keyid = bytes('01234567', 'utf-8') # first 8 hex values of SHA256 fingerprint of signing certificate, not relevant for test
keyid = bytes('^EVf\xa5\x1exW', 'utf-8')
cose,signature (b"\x95,<\x90\x0b,D\xe8&'\x0e\xbc\xc56Y\x9a\xc36\x 85'\x13\xfe\x94H\xf3\xdb<\x13" b'\xc1\xf5\xf3\xbd\x90sab\xa0Cv?D\xb3\x93\x80\x89\ xc2~\x99\xf92\xcf\x1a' b"\xd0\xb0&k\x95\xb9\xef\xf1'E@\xc1")
Python code:
headers = {
'Authorization': '63e4f6bc-6705-c144-438f-97c0bbd9c2a5', // assets/appsettings.AppStore.json
'User-Agent': 'FHICORC/38357 CFNetwork/1240.0.4 Darwin/20.5.0'
}
r = requests.get('https://koronakontroll.nhn.no/v2/publickey', headers=headers)
if r.status_code == 200:
with open('certs.json', 'wb') as file:
certs = r.content
file.write(certs)
And you will get bunch of their official public keys.
Probably apps contains another API access data to get pem keys.
And generator on Python with TEST data (Python 3.7+, install base45==0.2.0, qrcode==6.1, Pillow==8.2.0, cbor2==5.4.0, cose==0.9.dev7, cryptography==3.4.7, unidecode==1.2.0 and others):
# Creates HC1 certificate for testing
# Certificate will not be valid as it will not be signed by official CA
# Definition of Data for Test Certificate
family_name = "Doe"
given_name = "John"
birthdate = "1911-11-11" # yyyy-mm-dd
country = "XX" # two letter country code
last_vaccination_date = "2021-05-01" # yyyy-mm-dd
cert_issuer = "Non Valid Test Certificate"
time_to_live = 180 * 24 * 3600 # validity period of cert, default 180 days
issuing_country = "XX" # two letter country code
keyid = bytes('01234567', 'utf-8') # first 8 hex values of SHA256 fingerprint of signing certificate, not relevant for test
# Private Signature Key for ecdsa-with-SHA256 for test certificate without password protection
# AS THIS IS JUST USED FOR PUBLIC TESTING IT IS NOT CRITICAL TO HAVE THIS PRIVATE KEY IN THIS CODE #
pem = b'-----BEGIN EC PRIVATE KEY-----\n' \
b'MHcCAQEEIICXhlDKAkd37q3LEtYmjoCuaIvne9/FzV0BClH2X52AoAoGCCqGSM49\n' \
b'AwEHoUQDQgAEL8eW9/mJUjRX0G6+dA2M9DHquAx5Q07wHFdZ0vM5WzkbOMNea2X2\n' \
b'iirLZ+RmhRAuDMZ6SN7Gj5uRrOo89+7KFA==' \
b'\n-----END EC PRIVATE KEY-----'
cert_id = "00XX/00000/1234567890/THISISATESTCERTIFICATEXXX#S"
vaccine_manufacturer = "ORG-100030215"
vaccine_id = "EU/1/20/1528"
dn = 2
sd = 2
tg = "840539006"
vp = "1119349007"
version = "1.0.0"
# Required imports
import unidecode
import json
from datetime import datetime
import cbor2
from cryptography.hazmat.primitives.serialization import load_pem_private_key
from cose.messages import Sign1Message
from cose.keys.curves import P256
from cose.algorithms import Es256
