeyPN isEqual:pubSysKeyC], "%s proposed and committed differ after bump", name); | |
| 79b9da22 | 168 | |
| d64be36e A |
169 | res = SecKeyControlLifetime((__bridge SecKeyRef)sysKeyP, kSecKeyControlLifetimeTypeCommit, (void *)&error); |
| 170 | ok(res, "committing %s: %@", name, error); | |
| 79b9da22 | 171 | |
| d64be36e | 172 | if (canAttest) { |
| 79b9da22 | 173 | error = nil; |
| d64be36e A |
174 | NSData *attSysKeyCNN = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sysKeyC, (__bridge SecKeyRef)privKey, (void *)&error)); |
| 175 | ok(attSysKeyCNN != nil, "%s-committed attesting privKey: %@", name, error); | |
| 79b9da22 A |
176 | |
| 177 | error = nil; | |
| d64be36e A |
178 | NSData *attSysKeyPNN = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sysKeyP, (__bridge SecKeyRef)privKey, (void *)&error)); |
| 179 | ok(attSysKeyPNN != nil, "%s-proposed attesting privKey: %@", name, error); | |
| 180 | } | |
| 79b9da22 | 181 | |
| d64be36e A |
182 | id pubSysKeyCN = CFBridgingRelease(SecKeyCopyPublicKey((__bridge SecKeyRef)sysKeyC)); |
| 183 | ok(pubSysKeyCN != nil, "%s-committed copy public key", name); | |
| 184 | ok([pubSysKeyPN isEqual:pubSysKeyCN], "%s proposed and committed same after commit", name); | |
| 79b9da22 | 185 | |
| d64be36e A |
186 | // Attest system key with SIK |
| 187 | NSData *attSIKSysKeyP = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sik, (__bridge SecKeyRef)sysKeyP, (void *)&error)); | |
| 188 | ok(attSIKSysKeyP != nil, "SIK attesting %s-proposed, error: %@", name, error); | |
| 79b9da22 | 189 | |
| d64be36e A |
190 | NSData *attSIKSysKeyC = CFBridgingRelease(SecKeyCreateAttestation((__bridge SecKeyRef)sik, (__bridge SecKeyRef)sysKeyC, (void *)&error)); |
| 191 | ok(attSIKSysKeyC != nil, "SIK attesting %s-committed, error: %@", name, error); | |
| 866f8763 A |
192 | } |
| 193 | ||
| b54c578e A |
194 | static void keyFromBlobTest(void) { |
| 195 | NSError *error; | |
| 196 | ||
| 197 | NSDictionary *keyParams = @{ (id)kSecAttrTokenID: (id)kSecAttrTokenIDAppleKeyStore, | |
| 198 | (id)kSecAttrKeyType: (id)kSecAttrKeyTypeECSECPrimeRandom, | |
| 199 | (id)kSecAttrIsPermanent: @NO | |
| 200 | }; | |
| 201 | id privateKeyRef = CFBridgingRelease(SecKeyCreateRandomKey((CFDictionaryRef)keyParams, (void *)&error)); | |
| 202 | ok(privateKeyRef != nil, "Failed to create a random key: %@", error); | |
| 203 | ||
| 204 | NSDictionary *keyAttrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)privateKeyRef)); | |
| 205 | NSData *keyBlob = keyAttrs[(id)kSecAttrTokenOID]; | |
| 206 | ||
| 207 | // keyBlob -> SecKey: | |
| 208 | NSDictionary *params = @{ (id)kSecAttrTokenID : (id)kSecAttrTokenIDAppleKeyStore, | |
| 209 | (id)kSecAttrTokenOID : keyBlob }; | |
| 210 | id newKeyRef = CFBridgingRelease(SecKeyCreateWithData((CFDataRef)keyBlob, (CFDictionaryRef)params, (void *)&error)); | |
| 211 | ok(newKeyRef != nil, "Failed to create key from data: %@", error); | |
| 212 | ||
| 213 | id ref; | |
| 214 | is_status(SecItemCopyMatching(((__bridge CFDictionaryRef) @{(id)kSecClass: (id)kSecClassKey, (id)kSecValueRef: newKeyRef}), (void *)&ref), errSecItemNotFound); | |
| 215 | } | |
| dbe77505 A |
216 | |
| 217 | static const uint8_t satori_priv[] = { | |
| 218 | 0x04, 0xe4, 0xef, 0x00, 0x27, 0xcb, 0xa6, 0x46, | |
| 219 | 0x0d, 0xa6, 0xbd, 0x77, 0x14, 0x65, 0xe5, 0x5a, 0x14, 0xc9, 0xf8, 0xd8, 0xdd, 0x4c, 0x70, 0x44, | |
| 220 | 0x50, 0x49, 0xe4, 0xfa, 0x24, 0x71, 0xaa, 0x4c, 0xe2, 0x74, 0x3b, 0xfd, 0x23, 0xda, 0x6f, 0x92, | |
| 221 | 0x04, 0x4c, 0x93, 0x6c, 0xea, 0x8a, 0xac, 0x22, 0x99, 0xd9, 0x6e, 0x3f, 0xed, 0x20, 0xfd, 0xdd, | |
| 222 | 0x95, 0xe2, 0x32, 0xa0, 0xeb, 0x23, 0xa2, 0xd2, 0x8b, 0x23, 0xcf, 0x74, 0xb4, 0x76, 0x93, 0xdf, | |
