Send Can number for Spanish electronic ID

[mikeld]

Andy, your work is awesome!
Im trying to read spanish electronic id using some clases of your proyect.
Exist Android library but for ios there is nothing to use.
I think that i have to send only can number , there are 6 number, for example: 373833
When i use your functions, i suppose that i need few datagroups to read,
i always receive the same error:
Error reading tag: sw1 - 0x63, sw2 - 0x00
ERROR - InvalidMRZKey
BAC Failed

Anyone can help me to get that communication?
thanks you very much.

[diegocidm4]

Hello, I have been able to use this library to be able to read the Spanish DNIe using the CAN or MRZ. In your case it seems that the error is that you send the CAN but you are using the validation by MRZ. When using the readPassport function, it is necessary to indicate the correct paceKeyReference (in case you want to use the CAN it would be PACEHandler.CAN_PACE_KEY_REFERENCE.
If you want to comment on how to use it for the Spanish DNIe, we can see it.

[mikeld]

Hi, thank you very very much for your reply.
I don't understand very good what I have to do.

Im doing this: I don't know what DataGroups I need for use can reference
let dataGroups : [DataGroupId] = [.DG14, .DG15]
// let dataGroups : [DataGroupId] = [.COM, .SOD, .DG1, .DG2, .DG7, .DG11, .DG12, .DG14, .DG15]
passportReader.readPassport(mrzKey: mrzKey, tags:dataGroups, completed: { (passport, error) in
if (passport != nil){
print(passport!)
}
})

this is my output:
Starting Password Authenticated Connection Establishment (PACE)
Performing PACE with id-PACE-ECDH-GM-AES-CBC-CMAC-128
Error reading tag: sw1 - 0x69, sw2 - 0x88
reason: SM data objects incorrect
PACEHandler: Step3 KeyAgreement - Error - SM data objects incorrect
OpenSSLError:
PACE Failed - Invalid data passed - PACE Failed
Starting Basic Access Control (BAC)
Error reading tag: sw1 - 0x63, sw2 - 0x00
ERROR - InvalidMRZKey
BAC Failed

Reading your answer I have searched for (paceKeyReference) and I have changed for PACEHandler.CAN_PACE_KEY_REFERENCE
let key = try smskg.deriveKey(keySeed: hash, cipherAlgName: cipherAlg, keyLength: keyLength, nonce: nil, mode: .PACE_MODE, paceKeyReference: PACEHandler.CAN_PACE_KEY_REFERENCE)

Can you help me? very thankful

[mikeld]

If I read passport like this:

passportReader.readPassport(mrzKey: mrzKey, customDisplayMessage: { (displayMessage) in
switch displayMessage {
case .requestPresentPassport:
return "Hold your iPhone near an NFC enabled passport."
default:
// Return nil for all other messages so we use the provided default
return nil
}
}, completed: { (passport, error) in
if let passport = passport {
let dict = passport.dumpPassportData(selectedDataGroups: DataGroupId.allCases, includeActiveAuthenticationData: true)
if let data = try? JSONSerialization.data(withJSONObject: dict, options: .prettyPrinted) {
print(data)
}
} else {
print("error")
}
})

   **I have the same error, so I think that the problem is in other side:** 

Read CardAccess - data 3170300D060804007F0007020202020101300F060A04007F000702020302010201013012060A04007F0007020204020202010202010D3012060A04007F0007020204020102010202010D3012060A04007F000702020401020201020201003012060A04007F00070202040101020102020100
Starting Password Authenticated Connection Establishment (PACE)
Performing PACE with id-PACE-ECDH-GM-AES-CBC-CMAC-128
Error reading tag: sw1 - 0x69, sw2 - 0x88
reason: SM data objects incorrect
PACEHandler: Step3 KeyAgreement - Error - SM data objects incorrect
OpenSSLError:
PACE Failed - Invalid data passed - PACE Failed
Starting Basic Access Control (BAC)
Error reading tag: sw1 - 0x63, sw2 - 0x00
ERROR - InvalidMRZKey
BAC Failed

[diegocidm4]

I have modified the code to be able to do it via CAN and that is why my response was not as immediate as I thought, sorry.

I put you in context. Before reading the datagroups, it is necessary to establish the PACE channel, and for this there are two methods, using MRZ or using CAN. The code in this default library creates the PACE channel using MRZ. Have you tried using this data to establish the channel?

func getMRZKey(passportNumber: String, dateOfBirth: String, dateOfExpiry: String ) -> String {

    // Pad fields if necessary
    let pptNr = pad( passportNumber, fieldLength:9)
    let dob = pad( dateOfBirth, fieldLength:6)
    let exp = pad( dateOfExpiry, fieldLength:6)
    
    // Calculate checksums
    let passportNrChksum = calcCheckSum(pptNr)
    let dateOfBirthChksum = calcCheckSum(dob)
    let expiryDateChksum = calcCheckSum(exp)

    let mrzKey = "\(pptNr)\(passportNrChksum)\(dob)\(dateOfBirthChksum)\(exp)\(expiryDateChksum)"
    
    return mrzKey
}

You can obtain the MRZ code with the following function to which you have to pass the DNI number, the date of birth and the expiration date of the DNI. Dates are Strings in "dd/MM/yyyy" format.