from cose.headers import Algorithm, KID
from cose.keys import CoseKey
from cose.keys.keyparam import KpAlg, EC2KpD, EC2KpCurve
from cose.keys.keyparam import KpKty
from cose.keys.keytype import KtyEC2
import zlib
from base45 import b45encode
import matplotlib.pyplot as plt
import qrcode
# Create upper case string without special characters and whitespace replaced by '<'
fnt = unidecode.unidecode(family_name).upper().replace(" ", "<")
gnt = unidecode.unidecode(given_name).upper().replace(" ", "<")
# Create json payload
json_issuance = '"v": [{"ci": "' + cert_id + '", "co": "' + country + '", "dn": ' + str(dn) + ', "dt": "' + \
last_vaccination_date + '", "is": "' + cert_issuer + '", "ma": "' + vaccine_manufacturer + \
'", "mp": "' + vaccine_id + '", "sd": ' + str(sd) + ', "tg": "' + tg + '", "vp": "' + vp + '"}]'
json_name = '"nam": {"fn": "' + family_name + '", "gn": "' + given_name + '", "fnt": "' + fnt + '", "gnt": "' + gnt + '"}'
json_payload = '{ ' + json_issuance + ', "dob": "' + birthdate + '", ' + json_name + ', "ver": "' + version + '"}'
# Make sure correct utf-8 was base
json_payload = json_payload.encode("utf-8")
json_payload = json.loads(json_payload.decode("utf-8"))
# Add additional required info to json_payload
json_payload = {
1: issuing_country,
4: int(datetime.now().timestamp() + time_to_live),
6: int(datetime.today().timestamp()),
-260: {
1: json_payload,
},
}
print("\nFULL JSON PAYLOAD:")
print(json_payload)
# Convert to CBOR
#
payload = cbor2.dumps(json_payload)
print("\nCBOR FORMAT:")
print(payload)
# Read in the private key that we use to actually sign this
#
keyfile = load_pem_private_key(pem, password=None)
priv = keyfile.private_numbers().private_value.to_bytes(3 2, byteorder="big")
# Prepare a message to sign; specifying algorithm and keyid
# that we (will) use
#
msg = Sign1Message(phdr={Algorithm: Es256, KID: keyid}, payload=payload)
print("\nMSG TO BE SIGNED:")
print(msg)
# Create the signing key - use ecdsa-with-SHA256
# and NIST P256 / secp256r1
#
cose_key = {
KpKty: KtyEC2,
KpAlg: Es256, # ecdsa-with-SHA256
EC2KpCurve: P256, # Ought to be pk.curve - but the two libs clash
EC2KpD: priv,
}
msg.key = CoseKey.from_dict(cose_key)
out = msg.encode()
print("\nSIGNED MESSAGE:")
print(out)
out = zlib.compress(out, 9)
print("\nCOMPRESSED MESSAGE:")
print(out)
out = b'HC1:' + b45encode(out)
print("\nBASE45 ENCODED:")
print(out)
qr = qrcode.QRCode(
version=1,
error_correction=qrcode.constants.ERROR_CORRECT_L,
box_size=10,
border=4,
)
qr.add_data(out)
qr.make(fit=True)