| 223 | 0x6d, 0x31, 0x63, 0xc9, 0x87, 0x85, 0x3f, 0x44, 0x09, 0x1f, 0x0d, 0xe2, 0x9a, 0x94, 0x29, 0x03, | |
| 224 | 0x70, 0xbf, 0x87, 0x2a, 0x7e, 0xac, 0xa8, 0x8d, 0x11, | |
| 225 | }; | |
| 226 | ||
| 227 | static const uint8_t satori_test_cert[] = { | |
| 228 | 0x30, 0x82, 0x03, 0xf2, 0x30, 0x82, 0x03, 0x98, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x75, | |
| 229 | 0x0e, 0x97, 0x07, 0xb3, 0x6e, 0x48, 0xe9, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, | |
| 230 | 0x04, 0x03, 0x02, 0x30, 0x7f, 0x31, 0x33, 0x30, 0x31, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x2a, | |
| 231 | 0x54, 0x65, 0x73, 0x74, 0x20, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x6c, 0x69, | |
| 232 | 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, | |
| 233 | 0x6f, 0x6e, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x47, 0x33, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03, | |
| 234 | 0x55, 0x04, 0x0b, 0x0c, 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, | |
| 235 | 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, | |
| 236 | 0x74, 0x79, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70, | |
| 237 | 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, | |
| 238 | 0x13, 0x02, 0x55, 0x53, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x38, 0x30, 0x39, 0x32, 0x37, 0x31, 0x38, | |
| 239 | 0x33, 0x31, 0x30, 0x37, 0x5a, 0x17, 0x0d, 0x32, 0x30, 0x31, 0x30, 0x32, 0x36, 0x31, 0x38, 0x33, | |
| 240 | 0x31, 0x30, 0x37, 0x5a, 0x30, 0x73, 0x31, 0x17, 0x30, 0x15, 0x06, 0x0a, 0x09, 0x92, 0x26, 0x89, | |
| 241 | 0x93, 0xf2, 0x2c, 0x64, 0x01, 0x01, 0x0c, 0x07, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x31, | |
| 242 | 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0c, 0x54, 0x65, 0x73, 0x74, 0x20, 0x53, | |
| 243 | 0x50, 0x20, 0x4c, 0x65, 0x61, 0x66, 0x31, 0x22, 0x30, 0x20, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, | |
| 244 | 0x19, 0x31, 0x2e, 0x32, 0x2e, 0x38, 0x34, 0x30, 0x2e, 0x31, 0x31, 0x33, 0x36, 0x33, 0x35, 0x2e, | |
| 245 | 0x31, 0x30, 0x30, 0x2e, 0x36, 0x2e, 0x36, 0x34, 0x2e, 0x33, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, | |
| 246 | 0x55, 0x04, 0x0a, 0x0c, 0x07, 0x54, 0x65, 0x73, 0x74, 0x20, 0x53, 0x50, 0x31, 0x0b, 0x30, 0x09, | |
| 247 | 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, | |
| 248 | 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, | |
| 249 | 0x03, 0x42, 0x00, 0x04, 0xe4, 0xef, 0x00, 0x27, 0xcb, 0xa6, 0x46, 0x0d, 0xa6, 0xbd, 0x77, 0x14, | |
| 250 | 0x65, 0xe5, 0x5a, 0x14, 0xc9, 0xf8, 0xd8, 0xdd, 0x4c, 0x70, 0x44, 0x50, 0x49, 0xe4, 0xfa, 0x24, | |
| 251 | 0x71, 0xaa, 0x4c, 0xe2, 0x74, 0x3b, 0xfd, 0x23, 0xda, 0x6f, 0x92, 0x04, 0x4c, 0x93, 0x6c, 0xea, | |
| 252 | 0x8a, 0xac, 0x22, 0x99, 0xd9, 0x6e, 0x3f, 0xed, 0x20, 0xfd, 0xdd, 0x95, 0xe2, 0x32, 0xa0, 0xeb, | |
| 253 | 0x23, 0xa2, 0xd2, 0x8b, 0xa3, 0x82, 0x02, 0x08, 0x30, 0x82, 0x02, 0x04, 0x30, 0x0c, 0x06, 0x03, | |
| 254 | 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, | |
| 255 | 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0xb9, 0x04, 0x1a, 0x95, 0x5b, 0x6b, 0x91, 0x04, 0x39, | |
| 256 | 0xea, 0x70, 0x2a, 0x47, 0xb7, 0xa8, 0x49, 0x36, 0xe4, 0x4d, 0xdb, 0x30, 0x4d, 0x06, 0x08, 0x2b, | |
| 257 | 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x41, 0x30, 0x3f, 0x30, 0x3d, 0x06, 0x08, 0x2b, | |
| 258 | 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x31, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, | |
| 259 | 0x6f, 0x63, 0x73, 0x70, 0x2d, 0x75, 0x61, 0x74, 0x2e, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x61, 0x70, | |
| 260 | 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x33, 0x2d, 0x74, | |
| 261 | 0x73, 0x61, 0x61, 0x69, 0x63, 0x61, 0x67, 0x33, 0x31, 0x30, 0x30, 0x82, 0x01, 0x03, 0x06, 0x03, | |
