Ashin Walpola
0e9525162d
obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but that tree was gitignored, so a clone of this repository could not build the firmware it ships. It is now committed here as ordinary files in its own folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP bridge's signature verification (--trust) used on the bench. Nothing is fetched from or pushed to the colleague's repository; this repository and its remotes carry everything. The folder's own .gitignore keeps build output, downloaded components and private key material out, as it did there; the committed file set is identical to that repository's tracked files. The ESP32-C5 is still flashed from obu-firmware/, which only takes vanetza-idf from microbu-esp32c5/, so the two stay separate folders. FLASHING.md says how to take a newer version of the colleague's tree (copy it over the folder, rebuild, test, commit).
2.9 KiB
independent-verifier-02: rehearsal on a twin of a real EU CCMS L0 root
The same procedure as independent-verifier-01,
this time under a root certificate that carries the exact appPermissions,
certIssuePermissions and region of a real root submitted to the EU CCMS L0
ECTL (vidf_issue root --like <real root>.oer with a throwaway key: the twin
differs from the real root only in key, name and validity). The real root's
public certificate itself is not part of this repository; the twin shows what
the library will do with a chain of that shape.
| File | Content |
|---|---|
TWIN_RCA.oer |
twin root: CPOC Protocol Release 3.0/3.3 permission profile (CAM 01FFFF/FF0000, DENM 02FFFFFFFF/FF00000000, TLM, RLT, IVI, TLC-R, GN-MGMT all, SCR 01C0/FF3F, TLC-S, VRU 01/FF, CP, POI; second group SCR 013E/FFC1; chain length 2, eeType app+enrol), identifiedRegion countryOnly 65535 (CPOC clause I.3.9) |
TWIN_AA.oer |
AA derived from the root by vidf_issue authority: the root's ranges with chain length 1, the root's region, appPermissions psid 623 ssp 0130 |
TWIN_AT.oer |
ticket: psid 638 (01), 141 (no SSP), 36 (01FFFC); region inherited from the AA |
TWIN_AT2.oer |
the same without psid 141 |
sut.pcap, sut2.pcap |
three CAM carriers each (capture_pcap.py; the DENM carrier is refused because the tickets carry no psid 37) |
c-its-standard.jsonl, c-its-nomgmt.jsonl |
c-its-pcap output |
Result
| Capture | Message signature | Certificate signatures | ee_permissions_valid |
security_authorized |
|---|---|---|---|---|
sut2.pcap (ticket without psid 141) |
verifies (3/3) | verify (3/3) | true | true (3/3 CAMs) |
sut.pcap (standard ticket) |
verifies (3/3) | verify (3/3) | false (c-its treats the SSP-less psid 141 as unsupported, see -01) | false |
vidf_issue refused a ticket with the DENM SSP 01FFFFFF under this root
(refusing to write a ticket the issuer cannot authorise): the root's DENM
range fixes the first octet to 02 (SSP version 2 of the CPOC 3.3 profile),
which IEEE Std 1609.2 6.4.30 makes binding for every subordinate.
vidf_issue verify TWIN_AT.oer TWIN_AA.oer TWIN_RCA.oer reports the three
signatures, the validity nesting, the region nesting and the permission
consistency as the library's verifier applies them.
What this run changed in the library
The upstream region consistency (is_within) knows no identifiedRegion
issuer, so every certificate under an EU root was "inconsistent" for the
receive-side verifier. The chain validator now applies IEEE Std 1609.2 clause
6.4.17 itself: identifier containment for identified regions (whole country,
regions, subregions), the upstream geometry for geometric issuers, and the
station's permissive_identified_region policy for a geometric region under an
identified one (no border database on the device). test_region_consistency
covers the three cases (873 host checks, 747 on the ESP32-C5).