keycard.parsing package¶
Submodules¶
keycard.parsing.application_info module¶
- class keycard.parsing.application_info.ApplicationInfo(capabilities, ecc_public_key, instance_uid, key_uid, version_major, version_minor, free_pairing_slots=None, status=None, identity_certificate=None)¶
Bases:
objectRepresents parsed application information from a SELECT response.
Fields a card version does not report are None.
- capabilities¶
Parsed capabilities value, if present.
- Type:
Optional[int]
- ecc_public_key¶
Secure Channel V1 public key (3.x only).
- Type:
Optional[bytes]
- instance_uid¶
Instance UID (3.x only).
- Type:
Optional[bytes]
- key_uid¶
Unique identifier for the key, if present.
- Type:
Optional[bytes]
- version_major¶
Major version number of the application.
- Type:
int
- version_minor¶
Minor version number of the application.
- Type:
int
- free_pairing_slots¶
Free pairing slots (3.x only).
- Type:
Optional[int]
- status¶
Application status byte (4.x only).
- Type:
Optional[int]
- identity_certificate¶
The card’s Identity Certificate (4.x only).
- Type:
Optional[bytes]
- capabilities: int | None¶
- ecc_public_key: bytes | None¶
- free_pairing_slots: int | None = None¶
- identity_certificate: bytes | None = None¶
- instance_uid: bytes | None¶
- property is_initialized: bool¶
from the status byte on 4.x, from the presence of the key UID before.
- Returns:
True if the application is initialized.
- Return type:
bool
- Type:
Checks if the application is initialized
- property is_lee_mode: bool¶
Whether a LEE seed is loaded (4.x only).
- key_uid: bytes | None¶
- static parse(data)¶
Parses a SELECT response.
- Return type:
- Parameters:
data (bytes) – The response data.
- Returns:
The parsed application information.
- Return type:
- Raises:
InvalidResponseError – If the response is malformed.
- property pin_retries: int | None¶
Remaining PIN attempts (4.x only).
- status: int | None = None¶
- version_major: int¶
- version_minor: int¶
keycard.parsing.capabilities module¶
- class keycard.parsing.capabilities.Capabilities(*values)¶
Bases:
IntFlagAn enumeration representing the various capabilities supported by a device or application.
- SECURE_CHANNEL¶
Indicates support for secure channel communication (0x01).
- Type:
int
- KEY_MANAGEMENT¶
Indicates support for key management operations (0x02).
- Type:
int
- CREDENTIALS_MANAGEMENT¶
Indicates support for credentials management (0x04).
- Type:
int
- NDEF¶
Indicates support for NDEF (NFC Data Exchange Format) operations (0x08).
- Type:
int
- FACTORY_RESET¶
Indicates support for the FACTORY RESET command (0x10).
- Type:
int
- CREDENTIALS_MANAGEMENT = 4¶
- FACTORY_RESET = 16¶
- KEY_MANAGEMENT = 2¶
- NDEF = 8¶
- SECURE_CHANNEL = 1¶
- classmethod parse(value)¶
Parses an integer value and returns a corresponding Capabilities instance.
- Return type:
- Parameters:
value (int) – The integer value representing the capabilities.
- Returns:
An instance of the Capabilities class corresponding to the given value.
- Return type:
keycard.parsing.certificate module¶
- class keycard.parsing.certificate.IdentityCertificate(identity_public_key, signature, recovery_id)¶
Bases:
objectA card’s Identity Certificate: its Identity Key signed by a Keycard CA.
- identity_public_key¶
The card’s compressed Identity Key.
- Type:
bytes
- signature¶
The CA signature as r || s.
- Type:
bytes
- recovery_id¶
Recovery id of the CA signature.
- Type:
int
- property ca_public_key: bytes¶
The compressed public key of the Keycard CA that signed this certificate, recovered from the signature.
- Raises:
InvalidResponseError – If no key can be recovered.
- check_trust(ca_public_keys, trusted_identity_keys=())¶
Checks that the certificate was signed by a trusted Keycard CA, or that its Identity Key is trusted directly.
- Return type:
None- Raises:
UntrustedCardError – If neither is the case.
- identity_public_key: bytes¶
- classmethod parse(data)¶
Parses a 98-byte Identity Certificate.
- Return type:
- Raises:
InvalidResponseError – If the certificate has the wrong length.
- recovery_id: int¶
- signature: bytes¶
- verify(digest, signature)¶
Verifies a DER-encoded ECDSA signature made with the Identity Key over a SHA-256 digest.
- Return type:
None- Raises:
InvalidResponseError – If the signature is invalid.
- keycard.parsing.certificate.compress_public_key(public_key)¶
Normalizes an encoded secp256k1 public key to its compressed form.
- Return type:
bytes- Parameters:
public_key (bytes) – A compressed or uncompressed public key.
- Returns:
The 33-byte compressed public key.
- Return type:
bytes
- Raises:
ValueError – If the key is not a valid secp256k1 point.
keycard.parsing.exported_key module¶
keycard.parsing.identity module¶
- keycard.parsing.identity.parse(challenge, data)¶
Parses an IDENTIFY CARD response and verifies the card’s signature over the challenge.
- Return type:
bytes- Parameters:
challenge (bytes) – The 32-byte challenge sent to the card.
data (bytes) – The response data.
- Returns:
- The compressed public key of the Keycard CA that signed the
card’s Identity Certificate.
- Return type:
bytes
- Raises:
InvalidResponseError – If the response is malformed or the signature does not verify.
keycard.parsing.keypath module¶
keycard.parsing.lee_keys module¶
keycard.parsing.signature_result module¶
keycard.parsing.tlv module¶
- keycard.parsing.tlv.parse_tlv(data)¶
Parses one level of BER-TLV encoded data.
Constructed values are returned as raw bytes; parse them again to read their children.
- Return type:
defaultdict[int,list[bytes]]- Parameters:
data (bytes) – The byte sequence to parse.
- Returns:
- The values of each tag, in the order
they appear. Repeated tags keep every value.
- Return type:
defaultdict[int, list[bytes]]
- Raises:
InvalidResponseError – If the data is not valid BER-TLV.