OpenPACE: Protocol Steps for Chip Authentication

OpenPACE

Functions
Protocol Steps for Chip Authentication
Protocol Steps for Extended Access Control

## Functions
BUF_MEM * | CA_STEP1_get_pubkey (const EAC_CTX *ctx)
| Get the PICC's encoded public key. More...
BUF_MEM * | CA_STEP2_get_eph_pubkey (const EAC_CTX *ctx)
| Get the PCD's ephemeral public key (generated in TA step 3) More...
int | CA_STEP3_check_pcd_pubkey (const EAC_CTX *ctx, const BUF_MEM *comp_pubkey, const BUF_MEM *pubkey)
| Check whether the public key matches the compressed public key previously received in TA. More...
int | CA_STEP4_compute_shared_secret (const EAC_CTX *ctx, const BUF_MEM *pubkey)
| Compute the shared secret using the PICC's static key pair and the PCD's ephemeral key pair. More...
int | CA_STEP5_derive_keys (const EAC_CTX *ctx, const BUF_MEM *pub, BUF_MEM **nonce, BUF_MEM **token)
| Derives the PICC's encryption and authentication keys. More...
int | CA_STEP6_derive_keys (EAC_CTX *ctx, const BUF_MEM *nonce, const BUF_MEM *token)
| Derives the PCD's encryption and authentication keys. More...

## Detailed Description

## Function Documentation

## ◆ CA_STEP1_get_pubkey()

BUF_MEM* CA_STEP1_get_pubkey | ( | const EAC_CTX * | ctx | ) |

Get the PICC's encoded public key.

Parameters

  [in] | ctx | EAC context

Returns
  Encoded public key or NULL in case of an error

See also
  CA's Protocol Specification

## ◆ CA_STEP2_get_eph_pubkey()

BUF_MEM* CA_STEP2_get_eph_pubkey | ( | const EAC_CTX * | ctx | ) |

Get the PCD's ephemeral public key (generated in TA step 3)

Parameters

  [in] | ctx | EAC context

Returns
  Public key or NULL in case of an error

See also
  CA's Protocol Specification

## ◆ CA_STEP3_check_pcd_pubkey()

int CA_STEP3_check_pcd_pubkey | ( | const EAC_CTX * | ctx,
|  | const BUF_MEM * | comp_pubkey,
|  | const BUF_MEM * | pubkey
| ) |  |

Check whether the public key matches the compressed public key previously received in TA.

Parameters

  [in] | ctx | EAC context
  [in] | comp_pubkey | Compressed public key (received in TA step 3)
  [in] | pubkey | Uncompressed public key (received in CA step 2)

Returns
  1 if the keys match, 0 if they don't or -1 in case of an error

See also
  CA's Protocol Specification

## ◆ CA_STEP4_compute_shared_secret()

int CA_STEP4_compute_shared_secret | ( | const EAC_CTX * | ctx,
|  | const BUF_MEM * | pubkey
| ) |  |

Compute the shared secret using the PICC's static key pair and the PCD's ephemeral key pair.

Parameters

  [in,out] | ctx | EAC context. The secret is saved in ctx.
  [in] | pubkey | Public key from the other party

Returns
  1 on success or 0 in case of an error

See also
  `CA_get_pubkey()` extracts the PICC's public key from an `EF.CardSecurity`
  CA's Protocol Specification

## ◆ CA_STEP5_derive_keys()

int CA_STEP5_derive_keys | ( | const EAC_CTX * | ctx,
|  | const BUF_MEM * | pub,
|  | BUF_MEM ** | nonce,
|  | BUF_MEM ** | token
| ) |  |

Derives the PICC's encryption and authentication keys.

Parameters

  [in,out] | ctx | EAC context. The keys are saved in ctx.
  [in] | pub | PCD's ephemeral public key
  [out] | nonce | Generated nonce
  [out] | token | Authentication token

Returns
  1 on success or 0 in case of an error

See also
  CA's Protocol Specification

## ◆ CA_STEP6_derive_keys()

int CA_STEP6_derive_keys | ( | EAC_CTX * | ctx,
|  | const BUF_MEM * | nonce,
|  | const BUF_MEM * | token
| ) |  |

Derives the PCD's encryption and authentication keys.

Parameters

  [in,out] | ctx | EAC context. The keys are saved in ctx.
  [in] | nonce | PICC's generated nonce
  [in] | token | PICC's authentication token to verify

Returns
  1 on success or 0 in case of an error

See also
  CA's Protocol Specification