| 262 | 0x55, 0x1d, 0x20, 0x04, 0x81, 0xfb, 0x30, 0x81, 0xf8, 0x30, 0x81, 0xf5, 0x06, 0x09, 0x2a, 0x86, | |
| 263 | 0x48, 0x86, 0xf7, 0x63, 0x64, 0x05, 0x01, 0x30, 0x81, 0xe7, 0x30, 0x81, 0xac, 0x06, 0x08, 0x2b, | |
| 264 | 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x02, 0x30, 0x81, 0x9f, 0x0c, 0x81, 0x9c, 0x52, 0x65, 0x6c, | |
| 265 | 0x69, 0x61, 0x6e, 0x63, 0x65, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x69, 0x73, 0x20, 0x63, 0x65, | |
| 266 | 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x62, 0x79, 0x20, 0x61, 0x6e, 0x79, | |
| 267 | 0x20, 0x70, 0x61, 0x72, 0x74, 0x79, 0x20, 0x69, 0x73, 0x20, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, | |
| 268 | 0x74, 0x20, 0x74, 0x6f, 0x20, 0x74, 0x68, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, | |
| 269 | 0x63, 0x61, 0x74, 0x65, 0x20, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2c, 0x20, 0x43, 0x65, 0x72, | |
| 270 | 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x50, 0x72, 0x61, 0x63, 0x74, | |
| 271 | 0x69, 0x63, 0x65, 0x20, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2c, 0x20, 0x61, | |
| 272 | 0x6e, 0x64, 0x20, 0x74, 0x68, 0x65, 0x20, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x20, 0x6f, 0x66, 0x20, | |
| 273 | 0x61, 0x6e, 0x79, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x62, 0x6c, 0x65, 0x20, 0x61, | |
| 274 | 0x67, 0x72, 0x65, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x30, 0x36, 0x06, 0x08, 0x2b, 0x06, 0x01, | |
| 275 | 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x2a, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, | |
| 276 | 0x77, 0x2e, 0x61, 0x70, 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x65, 0x72, 0x74, | |
| 277 | 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, | |
| 278 | 0x2f, 0x30, 0x3c, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x35, 0x30, 0x33, 0x30, 0x31, 0xa0, 0x2f, | |
| 279 | 0xa0, 0x2d, 0x86, 0x2b, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2d, 0x75, | |
| 280 | 0x61, 0x74, 0x2e, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x61, 0x70, 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, | |
| 281 | 0x6d, 0x2f, 0x74, 0x73, 0x61, 0x61, 0x69, 0x63, 0x61, 0x67, 0x33, 0x2e, 0x63, 0x72, 0x6c, 0x30, | |
| 282 | 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xa0, 0xe6, 0xdf, 0x03, 0xb1, 0x2a, | |
| 283 | 0x53, 0x40, 0x35, 0xc4, 0x01, 0x4b, 0x6a, 0xbd, 0x35, 0x8f, 0x6d, 0x28, 0x63, 0xba, 0x30, 0x0e, | |
| 284 | 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x03, 0x28, 0x30, 0x10, | |
| 285 | 0x06, 0x0a, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x63, 0x64, 0x06, 0x40, 0x03, 0x04, 0x02, 0x05, 0x00, | |
| 286 | 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, | |
| 287 | 0x45, 0x02, 0x20, 0x6a, 0x7e, 0xf1, 0x0b, 0x60, 0xba, 0x4c, 0x3c, 0x83, 0xd5, 0xbd, 0x4a, 0xb1, | |
| 288 | 0x62, 0x2f, 0x52, 0x92, 0xba, 0xb9, 0x64, 0xcd, 0xaa, 0x63, 0x96, 0xa6, 0xd8, 0x6d, 0x3a, 0xf3, | |
| 289 | 0x83, 0x81, 0xb9, 0x02, 0x21, 0x00, 0xc2, 0x37, 0x2d, 0x3a, 0xb7, 0x03, 0x81, 0x2f, 0x3e, 0xf1, | |
| 290 | 0x32, 0x98, 0x43, 0x27, 0xbb, 0x64, 0xbf, 0xfb, 0xb9, 0x9a, 0x0c, 0xad, 0x9a, 0x98, 0x6f, 0xbc, | |
| 291 | 0x87, 0x30, 0xfe, 0xfe, 0x3c, 0x2e, 0x30, 0x82, 0x03, 0x17, 0x30, 0x82, 0x02, 0x9e, 0xa0, 0x03, | |
| 292 | 0x02, 0x01, 0x02, 0x02, 0x08, 0x5b, 0x7d, 0xce, 0x90, 0x32, 0x77, 0x34, 0xd6, 0x30, 0x0a, 0x06, | |
| 293 | 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03, 0x30, 0x6c, 0x31, 0x20, 0x30, 0x1e, 0x06, | |
| 294 | 0x03, 0x55, 0x04, 0x03, 0x0c, 0x17, 0x54, 0x65, 0x73, 0x74, 0x20, 0x41, 0x70, 0x70, 0x6c, 0x65, | |
| 295 | 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x47, 0x33, 0x31, 0x26, 0x30, | |