img = qr.make_image(back_color=(255, 255, 255), fill_color=(0, 0, 0))
imgplot = plt.imshow(img)
plt.show()
<COSE_Sign1: [{'Algorithm': 'Es256'}, {'KID': b'^EVf\xa5\x1exW'}, b'\xa4\x01bDE' ... (280 B), b'\x95,<\x90\x0b' ... (64 B)]>
\cose,signature
b"\x95,<\x90\x0b,D\xe8&'\x0e\xbc\xc56Y\x9a\xc36\x8 5'\x13\xfe\x94H\xf3\xdb<\x13\xc1\xf5\xf3\xbd\x90sa b\xa0Cv?D\xb3\x93\x80\x89\xc2~\x99\xf92\xcf\x1a\xd 0\xb0&k\x95\xb9\xef\xf1'E@\xc1"
\cose,uhdr
{<class 'cose.headers.KID'>: b'^EVf\xa5\x1exW'}
\cose,phdr
{<class 'cose.headers.Algorithm'>: <class 'cose.algorithms.Es256'>}
\cose,key
None
Enc0Message.encode message = [self.phdr_encoded, self.uhdr_encoded, self.encrypt()] AttributeError: 'dict' object has no attribute 'phdr_encoded'
#2 CBORBINARY datacbor2 = cbor2.dumps(data_json) print(datacbor2) #3 COSE SIGNED datacose = CoseMessage.encode(datacbor2) print(datacose) #4 ZLIBCOMPRESS #5 BASE45 + HC1
# decode COSE message (no signature verification done)
datacose = CoseMessage.encode(datacbor2) TypeError: encode() missing 1 required positional argument: 'message'
#! /usr/bin/env python3
import json
import sys
import zlib
import base45
import cbor2
from cose.messages import CoseMessage
data = 'HC1:6BFNX1:HM*I0PS3TLU.NGMU5AG8JKM:SF9VN1RFBIKJ:3 AXL1RR+ 8::N$OAG+RC4NKT1:P4.33GH40HD*98UIHJIDB 4N*2R7C*MCV+1AY3:YP*YVNUHC.G-NFPIR6UBRRQL9K5%L4.Q*4986NBHP95R*QFLNUDTQH-GYRN2FMGO73ZG6ZTJZC:$0$MTZUF2A81R9NEBTU2Y437XCI9DU 4S3N%JRP:HPE3$ 435QJ+UJVGYLJIMPI%2+YSUXHB42VE5M44%IJLX0SYI7BU+EGC SHG:AQ+58CEN RAXI:D53H8EA0+WAI9M8JC0D0S%8PO00DJAPE3 GZZB:X85Y8345MOLUZ3+HT0TRS76MW2O.0CGL EQ5AI.XM5 01LCWBA.RE.-SUYH+S7SBE0%B-KT+YSMFCLTQQQ6LEHG.P46UNL6DA2C$AF-SQ00A58HYO5:M8 7S$ULGC-IP49MZCSU8ST3HDRJNPV3UJADJ9BVV:7K13B4WQ+DCTEG4V8OT 09797FZMQ3/A7DU0.3D148IDZ%UDR9CYF'
payload = data[4:]
print("decoding payload: "+ payload)
# decode Base45 (remove HC1: prefix)
decoded = base45.b45decode(payload)
# decompress using zlib
decompressed = zlib.decompress(decoded)
# decode COSE message (no signature verification done)
cose = CoseMessage.decode(decompressed)
# decode the CBOR encoded payload and print as json
print(json.dumps(cbor2.loads(cose.payload), indent=2))
| 1 | Load the picture and extract the prefixed BASE45content. | PREFIX , 2DCode | EXPECTEDPICTUREDECODE | |
| 2 | Load Prefix Object from RAW Content and remove the prefix. Validate against the BASE45 raw content. | PREFIX, BASE45 | EXPECTEDUNPREFIX | |
| 3 | Decode the BASE45 RAW Content and validate the COSE content against the RAW content. | BASE45, COSE | EXPECTEDB45DECODE | |
