From cb73a14bd7ec1947871dd719536002cc4d8dc90b Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Fri, 27 Oct 2017 20:51:33 +0300 Subject: [PATCH 1/5] EstEID ECDSA token support (#1158) --- src/libopensc/card-mcrd.c | 10 ++++++--- src/libopensc/pkcs15-esteid.c | 47 +++++++++++++++++++++++++------------------ 2 files changed, 34 insertions(+), 23 deletions(-) diff --git a/src/libopensc/card-mcrd.c b/src/libopensc/card-mcrd.c index cbba3fdfa..28f8abfad 100644 --- a/src/libopensc/card-mcrd.c +++ b/src/libopensc/card-mcrd.c @@ -304,7 +304,7 @@ static int mcrd_match_card(sc_card_t * card) static int mcrd_init(sc_card_t * card) { - unsigned long flags; + unsigned long flags, ext_flags; struct mcrd_priv_data *priv; int r; sc_path_t tmppath; @@ -329,6 +329,10 @@ static int mcrd_init(sc_card_t * card) flags = SC_ALGORITHM_RSA_RAW | SC_ALGORITHM_RSA_HASH_SHA1 | SC_ALGORITHM_RSA_PAD_PKCS1 | SC_ALGORITHM_RSA_HASH_SHA256; /* EstEID v3.0 has 2048 bit keys */ _sc_card_add_rsa_alg(card, 2048, flags, 0); + + flags = SC_ALGORITHM_ECDSA_RAW | SC_ALGORITHM_ECDH_CDH_RAW | SC_ALGORITHM_ECDSA_HASH_NONE; + ext_flags = SC_ALGORITHM_EXT_EC_NAMEDCURVE | SC_ALGORITHM_EXT_EC_UNCOMPRESES; + _sc_card_add_ec_alg(card, 384, flags, ext_flags, NULL); sc_reset(card, 0); sc_format_apdu(card, &apdu, SC_APDU_CASE_3, 0xA4, 0x04, 0x00); @@ -1188,7 +1192,7 @@ static int mcrd_set_security_env(sc_card_t * card, if (is_esteid_card(card)) { /* some sanity checks */ if (env->flags & SC_SEC_ENV_ALG_PRESENT) { - if (env->algorithm != SC_ALGORITHM_RSA) + if (env->algorithm != SC_ALGORITHM_RSA && env->algorithm != SC_ALGORITHM_EC) return SC_ERROR_INVALID_ARGUMENTS; } if (!(env->flags & SC_SEC_ENV_KEY_REF_PRESENT) @@ -1375,7 +1379,7 @@ static int mcrd_compute_signature(sc_card_t * card, apdu.lc = datalen; apdu.data = data; apdu.datalen = datalen; - apdu.le = 0x80; + apdu.le = MIN(0x80u, outlen); apdu.resp = out; apdu.resplen = outlen; diff --git a/src/libopensc/pkcs15-esteid.c b/src/libopensc/pkcs15-esteid.c index 361b2525a..a4655b7f7 100644 --- a/src/libopensc/pkcs15-esteid.c +++ b/src/libopensc/pkcs15-esteid.c @@ -33,6 +33,7 @@ #include "common/compat_strlcat.h" #include "internal.h" +#include "opensc.h" #include "pkcs15.h" #include "esteid.h" @@ -64,6 +65,7 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) sc_card_t *card = p15card->card; unsigned char buff[128]; int r, i; + size_t field_length = 0, modulus_length = 0; sc_path_t tmppath; set_string (&p15card->tokeninfo->label, "ID-kaart"); @@ -74,7 +76,7 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) r = sc_select_file (card, &tmppath, NULL); SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "select esteid PD failed"); - /* read the serial (document number) */ + /* read the serial (document number) */ r = sc_read_record (card, SC_ESTEID_PD_DOCUMENT_NR, buff, sizeof(buff), SC_RECORD_BY_REC_NR); SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "read document number failed"); buff[r] = '\0'; @@ -93,10 +95,10 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) "3f00eeeeaace", "3f00eeeeddce"}; static int esteid_cert_ids[2] = {1, 2}; - + struct sc_pkcs15_cert_info cert_info; struct sc_pkcs15_object cert_obj; - + memset(&cert_info, 0, sizeof(cert_info)); memset(&cert_obj, 0, sizeof(cert_obj)); @@ -110,6 +112,10 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) if (i == 0) { sc_pkcs15_cert_t *cert; r = sc_pkcs15_read_certificate(p15card, &cert_info, &cert); + if (cert->key->algorithm == SC_ALGORITHM_EC) + field_length = cert->key->u.ec.params.field_length; + else + modulus_length = cert->key->u.rsa.modulus.len * 8; if (r == SC_SUCCESS) { static const struct sc_object_id cn_oid = {{ 2, 5, 4, 3, -1 }}; u8 *cn_name = NULL; @@ -155,16 +161,16 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) memset(&pin_info, 0, sizeof(pin_info)); memset(&pin_obj, 0, sizeof(pin_obj)); - + /* read the number of tries left for the PIN */ r = sc_read_record (card, i + 1, buff, sizeof(buff), SC_RECORD_BY_REC_NR); if (r < 0) return SC_ERROR_INTERNAL; tries_left = buff[5]; - + pin_info.auth_id.len = 1; pin_info.auth_id.value[0] = esteid_pin_authid[i]; - pin_info.auth_type = SC_PKCS15_PIN_AUTH_TYPE_PIN; + pin_info.auth_type = SC_PKCS15_PIN_AUTH_TYPE_PIN; pin_info.attrs.pin.reference = esteid_pin_ref[i]; pin_info.attrs.pin.flags = esteid_pin_flags[i]; pin_info.attrs.pin.type = SC_PKCS15_PIN_TYPE_ASCII_NUMERIC; @@ -188,16 +194,11 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) if (r < 0) return SC_ERROR_INTERNAL; } - + /* add private keys */ for (i = 0; i < 2; i++) { static int prkey_pin[2] = {1, 2}; - static int prkey_usage[2] = { - SC_PKCS15_PRKEY_USAGE_ENCRYPT - | SC_PKCS15_PRKEY_USAGE_DECRYPT - | SC_PKCS15_PRKEY_USAGE_SIGN, - SC_PKCS15_PRKEY_USAGE_NONREPUDIATION}; - + static const char *prkey_name[2] = { "Isikutuvastus", "Allkirjastamine"}; @@ -207,16 +208,19 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) memset(&prkey_info, 0, sizeof(prkey_info)); memset(&prkey_obj, 0, sizeof(prkey_obj)); - + prkey_info.id.len = 1; prkey_info.id.value[0] = prkey_pin[i]; - prkey_info.usage = prkey_usage[i]; prkey_info.native = 1; prkey_info.key_reference = i + 1; - if (card->type == SC_CARD_TYPE_MCRD_ESTEID_V30) - prkey_info.modulus_length = 2048; + prkey_info.field_length = field_length; + prkey_info.modulus_length = modulus_length; + if (i == 1) + prkey_info.usage = SC_PKCS15_PRKEY_USAGE_NONREPUDIATION; + else if(field_length > 0) // ECC has only sign usage + prkey_info.usage = SC_PKCS15_PRKEY_USAGE_SIGN; else - prkey_info.modulus_length = 1024; + prkey_info.usage = SC_PKCS15_PRKEY_USAGE_SIGN | SC_PKCS15_PRKEY_USAGE_ENCRYPT | SC_PKCS15_PRKEY_USAGE_DECRYPT; strlcpy(prkey_obj.label, prkey_name[i], sizeof(prkey_obj.label)); prkey_obj.auth_id.len = 1; @@ -224,7 +228,10 