#include <se050_device.hpp>

Public Member Functions
	Device (TransportT &transport) noexcept

bool	EnsureInitialized () noexcept

Error	TransceiveRaw (const std::uint8_t tx, std::size_t tx_len, std::uint8_t rx, std::size_t rx_cap, std::size_t *rx_len_out, std::uint32_t timeout_ms) noexcept
	Raw I²C exchange (legacy / bring-up); prefer T1 for SE050 T=1 blocks.

Error	HardwareReset () noexcept

T1Session< TransportT > &	T1 () noexcept
	ISO 7816-3 T=1 session bound to the same transport as SessionRef.

const T1Session< TransportT > &	T1 () const noexcept

scp03::Session< TransportT > &	Scp03 () noexcept
	SCP03 session. Handshake uses T=1 directly; wrapped APDUs go through TransmitApdu.

const scp03::Session< TransportT > &	Scp03 () const noexcept

void	BindScp03WrapScratch (std::uint8_t *buf, std::size_t cap) noexcept
	Bind caller-owned wrap workspace (CM4: D2 `.se_apdu_scratch`, not a task stack).

Error	TransmitApdu (const std::uint8_t capdu, std::size_t capdu_len, std::uint8_t rapdu_buf, std::size_t rapdu_cap, std::size_t *rapdu_len, std::uint32_t timeout_ms) noexcept
	Transmit a C-APDU (already serialized) and receive the R-APDU INF bytes.

Error	SelectDefaultIoTApplet (std::uint8_t rapdu_buf, std::size_t rapdu_cap, std::size_t rapdu_len, std::uint32_t timeout_ms) noexcept
	`SELECT` the default IoT applet (`applet::kDefaultIoTAppletAid`, short `Le`).

Error	SelectCardManager (std::uint8_t rapdu_buf, std::size_t rapdu_cap, std::size_t rapdu_len, std::uint32_t timeout_ms) noexcept
	`SELECT` the GlobalPlatform Card Manager (ISD) for `PUT KEY`.

Error	GetVersion (cmd::VersionInfo *out, std::uint32_t timeout_ms) noexcept

Error	GetRandom (std::uint16_t bytes_requested, std::uint8_t out, std::size_t out_cap, std::size_t out_len, std::uint32_t timeout_ms) noexcept

Error	GetFreeMemory (cmd::MemoryType memory_type, std::uint16_t *free_bytes, std::uint32_t timeout_ms) noexcept

Error	WriteBinary (const cmd::ObjectId &object_id, const std::uint8_t *data, std::size_t data_len, bool has_offset, std::uint16_t offset, bool has_file_length, std::uint16_t file_length, std::uint32_t timeout_ms) noexcept

Error	ReadObject (const cmd::ObjectId &object_id, bool has_offset, std::uint16_t offset, bool has_length, std::uint16_t length, std::uint8_t out, std::size_t out_cap, std::size_t out_len, std::uint32_t timeout_ms) noexcept

Error	DeleteSecureObject (const cmd::ObjectId &object_id, std::uint32_t timeout_ms) noexcept

Error	CheckObjectExists (const cmd::ObjectId &object_id, bool *exists, std::uint32_t timeout_ms) noexcept

Error	ReadPublicEcKey (const cmd::ObjectId &key_id, std::uint8_t out, std::size_t out_cap, std::size_t out_len, std::uint32_t timeout_ms) noexcept

Error	GenerateEcKeyPair (const cmd::ObjectId &object_id, cmd::EcCurve curve, std::uint32_t timeout_ms) noexcept

Error	EcdsaSign (const cmd::ObjectId &key_id, cmd::EcdsaAlgo algo, const std::uint8_t digest, std::size_t digest_len, std::uint8_t signature_out, std::size_t signature_cap, std::size_t *signature_len, std::uint32_t timeout_ms) noexcept

Error	EcdsaVerify (const cmd::ObjectId &key_id, cmd::EcdsaAlgo algo, const std::uint8_t digest, std::size_t digest_len, const std::uint8_t signature, std::size_t signature_len, bool *verified, std::uint32_t timeout_ms) noexcept

Error	WriteAesKey (const cmd::ObjectId &object_id, const std::uint8_t *key, std::size_t key_len, std::uint32_t timeout_ms) noexcept
	Write a persistent AESKey (AN12413 WriteSymmKey, P1_AES).

Error	CipherAesEcb (const cmd::ObjectId &key_id, bool decrypt, const std::uint8_t in, std::size_t in_len, std::uint8_t out, std::size_t out_cap, std::size_t *out_len, std::uint32_t timeout_ms) noexcept
	One-shot AES-ECB (AN12413 CipherOneShot, AES_ECB_NOPAD).

Error	UnwrapAes256Rfc3394 (const cmd::ObjectId &kek_id, const std::uint8_t wrapped, std::size_t wrapped_len, std::uint8_t out, std::size_t out_cap, std::size_t *out_len, std::uint32_t timeout_ms) noexcept
	RFC 3394 unwrap of an AES-256 CEK using `kek_id` as the wrapping key.

