EPassport - Revision history

PhilippeTeuwen: /* Tools */

2013-06-20T11:03:20Z

Tools

← Older revision		Revision as of 11:03, 20 June 2013
Line 448:		Line 448:
	* [http://code.google.com/p/epassportviewer/ Read your ePassport in one Click]		* [http://code.google.com/p/epassportviewer/ Read your ePassport in one Click]
	* [http://code.google.com/p/pypassport/ Python library to read the biometric ePassport]		* [http://code.google.com/p/pypassport/ Python library to read the biometric ePassport]
			===[http://sourceforge.net/projects/openpace/ openPACE]===
			cryptolib

	==Specific countries==		==Specific countries==

PhilippeTeuwen: /* CSCA certificates */

2013-02-28T14:19:58Z

CSCA certificates

← Older revision		Revision as of 14:19, 28 February 2013
Line 112:		Line 112:
	awk "/:d=1/{b=0}		awk "/:d=1/{b=0}
	/:d=1.*SET/{b=1}		/:d=1.*SET/{b=1}
	/:d=2/&&b{print $1}"\|\		/:d=2/&&b{print}"\|\
	sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./\		sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./\
	dd if=$PAYLOAD bs=1 skip=\1 count=$((\2+\3)) 2>\/dev\/null > $REF.\1.cer;\		dd if=$PAYLOAD bs=1 skip=\1 count=$((\2+\3)) 2>\/dev\/null > $REF.\1.cer;\

PhilippeTeuwen: /* Verifying a passport */

2013-01-24T00:35:10Z

Verifying a passport

← Older revision		Revision as of 00:35, 24 January 2013
Line 252:		Line 252:
	Verification successful		Verification successful

			If you extracted all CSCA certificates in a single directory from the ldif as explained above, you can also use it as a CA directory. Prepare the hash links by running within the directory:
⚫	~~So if~~ you don't have your country's CSCA certificate, you can only do the -verify -noverify step.
			c_rehash .
			Then use openssl as following:
			$ openssl smime -verify -in EF_SOD.PEM -inform pem -CApath /path/to/pkdML.000023.ldif/certs/ > EF_SOD.data
			Verification successful

		⚫	If you don't have your country's CSCA certificate, you can only do the -verify -noverify step.

	In case that step fails with an error message similar to:		In case that step fails with an error message similar to:

PhilippeTeuwen: /* CSCA certificates */

2013-01-24T00:04:00Z

CSCA certificates

← Older revision		Revision as of 00:04, 24 January 2013
Line 218:		Line 218:
	Issuer: serialNumber=3, CN=CSCA NL, OU=Ministry of the Interior and Kingdom Relations, O=State of the Netherlands, C=NL		Issuer: serialNumber=3, CN=CSCA NL, OU=Ministry of the Interior and Kingdom Relations, O=State of the Netherlands, C=NL
	Issuer: serialNumber=3, O=Hellenic Republic, CN=CSCA-HELLAS, C=GR/emailAddress=csca@passport.gov.gr		Issuer: serialNumber=3, O=Hellenic Republic, CN=CSCA-HELLAS, C=GR/emailAddress=csca@passport.gov.gr
	~~This~~ list is matching the one given in the [http://www.icao.int/Security/mrtd/Downloads/PKD%20Documents/PKD%20Master%20List%20Content.pdf PKD Master List Content document]		Last time I checked, list pkdML.000016.ldif was matching the one given in the [http://www.icao.int/Security/mrtd/Downloads/PKD%20Documents/PKD%20Master%20List%20Content.pdf PKD Master List Content document] but the doc seems not updated since.

