源码对照：4.2.6.2.1
ES8+ 更换会话密钥 / TC_eUICC_ES8+.ReplaceSessionKeys
左侧为人工切片入口（-man，来自 原料/切片 的最小可执行脚本），右侧为 Cas 盲生成入口（-cas，仅依据规范生成）。文件按原始编码（多为 GBK）解码为 UTF-8 显示，行号自 1 起；字节级原文与 sha256 见两侧脚本包。完整 unified diff 见本页底部折叠区，以及 报告原文 §4。
-man 入口
Import/TestCase_SGP_23.js
61 行 / 2823 字符 / gb18030
-cas 入口
TC_eUICC_ES8_ReplaceSessionKeys/Import/TC_eUICC_ES8_ReplaceSessionKeys.js
98 行 / 7718 字符 / gb18030
默认折行显示长行；取消勾选可横向滚动查看原始行宽
-man 人工切片Import/TestCase_SGP_23.js61 行 / 2823 字符 / gb18030入口函数 @L3
1// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES8_ReplaceSessionKeys_01_Error_Incorrect_PPK_size (extracted verbatim)
2
3function TC_eUICC_ES8_ReplaceSessionKeys_01_Error_Incorrect_PPK_size()
4{
5
6 tracenamestr = "测试目的：验证eUICC检查所有PPK大小是否与会话密钥相同";
7 curDis.TraceStart(sno++,tracenamestr);
8
9 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
10 Ini_powerOn_eUICC_LPAe_not_activate();
11
12 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
13 TS_MANAGE_CHANNEL_OPEN();
14
15 curLogicChannel = 1;
16
17 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
18 TS_SELECT("Select ISD",ISD_R_AID,"9000");
19
20 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
21 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
22 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
23 Profile_load_procedure.ES10b_GetEUICCInfo1();
24
25 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
26 Profile_load_procedure.ES10b_GetEUICCChallenge();
27
28 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
29 Profile_load_procedure.ES10b_AuthenticateServer();
30
31 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
32 Profile_load_procedure.ES10b_PrepareDownload();
33
34 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
35 Profile_load_procedure.ES10b_GetEID();
36
37 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest域中使用错误长度的PPK initialMacChaining；");
38 Profile_load_procedure.serviceProviderName = SP_NAME1;
39 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
40 Profile_load_procedure.iconType = "01";
41 Profile_load_procedure.icon = ICON_OP_PROF1;
42 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
43 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
44 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
45 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
46 Profile_load_procedure.profileClass = "02";
47 Profile_load_procedure.profilePolicyRules = "0640";
48 Profile_load_procedure.mccMnc = MCC_MNC1;
49 Profile_load_procedure.initialMacChainingValueLen = 24;
50 Profile_load_procedure.UsePPK = true;
51
52 Profile_load_procedure.isErrorTest = true;
53 Profile_load_procedure.bppCommandId = BppCommandId.replaceSessionKeys;
54 Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
55 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
56
57
58
59 RecoverCard();
60}
61
-cas 盲生成TC_eUICC_ES8_ReplaceSessionKeys/Import/TC_eUICC_ES8_ReplaceSessionKeys.js98 行 / 7718 字符 / gb18030入口函数 @L12
1// Author: 卡思Cas智能体
2// Date: 20261005-152741
3// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES8+.ReplaceSessionKeys，Test Sequence #01 Error: Incorrect PPK size（B 行名称注记：except test sequence #11 and #12——本 TC 仅含 #01），适用性 M。
4// Test points: S4-C1 SW；S5-C1 SW；S6-C1 SW；S7-C1 SW；S7-C2 SW；S7-C2 resp present
5// 本函数由 CaseIR 4.2.6.2.1 编译生成（fullwave-blindgen-live-70，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
6// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
7// 适用性 M：编译期门，运行时由 harness 环境前置承担。
8// PRECONDITION (declared, NOT compiled): initial_conditions 缺语料过程体（Annex C.2 absent from input package, corpus vacuum）: IC 序列属测试工具/卡态编排责任，本脚本不虚构初始化步骤；语义影响见 CaseIR open_items。
9// GIC 通信初始化+ISD-R 选择+相互认证+End User Confirmation+PrepareDownload（#PREP_DOWNLOAD_NO_CC）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
10// GIC-sub PROC_EUICC_INITIALIZATION_SEQUENCE（R2 闭合，K_annexC2_procs 表1256：RESET/[SELECT_MF]/[TERMINAL_CAPABILITY_LPAd]/[TERMINAL_PROFILE]）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
11// GIC-sub PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR（R2 闭合，K_annexC2_procs 表1258：[MANAGE_CHANNEL_OPEN]/MTD_SELECT(#ISD_R_AID)）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
12function TC_eUICC_ES8_ReplaceSessionKeys_01_11_12_01_merged() {
13 var bind = curBind;
14
15 // 步骤 1：IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
16 // test-tool internal preparation (no APDU face): runtime-domain
17 // values per CaseIR unresolved (G Annex B generation rules);
18 // no fabricated bytes emitted here.
19
20 // 步骤 2：IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
21 // BPP synthesized (4.2.6.2.1 seq#1, structural layer, SCP03t-unprotected): 1120 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=53B, A3=796B.
