1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
# policy.py - module for handling PSKC policy information
# coding: utf-8
#
# Copyright (C) 2014 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
"""Module that provides PSKC key policy information."""
class Policy(object):
"""Representation of a policy that describes key and pin usage.
Instances of this class provide attributes that describe limits that
are placed on key usage and requirements for key PIN protection. The
policy provides the following attributes:
start_date: the key MUST not be used before this datetime
expiry_date: the key MUST not be used after this datetime
number_of_transactions: maximum number of times the key may be used
key_usage: list of valid usage scenarios for the key (e.g. OTP)
pin_key_id: id of to the key that holds the PIN
pin_key: reference to the key that holds the PIN
pin: value of the PIN to use
pin_usage: define how the PIN is used in relation to the key
pin_max_failed_attemtps: max. number of times a wrong PIN may be entered
pin_min_length: minimum length of a PIN that may be set
pin_max_length: maximum length of a PIN that may be set
pin_encoding: DECIMAL/HEXADECIMAL/ALPHANUMERIC/BASE64/BINARY
unknown_policy_elements: True if the policy contains unsupported rules
If unknown_policy_elements is True the recipient MUST assume that key
usage is not permitted.
"""
# Key is used for OTP generation.
KEY_USE_OTP = 'OTP'
# Key is used for Challenge/Response purposes.
KEY_USE_CR = 'CR'
# Key is used for data encryption purposes.
KEY_USE_ENCRYPT = 'Encrypt'
# For generating keyed message digests.
KEY_USE_INTEGRITY = 'Integrity'
# For checking keyed message digests.
KEY_USE_VERIFY = 'Verify'
# Unlocking device when wrong PIN has been entered too many times.
KEY_USE_UNLOCK = 'Unlock'
# Key is used for data decryption purposes.
KEY_USE_DECRYPT = 'Decrypt'
# The key is used for key wrap purposes.
KEY_USE_KEYWRAP = 'KeyWrap'
# The key is used for key unwrap purposes.
KEY_USE_UNWRAP = 'Unwrap'
# Use in a key derivation function to derive a new key.
KEY_USE_DERIVE = 'Derive'
# Generate a new key based on a random number and the previous value.
KEY_USE_GENERATE = 'Generate'
# The PIN is checked on the device before the key is used.
PIN_USE_LOCAL = 'Local'
# The response has the PIN prepanded and needs to be checked.
PIN_USE_PREPEND = 'Prepend'
# The response has the PIN appended and needs to be checked.
PIN_USE_APPEND = 'Append'
# The PIN is used in the algorithm computation.
PIN_USE_ALGORITHMIC = 'Algorithmic'
def __init__(self, key=None, policy=None):
"""Create a new policy, optionally linked to the key and parsed."""
self.key = key
self.start_date = None
self.expiry_date = None
self.number_of_transactions = None
self.key_usage = []
self.pin_key_id = None
self.pin_usage = None
self.pin_max_failed_attemtps = None
self.pin_min_length = None
self.pin_max_length = None
self.pin_encoding = None
self.unknown_policy_elements = False
self.parse(policy)
def parse(self, policy):
"""Read key policy information from the provided <Policy> tree."""
from pskc.parse import (
find, findall, findtext, findint, findtime, getint)
if policy is None:
return
self.start_date = findtime(policy, 'pskc:StartDate')
self.expiry_date = findtime(policy, 'pskc:ExpiryDate')
self.number_of_transactions = findint(
policy, 'pskc:NumberOfTransactions')
for key_usage in findall(policy, 'pskc:KeyUsage'):
self.key_usage.append(findtext(key_usage, '.'))
pin_policy = find(policy, 'pskc:PINPolicy')
if pin_policy is not None:
self.pin_key_id = pin_policy.get('PINKeyId')
self.pin_usage = pin_policy.get('PINUsageMode')
self.pin_max_failed_attemtps = getint(
pin_policy, 'MaxFailedAttempts')
self.pin_min_length = getint(pin_policy, 'MinLength')
self.pin_max_length = getint(pin_policy, 'MaxLength')
self.pin_encoding = pin_policy.get('PINEncoding')
# TODO: check if there are any other attributes set for PINPolicy
# of if there are any children and set unknown_policy_elementss
# TODO: check if there are other children and make sure
# policy rejects any key usage (set unknown_policy_elements)
def may_use(self, usage):
"""Check whether the key may be used for the provided purpose."""
if self.unknown_policy_elements:
return False
return not self.key_usage or usage in self.key_usage
@property
def pin_key(self):
"""Reference to the PSKC Key that holds the PIN (if any)."""
if self.pin_key_id and self.key and self.key.pskc:
for key in self.key.pskc.keys:
if key.id == self.pin_key_id:
return key
@property
def pin(self):
"""PIN value referenced by PINKeyId if any."""
key = self.pin_key
if key:
return key.secret
|