Protocol Steps for Terminal Authentication

Functions
void	TA_disable_checks (EAC_CTX *ctx)
	Enables TA_FLAG_SKIP_TIMECHECK in the TA context. More...
int	TA_STEP2_import_certificate (const EAC_CTX *ctx, const unsigned char *cert, size_t cert_len)
	Imports a CV Certificate to the EAC context. More...
BUF_MEM *	TA_STEP3_generate_ephemeral_key (const EAC_CTX *ctx)
	Generates ephemeral key for CA. More...
BUF_MEM *	TA_STEP4_get_nonce (const EAC_CTX *ctx)
	Generates a nonce for the PCD. More...
int	TA_STEP4_set_nonce (const EAC_CTX *ctx, const BUF_MEM *nonce)
	Import the nonce from the PICC. More...
BUF_MEM *	TA_STEP5_sign (const EAC_CTX *ctx, const BUF_MEM *my_ta_eph_pubkey, const BUF_MEM *opp_pace_eph_pubkey, const BUF_MEM *auxdata)
	Signs data for terminal authentication. More...
int	TA_STEP6_verify (const EAC_CTX *ctx, const BUF_MEM *opp_ta_comp_eph_pubkey, const BUF_MEM *my_pace_comp_eph_pubkey, const BUF_MEM *auxdata, const BUF_MEM *signature)
	Verifies PCD's signature from TA step 5. More...

Detailed Description

Function Documentation

TA_disable_checks()

void TA_disable_checks

(

EAC_CTX *

ctx

)

Enables TA_FLAG_SKIP_TIMECHECK in the TA context.

Parameters

[in]

ctx

EAC context for which to disable TA checks

TA_STEP2_import_certificate()

int TA_STEP2_import_certificate	(	const EAC_CTX *	ctx,
		const unsigned char *	cert,
		size_t	cert_len
	)

Imports a CV Certificate to the EAC context.

This function should be used to subsequently verify all certificates of a certificate chain. The signature and date of the certificate are verified using the trust anchor or the most recently imported certificate. The TA context is adjusted to use domain parameters of the imported certificate. If the chain contains a new trust anchor (i.e. a CVCA certificate), the old trust anchor is replaced when EAC is completed.

Parameters

[in,out]	ctx	EAC context
[in]	cert	raw Certificate to import
[in]	cert_len	Length of cert

Returns

1 on success or 0 in case of an error

See also

TA's Protocol Specification

TA_STEP3_generate_ephemeral_key()

BUF_MEM* TA_STEP3_generate_ephemeral_key

(

const EAC_CTX *

ctx

)

Generates ephemeral key for CA.

Parameters

[in,out]

ctx

EAC context. The CA context of ctx is initialized for key agreement

Returns

Ephemeral public key or NULL in case of an error

See also

TA's Protocol Specification

TA_STEP4_get_nonce()

BUF_MEM* TA_STEP4_get_nonce

(

const EAC_CTX *

ctx

)

Generates a nonce for the PCD.

Parameters

[in,out]

ctx

EAC context. The nonce is saved in ctx

Returns

Nonce or NULL in case of an error

Note

EAC_CTX_init_ca must have been called before the nonce can be generated

See also

TA's Protocol Specification

TA_STEP4_set_nonce()

int TA_STEP4_set_nonce	(	const EAC_CTX *	ctx,
		const BUF_MEM *	nonce
	)

Import the nonce from the PICC.

Parameters

[in,out]	ctx	EAC context. The nonce is saved in ctx
	nonce	The nonce to be copied

Returns

1 on success or 0 in case of an error

See also

TA's Protocol Specification

TA_STEP5_sign()

BUF_MEM* TA_STEP5_sign	(	const EAC_CTX *	ctx,
		const BUF_MEM *	my_ta_eph_pubkey,
		const BUF_MEM *	opp_pace_eph_pubkey,
		const BUF_MEM *	auxdata
	)

Signs data for terminal authentication.

Parameters

[in]	ctx	EAC context
[in]	my_ta_eph_pubkey	PCD's ephemeral public key generated in Step 3
[in]	opp_pace_eph_pubkey	PICC's ephemeral public key generated in PACE Step 3b
[in]	auxdata	(optional) Auxiliary data from PCD

Returns

Signature or NULL in case of an error

See also

TA's Protocol Specification

TA_STEP6_verify()

int TA_STEP6_verify	(	const EAC_CTX *	ctx,
		const BUF_MEM *	opp_ta_comp_eph_pubkey,
		const BUF_MEM *	my_pace_comp_eph_pubkey,
		const BUF_MEM *	auxdata,
		const BUF_MEM *	signature
	)

Verifies PCD's signature from TA step 5.

Parameters

[in]	ctx	EAC context
[in]	opp_ta_comp_eph_pubkey	PCD's compressed ephemeral public key generated in Step 3
[in]	my_pace_comp_eph_pubkey	PICC's compressed ephemeral public key generated in PACE Step 3b
[in]	auxdata	(optional) Auxiliary data from PCD
[in]	signature	Data to verify

Returns

1 if the signature has been verified, 0 if not or -1 in case of an error

See also

TA's Protocol Specification