PMA8N9P-BC
54 / 58
PROX'N'ROLL RFID SCANNER - Reference manual
SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.
All other brand names, product names, or trademarks belong to their respective holders.
Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
8. S
ECURITY ALGORITHMS
8.1. HMAC
SIGNATURE AND KEY DIVERSIFICATION
8.1.1. Abstracts
A message authentication code, or MAC, is a short piece of information used to
authenticate a message. A MAC algorithm accepts as input a secret key and a
message, and outputs a MAC that protects both message’s integrity and
authenticity.
An HMAC (or keyed-hash message authentication code) is a type of MAC function
were a cryptographic hash function is used to compute the output.
a. HMAC algorithm
Where
h
is the hash function,
K
is the secret key padded with extra zeros up to
64 bytes,
m
is the message to be authenticated.
opad
is the value
h
5C repeated
64 times, and ipad the value
h
36 repeated 64 times.
b. HMAC-MD5
HMAC-MD5 is a particular HMAC function where
h
is the MD5 standard function,
as defined by RSA laboratories. Size of HMAC is 16 bytes exactly.
In the
SpringCard RFID Scanners
family, we use HMAC-MD5 for both
signature and key diversification.
8.1.2. HMAC-MD5 for digital signature
HMAC protects both message’s integrity and authenticity, so it can be considered
as a digital signature
32
.
IWM implementation allows only 16-byte keys. The key can be used “as is” or be
the result of a diversification from a master key.
8.1.3. HMAC-MD5 for key diversification
In this particular mode, we name
K
the “master key” and we compute the HMAC
over card’s identifier to establish a “diversified key”
Ku
.
32
Literature often reserve the name “digital signature” to public key schemes, where verifier doesn’t
need to know signer’s private key to verify the signature. HMAC is a scheme where signer and
verifier must share the same secret key.
