SCP03 support: roadmap and help wanted

[Amperstrand]

Status

SCP02 is fully tested and working (19/19 hardware tests, 54/54 CI tests). SCP03 code exists in src/keystore/javacard/gp/scp03.py and src/keystore/javacard/gp/aes_cmac.py but has not been tested on any hardware.

What exists

• scp03.py — Complete SCP03 implementation: NIST SP 800-108 KDF, AES-CMAC wrapping, R-MAC verification, C-DEC/C-ENC encryption. Uses ucryptolib.aes (available in MicroPython) and aes_cmac.py.
• aes_cmac.py — Pure Python AES-CMAC (NIST SP 800-38B) using ucryptolib.aes as block cipher primitive.

What's missing

1. No hardware test — We only have a JCOP4 card with SCP02 default keys provisioned. SCP03 keys have not been provisioned.
2. No reference traces — No GPPro traces for SCP03 session establishment.
3. No CI tests — No software tests verifying SCP03 crypto against known values.

Why we can't test SCP03 yet

The JCOP4 card reports SCP02 when sent INITIALIZE UPDATE with P1=0x00 (any protocol). To test SCP03:

1. Use the existing SCP02 channel to send PUT KEY commands provisioning AES-128 keys (ENC, MAC, RMAC) with a new key version number (e.g., version 2)
2. Send INITIALIZE UPDATE with P1=0x03 (explicitly request SCP03) and the new key version
3. If the card accepts, capture the full APDU trace

How to help

If you have a JavaCard that supports SCP03 (most modern cards do), you can help by:

1. Capture SCP03 reference traces

# Using GlobalPlatformPro with a card that has SCP03 keys
gp -dv -install SomeApplet.cap 2>&1 | tee scp03_trace.txt

# Or just list the registry
gp -dv -l 2>&1 | tee scp03_trace.txt

2. Add trace files

Copy the trace to test/data/gp_traces/ with a descriptive name (e.g., scp03_jcop4_list.txt).

3. Add software tests

Create test/tests_native/test_scp03_crypto.py following the pattern of test_scp02_crypto.py:

• Parse session keys from the trace
• Verify KDF derivation matches
• Verify card/host cryptogram computation
• Verify MAC computation

4. (Optional) Implement PUT KEY

Add a put_key() function to enable provisioning SCP03 keys via the existing SCP02 channel. This would allow testing SCP03 on cards that only have SCP02 keys initially.

Roadmap

• Capture SCP03 reference traces from a card with SCP03 support
• Add test/tests_native/test_scp03_crypto.py with trace-based verification
• (Optional) Implement PUT KEY command for key provisioning
• (Optional) Add SCP03 hardware test to test_gp_flow.py
• (Optional) Auto-detect SCP version in profiles.py based on card response
• (Optional) Add CI tests for SCP03

Related

• Issue On-device GlobalPlatform card management via SCP02 — hardware-verified #25: On-device GlobalPlatform card management via SCP02 — hardware-verified