From d5244fc93eecace5c77ac7e80f5b0e058832092c Mon Sep 17 00:00:00 2001 From: Pol Henarejos Date: Fri, 14 Aug 2026 13:56:49 +0200 Subject: [PATCH] Keep private DOs under PW2 authorization Signed-off-by: Pol Henarejos --- src/openpgp/cmd_get_data.c | 2 +- src/openpgp/cmd_put_data.c | 2 +- tests/card_test_personalize_card_2.py | 21 +++++++++++---------- 3 files changed, 13 insertions(+), 12 deletions(-) diff --git a/src/openpgp/cmd_get_data.c b/src/openpgp/cmd_get_data.c index 9b220ee..81ef49c 100644 --- a/src/openpgp/cmd_get_data.c +++ b/src/openpgp/cmd_get_data.c @@ -32,7 +32,7 @@ int cmd_get_data(void) { return SW_REFERENCE_NOT_FOUND(); } if (fid == EF_PRIV_DO_3) { - if (!has_pw2 && !has_pw3) { + if (!has_pw2) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } } diff --git a/src/openpgp/cmd_put_data.c b/src/openpgp/cmd_put_data.c index 522e648..e74cc65 100644 --- a/src/openpgp/cmd_put_data.c +++ b/src/openpgp/cmd_put_data.c @@ -39,7 +39,7 @@ int cmd_put_data(void) { if (!file_authenticate_action(ef, ACL_OP_UPDATE_ERASE)) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } - if ((fid == EF_PRIV_DO_1 || fid == EF_PRIV_DO_3) && (!has_pw2 && !has_pw3)) { + if ((fid == EF_PRIV_DO_1 || fid == EF_PRIV_DO_3) && !has_pw2) { return SW_SECURITY_STATUS_NOT_SATISFIED(); } if (!(fid == EF_PRIV_DO_1 || fid == EF_PRIV_DO_3) && !has_pw3) { diff --git a/tests/card_test_personalize_card_2.py b/tests/card_test_personalize_card_2.py index 8b72655..52b7cdb 100644 --- a/tests/card_test_personalize_card_2.py +++ b/tests/card_test_personalize_card_2.py @@ -223,12 +223,13 @@ class Test_Card_Personalize_Card_2(object): v = card.verify(3, PW3_TEST0) assert v - def test_private_do_0101_write_ok_with_pw3(self, card): + def test_private_do_0101_write_fail_with_pw3(self, card): card.cmd_select_openpgp() v = card.verify(3, PW3_TEST0) assert v - r = card.cmd_put_data(PRIVATE_DO_0101[0], PRIVATE_DO_0101[1], b"priv0101_pw3_ok") - assert r + _expect_security_error( + lambda: card.cmd_put_data(PRIVATE_DO_0101[0], PRIVATE_DO_0101[1], b"priv0101_pw3") + ) def test_private_do_0101_write_fail_with_pw1_81(self, card): card.cmd_select_openpgp() @@ -248,7 +249,7 @@ class Test_Card_Personalize_Card_2(object): def test_private_do_0101_read_always(self, card): card.cmd_select_openpgp() data = get_data_object(card, 0x0101) - assert data == b"priv0101_ok" or data == b"priv0101_pw3_ok" + assert data == b"priv0101_ok" def test_private_do_0102_write_fail_with_pw1(self, card): card.cmd_select_openpgp() @@ -280,19 +281,19 @@ class Test_Card_Personalize_Card_2(object): assert v _expect_security_error(lambda: get_data_object(card, 0x0103)) - def test_private_do_0103_write_ok_with_pw3(self, card): + def test_private_do_0103_write_fail_with_pw3(self, card): card.cmd_select_openpgp() v = card.verify(3, PW3_TEST0) assert v - r = card.cmd_put_data(PRIVATE_DO_0103[0], PRIVATE_DO_0103[1], b"priv0103_pw3_ok") - assert r + _expect_security_error( + lambda: card.cmd_put_data(PRIVATE_DO_0103[0], PRIVATE_DO_0103[1], b"priv0103_pw3") + ) - def test_private_do_0103_read_ok_with_pw3(self, card): + def test_private_do_0103_read_fail_with_pw3(self, card): card.cmd_select_openpgp() v = card.verify(3, PW3_TEST0) assert v - data = get_data_object(card, 0x0103) - assert data == b"priv0103_pw3_ok" + _expect_security_error(lambda: get_data_object(card, 0x0103)) def test_private_do_0103_write_ok_with_pw1_82(self, card): card.cmd_select_openpgp()