Classes
struct	Cmac
	Streaming AES-128-CMAC (RFC 4493) — no concatenated MAC buffer. More...

class	ScopedWipe
	Wipes a buffer with SecureZero when the scope ends, on every return path. More...

Functions
void	SecureZero (void *p, std::size_t len) noexcept
	Overwrite `len` bytes at `p` with zeros in a way the compiler cannot drop.

bool	ConstantTimeEqual (const std::uint8_t a, const std::uint8_t b, std::size_t len) noexcept
	Compare two byte strings in time that depends only on `len`, not on where they differ.

void	AddRoundKey (std::uint8_t s[16], const std::uint8_t *rk)

void	SubBytes (std::uint8_t s[16])

void	InvSubBytes (std::uint8_t s[16])

void	ShiftRows (std::uint8_t s[16])

void	InvShiftRows (std::uint8_t s[16])

std::uint8_t	Xtime (std::uint8_t x)

std::uint8_t	Gmul (std::uint8_t a, std::uint8_t b)

void	MixColumns (std::uint8_t s[16])

void	InvMixColumns (std::uint8_t s[16])

void	ExpandKey (const std::uint8_t key[16], std::uint8_t rk[176])

void	Aes128EncryptBlock (const std::uint8_t key[kAes128KeyLen], const std::uint8_t in[16], std::uint8_t out[16])

void	Aes128DecryptBlock (const std::uint8_t key[kAes128KeyLen], const std::uint8_t in[16], std::uint8_t out[16])

void	XorBlock (std::uint8_t a, const std::uint8_t b)

void	LeftShift1 (std::uint8_t in[16])

void	GenerateSubkeys (const std::uint8_t key[16], std::uint8_t k1[16], std::uint8_t k2[16])

void	Aes128Cmac (const std::uint8_t key[kAes128KeyLen], const std::uint8_t *msg, std::size_t msg_len, std::uint8_t out[kCmacLen])

bool	FillDerivationData (std::uint8_t constant, std::uint16_t bit_len, std::uint8_t counter, const std::uint8_t context, std::uint16_t context_len, std::uint8_t out, std::size_t out_cap, std::size_t *out_len)
	GP Amendment D derivation input (label \|\| 00 \|\| L \|\| i \|\| context).

bool	DeriveSessionKey (const std::uint8_t static_key[kAes128KeyLen], std::uint8_t constant, const std::uint8_t host_challenge[kChallengeLen], const std::uint8_t card_challenge[kChallengeLen], std::uint8_t out_key[kAes128KeyLen])

bool	ComputeCryptogram (const std::uint8_t session_mac_key[kAes128KeyLen], std::uint8_t constant, const std::uint8_t host_challenge[kChallengeLen], const std::uint8_t card_challenge[kChallengeLen], std::uint8_t out8[kCryptogramLen])

bool	Aes128CbcEncrypt (const std::uint8_t key[kAes128KeyLen], const std::uint8_t iv[16], const std::uint8_t src, std::uint8_t dst, std::size_t len)

bool	Aes128CbcDecrypt (const std::uint8_t key[kAes128KeyLen], const std::uint8_t iv[16], const std::uint8_t src, std::uint8_t dst, std::size_t len)

bool	IsoPad80 (std::uint8_t buf, std::size_t len, std::size_t cap)

bool	StaticKeysUsable (const std::uint8_t enc, std::size_t enc_len, const std::uint8_t mac, std::size_t mac_len)

void	CmacStart (Cmac &c, const std::uint8_t key[kAes128KeyLen])

void	CmacUpdate (Cmac &c, const std::uint8_t *data, std::size_t len)

void	CmacFinish (Cmac &c, std::uint8_t out[kCmacLen])

void	CommandIcv (const std::uint8_t senc[kAes128KeyLen], const std::uint8_t counter[16], std::uint8_t icv[16])
	Command ICV = AES-ECB(SENC, counter). CBC with IV=0 of one block.

void	ResponseIcv (const std::uint8_t senc[kAes128KeyLen], const std::uint8_t counter[16], std::uint8_t icv[16])
	Response ICV: counter with MSB 0x80, then AES-ECB(SENC, ·).

void	IncCommandCounter (std::uint8_t counter[16])

bool	IsoUnpad80 (const std::uint8_t padded, std::size_t padded_len, std::size_t plain_len)

Variables
constexpr std::size_t	kAes128KeyLen = 16U

constexpr std::size_t	kCmacLen = 16U

constexpr std::size_t	kChallengeLen = 8U

constexpr std::size_t	kCryptogramLen = 8U

constexpr std::size_t	kLabelLen = 12U

constexpr std::uint8_t	kDeriveCardCryptogram = 0x00U

constexpr std::uint8_t	kDeriveHostCryptogram = 0x01U

constexpr std::uint8_t	kDeriveSenc = 0x04U

constexpr std::uint8_t	kDeriveSmac = 0x06U

constexpr std::uint8_t	kDeriveSrmac = 0x07U

constexpr std::uint8_t	kKdfCounter = 0x01U

constexpr std::uint16_t	kLen128Bit = 0x0080U

constexpr std::uint16_t	kLen64Bit = 0x0040U

constexpr std::uint8_t	kSbox [256]

constexpr std::uint8_t	kInvSbox [256]

constexpr std::uint8_t	kRcon [10]

