OpenPACE: Protocol Steps for Terminal Authentication

OpenPACE

Functions
Protocol Steps for Terminal Authentication
Protocol Steps for Extended Access Control

## Functions
void | TA_disable_checks (EAC_CTX *ctx)
| Enables `TA_FLAG_SKIP_TIMECHECK` in the TA context. More...
int | TA_STEP2_import_certificate (const EAC_CTX *ctx, const unsigned char *cert, size_t cert_len)
| Imports a CV Certificate to the EAC context. More...
BUF_MEM * | TA_STEP3_generate_ephemeral_key (const EAC_CTX *ctx)
| Generates ephemeral key for CA. More...
BUF_MEM * | TA_STEP4_get_nonce (const EAC_CTX *ctx)
| Generates a nonce for the PCD. More...
int | TA_STEP4_set_nonce (const EAC_CTX *ctx, const BUF_MEM *nonce)
| Import the nonce from the PICC. More...
BUF_MEM * | TA_STEP5_sign (const EAC_CTX *ctx, const BUF_MEM *my_ta_eph_pubkey, const BUF_MEM *opp_pace_eph_pubkey, const BUF_MEM *auxdata)
| Signs data for terminal authentication. More...
int | TA_STEP6_verify (const EAC_CTX *ctx, const BUF_MEM *opp_ta_comp_eph_pubkey, const BUF_MEM *my_pace_comp_eph_pubkey, const BUF_MEM *auxdata, const BUF_MEM *signature)
| Verifies PCD's signature from TA step 5. More...

## Detailed Description

## Function Documentation

## ◆ TA_disable_checks()

void TA_disable_checks | ( | EAC_CTX * | ctx | ) |

Enables `TA_FLAG_SKIP_TIMECHECK` in the TA context.

Parameters

  [in] | ctx | EAC context for which to disable TA checks

## ◆ TA_STEP2_import_certificate()

int TA_STEP2_import_certificate | ( | const EAC_CTX * | ctx,
|  | const unsigned char * | cert,
|  | size_t | cert_len
| ) |  |

Imports a CV Certificate to the EAC context.

This function should be used to subsequently verify all certificates of a certificate chain. The signature and date of the certificate are verified using the trust anchor or the most recently imported certificate. The TA context is adjusted to use domain parameters of the imported certificate. If the chain contains a new trust anchor (i.e. a CVCA certificate), the old trust anchor is replaced when EAC is completed.

Parameters

  [in,out] | ctx | EAC context
  [in] | cert | raw Certificate to import
  [in] | cert_len | Length of cert

Returns
  1 on success or 0 in case of an error

See also
  TA's Protocol Specification

## ◆ TA_STEP3_generate_ephemeral_key()

BUF_MEM* TA_STEP3_generate_ephemeral_key | ( | const EAC_CTX * | ctx | ) |

Generates ephemeral key for CA.

Parameters

  [in,out] | ctx | EAC context. The CA context of ctx is initialized for key agreement

Returns
  Ephemeral public key or NULL in case of an error

See also
  TA's Protocol Specification

## ◆ TA_STEP4_get_nonce()

BUF_MEM* TA_STEP4_get_nonce | ( | const EAC_CTX * | ctx | ) |

Generates a nonce for the PCD.

Parameters

  [in,out] | ctx | EAC context. The nonce is saved in ctx

Returns
  Nonce or NULL in case of an error

Note
  EAC_CTX_init_ca must have been called before the nonce can be generated

See also
  TA's Protocol Specification

## ◆ TA_STEP4_set_nonce()

int TA_STEP4_set_nonce | ( | const EAC_CTX * | ctx,
|  | const BUF_MEM * | nonce
| ) |  |

Import the nonce from the PICC.

Parameters

  [in,out] | ctx | EAC context. The nonce is saved in ctx
  | nonce | The nonce to be copied

Returns
  1 on success or 0 in case of an error

See also
  TA's Protocol Specification

## ◆ TA_STEP5_sign()

BUF_MEM* TA_STEP5_sign | ( | const EAC_CTX * | ctx,
|  | const BUF_MEM * | my_ta_eph_pubkey,
|  | const BUF_MEM * | opp_pace_eph_pubkey,
|  | const BUF_MEM * | auxdata
| ) |  |

Signs data for terminal authentication.

Parameters

  [in] | ctx | EAC context
  [in] | my_ta_eph_pubkey | PCD's ephemeral public key generated in Step 3
  [in] | opp_pace_eph_pubkey | PICC's ephemeral public key generated in PACE Step 3b
  [in] | auxdata | (optional) Auxiliary data from PCD

Returns
  Signature or NULL in case of an error

See also
  TA's Protocol Specification

## ◆ TA_STEP6_verify()

int TA_STEP6_verify | ( | const EAC_CTX * | ctx,
|  | const BUF_MEM * | opp_ta_comp_eph_pubkey,
|  | const BUF_MEM * | my_pace_comp_eph_pubkey,
|  | const BUF_MEM * | auxdata,
|  | const BUF_MEM * | signature
| ) |  |

Verifies PCD's signature from TA step 5.

Parameters

  [in] | ctx | EAC context
  [in] | opp_ta_comp_eph_pubkey | PCD's compressed ephemeral public key generated in Step 3
  [in] | my_pace_comp_eph_pubkey | PICC's compressed ephemeral public key generated in PACE Step 3b
  [in] | auxdata | (optional) Auxiliary data from PCD
  [in] | signature | Data to verify

Returns
  1 if the signature has been verified, 0 if not or -1 in case of an error

See also
  TA's Protocol Specification