Merge pull request #12 from sysdevrun/claude/add-fips-trust-checkbox-0EzC0

Add FIPS trust checkbox to decode page for RICS 9999, key id 0

Author: chtitux

package-lock.json

@@ -20,7 +20,8 @@ export default function DecodeTab({ initialHex, onHexChange, onEditInEncoder }:
   const [showCamera, setShowCamera] = useState(false);
   const [showHexViewer, setShowHexViewer] = useState(false);
   const [showRawJson, setShowRawJson] = useState(false);
-  const { ticket, signatures, signedData, error, loading } = useTicketDecode(hex);
+  const [trustFipsKey, setTrustFipsKey] = useState(true);
+  const { ticket, signatures, signedData, error, loading } = useTicketDecode(hex, trustFipsKey);
 
   useEffect(() => {
     if (initialHex && initialHex !== hex) {
@@ -60,6 +61,16 @@ export default function DecodeTab({ initialHex, onHexChange, onEditInEncoder }:
         onOpenCamera={() => setShowCamera(true)}
       />
 
+      <label className="flex items-center gap-2 text-xs text-gray-600">
+        <input
+          type="checkbox"
+          checked={trustFipsKey}
+          onChange={(e) => setTrustFipsKey(e.target.checked)}
+          className="rounded border-gray-300"
+        />
+        Trust FIPS public key for level 1 as RICS 9999, key id 0
+      </label>
+
       {showCamera && (
         <CameraScanner
           onScan={(h) => {

website/package-lock.json

@@ -15,7 +15,7 @@ export interface DecodeResult {
   loading: boolean;
 }
 
-export function useTicketDecode(hex: string): DecodeResult {
+export function useTicketDecode(hex: string, trustFipsKey = false): DecodeResult {
   const [ticket, setTicket] = useState<UicBarcodeTicket | null>(null);
   const [signatures, setSignatures] = useState<SignatureVerificationResult | null>(null);
   const [signedData, setSignedData] = useState<ExtractedSignedData | null>(null);
@@ -60,7 +60,7 @@ export function useTicketDecode(hex: string): DecodeResult {
           const bytes = new Uint8Array(
             clean.match(/.{1,2}/g)!.map((b) => parseInt(b, 16)),
           );
-          const keyProvider = await createKeyProvider();
+          const keyProvider = await createKeyProvider(trustFipsKey);
           const result = await verifySignatures(bytes, {
             level1KeyProvider: keyProvider,
           });
@@ -79,7 +79,7 @@ export function useTicketDecode(hex: string): DecodeResult {
     }, 200);
 
     return () => clearTimeout(debounceRef.current);
-  }, [hex]);
+  }, [hex, trustFipsKey]);
 
   return { ticket, signatures, signedData, error, loading };
 }

website/src/components/DecodeTab.tsx

@@ -1,9 +1,22 @@
-import { parseKeysXml, findKeyInXml } from 'dosipas-ts';
+import { parseKeysXml, findKeyInXml, getPublicKey as derivePublicKey } from 'dosipas-ts';
 import type { Level1KeyProvider, UicPublicKeyEntry } from 'dosipas-ts';
 
 let cachedXml: string | null = null;
 let cachedKeys: UicPublicKeyEntry[] | null = null;
 
+/** NIST FIPS 186-4 ECDSA P-256 test vector private key (Level 1). */
+const FIPS_L1_PRIV_HEX = 'c9806898a0334916c860748880a541f093b579a9b1f32934d86c363c39800357';
+
+let cachedFipsL1PubKey: Uint8Array | null = null;
+
+function getFipsL1PublicKey(): Uint8Array {
+  if (!cachedFipsL1PubKey) {
+    const privBytes = new Uint8Array(FIPS_L1_PRIV_HEX.match(/.{1,2}/g)!.map((b) => parseInt(b, 16)));
+    cachedFipsL1PubKey = derivePublicKey(privBytes, 'P-256');
+  }
+  return cachedFipsL1PubKey;
+}
+
 export async function loadKeysXml(): Promise<string> {
   if (cachedXml) return cachedXml;
   const resp = await fetch('./uic-publickeys.xml');
@@ -19,11 +32,14 @@ export async function getKeys(): Promise<UicPublicKeyEntry[]> {
   return cachedKeys;
 }
 
-export async function createKeyProvider(): Promise<Level1KeyProvider> {
+export async function createKeyProvider(trustFipsKey = false): Promise<Level1KeyProvider> {
   const xml = await loadKeysXml();
   return {
     async getPublicKey(securityProvider, keyId) {
       const issuerCode = securityProvider.num ?? 0;
+      if (trustFipsKey && issuerCode === 9999 && keyId === 0) {
+        return getFipsL1PublicKey();
+      }
       const key = findKeyInXml(xml, issuerCode, keyId);
       if (!key) {
         throw new Error(`Key not found: issuer=${issuerCode}, keyId=${keyId}`);