| 296 | 0x24, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, | |
| 297 | 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, | |
| 298 | 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, | |
| 299 | 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, | |
| 300 | 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x37, 0x30, 0x35, 0x33, | |
| 301 | 0x30, 0x32, 0x31, 0x33, 0x35, 0x35, 0x35, 0x5a, 0x17, 0x0d, 0x33, 0x32, 0x30, 0x35, 0x32, 0x36, | |
| 302 | 0x32, 0x31, 0x33, 0x35, 0x35, 0x35, 0x5a, 0x30, 0x7f, 0x31, 0x33, 0x30, 0x31, 0x06, 0x03, 0x55, | |
| 303 | 0x04, 0x03, 0x0c, 0x2a, 0x54, 0x65, 0x73, 0x74, 0x20, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x41, | |
| 304 | 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x67, | |
| 305 | 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x47, 0x33, 0x31, 0x26, | |
| 306 | 0x30, 0x24, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, | |
| 307 | 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, | |
| 308 | 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, | |
| 309 | 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, | |
| 310 | 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, | |
| 311 | 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, | |
| 312 | 0x42, 0x00, 0x04, 0xfa, 0xdc, 0xcc, 0x11, 0x10, 0x74, 0x7b, 0x30, 0xc4, 0x69, 0xdd, 0x65, 0xc3, | |
| 313 | 0xda, 0xa1, 0x55, 0xdf, 0xeb, 0x09, 0x5c, 0x29, 0xd0, 0x50, 0x3e, 0x1c, 0x0a, 0x34, 0xfa, 0x83, | |
| 314 | 0xb1, 0x79, 0x49, 0x4d, 0x9d, 0xb3, 0xb9, 0x46, 0xa1, 0xc9, 0x43, 0x67, 0xb3, 0x03, 0x45, 0xd3, | |
| 315 | 0xa4, 0x01, 0x60, 0xc3, 0x58, 0xdb, 0x98, 0x83, 0x19, 0x32, 0xce, 0xc5, 0xa3, 0x68, 0x38, 0xb6, | |
| 316 | 0xca, 0x4d, 0x63, 0xa3, 0x82, 0x01, 0x15, 0x30, 0x82, 0x01, 0x11, 0x30, 0x53, 0x06, 0x08, 0x2b, | |
| 317 | 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x47, 0x30, 0x45, 0x30, 0x43, 0x06, 0x08, 0x2b, | |
| 318 | 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x37, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, | |
| 319 | 0x6f, 0x63, 0x73, 0x70, 0x2d, 0x75, 0x61, 0x74, 0x2e, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x61, 0x70, | |
| 320 | 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x34, 0x2d, 0x74, | |
| 321 | 0x65, 0x73, 0x74, 0x61, 0x70, 0x70, 0x6c, 0x65, 0x72, 0x6f, 0x6f, 0x74, 0x63, 0x61, 0x67, 0x33, | |
| 322 | 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xb9, 0x04, 0x1a, 0x95, 0x5b, | |
| 323 | 0x6b, 0x91, 0x04, 0x39, 0xea, 0x70, 0x2a, 0x47, 0xb7, 0xa8, 0x49, 0x36, 0xe4, 0x4d, 0xdb, 0x30, | |
| 324 | 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, | |
| 325 | 0x02, 0x01, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, | |
| 326 | 0xfc, 0x46, 0xd8, 0x83, 0x6c, 0x1f, 0xe6, 0xf2, 0xdc, 0xdf, 0xa7, 0x99, 0x17, 0xae, 0x0b, 0x44, | |
| 327 | 0x67, 0x17, 0x1b, 0x46, 0x30, 0x44, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x3d, 0x30, 0x3b, 0x30, | |
| 328 | 0x39, 0xa0, 0x37, 0xa0, 0x35, 0x86, 0x33, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, | |
| 329 | 0x6c, 0x2d, 0x75, 0x61, 0x74, 0x2e, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x61, 0x70, 0x70, 0x6c, 0x65, | |
| 330 | 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x61, 0x70, 0x70, 0x6c, 0x65, 0x72, 0x6f, | |
| 331 | 0x6f, 0x74, 0x63, 0x61, 0x67, 0x33, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, | |
| 332 | 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x10, 0x06, 0x0a, 0x2a, 0x86, | |
| 333 | 0x48, 0x86, 0xf7, 0x63, 0x64, 0x06, 0x02, 0x0e, 0x04, 0x02, 0x05, 0x00, 0x30, 0x0a, 0x06, 0x08, | |
| 334 | 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03, 0x03, 0x67, 0x00, 0x30, 0x64, 0x02, 0x30, 0x6a, | |
| 335 | 0x26, 0x0d, 0x2a, 0x80, 0xcd, 0x69, 0x33, 0xef, 0x50, 0xbb, 0x78, 0xbc, 0x17, 0x4c, 0xcd, 0xa6, | |