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) prkey_obj.user_consent = 0; prkey_obj.flags = SC_PKCS15_CO_FLAG_PRIVATE; - r = sc_pkcs15emu_add_rsa_prkey(p15card, &prkey_obj, &prkey_info); + if(field_length > 0) + r = sc_pkcs15emu_add_ec_prkey(p15card, &prkey_obj, &prkey_info); + else + r = sc_pkcs15emu_add_rsa_prkey(p15card, &prkey_obj, &prkey_info); if (r < 0) return SC_ERROR_INTERNAL; } @@ -236,7 +243,7 @@ static int esteid_detect_card(sc_pkcs15_card_t *p15card) { if (is_esteid_card(p15card->card)) return SC_SUCCESS; - else + else return SC_ERROR_WRONG_CARD; } From bea03e86d385a7d1ec58f42a501a5c2d471357d1 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Wed, 8 Nov 2017 14:24:18 +0200 Subject: [PATCH 2/5] Fix crash when certificate read failed (#1189) Fixes https://github.com/OpenSC/OpenSC/issues/1176 --- src/libopensc/pkcs15-esteid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/libopensc/pkcs15-esteid.c b/src/libopensc/pkcs15-esteid.c index a4655b7f7..a5f9af8b2 100644 --- a/src/libopensc/pkcs15-esteid.c +++ b/src/libopensc/pkcs15-esteid.c @@ -110,8 +110,10 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) if (r < 0) return SC_ERROR_INTERNAL; if (i == 0) { - sc_pkcs15_cert_t *cert; + sc_pkcs15_cert_t *cert = NULL; r = sc_pkcs15_read_certificate(p15card, &cert_info, &cert); + if (r < 0) + return SC_ERROR_INTERNAL; if (cert->key->algorithm == SC_ALGORITHM_EC) field_length = cert->key->u.ec.params.field_length; else From da05d83a0d3a97eea8f33d5566c60798acc137fc Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Fri, 10 Nov 2017 09:58:31 +0200 Subject: [PATCH 3/5] EstEID ECDH token support (#1185) --- src/libopensc/card-mcrd.c | 89 ++++++++++++++++++++++++++++++++++++++++--- src/libopensc/pkcs15-esteid.c | 4 +- 2 files changed, 86 insertions(+), 7 deletions(-) diff --git a/src/libopensc/card-mcrd.c b/src/libopensc/card-mcrd.c index 28f8abfad..085d02965 100644 --- a/src/libopensc/card-mcrd.c +++ b/src/libopensc/card-mcrd.c @@ -59,9 +59,9 @@ static struct sc_atr_table mcrd_atrs[] = { {NULL, NULL, NULL, 0, 0, NULL} }; -static unsigned char EstEID_v3_AID[] = {0xF0, 0x45, 0x73, 0x74, 0x45, 0x49, 0x44, 0x20, 0x76, 0x65, 0x72, 0x20, 0x31, 0x2E, 0x30}; -static unsigned char EstEID_v35_AID[] = {0xD2, 0x33, 0x00, 0x00, 0x00, 0x45, 0x73, 0x74, 0x45, 0x49, 0x44, 0x20, 0x76, 0x33, 0x35}; -static unsigned char AzeDIT_v35_AID[] = {0xD0, 0x31, 0x00, 0x00, 0x00, 0x44, 0x69, 0x67, 0x69, 0x49, 0x44}; +static const unsigned char EstEID_v3_AID[] = {0xF0, 0x45, 0x73, 0x74, 0x45, 0x49, 0x44, 0x20, 0x76, 0x65, 0x72, 0x20, 0x31, 0x2E, 0x30}; +static const unsigned char EstEID_v35_AID[] = {0xD2, 0x33, 0x00, 0x00, 0x00, 0x45, 0x73, 0x74, 0x45, 0x49, 0x44, 0x20, 0x76, 0x33, 0x35}; +static const unsigned char AzeDIT_v35_AID[] = {0xD0, 0x31, 0x00, 0x00, 0x00, 0x44, 0x69, 0x67, 0x69, 0x49, 0x44}; static struct sc_card_operations mcrd_ops; static struct sc_card_driver