Session< TransportT > &	SessionRef () noexcept

const Session< TransportT > &	SessionRef () const noexcept

Constructor & Destructor Documentation

◆ Device()

template<typename TransportT >

se050::Device< TransportT >::Device ( TransportT & transport )

inlineexplicitnoexcept

Member Function Documentation

◆ BindScp03WrapScratch()

template<typename TransportT >

void se050::Device< TransportT >::BindScp03WrapScratch	(	std::uint8_t *	buf,
		std::size_t	cap
	)

inlinenoexcept

Bind caller-owned wrap workspace (CM4: D2 .se_apdu_scratch, not a task stack).

Required before TransmitApdu will wrap. Handshake APDUs stay plaintext.

◆ CheckObjectExists()

template<typename TransportT >

Error se050::Device< TransportT >::CheckObjectExists	(	const cmd::ObjectId &	object_id,
		bool *	exists,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ CipherAesEcb()

template<typename TransportT >

Error se050::Device< TransportT >::CipherAesEcb	(	const cmd::ObjectId &	key_id,
		bool	decrypt,
		const std::uint8_t *	in,
		std::size_t	in_len,
		std::uint8_t *	out,
		std::size_t	out_cap,
		std::size_t *	out_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

One-shot AES-ECB (AN12413 CipherOneShot, AES_ECB_NOPAD).

Input must be a multiple of 16 bytes. Used as the RFC 3394 block oracle so the KEK never leaves the SE.

◆ DeleteSecureObject()

template<typename TransportT >

Error se050::Device< TransportT >::DeleteSecureObject	(	const cmd::ObjectId &	object_id,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ EcdsaSign()

template<typename TransportT >

Error se050::Device< TransportT >::EcdsaSign	(	const cmd::ObjectId &	key_id,
		cmd::EcdsaAlgo	algo,
		const std::uint8_t *	digest,
		std::size_t	digest_len,
		std::uint8_t *	signature_out,
		std::size_t	signature_cap,
		std::size_t *	signature_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ EcdsaVerify()

template<typename TransportT >

Error se050::Device< TransportT >::EcdsaVerify	(	const cmd::ObjectId &	key_id,
		cmd::EcdsaAlgo	algo,
		const std::uint8_t *	digest,
		std::size_t	digest_len,
		const std::uint8_t *	signature,
		std::size_t	signature_len,
		bool *	verified,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ EnsureInitialized()

template<typename TransportT >

bool se050::Device< TransportT >::EnsureInitialized ( )

inlinenoexcept

◆ GenerateEcKeyPair()

template<typename TransportT >

Error se050::Device< TransportT >::GenerateEcKeyPair	(	const cmd::ObjectId &	object_id,
		cmd::EcCurve	curve,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ GetFreeMemory()

template<typename TransportT >

Error se050::Device< TransportT >::GetFreeMemory	(	cmd::MemoryType	memory_type,
		std::uint16_t *	free_bytes,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ GetRandom()

template<typename TransportT >

Error se050::Device< TransportT >::GetRandom	(	std::uint16_t	bytes_requested,
		std::uint8_t *	out,
		std::size_t	out_cap,
		std::size_t *	out_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ GetVersion()

template<typename TransportT >

Error se050::Device< TransportT >::GetVersion	(	cmd::VersionInfo *	out,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ HardwareReset()

template<typename TransportT >

Error se050::Device< TransportT >::HardwareReset ( )

inlinenoexcept

◆ ReadObject()

template<typename TransportT >

Error se050::Device< TransportT >::ReadObject	(	const cmd::ObjectId &	object_id,
		bool	has_offset,
		std::uint16_t	offset,
		bool	has_length,
		std::uint16_t	length,
		std::uint8_t *	out,
		std::size_t	out_cap,
		std::size_t *	out_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ ReadPublicEcKey()

template<typename TransportT >

Error se050::Device< TransportT >::ReadPublicEcKey	(	const cmd::ObjectId &	key_id,
		std::uint8_t *	out,
		std::size_t	out_cap,
		std::size_t *	out_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

◆ Scp03() [1/2]

template<typename TransportT >

const scp03::Session< TransportT > & se050::Device< TransportT >::Scp03 ( ) const

inlinenoexcept

◆ Scp03() [2/2]

template<typename TransportT >

scp03::Session< TransportT > & se050::Device< TransportT >::Scp03 ( )

inlinenoexcept

SCP03 session. Handshake uses T=1 directly; wrapped APDUs go through TransmitApdu.

◆ SelectCardManager()

template<typename TransportT >

Error se050::Device< TransportT >::SelectCardManager	(	std::uint8_t *	rapdu_buf,
		std::size_t	rapdu_cap,
		std::size_t *	rapdu_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

SELECT the GlobalPlatform Card Manager (ISD) for PUT KEY.

Required before rotating platform SCP03 keys. Handshake APDUs stay plaintext T=1; once the channel is open this SELECT is wrapped.

