Package: pycvc
pycvcCard Verifiable Certificates (CVC) tools for PythonIntroductionCard Verifiable Certificates are an specification of storing electronic certificates, signed by RSA or Elliptic Curves algorithms.In contrast to X509 certificates, CVC are more compact and are widely used by HSM cards or personal USB tokens.pycvc implements the specifications of BSI TR 03110 to create CV certificates and requests.pycvc can be used to make a CV request and deploy a PKI based on CVC.pycvc also supports ECDH keys such as Curve25519 and Curve448.Installpip install pycvcUsagepycvc can be used by importing the package or calling the command line toolscvc-create, for CVC generation, andcvc-print, for displaying CVC information and verification.For more information, executecvc-createorcvc-printwith--helpflag.Supported algorithmsRSAECDSAEDDSASupported curvessecp192r1 (prime192v1)secp224r1secp256r1 (prime256v1)secp384r1secp521r1brainpoolP256r1brainpoolP384r1brainpoolP512r1secp256k1ed25519ed448Supported schemesECDSA_SHA_1ECDSA_SHA_224ECDSA_SHA_256ECDSA_SHA_384ECDSA_SHA_512RSA_v1_5_SHA_1RSA_v1_5_SHA_256RSA_v1_5_SHA_512RSA_PSS_SHA_1RSA_PSS_SHA_256RSA_PSS_SHA_512Here some examples.Create a PKI with ECDSAcvc-createis the tool to create certificates or requests. Callcvc-create --helpfor a complete list of parameters.1- Setup the CA:opensslecparam-outZZATCVCA00001.pem-nameprime256v1-genkey
opensslpkcs8-topk8-nocrypt-inZZATCVCA00001.pem-outformDER-outZZATCVCA00001.pkcs8
cvc-create--role=cvca--type=at--chr=ZZATCVCA00001--days=365--sign-key=ZZATCVCA00001.pkcs8--scheme=ECDSA_SHA_2562- Setup the DV:opensslecparam-outZZATDVCA00001.pem-nameprime256v1-genkey
opensslpkcs8-topk8-nocrypt-inZZATDVCA00001.pem-outformDER-outZZATDVCA00001.pkcs8
opensslec-inZZATDVCA00001.pem-outZZATDVCA00001.pub-pubout-outformDER
cvc-create--role=dv_domestic--type=at--chr=ZZATDVCA00001--days=180--sign-key=ZZATCVCA00001.pkcs8--scheme=ECDSA_SHA_256--sign-as=ZZATCVCA00001.cvcert--public-key=ZZATDVCA00001.pub3- Create a certificate requestopensslecparam-outZZATTERM00001.pem-nameprime256v1-genkey
opensslpkcs8-topk8-nocrypt-inZZATTERM00001.pem-outformDER-outZZATTERM00001.pkcs8
cvc-create--chr=ZZATTERM00001--scheme=ECDSA_SHA_256--sign-key=ZZATTERM00001.pkcs8--out-cert=ZZATTERM00001.cvreq--req-car=ZZATDVCA000014- Sign a certificate requestcvc-create--role=terminal--type=at--days=60--sign-key=ZZATDVCA00001.pkcs8--sign-as=ZZATDVCA00001.cvcert--request=ZZATTERM00001.cvreqCreate a PKI with RSAcvc-createis the tool to create certificates or requests. Callcvc-create --helpfor a complete list of parameters.1- Setup the CA:opensslgenrsa-outZZATCVCA00001.pem3072opensslpkcs8-topk8-nocrypt-inZZATCVCA00001.pem-outformDER-outZZATCVCA00001.pkcs8
cvc-create--role=cvca--type=at--chr=ZZATCVCA00001--days=365--sign-key=ZZATCVCA00001.pkcs8--scheme=RSA_v1_5_SHA_2562- Setup the DV:opensslgenrsa-outZZATDVCA00001.pem2048opensslpkcs8-topk8-nocrypt-inZZATDVCA00001.pem-outformDER-outZZATDVCA00001.pkcs8
opensslrsa-inZZATDVCA00001.pem-outZZATDVCA00001.pub-pubout-outformDER
cvc-create--role=dv_domestic--type=at--chr=ZZATDVCA00001--days=180--sign-key=ZZATCVCA00001.pkcs8--scheme=RSA_v1_5_SHA_256--sign-as=ZZATCVCA00001.cvcert--public-key=ZZATDVCA00001.pub3- Create a certificate requestopensslgenrsa-outZZATTERM00001.pem2048opensslpkcs8-topk8-nocrypt-inZZATTERM00001.pem-outformDER-outZZATTERM00001.pkcs8
cvc-create--chr=ZZATTERM00001--scheme=RSA_v1_5_SHA_256--sign-key=ZZATTERM00001.pkcs8--out-cert=ZZATTERM00001.cvreq--req-car=ZZATDVCA000014- Sign a certificate requestcvc-create--role=terminal--type=at--days=60--sign-key=ZZATDVCA00001.pkcs8--sign-as=ZZATDVCA00001.cvcert--request=ZZATTERM00001.cvreqCreate a PKI with EdDSAcvc-createis the tool to create certificates or requests. Callcvc-create --helpfor a complete list of parameters.1- Setup the CA:opensslgenpkey-algorithmEd25519-outZZATCVCA00001.pem
opensslpkcs8-topk8-nocrypt-inZZATCVCA00001.pem-outformDER-outZZATCVCA00001.pkcs8
cvc-create--role=cvca--type=at--chr=ZZATCVCA00001--days=365--sign-key=ZZATCVCA00001.pkcs82- Setup the DV:opensslgenpkey-algorithmEd25519-outZZATDVCA00001.pem
opensslpkcs8-topk8-nocrypt-inZZATDVCA00001.pem-outformDER-outZZATDVCA00001.pkcs8
opensslpkey-inZZATDVCA00001.pem-outZZATDVCA00001.pub-pubout-outformDER2>/dev/null
cvc-create--role=dv_domestic--type=at--chr=ZZATDVCA00001--days=180--sign-key=ZZATCVCA00001.pkcs8--sign-as=ZZATCVCA00001.cvcert--public-key=ZZATDVCA00001.pub3- Create a certificate requestopensslgenpkey-algorithmEd25519-outZZATTERM00001.pem
opensslpkcs8-topk8-nocrypt-inZZATTERM00001.pem-outformDER-outZZATTERM00001.pkcs8
cvc-create--chr=ZZATTERM00001--sign-key=ZZATTERM00001.pkcs8--out-cert=ZZATTERM00001.cvreq--req-car=ZZATDVCA000014- Sign a certificate requestcvc-create--role=terminal--type=at--days=60--sign-key=ZZATDVCA00001.pkcs8--sign-as=ZZATDVCA00001.cvcert--request=ZZATTERM00001.cvreqValidate certificates and requestscvc-printis the tool for certificate validation and verification. Callcvc-print --helpfor a complete list of parameters.The validation is performed by veryfing all signatures in the certificate chain.1- Setup trust directorymkdircerts
cpZZATCVCA00001.cvcertcerts/ZZATCVCA00001
cpZZATDVCA00001.cvcertcerts/ZZATDVCA000012- Validate certificates$cvc-print-dcertsZZATCVCA00001.cvcert
Certificate:ProfileIdentifier:00CAR:ZZATCVCA00001PublicKey:Scheme:ECDSA_SHA_256PublicPoint:040e5e4d5f20ee36ac920132f7f448da353d826156e9cfd3075f9d877f9c172111a689953b9accd5011248be50ccf47480ab703b42382a7a45484fccdc738a82e7CHR:ZZATCVCA00001CHAT:Role:TypeATBytes:c000000000Since:2022-08-23Expires:2023-08-23
InnersignatureisVALID
CertificateVALID