| 336 | 0x6b, 0x86, 0xe2, 0x86, 0xd3, 0xe7, 0x3d, 0xc3, 0x8f, 0x01, 0xd8, 0x83, 0xe6, 0xc8, 0x1c, 0x7d, | |
| 337 | 0xe7, 0x78, 0xca, 0xfd, 0x29, 0xd5, 0xfa, 0x32, 0x63, 0x98, 0xdb, 0x65, 0x17, 0x2e, 0x05, 0x02, | |
| 338 | 0x30, 0x4d, 0xd7, 0x31, 0x32, 0xfa, 0x17, 0x73, 0x50, 0x9c, 0xb6, 0x04, 0x1d, 0xca, 0xa6, 0x1f, | |
| 339 | 0x60, 0x0a, 0x72, 0x59, 0x6d, 0x7f, 0xc9, 0x5b, 0x93, 0x4a, 0x13, 0x40, 0x60, 0xae, 0x6c, 0x13, | |
| 340 | 0x43, 0xd2, 0x71, 0xc2, 0xdd, 0x32, 0xaa, 0x90, 0xa9, 0xc5, 0xe2, 0xdd, 0x32, 0x23, 0x2f, 0xaa, | |
| 341 | 0xda, 0x30, 0x82, 0x02, 0x4c, 0x30, 0x82, 0x01, 0xd3, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, | |
| 342 | 0x78, 0x36, 0x0b, 0xf4, 0xb7, 0xc8, 0xb6, 0xb0, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, | |
| 343 | 0x3d, 0x04, 0x03, 0x03, 0x30, 0x6c, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, | |
| 344 | 0x17, 0x54, 0x65, 0x73, 0x74, 0x20, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x52, 0x6f, 0x6f, 0x74, | |
| 345 | 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x47, 0x33, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03, 0x55, 0x04, | |
| 346 | 0x0b, 0x0c, 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, | |
| 347 | 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, | |
| 348 | 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, | |
| 349 | 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, | |
| 350 | 0x55, 0x53, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34, 0x32, 0x32, 0x30, 0x33, 0x31, 0x37, | |
| 351 | 0x34, 0x34, 0x5a, 0x17, 0x0d, 0x34, 0x30, 0x31, 0x32, 0x32, 0x36, 0x30, 0x33, 0x31, 0x33, 0x33, | |
| 352 | 0x37, 0x5a, 0x30, 0x6c, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x17, 0x54, | |
| 353 | 0x65, 0x73, 0x74, 0x20, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, | |
| 354 | 0x41, 0x20, 0x2d, 0x20, 0x47, 0x33, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, | |
| 355 | 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, | |
| 356 | 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x13, | |
| 357 | 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, | |
| 358 | 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, | |
| 359 | 0x30, 0x76, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, | |
| 360 | 0x81, 0x04, 0x00, 0x22, 0x03, 0x62, 0x00, 0x04, 0xa9, 0x1a, 0x63, 0x34, 0xef, 0xbc, 0xa6, 0x8a, | |
| 361 | 0xd6, 0x2a, 0x6a, 0x38, 0x22, 0xe9, 0x25, 0xad, 0xda, 0x28, 0xa0, 0x49, 0xc5, 0x64, 0xfe, 0x5d, | |
| 362 | 0x91, 0xc3, 0x6c, 0xf7, 0x99, 0xe4, 0xba, 0xe4, 0x2a, 0x5f, 0x61, 0xd2, 0xbf, 0x3b, 0x6c, 0xa8, | |
| 363 | 0x61, 0x11, 0xb5, 0xe0, 0x66, 0xf7, 0x22, 0x11, 0x86, 0x97, 0x5d, 0xc3, 0xba, 0x1b, 0x6d, 0x55, | |
| 364 | 0x7f, 0xd0, 0xf9, 0x80, 0xe0, 0xff, 0xd9, 0x05, 0xad, 0x5a, 0x5b, 0xbf, 0x3a, 0x7a, 0xa7, 0x09, | |
| 365 | 0x52, 0x1a, 0x31, 0x7f, 0x0c, 0xa2, 0xe8, 0x10, 0xf5, 0x36, 0xd3, 0xc8, 0xea, 0xa0, 0x5b, 0x0a, | |
| 366 | 0x28, 0x85, 0x30, 0x28, 0x5f, 0x94, 0xf6, 0x94, 0xa3, 0x42, 0x30, 0x40, 0x30, 0x1d, 0x06, 0x03, | |
| 367 | 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xfc, 0x46, 0xd8, 0x83, 0x6c, 0x1f, 0xe6, 0xf2, 0xdc, | |
| 368 | 0xdf, 0xa7, 0x99, 0x17, 0xae, 0x0b, 0x44, 0x67, 0x17, 0x1b, 0x46, 0x30, 0x0f, 0x06, 0x03, 0x55, | |
| 369 | 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0e, 0x06, 0x03, | |
| 370 | 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x0a, 0x06, 0x08, | |
| 371 | 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03, 0x03, 0x67, 0x00, 0x30, 0x64, 0x02, 0x30, 0x1a, | |
| 372 | 0x14, 0x38, 0x24, 0xff, 0xb4, 0x08, 0xcb, 0xea, 0xc9, 0x3b, 0xda, 0xcc, 0x82, 0xf3, 0xd9, 0x0d, | |