| 4 | Check the EXP Field for expiring against the VALIDATIONCLOCKtime. | COSE | VALIDATIONCLOCK | EXPECTEDEXPIRATIONCHECK |
| 5 | Verify the signature of the COSE Object against the JWK Public Key. | COSE | JWK | EXPECTEDVERIFY |
| 6 | Extract the CBOR content and validate the CBOR content against the RAW CBOR content field. See note 2 below. | COSE,CBOR | EXPECTEDDECODE | |
| 7 | Transform CBOR into JSON and validate against the RAW JSON content. See note 3 below. | CBOR,JSON | EXPECTEDVALIDJSON | |
| 8 | Validate the extracted JSON against the schema defined in the test context. | CBOR,JSON | SCHEMA | EXPECTEDSCHEMAVALIDATION |
| 9 | The value given in COMPRESSED has to be decompressed by zlib and must match to the value given in COSE | COSE,COMPRESSED | EXPECTEDCOMPRESSION |
ValueError('Invalid base45 string
compressed = base45.b45decode(token[4:]) decompressed = zlib.decompress(compressed)
| Data from QR is prefixed by 4 chars e.g. "HC1:" and these 4 bytes should be skipped before decoding base45. |
File "/Users/admin/Desktop/impfnachweisvalidierer-main/eu-covid-certificate-qr-decoder.py", line 57, in main
decoded = b45decode(data)
File "/Users/admin/Desktop/impfnachweisvalidierer-main/eu-covid-certificate-qr-decoder.py", line 51, in b45decode
raise ValueError("Invalid base45 string")
MIIHUTCCBQmgAwIBAgIQUl/a6dCJQYWN7+hvCmQMjDA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCA6EaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgOiAwIBQDBbMQswCQYDVQQGEwJERTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMRwwGgYDVQQDExNELVRSVVNUIENBIDItMiAyMDE5MRcwFQYDVQRhEw5OVFJERS1IUkI3NDM0NjAeFw0yMTA1MDcxNDE1MzJaFw0yMzA1MTExNDE1MzJaMIHrMQswCQYDVQQGEwJERTEdMBsGA1UEChMUUm9iZXJ0IEtvY2gtSW5zdGl0dXQxJDAiBgNVBAsTG0VsZWt0cm9uaXNjaGVyIEltcGZuYWNod2VpczEdMBsGA1UEAxMUUm9iZXJ0IEtvY2gtSW5zdGl0dXQxDzANBgNVBAcTBkJlcmxpbjEOMAwGA1UEEQwFMTMzNTMxFDASBgNVBAkTC05vcmR1ZmVyIDIwMRkwFwYDVQRhExBEVDpERS0zMDIzNTMxNDQ1MRUwEwYDVQQFEwxDU00wMjYxNjQxOTUxDzANBgNVBAgTBkJlcmxpbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKKxhkXxInNhi+aPV5yE3at53fXe6Vg78usGkpAzCOt9/sLwpbkgVd61kf0JC9xXX6XC9hTglmgEef7FzooaX6+jggLpMIIC5TAfBgNVHSMEGDAWgBRxEDKudHF7VI7x1qtiVK78PsC7FjAtBggrBgEFBQcBAwQhMB8wCAYGBACORgEBMBMGBgQAjkYBBjAJBgcEAI5GAQYCMIH+BggrBgEFBQcBAQSB8TCB7jA3BggrBgEFBQcwAYYraHR0cDovL2QtdHJ1c3QtY2EtMi0yLTIwMTkub2NzcC5kLXRydXN0Lm5ldDBCBggrBgEFBQcwAoY2aHR0cDovL3d3dy5kLXRydXN0Lm5ldC9jZ2ktYmluL0QtVFJVU1RfQ0FfMi0yXzIwMTkuY3J0MG8GCCsGAQUFBzAChmNsZGFwOi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBDQSUyMDItMiUyMDIwMTksTz1ELVRydXN0JTIwR21iSCxDPURFP2NBQ2VydGlmaWNhdGU/YmFzZT8wcAYDVR0gBGkwZzAJBgcEAIvsQAEBMFoGCysGAQQBpTQCgRYFMEswSQYIKwYBBQUHAgEWPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvaW50ZXJuZXQvZmlsZXMvRC1UUlVTVF9DU01fUEtJX0NQUy5wZGYwgfAGA1UdHwSB6DCB5TCB4qCB36CB3IZpbGRhcDovL2RpcmVjdG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwQ0ElMjAyLTIlMjAyMDE5LE89RC1UcnVzdCUyMEdtYkgsQz1ERT9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0hjJodHRwOi8vY3JsLmQtdHJ1c3QubmV0L2NybC9kLXRydXN0X2NhXzItMl8yMDE5LmNybIY7aHR0cDovL2Nkbi5kLXRydXN0LWNsb3VkY3JsLm5ldC9jcmwvZC10cnVzdF9jYV8yLTJfMjAxOS5jcmwwHQYDVR0OBBYEFLZUelpTEvjvhoJ0FEt3jzVhmdMtMA4GA1UdDwEB/wQEAwIGwDA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCA6EaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgOiAwIBQAOCAgEAobJq9rpQ7gjNp0cvnJgVytpdrq9Brej3T/Jef4/M1YK+7uk1uGSDiR9+go/49IWiDFWBX5HBa1s+8bHxAUQNvMP7Y3Dje75KFX1a2L2XExjpoKxkwC96L/UvKZK5de3h0fZDGHFQb8nQB7CT4Ygky5iFO8TnRdSoVz33su+OM0d6LejPP+SU21bsg//pzVVuzDXAF2rngBbcYSSjSaZxKKfGAMv9p5pnXbmjeNLPn7u1cBCu20CKbsMu/ARfisW+jR1kAFo5gfOToOd2xetkKTL/p8wC8PdJc9vK5wimEK5p/lgFG3i0DPfDlQ8Zjs0yTV3lbuaIjv4EQgb8GjhmcJOlpO6zTVp7kDLO4vgSnW45HS//pckR7rijMb9QRfn6fLE2KW3l3er1XC+/9f1oZBf394PTKJevOQEPQynWuNbw29WyFElWdFwnPbvup6g4D4a6VcUUtDLYAMX8raSpvgcTu5PjVgTnsTItSgG6rz096it0dQODyswmNUdig8TxYmalJNB0SMLijCpodeUZehOtpNwJ/9U5ejNEn5puwaKjwiVom+OeMOLj5ujsNrhQP6KxlfjBGcz2xV+9dxXgez/izIoo+Q8eaHmXWAbhOH2BOkCceIwihL/2Y28IlBCL2f47YOKpEAU0zffeC96U0XzKYDV0I3jIOuyvySylMuE=
HC1:6BFR%BH:7*I0PS33NUA9HWP5PZ2CLJ*GH7WV-UNA1VZJKZ6HX.A/5R..9*CV6+LJ*F.UN7A2BT8B+6B897S69R48S1.R1VJO9Q1ZZO +CC$A9%T5X7RI25A8S57D JK-PQ+JR*FDTW3+1EC1JXLOQ58+KFL49ZMENAO.YOWR75PAH0HD6A IHCPWHJTF.RJ*JCSKEHL1N31HWEO67KJH8TIX-B3QB-+9*LCU:C:P2QEEQ7KF$V--4CW7JWILDWU%Q%IO0LAK70J$KW2JW56.KO8E2RHPH60ILI8T0N/7OEPD7P3+3IH9VZIVWP.44FX87QH5I97ZK0MK8OIGC3 3CQ6WO+9P9ECRSV%72M4L65 KAVKE*YPRHSIF1 89*4NDZ7FU6:F6NPJ1PHL059BGBB1%/C/J91R75Z5I7CWV0TREWYSY8ULK5HWPGEP$SI5B1$8HDOCH3JEBC L*8SE2AZT9SC+84JVGR39:2V*TR:KBW/4S:FK DOHF-1789MQ.18CV2C3YCN79OR176:1U:0CQVNGDJ0GUPO%CRT+QC/O$:D/WQY$3*5UR2M4YPFXK$DH
HC1:NCFOXN%TS3DH3ZSUZK+.V0ETD%65NL-AH-R6IOOA+IKVC.X48WA. ST7KKD93B4:ZH6I1$4JN:IN1MKK9+OC*PP:+P*.1D9R+Q6646C%6RF6:X93O5RF6$T61R64IM64631AWC5ME65H1KD34LT HBSZ4GH0B69X5QF36FY1OSMNV1L8VNF6O M9R1RF6ECM676746C0FFS6NWE0Y6Z EJZ6KS6YQEE%61Y6LMEA46*-ALK9KZ56DE/.QC$Q3J62:6LZ64998T5UEIY0Q$UPR$5:NLOEPNRAE69K P4NPDDAJP5DMH1$48X2+36D-I/2DBAJDAJPK0%KC$ZJ*DJ3Q4+Y5V$K2:6.77/Z6KZ5LD6E6P 9SH87/YQJ/RL35+Y5P Q-BLQ+M3+L IMXDRHJUXYOOP6NQQ0THYZQ4H99$R2-JIS77%F.UINXU: RFTIDG62QEZUIQJAZGA+1VG%U5SI:TU+MM0W5JW544SOH63BEY8FAM56.I8K345OCGHITPS3OI.N*9QH83$7S+:M%1H.IP/E1A0K*SMZTSOYD K6G3UVASBVI%EV2JTQ5L+9S%UHK8PS%J%ZFMF6V50A1LT.G
Прокомментировать: