feat: Add Brainpool and NIST elliptic curve support for PACE (issue #11)

Cargo.toml

@@ -11,7 +11,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.3.0"
 authors = ["Balamurali Pandranki <balamurali@live.com>"]
 edition = "2021"
 # 1.92 is required by the `xml-sec` dependency (Aadhaar XML-DSig verification);
@@ -70,5 +70,9 @@ num-bigint = "0.4"
 num-traits = "0.2"
 rand = "0.10"
 p256 = { version = "0.14", features = ["arithmetic", "ecdh", "ecdsa"] }
-p384 = { version = "0.13", features = ["ecdsa"] }
+p384 = { version = "0.13", features = ["arithmetic", "ecdh", "ecdsa"] }
+p521 = { version = "0.13", features = ["arithmetic", "ecdh", "ecdsa"] }
+p224 = { version = "0.13", features = ["arithmetic", "ecdh", "ecdsa"] }
+bp256 = { version = "0.14.0-rc.15", features = ["arithmetic"] }
+bp384 = { version = "0.14.0-rc.15", features = ["arithmetic"] }
 elliptic-curve = { version = "0.14", features = ["arithmetic"] }

README.md

@@ -8,7 +8,7 @@ offline e-KYC, and Income-Tax PAN.
 
 | Crate | Path | Description |
 |-------|------|-------------|
-| [`dmrtd`](crates/dmrtd) | `crates/dmrtd` | eMRTD / ICAO 9303 reader core — BAC, PACE (ECDH-GM P-256 and DH-GM), MRZ, LDS parsing, secure messaging. Transport-agnostic (NFC plugs in via a `Transceiver` trait). |
+| [`dmrtd`](crates/dmrtd) | `crates/dmrtd` | eMRTD / ICAO 9303 reader core — BAC, PACE (ECDH-GM NIST & Brainpool, DH-GM), MRZ, LDS parsing, secure messaging. Transport-agnostic (NFC plugs in via a `Transceiver` trait). |
 | [`mrz-parser`](crates/mrz-parser) | `crates/mrz-parser` | ICAO 9303 Machine Readable Zone (TD1 / TD2 / TD3) text parser — fields + check digits, country patterns, OCR-defect fixer. |
 | [`aamva`](crates/aamva) | `crates/aamva` | AAMVA DL/ID — PDF417 barcode scan + payload parser (US / Canadian driver's licenses). |
 | [`aadhaar-offline-kyc`](crates/aadhaar-offline-kyc) | `crates/aadhaar-offline-kyc` | Aadhaar offline e-KYC (India UIDAI) — Secure QR v2 + Paperless Offline e-KYC (ZIP/XML) with signature verification; Verhoeff number validation. |

crates/dmrtd/Cargo.toml

@@ -47,5 +47,10 @@ zeroize.workspace = true
 num-bigint.workspace = true
 num-traits.workspace = true
 rand.workspace = true
-p256.workspace = true
-elliptic-curve.workspace = true
+p256 = { workspace = true }
+p384 = { workspace = true }
+p521 = { workspace = true }
+p224 = { workspace = true }
+bp256 = { workspace = true }
+bp384 = { workspace = true }
+elliptic-curve = { workspace = true }

crates/dmrtd/README.md

@@ -17,12 +17,12 @@ Android (Dart FFI), a desktop reader, or tests alike.
 | Keys (`DBAKey`, `CanKey`, `AccessKey` trait) | ✅ |
 | SM ciphers (3DES, AES) + `MrtdSM` wrapper | ✅ |
 | BAC — pure helpers, session keys, `BacSession` state machine | ✅ |
-| PACE — helpers, `PaceSession` state machine (ECDH-GM on NIST P-256) | ✅ |
+| PACE — helpers, `PaceSession` state machine (ECDH-GM on NIST & Brainpool) | ✅ |
 | DH-PACE (RFC 5114 groups) | ✅ |
-| ECDH-PACE (NIST P-256 via `p256`) | ✅ |
+| ECDH-PACE (NIST P-224/256/384/521 & Brainpool P-256/384) | ✅ |
 | `MrtdApi` (sync ICC orchestrator) + `Transceiver` trait | ✅ |
 | `Passport` — high-level BAC/PACE + file-read API | ✅ |
-| Additional PACE curves (Brainpool etc.) | ⏳ pending |
+| Additional PACE curves (Brainpool, NIST P-224/384/521) | ✅ |
 
 Reference vectors verified include ICAO 9303 Appendix A check digits + EF.COM +
 EF.DG1 TD1 sample, Appendix D.2 `K_seed`, Appendix D.3 BAC SSC + session keys

crates/dmrtd/src/proto/domain_parameter.rs

@@ -100,7 +100,7 @@ pub static ICAO_DOMAIN_PARAMETERS: Lazy<HashMap<u32, DomainParameter>> = Lazy::n
             name: "NIST P-224 (secp224r1)",
             size: 224,
             kind: DomainParameterType::Ecp,
-            is_supported: false,
+            is_supported: true,
         },
         DomainParameter {
             id: 11,
@@ -121,7 +121,7 @@ pub static ICAO_DOMAIN_PARAMETERS: Lazy<HashMap<u32, DomainParameter>> = Lazy::n
             name: "BrainpoolP256r1",
             size: 256,
             kind: DomainParameterType::Ecp,
-            is_supported: false,
+            is_supported: true,
         },
         DomainParameter {
             id: 14,
@@ -135,14 +135,14 @@ pub static ICAO_DOMAIN_PARAMETERS: Lazy<HashMap<u32, DomainParameter>> = Lazy::n
             name: "NIST P-384 (secp384r1)",
             size: 384,
             kind: DomainParameterType::Ecp,
-            is_supported: false,
+            is_supported: true,
         },
         DomainParameter {
             id: 16,
             name: "BrainpoolP384r1",
             size: 384,
             kind: DomainParameterType::Ecp,
-            is_supported: false,
+            is_supported: true,
         },
         DomainParameter {
             id: 17,
@@ -156,7 +156,7 @@ pub static ICAO_DOMAIN_PARAMETERS: Lazy<HashMap<u32, DomainParameter>> = Lazy::n
             name: "NIST P-521 (secp521r1)",
             size: 521,
             kind: DomainParameterType::Ecp,
-            is_supported: false,
+            is_supported: true,
         },
     ];
     entries.into_iter().map(|p| (p.id, p)).collect()
@@ -176,15 +176,15 @@ mod tests {
     use super::*;
 
     #[test]
-    fn supported_entries_are_p256_and_rfc5114_dh_groups() {
+    fn supported_entries_include_brainpool_and_nist_curves() {
         let mut supported: Vec<u32> = ICAO_DOMAIN_PARAMETERS
             .values()
             .filter(|p| p.is_supported)
             .map(|p| p.id)
             .collect();
         supported.sort_unstable();
-        // P-256 (12, ECDH) + RFC 5114 MODP/DH groups (0/1/2).
-        assert_eq!(supported, vec![0, 1, 2, 12]);
+        // P-256 (12, ECDH) + RFC 5114 MODP/DH groups (0/1/2) + Brainpool + NIST P-224/384/521.
+        assert_eq!(supported, vec![0, 1, 2, 10, 12, 13, 15, 16, 18]);
     }
 
     #[test]