| 373 | 0xd1, 0x2b, 0x6e, 0xbf, 0x1f, 0xc4, 0x15, 0x14, 0x44, 0xdf, 0x98, 0x9b, 0xd7, 0xdd, 0xba, 0x1b, | |
| 374 | 0xbe, 0x4f, 0x9f, 0x17, 0xa4, 0xd2, 0x02, 0x75, 0x90, 0x7d, 0x76, 0xcc, 0x93, 0x16, 0x2f, 0x02, | |
| 375 | 0x30, 0x02, 0xd7, 0xda, 0x0b, 0xbe, 0xdd, 0x3d, 0xed, 0xf9, 0xa3, 0x06, 0x90, 0xa9, 0x58, 0xbd, | |
| 376 | 0x6b, 0x7c, 0x7c, 0xe5, 0xc5, 0x4e, 0x0e, 0x44, 0xa2, 0x94, 0x2f, 0xb4, 0x04, 0x9a, 0xcd, 0x9b, | |
| 377 | 0x69, 0x8d, 0x2a, 0xc6, 0x1d, 0x58, 0xff, 0xe3, 0x32, 0xb6, 0xdb, 0x3e, 0x34, 0xff, 0x67, 0x70, | |
| 378 | 0xf1 | |
| 379 | }; | |
| 380 | ||
| 381 | static void rewrapTest(void) { | |
| 382 | id accessControl; | |
| 383 | accessControl = CFBridgingRelease(SecAccessControlCreate(kCFAllocatorDefault, NULL)); | |
| 384 | SecAccessControlSetProtection((__bridge SecAccessControlRef)accessControl, kSecAttrAccessibleWhenUnlocked, NULL); | |
| 385 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)accessControl, (__bridge CFDictionaryRef)@{(id)kAKSKeyOpECIESTranscode: @YES}); | |
| 386 | ||
| 387 | NSDictionary *keyAttributes = @{ (id)kSecAttrTokenID : (id)kSecAttrTokenIDAppleKeyStore, | |
| 388 | (id)kSecAttrKeyType : (id)kSecAttrKeyTypeECSECPrimeRandom, | |
| 389 | (id)kSecKeyApplePayEnabled: @YES, | |
| 390 | (id)kSecAttrAccessControl : accessControl, | |
| 391 | (id)kSecAttrIsPermanent : @NO }; | |
| 392 | NSError *error; | |
| 393 | id key = (__bridge_transfer id)SecKeyCreateRandomKey((CFDictionaryRef)keyAttributes, (void *)&error); | |
| 394 | ok(key, "failed to create random key %@", error); | |
| 395 | ||
| 396 | // Encrypt message with SEP key. | |
| 397 | NSData *message = [@"message" dataUsingEncoding:NSUTF8StringEncoding]; | |
| 398 | id pubKey = CFBridgingRelease(SecKeyCopyPublicKey((SecKeyRef)key)); | |
| 07691282 | 399 | NSData *encrypted = CFBridgingRelease(SecKeyCreateEncryptedDataWithParameters((__bridge SecKeyRef)pubKey, kSecKeyAlgorithmECIESEncryptionStandardVariableIVX963SHA256AESGCM, (__bridge CFDataRef)message, (__bridge CFDictionaryRef)@{(id)kSecKeyEncryptionParameterSymmetricKeySizeInBits: @128}, (void *)&error)); |
| dbe77505 A |
400 | ok(encrypted, "failed to encrypt with public key, %@", error); |
| 401 | NSData *cert = [NSData dataWithBytes:satori_test_cert length:sizeof(satori_test_cert)]; | |
| 402 | NSDictionary *recryptParams = @{ | |
| 403 | (id)kSecKeyEncryptionParameterRecryptCertificate: cert, | |
| 07691282 | 404 | (id)kSecKeyEncryptionParameterSymmetricKeySizeInBits: @128, |
| dbe77505 | 405 | (id)kSecKeyEncryptionParameterRecryptParameters: @{ |
| 07691282 | 406 | (id)kSecKeyEncryptionParameterSymmetricKeySizeInBits: @128 |
| dbe77505 A |
407 | }, |
| 408 | }; | |
| 409 | NSData *recrypted = CFBridgingRelease(SecKeyCreateDecryptedDataWithParameters((__bridge SecKeyRef)key, kSecKeyAlgorithmECIESEncryptionStandardVariableIVX963SHA256AESGCM, (__bridge CFDataRef)encrypted, (__bridge CFDictionaryRef)recryptParams, (void *)&error)); | |
| 410 | ok(recrypted, "failed to recrypt, %@", error); | |
| 411 | ||
| 412 | id recryptKey = CFBridgingRelease(SecKeyCreateWithData((CFDataRef)[NSData dataWithBytes:satori_priv length:sizeof(satori_priv)], (CFDictionaryRef)@{(id)kSecAttrKeyType: (id)kSecAttrKeyTypeECSECPrimeRandom, (id)kSecAttrKeyClass: (id)kSecAttrKeyClassPrivate}, (void *)&error)); | |
| 07691282 | 413 | NSData *decrypted = CFBridgingRelease(SecKeyCreateDecryptedData((__bridge SecKeyRef)recryptKey, kSecKeyAlgorithmECIESEncryptionStandardVariableIVX963SHA256AESGCM, (__bridge CFDataRef)recrypted, (void *)&error)); |
| dbe77505 A |
414 | ok(decrypted, "failed to decrypt, %@", error); |
| 415 | ok([decrypted isEqualToData:message], "Decrypted data differs: %@ vs %@", decrypted, message); | |
| 416 | } | |
| 417 | ||
| b3971512 A |
418 | static void keychainTest(void) { |