22 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
23 // [SPEC] TC — SGP.23 4.2.6.2.1 seq#1 接线（段选择/注入面）
24 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
25 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
26 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
27 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
28 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
29 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
30 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
31 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
32 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
33 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
34 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
35 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
36 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
37 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
38 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
39 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
40 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
41 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
42 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
43 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
44 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
45 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
46 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
47 // [SPEC] PE header/version — PITS asn:67-68 2/3
48 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
49 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
50 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
51 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
52 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
53 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
54 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
55 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
56 // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
57 // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
58 // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
59 // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
60 // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
61 // [HYPOTHESIS] BF26/04 ppkEnc — 注入 ppk_invalid_size：16B→8B（4.2.6.2.1 seq#01）
62 // S2-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
63
64 // 步骤 3：IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>（tc_step）
65 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>.
66 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
67 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
68 // S3-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
69
70 // 步骤 4：IC4: MTD_STORE_DATA_SCRIPT（tc_step）
71 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
72 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
73 var s4 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
74 bind.checkData("S4-C1 SW", "9000", s4.sw);
75
76 // 步骤 5：IC5: MTD_STORE_DATA_SCRIPT（tc_step）
77 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
78 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
79 var s5 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
80 bind.checkData("S5-C1 SW", "9000", s5.sw);
81
82 // 步骤 6：IC6: MTD_STORE_DATA_SCRIPT（tc_step）
83 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
84 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
85 var s6 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
86 bind.checkData("S6-C1 SW", "9000", s6.sw);
87
88 // 步骤 7：1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ55_038, RQ55_041, RQ31_168, RQ26_021, RQ26_022, RQ25_024, RQ25_025, RQ25_026）
89 // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
90 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
91 var s7 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
92 bind.checkData("S7-C1 SW", "9000", s7.sw);
93 bind.checkData("S7-C2 SW", "9000", s7.sw);
94 bind.checkData("S7-C2 resp present", "1", s7.resp.length > 0 ? "1" : "0");
95 // S7-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
96 // S7-C4: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
97}
98
完整 unified diff
行级差异：新增 92 行 / 删除 55 行（以 -man 为基准，unified 上下文 3 行）。
展开 diff（156 行）
--- -man
+++ -cas
@@ -1,61 +1,98 @@
-// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES8_ReplaceSessionKeys_01_Error_Incorrect_PPK_size (extracted verbatim)
+// Author: 卡思Cas智能体
+// Date: 20261005-152741
+// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES8+.ReplaceSessionKeys，Test Sequence #01 Error: Incorrect PPK size（B 行名称注记：except test sequence #11 and #12——本 TC 仅含 #01），适用性 M。
+// Test points: S4-C1 SW；S5-C1 SW；S6-C1 SW；S7-C1 SW；S7-C2 SW；S7-C2 resp present
+// 本函数由 CaseIR 4.2.6.2.1 编译生成（fullwave-blindgen-live-70，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
+// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
+// 适用性 M：编译期门，运行时由 harness 环境前置承担。
+// PRECONDITION (declared, NOT compiled): initial_conditions 缺语料过程体（Annex C.2 absent from input package, corpus vacuum）: IC 序列属测试工具/卡态编排责任，本脚本不虚构初始化步骤；语义影响见 CaseIR open_items。
+// GIC 通信初始化+ISD-R 选择+相互认证+End User Confirmation+PrepareDownload（#PREP_DOWNLOAD_NO_CC）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// GIC-sub PROC_EUICC_INITIALIZATION_SEQUENCE（R2 闭合，K_annexC2_procs 表1256：RESET/[SELECT_MF]/[TERMINAL_CAPABILITY_LPAd]/[TERMINAL_PROFILE]）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// GIC-sub PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR（R2 闭合，K_annexC2_procs 表1258：[MANAGE_CHANNEL_OPEN]/MTD_SELECT(#ISD_R_AID)）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+function TC_eUICC_ES8_ReplaceSessionKeys_01_11_12_01_merged() {
+ var bind = curBind;
-function TC_eUICC_ES8_ReplaceSessionKeys_01_Error_Incorrect_PPK_size()
-{
-
- tracenamestr = "测试目的：验证eUICC检查所有PPK大小是否与会话密钥相同";
- curDis.TraceStart(sno++,tracenamestr);
+ // 步骤 1：IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
+ // 步骤 2：IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.6.2.1 seq#1, structural layer, SCP03t-unprotected): 1120 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=53B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.6.2.1 seq#1 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
+ // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
+ // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkEnc — 注入 ppk_invalid_size：16B→8B（4.2.6.2.1 seq#01）
+ // S2-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
+ // 步骤 3：IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S3-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest域中使用错误长度的PPK initialMacChaining；");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC1;
- Profile_load_procedure.initialMacChainingValueLen = 24;
- Profile_load_procedure.UsePPK = true;
-
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.replaceSessionKeys;
- Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
-
- RecoverCard();
+ // 步骤 4：IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s4 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S4-C1 SW", "9000", s4.sw);
+
+ // 步骤 5：IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s5 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S5-C1 SW", "9000", s5.sw);
+
+ // 步骤 6：IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s6 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S6-C1 SW", "9000", s6.sw);
+
+ // 步骤 7：1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ55_038, RQ55_041, RQ31_168, RQ26_021, RQ26_022, RQ25_024, RQ25_025, RQ25_026）
+ // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s7 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S7-C1 SW", "9000", s7.sw);
+ bind.checkData("S7-C2 SW", "9000", s7.sw);
+ bind.checkData("S7-C2 resp present", "1", s7.resp.length > 0 ? "1" : "0");
+ // S7-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+ // S7-C4: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
}