mcrd_drv = { @@ -119,6 +119,24 @@ struct mcrd_priv_data { #define DRVDATA(card) ((struct mcrd_priv_data *) ((card)->drv_data)) +// Control Reference Template Tag for Key Agreement (ISO 7816-4:2013 Table 54) +static const struct sc_asn1_entry c_asn1_control[] = { + { "control", SC_ASN1_STRUCT, SC_ASN1_CONS | SC_ASN1_CTX | 0xA6, 0, NULL, NULL }, + { NULL, 0, 0, 0, NULL, NULL } +}; + +// Ephemeral public key Template Tag (ISO 7816-8:2016 Table 3) +static const struct sc_asn1_entry c_asn1_ephermal[] = { + { "ephemeral", SC_ASN1_STRUCT, SC_ASN1_CONS | SC_ASN1_APP | 0x7F49, 0, NULL, NULL }, + { NULL, 0, 0, 0, NULL, NULL } +}; + +// External Public Key +static const struct sc_asn1_entry c_asn1_public[] = { + { "publicKey", SC_ASN1_OCTET_STRING, SC_ASN1_CTX | 0x86, 0, NULL, NULL }, + { NULL, 0, 0, 0, NULL, NULL } +}; + static int load_special_files(sc_card_t * card); static int select_part(sc_card_t * card, u8 kind, unsigned short int fid, sc_file_t ** file); @@ -1208,6 +1226,7 @@ static int mcrd_set_security_env(sc_card_t * card, select_esteid_df(card); switch (env->operation) { case SC_SEC_OPERATION_DECIPHER: + case SC_SEC_OPERATION_DERIVE: sc_debug(card->ctx, SC_LOG_DEBUG_NORMAL, "Using keyref %d to dechiper\n", env->key_ref[0]); @@ -1351,11 +1370,14 @@ static int mcrd_compute_signature(sc_card_t * card, u8 * out, size_t outlen) { struct mcrd_priv_data *priv = DRVDATA(card); - sc_security_env_t *env = &priv->sec_env; + sc_security_env_t *env = NULL; int r; sc_apdu_t apdu; - assert(card != NULL && data != NULL && out != NULL); + if (card == NULL || data == NULL || out == NULL) + return SC_ERROR_INVALID_ARGUMENTS; + env = &priv->sec_env; + SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_NORMAL); if (env->operation != SC_SEC_OPERATION_SIGN) return SC_ERROR_INVALID_ARGUMENTS; @@ -1391,6 +1413,62 @@ static int mcrd_compute_signature(sc_card_t * card, SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, apdu.resplen); } +static int mcrd_decipher(struct sc_card *card, + const u8 * crgram, size_t crgram_len, + u8 * out, size_t outlen) +{ + sc_security_env_t *env = NULL; + int r = 0; + size_t sbuf_len = 0; + sc_apdu_t apdu; + u8 *sbuf = NULL; + struct sc_asn1_entry asn1_control[2], asn1_ephermal[2], asn1_public[2]; + + if (card == NULL || crgram == NULL || out == NULL) + return SC_ERROR_INVALID_ARGUMENTS; + env = &DRVDATA(card)->sec_env; + + LOG_FUNC_CALLED(card->ctx); + if (env->operation != SC_SEC_OPERATION_DERIVE) + SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, iso_ops->decipher(card, crgram, crgram_len, out, outlen)); + if (crgram_len > 255) + SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_ARGUMENTS); + + sc_debug(card->ctx, SC_LOG_DEBUG_NORMAL, + "Will dervie (%d) for %"SC_FORMAT_LEN_SIZE_T"u (0x%02"SC_FORMAT_LEN_SIZE_T"x) bytes using key %d algorithm %d flags %d\n", + env->operation, crgram_len, crgram_len, env->key_ref[0], + env->algorithm, env->algorithm_flags); + + // Encode TLV + sc_copy_asn1_entry(c_asn1_control, asn1_control); + sc_copy_asn1_entry(c_asn1_ephermal, asn1_ephermal); + sc_copy_asn1_entry(c_asn1_public, asn1_public); + sc_format_asn1_entry(asn1_public + 0, (void*)crgram, &crgram_len, 1); + sc_format_asn1_entry(asn1_ephermal + 0, &asn1_public, NULL, 1); + sc_format_asn1_entry(asn1_control + 0, &asn1_ephermal, NULL, 1); + r = sc_asn1_encode(card->ctx, asn1_control, &sbuf, &sbuf_len); + LOG_TEST_RET(card->ctx, r, "Error encoding TLV."); + + // Create APDU + sc_format_apdu(card, &apdu, SC_APDU_CASE_4, 0x2A, 0x80, 0x86); + apdu.lc = sbuf_len; + apdu.data = sbuf; + apdu.datalen = sbuf_len; + apdu.le = MIN(0x80u, outlen); + apdu.resp = out; + apdu.resplen = outlen; + + r = sc_transmit_apdu(card, &apdu); + sc_mem_clear(sbuf, sbuf_len); + free(sbuf); + LOG_TEST_RET(card->ctx, r, "APDU transmit failed"); + + r = sc_check_sw(card, apdu.sw1, apdu.sw2); + LOG_TEST_RET(card->ctx, r, "Card returned error"); + + SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, apdu.resplen); +} + /* added by -mp, to give pin information in the card driver (pkcs15emu->driver needed) */ static int mcrd_pin_cmd(sc_card_t * card, struct sc_pin_cmd_data *data, int *tries_left) @@ -1454,6 +1532,7 @@ static struct sc_card_driver *sc_get_driver(void) mcrd_ops.select_file = mcrd_select_file; mcrd_ops.set_security_env = mcrd_set_security_env; mcrd_ops.compute_signature = mcrd_compute_signature; + mcrd_ops.decipher = mcrd_decipher; mcrd_ops.pin_cmd = mcrd_pin_cmd; return &mcrd_drv; diff --git a/src/libopensc/pkcs15-esteid.c b/src/libopensc/pkcs15-esteid.c index a5f9af8b2..b3cf5178f 100644 --- a/src/libopensc/pkcs15-esteid.c +++ b/src/libopensc/pkcs15-esteid.c @@ -219,8 +219,8 @@ sc_pkcs15emu_esteid_init (sc_pkcs15_card_t * p15card) prkey_info.modulus_length = modulus_length; if (i == 1) prkey_info.usage = SC_PKCS15_PRKEY_USAGE_NONREPUDIATION; - else if(field_length > 0) // ECC has only sign usage - prkey_info.usage = SC_PKCS15_PRKEY_USAGE_SIGN; + else if(field_length > 0) // ECC has sign and derive usage + prkey_info.usage = SC_PKCS15_PRKEY_USAGE_SIGN | SC_PKCS15_PRKEY_USAGE_DERIVE; else prkey_info.usage = SC_PKCS15_PRKEY_USAGE_SIGN | SC_PKCS15_PRKEY_USAGE_ENCRYPT | SC_PKCS15_PRKEY_USAGE_DECRYPT; From 3b33bf0e11253302ae48c2a3027b114162b92472 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Thu, 9 Nov 2017 14:42:30 +0200 Subject: [PATCH 4/5] Cleanup expired EstEID card ATR-s Signed-off-by: Raul Metsma --- etc/opensc.conf.in | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-) diff --git a/etc/opensc.conf.in b/etc/opensc.conf.in index 63abba9bf..2bbbe624c 100644 --- a/etc/opensc.conf.in +++ b/etc/opensc.conf.in @@ -309,33 +309,11 @@ app default { # driver = "piv"; # } - # Estonian ID card and Micardo driver sometimes only play together with T=0 + # Micardo driver