	==Verifying a passport==		==Verifying a passport==

PhilippeTeuwen: /* CSCA certificates */

2013-01-23T23:53:18Z

CSCA certificates

@@ Line 59: / Line 59: @@
 done
 </source>
 CSCA Master List LDIF is using another syntax.
@@ Line 103: / Line 131: @@
 Parsing pkdML.000023.ldif (2012-11-19) gave 3 ML signed by AU, CH & DE and containing all together certificates from 53 countries
  $ grep -h Issuer: *txt|sort|uniq
         Issuer: C=AE, O=MOI, OU=EPASS, CN=UAE CSCA 01

PhilippeTeuwen: /* CSCA certificates */

2013-01-23T23:47:08Z

CSCA certificates

Show changes

PhilippeTeuwen: /* CSCA certificates */

2012-04-26T16:10:20Z

CSCA certificates

← Older revision		Revision as of 16:10, 26 April 2012
Line 88:		Line 88:
	REF=${FILE%.pem}		REF=${FILE%.pem}
	C=$(openssl x509 -in $FILE -issuer -noout \|sed "s#./C=$[^/]\+$.#\1#")		C=$(openssl x509 -in $FILE -issuer -noout \|sed "s#./C=$[^/]\+$.#\1#")
	mv $REF.pem ${REF}_${C}.pem		mv $REF.pem $REF.$C.pem
	mv $REF.txt ${REF}_${C}.txt		mv $REF.txt $REF.$C.txt
	done		done
	echo "Done"		echo "Done"

PhilippeTeuwen: /* CSCA certificates */

2012-04-26T16:08:27Z

CSCA certificates

← Older revision		Revision as of 16:08, 26 April 2012
Line 79:		Line 79:
	/:d=1.*SET/{b=1}		/:d=1.*SET/{b=1}
	/:d=2/&&b{print $1}"\|\		/:d=2/&&b{print $1}"\|\
	sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./~~dd if=$PAYLOAD bs=1 skip=~~\~~1 count=$((\2+\3)) 2>\/dev\/null\|openssl x509 -inform der -out $REF.\1.pem -outform pem;openssl x509 -in $REF.\1.pem -inform pem -noout -text > $REF.\1.txt;/')~~		sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./\
			dd if=$PAYLOAD bs=1 skip=\1 count=$((\2+\3)) 2>\/dev\/null\|\
			openssl x509 -inform der -out $REF.\1.pem -outform pem;\
			openssl x509 -in $REF.\1.pem -inform pem -noout -text > $REF.\1.txt;/')
	done		done
	echo "Renaming cert files with corresponding country suffix"		echo "Renaming cert files with corresponding country suffix"

PhilippeTeuwen: /* CSCA certificates */

2012-04-26T16:05:38Z

CSCA certificates

← Older revision		Revision as of 16:05, 26 April 2012
Line 62:		Line 62:

	rm xx*		rm xx*
			echo "Splitting CscaMasterListData elements out of LDIF at offsets:"
	csplit pkdML.* '%CscaMasterListData%' '/^CscaMasterListData/' '{*}'		csplit pkdML.* '%CscaMasterListData%' '/^CscaMasterListData/' '{*}'
			echo "base64-decoding CscaMasterListData elements"
	for i in xx*; do		for i in xx*; do
	cat $i \|sed '1s/^.*:://;/:/,/qwerty/d' \|openssl base64 -d > $i.~~raw~~		cat $i \|sed '1s/^.*:://;/:/,/qwerty/d' \|openssl base64 -d > $i.der
	test $? -eq 0 && rm $i		test $? -eq 0 && rm $i
	done		done
	for FILE in xx*.~~raw~~; do		for FILE in xx*.der; do
			REF=${FILE%.der}
⚫	openssl cms -in $FILE -inform der -noverify -verify -out $~~FILE.data~~
	~~eval~~ $~~(openssl asn1parse -in $FILE~~.data ~~-inform~~ der ~~-i\|\~~		PAYLOAD=$REF.data.der
			echo "Verifying and extracting payload $PAYLOAD out of CscaMasterListData file $FILE:"
		⚫	openssl cms -in $FILE -inform der -noverify -verify -out $PAYLOAD
			echo "Extracting all certificates from payload $PAYLOAD"
			eval $(openssl asn1parse -in $PAYLOAD -inform der -i\|\
	awk "/:d=1/{b=0}		awk "/:d=1/{b=0}
	/:d=1.*SET/{b=1}		/:d=1.*SET/{b=1}
	/:d=2/&&b{print $1}"\|\		/:d=2/&&b{print $1}"\|\
	sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./dd if=$~~FILE.data~~ bs=1 skip=\1 count=$((\2+\3))\|openssl x509 -inform der -out $~~{FILE%.raw}~~.\1.pem -outform pem;openssl x509 -in $~~{FILE%.raw}~~.\1.pem -inform pem -noout -text > $~~{FILE%.raw}~~.\1.txt;/')		sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./dd if=$PAYLOAD bs=1 skip=\1 count=$((\2+\3)) 2>\/dev\/null\|openssl x509 -inform der -out $REF.\1.pem -outform pem;openssl x509 -in $REF.\1.pem -inform pem -noout -text > $REF.\1.txt;/')
	done		done
			echo "Renaming cert files with corresponding country suffix"
			for FILE in xx*.pem; do
			REF=${FILE%.pem}
			C=$(openssl x509 -in $FILE -issuer -noout \|sed "s#./C=$[^/]\+$.#\1#")
			mv $REF.pem ${REF}_${C}.pem
			mv $REF.txt ${REF}_${C}.txt
			done
			echo "Done"
	</source>		</source>

