PyMRTD

https://github.com/zeropass/pymrtd
Admin
PyMRTD is a Python implementation of the ICAO 9303 standard, providing tools to parse and verify...
Tokens:1,047
Snippets:11
Trust Score:6.5
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install Dependencies

Source: https://github.com/zeropass/pymrtd/blob/master/README.md

Commands to install the required asn1crypto and cryptography libraries.

```bash
 pip3 install asn1crypto
```

```bash
  pip3 install cryptography
```

--------------------------------

### Validate MRTD Trustchain

Source: https://github.com/zeropass/pymrtd/blob/master/README.md

Example of verifying the trust chain by checking certificate expiration and digital signatures.

```python
# 1. Parse SOD and get signing certificates (DSC, CSCA)
sod = SOD.load(...)
if len(sod.dscCertificates) == 0: # SOD is not required to store it's signer DSC certificate.
  raise Exception("Can't verify SOD, no DSC found")

dsc  = sod.dscCertificates[0] # SOD can store more than 1 DSC certificate by definition
csca = fetchCscaForDsc(sod.dscCertificates[0])
if csca is None:
  raise Exception("Can't verify DSC, no CSCA found")

# 2. Validate trust chain by verifying digital signatures and expiration time of certificates
if not csca.isValidOn(utils.time_now()):
  raise Exception("CSCA has expired")

if not dsc.isValidOn(utils.time_now()):
  raise Exception("DSC has expired")

try:
  for si in sod.signers:
    # Note: certificate conformance check (checkConformance) is not done by default
    #       because not all countries follow the standard strictly
    dsc.verify(issuing_cert=csca, checkConformance=True/False)
    sod.verify(si=si, issuerCert=dsc)
    return success
except:
  raise Exception("MRTD turstchain verification failed")
```

--------------------------------

### Load and Serialize CscaCertificate

Source: https://github.com/zeropass/pymrtd/blob/master/README.md

Demonstrates loading a CscaCertificate from a file and serializing it back to a byte array.

```python
f = open('csca.cer', 'rb')
csca = CscaCertificate.load(f.read())

print(csca.issuerCountry)
print(csca.subjectKey.hex())
print(csca.fingerprint)
print(csca.dump().hex())
```

--------------------------------

### Verify MRTD Digital Signature

Source: https://github.com/zeropass/pymrtd/blob/master/README.md

Verifies a digital signature by checking the security object and public key information.

```python
sod  = SOD.load(...)
dg15 = DG15.load(...)

# First verify DG15 was issued by country
# Note: SOD object should be validated into trustchain at this point
if not sod.ldsSecurityObject.contains(dg15):
  raise Exception("Can't verify signature, invalid EF.DG15 file")

# If ECC signature, get ECC signature algorithm from EF.DG14 file
sigAlgo = None
if dg15.aaPublicKey.isEcKey():
  # Get ECC signature algorithm
  dg14 = DG14.load(...)
  if not sod.ldsSecurityObject.contains(dg14): # Verify EF.DG14 was issued by country
    raise Exception("Can't verify signature, invalid EF.DG14 file")
  elif dg14.aaSignatureAlgo is None: # sanity check
    raise Exception("Missing ActiveAuthenticationInfo in DG14 file")
  sigAlgo = dg14.aaSignatureAlgo

# Verify signature made by MRTD
try:
  dg15.aaPublicKey.verifySignature(msg, sig, sigAlgo):
catch:
  raise Exception("Signature verification failed")
```
Tokens:
Raw