独立SSD直接加载签名CAP文件的权限配置及问题排查

我的目标是实现一个可直接加载签名CAP文件的独立Supplementary Security Domain（SSD）。目前从包A0000001515350实例化了AID为A000000151535041、权限为DAP Verification的SSD，已将其置为PERSONALIZED状态并存入RSA公钥用于验证签名小程序，但加载签名CAP文件时仍需先认证Issuer Security Domain（ISD），把小程序加载到ISD后再迁移至SSD，且ISD密钥可删除SSD中的小程序，存在安全隐患。

当前卡上ISD和SSD包信息 #

ISD: A000000151000000 (OP_READY)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

PKG: A0000001515350 (LOADED)
     Parent:  A000000151000000
     Version: -1.-1
     Applet:  A000000151535041

尝试的操作及结果 #

1. 配置Authorized Management权限失败 #

尝试安装带Authorized Management权限的SSD，命令及报错如下：

> gp -domain A000000151535041 -privs AuthorizedManagement

Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
Note: using default AID-s for SSD instantiation: A000000151535041 from A0000001515350
INSTALL [for install and make selectable] failed: 0x6A80 (Wrong data/incorrect values in data)

推测该卡不支持Authorized Management权限。

2. 配置Delegated Management权限成功 #

给SSD配置Delegated Management权限并成功安装：

> gp -domain A000000151535041 -privs DelegatedManagement

Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
Note: using default AID-s for SSD instantiation: A000000151535041 from A0000001515350

执行gp -l查看卡内状态：

> gp -l

Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
ISD: A000000151000000 (OP_READY)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

DOM: A000000151535041 (SELECTABLE)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, DelegatedManagement, TrustedPath

PKG: A0000001515350 (LOADED)
     Parent:  A000000151000000
     Version: -1.-1
     Applet:  A000000151535041

PKG: A00000016443446F634C697465 (LOADED)
     Parent:  A000000151000000
     Version: 1.0
     Applet:  A00000016443446F634C69746501

PKG: A0000000620204 (LOADED)
     Parent:  A000000151000000
     Version: 1.0

PKG: A0000000620202 (LOADED)
     Parent:  A000000151000000
     Version: 1.3

3. 完成SSD个性化 #

修改密钥将SSD置为PERSONALIZED状态：

> gp -sdaid A000000151535041 --lock BA0DDF2FF5A14AEC07A696D21731AE22

Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
[WARN] GPSession - No key template on card but trying to replace. Implying add
Card locked with: BA0DDF2FF5A14AEC07A696D21731AE22
Write this down, DO NOT FORGET/LOSE IT!

再次执行gp -l确认状态：

> gp -l

Warning: no keys given, using default test key 404142434445464748494A4B4C4D4E4F
ISD: A000000151000000 (OP_READY)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, CardLock, CardTerminate, CardReset, CVMManagement, TrustedPath, AuthorizedManagement, TokenVerification, GlobalDelete, GlobalLock, GlobalRegistry, FinalApplication, ReceiptGeneration

DOM: A000000151535041 (PERSONALIZED)
     Parent:  A000000151000000
     From:    A0000001515350
     Privs:   SecurityDomain, DelegatedManagement, TrustedPath

PKG: A0000001515350 (LOADED)
     Parent:  A000000151000000
     Version: -1.-1
     Applet:  A000000151535041

PKG: A00000016443446F634C697465 (LOADED)
     Parent:  A000000151000000
     Version: 1.0
     Applet:  A00000016443446F634C69746501

PKG: A0000000620204 (LOADED)
     Parent:  A000000151000000
     Version: 1.0

PKG: A0000000620202 (LOADED)
     Parent:  A000000151000000
     Version: 1.3

4. 存入RSA公钥失败 #

尝试存入版本为0x73的RSA签名公钥时报错：

> gp -sdaid A000000151535041 -key BA0DDF2FF5A14AEC07A696D21731AE22 -new-keyver 0x73 --put-key rsaPublicKey.pem

PUT KEY failed: 0x6A81 (Function not supported e.g. card Life Cycle State is CARD_LOCKED)

5. 尝试存入0x70版本密钥仍失败 #

按建议尝试存入版本为0x70的令牌验证密钥，依旧报错：

> gp -sdaid A000000151535041 -key BA0DDF2FF5A14AEC07A696D21731AE22 -new-keyver 0x70 --put-key rsaPublicKey.pem

PUT KEY failed: 0x6A81 (Function not supported e.g. card Life Cycle State is CARD_LOCKED)

此前测试结论：

• 带DAP Verification权限的SSD接受0x73版本验证密钥，但不接受0x70版本
• 带Delegated Management权限的SSD对两个版本的密钥均不支持

6. 卡能力信息查询 #

查询NXP J3R180 SecID卡的Card Capability Information：

<< 80 CA 00 67 00
>> 67 24 A0 09 80 01 02 81 04 15 35 55 75 81 03 E5 BE C0 82 03 1E 03 00 83 01 02 84 01 02 85 01 7B 86 01 0C 87 01 7B 90 00

确认该卡支持Delegated Management，但不支持Authorized Management权限。

问题：让SSD无需依赖ISD、仅通过自身认证密钥就能直接加载签名CAP文件，所需的正确权限是什么？

内容的提问来源于stack exchange，提问作者MJay