◆ SelectDefaultIoTApplet()

template<typename TransportT >

Error se050::Device< TransportT >::SelectDefaultIoTApplet	(	std::uint8_t *	rapdu_buf,
		std::size_t	rapdu_cap,
		std::size_t *	rapdu_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

SELECT the default IoT applet (applet::kDefaultIoTAppletAid, short Le).

Parameters

rapdu_buf	Response buffer (status at tail).
rapdu_cap	Capacity of `rapdu_buf`.
rapdu_len	Written length.

◆ SessionRef() [1/2]

template<typename TransportT >

const Session< TransportT > & se050::Device< TransportT >::SessionRef ( ) const

inlinenoexcept

◆ SessionRef() [2/2]

template<typename TransportT >

Session< TransportT > & se050::Device< TransportT >::SessionRef ( )

inlinenoexcept

◆ T1() [1/2]

template<typename TransportT >

const T1Session< TransportT > & se050::Device< TransportT >::T1 ( ) const

inlinenoexcept

◆ T1() [2/2]

template<typename TransportT >

T1Session< TransportT > & se050::Device< TransportT >::T1 ( )

inlinenoexcept

ISO 7816-3 T=1 session bound to the same transport as SessionRef.

◆ TransceiveRaw()

template<typename TransportT >

Error se050::Device< TransportT >::TransceiveRaw	(	const std::uint8_t *	tx,
		std::size_t	tx_len,
		std::uint8_t *	rx,
		std::size_t	rx_cap,
		std::size_t *	rx_len_out,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

Raw I²C exchange (legacy / bring-up); prefer T1 for SE050 T=1 blocks.

◆ TransmitApdu()

template<typename TransportT >

Error se050::Device< TransportT >::TransmitApdu	(	const std::uint8_t *	capdu,
		std::size_t	capdu_len,
		std::uint8_t *	rapdu_buf,
		std::size_t	rapdu_cap,
		std::size_t *	rapdu_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

Transmit a C-APDU (already serialized) and receive the R-APDU INF bytes.

When Scp03 is open, C-MAC/C-ENC wrap and R-MAC/R-ENC unwrap using the bound scratch. Otherwise plaintext T=1 (honest posture without unique keys). A response without a valid R-MAC returns Error::Authentication; so does a T=1 failure inside the channel (returned as the T=1 error). Either way the channel is closed with its keys wiped, and further calls return Error::Authentication until Scp03().Close() or a new OpenSecureChannel().

Parameters

capdu	Serialized command APDU.
capdu_len	Length of `capdu`.
rapdu_buf	Buffer for concatenated response body + `SW1SW2`.
rapdu_cap	Capacity of `rapdu_buf`.
rapdu_len	Written length on success.

◆ UnwrapAes256Rfc3394()

template<typename TransportT >

Error se050::Device< TransportT >::UnwrapAes256Rfc3394	(	const cmd::ObjectId &	kek_id,
		const std::uint8_t *	wrapped,
		std::size_t	wrapped_len,
		std::uint8_t *	out,
		std::size_t	out_cap,
		std::size_t *	out_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

RFC 3394 unwrap of an AES-256 CEK using kek_id as the wrapping key.

24 AES-ECB decrypt APDUs. Caller must HoldBus for the whole call.

◆ WriteAesKey()

template<typename TransportT >

Error se050::Device< TransportT >::WriteAesKey	(	const cmd::ObjectId &	object_id,
		const std::uint8_t *	key,
		std::size_t	key_len,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

Write a persistent AESKey (AN12413 WriteSymmKey, P1_AES).

Image KEK must be an AES object, not a BinaryFile, or CipherOneShot / RFC3394 unwrap returns 0x6985.

◆ WriteBinary()

template<typename TransportT >

Error se050::Device< TransportT >::WriteBinary	(	const cmd::ObjectId &	object_id,
		const std::uint8_t *	data,
		std::size_t	data_len,
		bool	has_offset,
		std::uint16_t	offset,
		bool	has_file_length,
		std::uint16_t	file_length,
		std::uint32_t	timeout_ms
	)

inlinenoexcept

The documentation for this class was generated from the following file:

se050_device.hpp

Public Member Functions

Constructor & Destructor Documentation

◆ Device()

Member Function Documentation

◆ BindScp03WrapScratch()

◆ CheckObjectExists()

◆ CipherAesEcb()

◆ DeleteSecureObject()

◆ EcdsaSign()

◆ EcdsaVerify()

◆ EnsureInitialized()

◆ GenerateEcKeyPair()

◆ GetFreeMemory()

◆ GetRandom()

◆ GetVersion()

◆ HardwareReset()

◆ ReadObject()

◆ ReadPublicEcKey()

◆ Scp03() [1/2]

◆ Scp03() [2/2]

◆ SelectCardManager()

◆ SelectDefaultIoTApplet()

◆ SessionRef() [1/2]

◆ SessionRef() [2/2]

◆ T1() [1/2]

◆ T1() [2/2]

◆ TransceiveRaw()

◆ TransmitApdu()

◆ UnwrapAes256Rfc3394()

◆ WriteAesKey()

◆ WriteBinary()