sometimes only play together with T=0 # In theory only the 'cold' ATR should be specified, as T=0 will # be the preferred protocol once you boot it up with T=0, but be # paranoid. # - # Warm ATR v1 - card_atr 3b:6e:00:ff:45:73:74:45:49:44:20:76:65:72:20:31:2e:30 { - force_protocol = t0; - } - # Cold ATR v1 - card_atr 3b:fe:94:00:ff:80:b1:fa:45:1f:03:45:73:74:45:49:44:20:76:65:72:20:31:2e:30:43 { - force_protocol = t0; - } - # Warm ATR v2 - card_atr 3b:5e:11:ff:45:73:74:45:49:44:20:76:65:72:20:31:2e:30 { - force_protocol = t0; - } - # Cold ATR v2 - card_atr 3b:de:18:ff:c0:80:b1:fe:45:1f:03:45:73:74:45:49:44:20:76:65:72:20:31:2e:30:2b { - force_protocol = t0; - } - # Digi-ID cold ATR. The same card has the same warm ATR as "Cold ATR v1" above - # The card is claimed to only support T=0 but in fact (sometimes) works with T=1, even if not advertised in ATR. - card_atr 3b:6e:00:00:45:73:74:45:49:44:20:76:65:72:20:31:2e:30 { - force_protocol = t0; - } - # D-Trust cards are also based on micardo and need T=0 for some reason card_atr 3b:ff:94:00:ff:80:b1:fe:45:1f:03:00:68:d2:76:00:00:28:ff:05:1e:31:80:00:90:00:23 { force_protocol = t0; From 1c28c1b56a28c38d24714f1377eebe87a0371421 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Fri, 17 Nov 2017 11:46:34 +0200 Subject: [PATCH 5/5] Fix reading EstEID certificates with T=0 (#1193) --- src/libopensc/card-mcrd.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/src/libopensc/card-mcrd.c b/src/libopensc/card-mcrd.c index 085d02965..525717ce9 100644 --- a/src/libopensc/card-mcrd.c +++ b/src/libopensc/card-mcrd.c @@ -365,15 +365,20 @@ static int mcrd_init(sc_card_t * card) if(apdu.sw1 != 0x90 && apdu.sw2 != 0x00) { sc_format_apdu(card, &apdu, SC_APDU_CASE_3, 0xA4, 0x04, 0x00); - apdu.lc = sizeof(EstEID_v35_AID); - apdu.data = EstEID_v35_AID; - apdu.datalen = sizeof(EstEID_v35_AID); - apdu.resplen = 0; - apdu.le = 0; + apdu.lc = sizeof(EstEID_v35_AID); + apdu.data = EstEID_v35_AID; + apdu.datalen = sizeof(EstEID_v35_AID); + apdu.resplen = 0; + apdu.le = 0; r = sc_transmit_apdu(card, &apdu); - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "APDU transmit failed"); - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "SELECT AID: %02X%02X", apdu.sw1, apdu.sw2); - if (apdu.sw1 != 0x90 && apdu.sw2 != 0x00) { + SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "APDU transmit failed"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "SELECT AID: %02X%02X", apdu.sw1, apdu.sw2); + if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) { + // Force EstEID 3.5 card recv size 255 with T=0 to avoid recursive read binary + // sc_read_binary cannot handle recursive 61 00 calls + if (card->reader && card->reader->active_protocol == SC_PROTO_T0) + card->max_recv_size = 255; + } else { sc_format_apdu(card, &apdu, SC_APDU_CASE_3, 0xA4, 0x04, 0x00); apdu.lc = sizeof(AzeDIT_v35_AID); apdu.data = AzeDIT_v35_AID;