#AUTHENTICATE instruction

The AUTHENTICATE instruction is used to establish a secure communication channel over the current communication link.

#INS value

INS = 0A

#Cookbook

In the following paragraphs,

• E_ECB (K, x) is the AES128-ECB Encrypt (one-block encipher) function, using key K over plain block x,
• E^-1_ECB (K, y) is the AES128-ECB Decrypt (one-block decipher) function, using key K over ciphered block y,
• E_CBC (K, x, iv) is the AES128-CBC Encrypt (cipher block chaining mode, encipher) function, using key K and initialization vector iv over plain message x,
• E^-1_CBC (K, y, iv) is the AES128-CBC Decrypt (cipher block chaining mode, decipher) function, using key K and initialization vector iv over ciphered message y.

#Host –> Device AUTHENTICATE command

#Device –> Host - Authentication Step 1

The device

1. Generates a 16-byte nonce RndB,
2. Sends E ( K, RndB ) where K_AUTH is the authentication key selected by the host, as it is known by the device (HostCommUserKey or HostCommAdminKey).

#Host –> Device - Authentication Step 2

The host

1. Generates a 16-byte nonce RndA,
2. Retrieves RndB by deciphering the response,
3. Computes RndB’ = RndB << 8 (rotate one byte to the left, with carry),
4. Sends E_ECB ( K_AUTH , RndA ) || E_ECB ( K_AUTH , RndB’ ) where K_AUTH is the authentication key as it is known by the host.

The device deciphers the host cryptogram. If the decrypted RndB’ matches with RndB, the device knows that it can trust the host.

#Device –> Host - Authentication Step 3

The device

1. Retrieves RndA from the command,
2. Computes RndA’ = RndA << 8 (rotate one byte to the left, with carry),
3. Sends E_ECB ( K_AUTH , RndA’ ).

The host deciphers the device cryptogram. If the decrypted RndA’ matches with RndA, the host knows that it can trust the device.

From now on, secure communication shall be used.

#Session keys and first init vector

Both the host and the device generate the same session keys as follow:

1. Assemble SV1 = RndA[0..3] || RndB[0..3] || RndA[8..11] || RndB[8..11]
2. Assemble SV2 = RndA[4..7] || RndB[4..7] || RndA[12..15] || RndB[12..15]
3. Compute the session encryption key K_ENC = E_ECB ( K_AUTH , SV1 ),
4. Compute the session authentication key K_MAC = E_ECB ( K_AUTH , SV2 ).
5. Assemble SV_MAC = RndA XOR RndB
6. Compute the first initialization vector IV₀ = E_ECB ( K_MAC , SV_MAC )

#Following init vectors, ciphering and CMACing

See the Secure Communication paragraph.