pace.h File Reference

Interface for Password Authenticated Connection Establishment. More...

#include "eac.h"
#include <openssl/bn.h>
#include <openssl/buffer.h>

Go to the source code of this file.

Data Structures
struct	pace_sec
	Shared secret for PACE. More...

Typedefs
typedef struct pace_sec	PACE_SEC
	Shared secret for PACE.

Enumerations
enum	s_type {   PACE_MRZ = 1, PACE_CAN, PACE_PIN, PACE_PUK,   PACE_RAW, PACE_SEC_UNDEF }
	Type of the secret. More...

Functions
void	PACE_SEC_clear_free (PACE_SEC *s)
	Free a PACE secret. More...
PACE_SEC *	PACE_SEC_new (const char *sec, size_t sec_len, enum s_type type)
	Create and initialize a new PACE secret. More...
int	PACE_SEC_print_private (BIO *out, const PACE_SEC *sec, int indent)
	Print PACE_SEC object including private secret. More...
BUF_MEM *	PACE_STEP1_enc_nonce (const EAC_CTX *ctx, const PACE_SEC *pi)
	Generates and encrypts a nonce. More...
int	PACE_STEP2_dec_nonce (const EAC_CTX *ctx, const PACE_SEC *pi, const BUF_MEM *enc_nonce)
	Decrypt the nonce from the other party. More...
BUF_MEM *	PACE_STEP3A_generate_mapping_data (const EAC_CTX *ctx)
	Generate a mapping data to perform the mapping to ephemeral domain parameters. More...
int	PACE_STEP3A_map_generator (const EAC_CTX *ctx, const BUF_MEM *in)
	Map to the ephemeral domain parameters. More...
BUF_MEM *	PACE_STEP3B_generate_ephemeral_key (EAC_CTX *ctx)
	Generate a keypair for key agreement. More...
int	PACE_STEP3B_compute_shared_secret (const EAC_CTX *ctx, const BUF_MEM *in)
	Compute the shared secret for key agreement. More...
int	PACE_STEP3C_derive_keys (const EAC_CTX *ctx)
	Derives encryption and authentication keys. More...
BUF_MEM *	PACE_STEP3D_compute_authentication_token (const EAC_CTX *ctx, const BUF_MEM *pub)
	Compute the authentication token from domain parameters and public key. More...
int	PACE_STEP3D_verify_authentication_token (const EAC_CTX *ctx, const BUF_MEM *token)
	Verifies an authentication token. More...

Detailed Description

Interface for Password Authenticated Connection Establishment.

PACE is a protocol used to establish strong session keys based on a weak shared secret (password). The result of a PACE run are two symmetric keys, one for MAC computation and one for encryption. It was specified for Extended Access Control (EAC) in Machine Readable Travel Documents (MRTD), but can also be used for securing any other communication channel. PACE can be used with different suites of algorithms and is not subject to any patents.

Author

Frank Morgner frank.nosp@m.morg.nosp@m.ner@g.nosp@m.mail.nosp@m..com

Dominik Oepen oepen.nosp@m.@inf.nosp@m.ormat.nosp@m.ik.h.nosp@m.u-ber.nosp@m.lin..nosp@m.de

Definition in file pace.h.

Enumeration Type Documentation

s_type

enum s_type

Type of the secret.

Enumerator
PACE_MRZ	MRZ is the Machine Readable Zone, printed on the card, encoding the personal information of the user.
PACE_CAN	CAN is the Card access number printed on the card.
PACE_PIN	PIN is the Personal Identification Number, a secret known only to the user and not printed on the card.
PACE_PUK	PUK is the Personal Unblocking key. This type of secret is used when the card is suspended due to too many incorrect PACE runs.
PACE_RAW	This type of secret is not defined in BSI TR-03110. We use it as a generic type, so we can use PACE independent from a ID card.
PACE_SEC_UNDEF	Undefined type, if nothing else matches.

Definition at line 67 of file pace.h.