| 419 | id accessControl = CFBridgingRelease(SecAccessControlCreateWithFlags(NULL, kSecAttrAccessibleWhenUnlocked, kSecAccessControlPrivateKeyUsage, NULL)); | |
| 420 | NSDictionary *keyAttributes = @{ (id)kSecAttrTokenID : (id)kSecAttrTokenIDAppleKeyStore, | |
| 421 | (id)kSecAttrKeyType : (id)kSecAttrKeyTypeECSECPrimeRandom, | |
| 422 | (id)kSecPrivateKeyAttrs : @{ | |
| 423 | (id)kSecAttrAccessControl : accessControl, | |
| 424 | (id)kSecAttrIsPermanent : @YES, | |
| 425 | (id)kSecAttrLabel : @"si_44_seckey_aks_1", | |
| 426 | }, | |
| 427 | }; | |
| 428 | NSError *error; | |
| 429 | id key = (__bridge_transfer id)SecKeyCreateRandomKey((CFDictionaryRef)keyAttributes, (void *)&error); | |
| 430 | ok(key, "failed to create random key %@", error); | |
| 431 | id pubKey = CFBridgingRelease(SecKeyCopyPublicKey((SecKeyRef)key)); | |
| 432 | ok(pubKey, "failed to get public key from SEP key"); | |
| 433 | key = nil; | |
| 434 | ||
| 435 | NSDictionary *query = @{ | |
| 436 | (id)kSecReturnRef: @YES, | |
| 437 | (id)kSecClass: (id)kSecClassKey, | |
| 438 | (id)kSecAttrLabel: @"si_44_seckey_aks_1", | |
| 439 | }; | |
| 440 | OSStatus status = SecItemCopyMatching((CFDictionaryRef)query, (void *)&key); | |
| 441 | is(status, errSecSuccess, "getting SEP key from keychain failed"); | |
| 442 | ||
| 443 | NSError *err; | |
| 444 | NSData *data = [@"message" dataUsingEncoding:NSUTF8StringEncoding]; | |
| 445 | NSData *sig = CFBridgingRelease(SecKeyCreateSignature((SecKeyRef)key, kSecKeyAlgorithmECDSASignatureMessageX962SHA256, (CFDataRef)data, (void *)&err)); | |
| 446 | ok(sig, "failed to create signature: %@", err); | |
| 447 | ok(SecKeyVerifySignature((SecKeyRef)pubKey, kSecKeyAlgorithmECDSASignatureMessageX962SHA256, (CFDataRef)data, (CFDataRef)sig, (void *)&err), "failed to verify signature: %@", err); | |
| 448 | ||
| 449 | status = SecItemDelete((CFDictionaryRef)query); | |
| 450 | is(status, errSecSuccess, "deleting SEP key from keychain failed"); | |
| 451 | ||
| 452 | status = SecItemCopyMatching((CFDictionaryRef)query, (void *)&key); | |
| 453 | is(status, errSecItemNotFound, "SEP key was not deleted from keychain"); | |
| 454 | } | |
| 455 | ||
| 456 | static void secAccessControlDescriptionTest(void) { | |
| 457 | NSError *error; | |
| 458 | NSObject *ac = CFBridgingRelease(SecAccessControlCreate(kCFAllocatorDefault, (void *)&error)); | |
| 459 | ok(ac, "failed to create ac: %@", error); | |
| 460 | ok(SecAccessControlSetProtection((__bridge SecAccessControlRef)ac, kSecAttrAccessibleWhenUnlocked, (void *)&error), "failed to set protection: %@", error); | |
| 461 | ||
| 462 | NSString *desc = ac.description; | |
| 463 | ok([desc isEqualToString:@"<SecAccessControlRef: ak>"], "unexpected desc: %@", desc); | |
| 464 | ||
| 465 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{}); | |
| 466 | desc = ac.description; | |
| 467 | ok([desc isEqualToString:@"<SecAccessControlRef: ak>"], "unexpected desc: %@", desc); | |
| 468 | ||
| 469 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": (__bridge id)kCFBooleanTrue}); | |
| 470 | desc = ac.description; | |
| 471 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(true)>"], "unexpected desc: %@", desc); | |
| 472 | ||
| 473 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": (__bridge id)kCFBooleanTrue, @"oe": (__bridge id)kCFBooleanFalse}); | |
| 474 | desc = ac.description; | |
| 475 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(true);oe(false)>"], "unexpected desc: %@", desc); | |
| 476 | ||
| 477 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": @"huh"}); | |
| 478 | desc = ac.description; | |
| 479 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(huh)>"], "unexpected desc: %@", desc); | |
| 480 | ||