$cvc-print-dcertsZZATDVCA00001.cvcert
Certificate:ProfileIdentifier:00CAR:ZZATCVCA00001PublicKey:Scheme:ECDSA_SHA_256PublicPoint:04b37a6588e55e9db3ea72837f4b4347028a51b1c5964ee54878bf2f856ee4abe06f1465e917c8d9ecf7170dbd61c2bc1fc37a1fa36698a33669daa6fa4c1e7400CHR:ZZATDVCA00001CHAT:Role:TypeATBytes:8000000000Since:2022-08-23Expires:2023-02-19
InnersignatureisVALID
CertificateVALID

$cvc-print-dcertsZZATTERM00001.cvreq
Certificate:ProfileIdentifier:00CAR:ZZATTERM00001PublicKey:Scheme:ECDSA_SHA_256PublicPoint:0406358861bc93173b3931a07595eba2bbcc88b852ed0a7139067047ab8abdba9b28eb07344f4f4e8f375bdc886c86d32060e92541b4d73178f9c9c53d3d98a765CHR:ZZATTERM00001
InnersignatureisVALID
CertificateVALID

$cvc-print-dcertsZZATTERM00001.cvcert
Certificate:ProfileIdentifier:00CAR:ZZATDVCA00001PublicKey:Scheme:ECDSA_SHA_256PublicPoint:0406358861bc93173b3931a07595eba2bbcc88b852ed0a7139067047ab8abdba9b28eb07344f4f4e8f375bdc886c86d32060e92541b4d73178f9c9c53d3d98a765CHR:ZZATTERM00001CHAT:Role:TypeATBytes:00Since:2022-08-23Expires:2022-10-22
InnersignatureisVALID
CertificateVALID