PhilippeTeuwen: /* CSCA certificates */

2012-04-26T15:36:14Z

CSCA certificates

← Older revision		Revision as of 15:36, 26 April 2012
Line 59:		Line 59:
	<br>Here is another ugly script to parse it (note that [http://sourceforge.net/projects/jmrtd/forums/forum/580232/topic/4872229 jmrtd code is also ugly] ;-) )		<br>Here is another ugly script to parse it (note that [http://sourceforge.net/projects/jmrtd/forums/forum/580232/topic/4872229 jmrtd code is also ugly] ;-) )
	<source lang=bash>		<source lang=bash>
	#!/bin/bash		#!/bin/bash

	rm xx*		rm xx*
Line 68:		Line 68:
	done		done
	for FILE in xx*.raw; do		for FILE in xx*.raw; do
		⚫	openssl cms -in $FILE -inform der -noverify -verify -out $FILE.data
	# offset to the meat
	~~off=$(~~eval ~~echo~~ $(openssl asn1parse -in $FILE -inform der -i \|\		eval $(openssl asn1parse -in $FILE.data -inform der -i\|\
	grep -A2 "d=4.*2\.23\.136\.1\.1\.2"\|\
	grep "HEX DUMP"\|\
	sed 's/^ $[0-9]\+$.hl=$[0-9]\+$.*/$((\1+\2))/'))
⚫	~~eval $(~~openssl ~~asn1parse~~ -in $FILE -inform der -i -~~offset~~ $~~off\|\~~
	awk "/:d=1/{b=0}		awk "/:d=1/{b=0}
	/:d=1.*SET/{b=1}		/:d=1.*SET/{b=1}
	/:d=2/&&b{print $1}"\|\		/:d=2/&&b{print $1}"\|\
	sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./dd if=$FILE bs=1 skip=~~$((~~\1~~+$off))~~ count=$((\2+\3))\|openssl x509 -inform der -out ${FILE%.raw}.~~$((~~\1~~+$off))~~.pem -outform pem;openssl x509 -in ${FILE%.raw}.~~$((~~\1~~+$off))~~.pem -inform pem -noout -text > ${FILE%.raw}.~~$((~~\1~~+$off))~~.txt;/')		sed 's/^ $[0-9]\+$.hl= $[0-9]\+$.l= $[0-9]\+$./dd if=$FILE.data bs=1 skip=\1 count=$((\2+\3))\|openssl x509 -inform der -out ${FILE%.raw}.\1.pem -outform pem;openssl x509 -in ${FILE%.raw}.\1.pem -inform pem -noout -text > ${FILE%.raw}.\1.txt;/')
	done		done
	</source>		</source>