Indicates the value [] in the tags parameter of the readPassport method.

With this you should be able to read the DNIe with this library using MRZ.

Once this was tested, in order to read the DNIe using the CAN code, I had to modify the code of this library. I have modified the readPassport method and simply modify the existing parameter to indicate the method I use to set the pace channel (self.paceKeyReference = paceKeyReference).

[LaurentziMart]

Hello!
I am trying to extract the authentication certificate from the Spanish ID card (DNI). I have managed to establish a PACE connection using the CAN. The next step indicated in the documentation is to open a secure PIN channel and PIN presentation. However, following the instructions in the documentation and the examples, the APDU commands sent through the SecureMessaging created in the PACE connection always return an incorrect status.
Any clue on how to proceed after establishing the PACE connection? I would greatly appreciate it.

[diegocidm4]

Good afternoon, the private part of the authentication and signature certificates of the DNIe never leave it, so it is not possible to read it. Signature operations can be sent so that the DNIe can carry them out and return the result.
We have been working on this for months and we have developed a library that allows us to use these certificates.
If you need more information you can write to me at [email protected]

[mikeld]

Hi!
Thank you very much for your answer.

I have checked using func getMRZKey(passportNumber: String, dateOfBirth: String, dateOfExpiry: String ) -> String {
My mrzkey is = "44637879P<<<386072093006265"
Can be a correct one?
Im using the default code for getting dates and writting my dni number.

Im getting the same error. Completed output:
TagReader - Number of data bytes to read - 112
Read CardAccess - data 3170300D060804007F0007020202020101300F060A04007F000702020302010201013012060A04007F0007020204020202010202010D3012060A04007F0007020204020102010202010D3012060A04007F000702020401020201020201003012060A04007F00070202040101020102020100
Starting Password Authenticated Connection Establishment (PACE)
Performing PACE with id-PACE-ECDH-GM-AES-CBC-CMAC-128
Doing PACE Step1...
Doing PACE Step2...
Using General Mapping (GM)...
Generating ECDH mapping keys from parameterSpec - 927
Sending public mapping key to passport..
Received passports public mapping key
Doing ECDH Mapping agreement
Doing PACE Step3 - Key Exchange
Generated Ephemeral key pair
Sending ephemeral public key to passport
Doing PACE Step3 Key Agreement...
Computing shared secret...
Deriving ksEnc and ksMac keys from shared secret
Generating authentication token
Sending auth token to passport
Error reading tag: sw1 - 0x69, sw2 - 0x88
reason: SM data objects incorrect
PACEHandler: Step3 KeyAgreement - Error - SM data objects incorrect
OpenSSLError:
PACE Failed - Invalid data passed - PACE Failed
Re-selecting eMRTD Application
Starting Basic Access Control (BAC)
BACHandler - deriving Document Basic Access Keys
BACHandler - Getting initial challenge
BACHandler - Doing mutual authentication
Error reading tag: sw1 - 0x63, sw2 - 0x00
ERROR - InvalidMRZKey
BAC Failed

[diegocidm4]

Sorry, I have miscounted the parameters that are sent to the function to generate the MRZ.

You have to send the support number (not the DNI number) and the dates are in YYMMdd format.

A question about your objectives, are you only looking to read the public data of the DNIe or are you also looking to use the certificates of the DNIe?

[mikeld]

I only want to get the age of the user. 😅
There is an ios aplication named valida that do that.
And the developer told me that he needs to senda can number for get the information
Do you think there is any other way yo get that information?
Thank you very much

[diegocidm4]

When I have told you that I can read the DNIe from IOS with these libraries, it is because I am the developer of the Valida app. In it, it has been decided to use the CAN to establish the secure channel, but the MRZ can be used.

[mikeld]

Ya siento molestarte otra vez, entonces existe la posibilidad de leer solo con can? Como podría hacerlo?
Un saludo y gracias

[mikeld]

Joe pues enhorabuena! Escuché un podcast donde explicabas tu trabajo. Me parece increíble, ojalá más gente así. El vie., 13 ene. 2023 10:18, diegocidm4 ***@***.***> escribió:

…

When I have told you that I can read the DNIe from IOS with these libraries, it is because I am the developer of the Valida app. In it, it has been decided to use the CAN to establish the secure channel, but the MRZ can be used. — Reply to this email directly, view it on GitHub <#171 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOPR6TRIZL24K554A5J63WSETYXANCNFSM6AAAAAATZKRA24> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[diegocidm4]

tal como te he explicado aquí: #171 (comment).

Puedes contactarme directamente en el correo [email protected]