| 481 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": @2}); | |
| 482 | desc = ac.description; | |
| 483 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(2)>"], "unexpected desc: %@", desc); | |
| 484 | ||
| 485 | NSData *shortData = [NSData dataWithBytes:"\x01\x02\x03" length:3]; | |
| 486 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": shortData}); | |
| 487 | desc = ac.description; | |
| 488 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(010203)>"], "unexpected desc: %@", desc); | |
| 489 | ||
| 490 | NSData *longData = [NSMutableData dataWithLength:128]; | |
| 491 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": longData}); | |
| 492 | desc = ac.description; | |
| 493 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...(128b))>"], "unexpected desc: %@", desc); | |
| 494 | ||
| 495 | SecAccessControlSetConstraints((__bridge SecAccessControlRef)ac, (__bridge CFDictionaryRef)@{@"od": @{@"kofn": @2}}); | |
| 496 | desc = ac.description; | |
| 497 | ok([desc isEqualToString:@"<SecAccessControlRef: ak;od(kofn(2))>"], "unexpected desc: %@", desc); | |
| 498 | } | |
| 499 | ||
| 866f8763 A |
500 | int si_44_seckey_aks(int argc, char *const *argv) { |
| 501 | @autoreleasepool { | |
| d64be36e A |
502 | NSNumber *hasSEP = CFBridgingRelease(MGCopyAnswer(kMGQHasSEP, NULL)); |
| 503 | if (!hasSEP.boolValue) { | |
| 79b9da22 A |
504 | // macOS without SEP cannot run attestations at all. |
| 505 | plan_tests(1); | |
| 506 | ok(true); | |
| 507 | return 0; | |
| 508 | } | |
| 509 | ||
| d64be36e A |
510 | NSNumber *hasPKA = CFBridgingRelease(MGCopyAnswer(kMGQHasPKA, NULL)); |
| 511 | plan_tests(hasPKA.boolValue ? 207 : 113); | |
| b54c578e | 512 | |
| b3971512 | 513 | secAccessControlDescriptionTest(); |
| d64be36e A |
514 | secKeySepTest(hasPKA.boolValue); |
| 515 | ||
| 516 | attestationTest(kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, YES); | |
| 517 | attestationTest(kSecAttrAccessibleUntilReboot, NO); | |
| 518 | ||
| 519 | sysKeyAttestationTest(kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, YES, "SysUIK", kSecKeyAttestationKeyTypeUIKCommitted, kSecKeyAttestationKeyTypeUIKProposed, YES); | |
| 520 | sysKeyAttestationTest(kSecAttrAccessibleUntilReboot, NO, "SysUIK", kSecKeyAttestationKeyTypeUIKCommitted, kSecKeyAttestationKeyTypeUIKProposed, YES); | |
| 521 | ||
| 522 | // OIK is too weird to be usable directly, just skip is testing for now. | |
| 523 | #if 0 | |
| 524 | sysKeyAttestationTest(kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, YES, "OIK", kSecKeyAttestationKeyTypeOIKCommitted, kSecKeyAttestationKeyTypeOIKProposed, NO); | |
| 525 | sysKeyAttestationTest(kSecAttrAccessibleUntilReboot, NO, "OIK", kSecKeyAttestationKeyTypeOIKCommitted, kSecKeyAttestationKeyTypeOIKProposed, NO); | |
| 526 | #endif | |
| 527 | ||
| 528 | sysKeyAttestationTest(kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, YES, "DAK", kSecKeyAttestationKeyTypeDAKCommitted, kSecKeyAttestationKeyTypeDAKProposed, YES); | |
| 529 | sysKeyAttestationTest(kSecAttrAccessibleUntilReboot, NO, "DAK", kSecKeyAttestationKeyTypeDAKCommitted, kSecKeyAttestationKeyTypeDAKProposed, YES); | |
| 530 | ||
| b54c578e | 531 | keyFromBlobTest(); |
| b3971512 | 532 | keychainTest(); |
| dbe77505 | 533 | |
| d64be36e A |
534 | if (hasPKA.boolValue) { |
| 535 | // Put SEP keys into test-keybag mode. Available only when running in direct-mode, not with extension. | |
| 536 | SecKeySetParameter(NULL, kSecAttrTokenIDAppleKeyStore, kCFBooleanTrue, NULL); | |
| 537 | rewrapTest(); | |
| 538 | SecKeySetParameter(NULL, kSecAttrTokenIDAppleKeyStore, kCFBooleanFalse, NULL); | |
| 539 | } | |
| dbe77505 | 540 | |
| 866f8763 A |
541 | return 0; |
| 542 | } | |
| 543 | } |