Function Documentation

◆ AddRoundKey()

void se050::scp03::crypto::AddRoundKey	(	std::uint8_t	s[16],
		const std::uint8_t *	rk
	)

inline

◆ Aes128CbcDecrypt()

bool se050::scp03::crypto::Aes128CbcDecrypt	(	const std::uint8_t	key[kAes128KeyLen],
		const std::uint8_t	iv[16],
		const std::uint8_t *	src,
		std::uint8_t *	dst,
		std::size_t	len
	)

inline

◆ Aes128CbcEncrypt()

bool se050::scp03::crypto::Aes128CbcEncrypt	(	const std::uint8_t	key[kAes128KeyLen],
		const std::uint8_t	iv[16],
		const std::uint8_t *	src,
		std::uint8_t *	dst,
		std::size_t	len
	)

inline

◆ Aes128Cmac()

void se050::scp03::crypto::Aes128Cmac	(	const std::uint8_t	key[kAes128KeyLen],
		const std::uint8_t *	msg,
		std::size_t	msg_len,
		std::uint8_t	out[kCmacLen]
	)

inline

◆ Aes128DecryptBlock()

void se050::scp03::crypto::Aes128DecryptBlock	(	const std::uint8_t	key[kAes128KeyLen],
		const std::uint8_t	in[16],
		std::uint8_t	out[16]
	)

inline

◆ Aes128EncryptBlock()

void se050::scp03::crypto::Aes128EncryptBlock	(	const std::uint8_t	key[kAes128KeyLen],
		const std::uint8_t	in[16],
		std::uint8_t	out[16]
	)

inline

◆ CmacFinish()

void se050::scp03::crypto::CmacFinish	(	Cmac &	c,
		std::uint8_t	out[kCmacLen]
	)

inline

◆ CmacStart()

void se050::scp03::crypto::CmacStart	(	Cmac &	c,
		const std::uint8_t	key[kAes128KeyLen]
	)

inline

◆ CmacUpdate()

void se050::scp03::crypto::CmacUpdate	(	Cmac &	c,
		const std::uint8_t *	data,
		std::size_t	len
	)

inline

◆ CommandIcv()

void se050::scp03::crypto::CommandIcv	(	const std::uint8_t	senc[kAes128KeyLen],
		const std::uint8_t	counter[16],
		std::uint8_t	icv[16]
	)

inline

Command ICV = AES-ECB(SENC, counter). CBC with IV=0 of one block.

◆ ComputeCryptogram()

bool se050::scp03::crypto::ComputeCryptogram	(	const std::uint8_t	session_mac_key[kAes128KeyLen],
		std::uint8_t	constant,
		const std::uint8_t	host_challenge[kChallengeLen],
		const std::uint8_t	card_challenge[kChallengeLen],
		std::uint8_t	out8[kCryptogramLen]
	)

inline

◆ ConstantTimeEqual()

bool se050::scp03::crypto::ConstantTimeEqual	(	const std::uint8_t *	a,
		const std::uint8_t *	b,
		std::size_t	len
	)

inlinenoexcept

Compare two byte strings in time that depends only on len, not on where they differ.

Use for MACs and cryptograms: memcmp returns at the first differing byte, which lets an attacker who can time the answer forge a MAC byte by byte.

◆ DeriveSessionKey()

bool se050::scp03::crypto::DeriveSessionKey	(	const std::uint8_t	static_key[kAes128KeyLen],
		std::uint8_t	constant,
		const std::uint8_t	host_challenge[kChallengeLen],
		const std::uint8_t	card_challenge[kChallengeLen],
		std::uint8_t	out_key[kAes128KeyLen]
	)

inline

◆ ExpandKey()

void se050::scp03::crypto::ExpandKey	(	const std::uint8_t	key[16],
		std::uint8_t	rk[176]
	)

inline

◆ FillDerivationData()

bool se050::scp03::crypto::FillDerivationData	(	std::uint8_t	constant,
		std::uint16_t	bit_len,
		std::uint8_t	counter,
		const std::uint8_t *	context,
		std::uint16_t	context_len,
		std::uint8_t *	out,
		std::size_t	out_cap,
		std::size_t *	out_len
	)

inline

GP Amendment D derivation input (label || 00 || L || i || context).

◆ GenerateSubkeys()

void se050::scp03::crypto::GenerateSubkeys	(	const std::uint8_t	key[16],
		std::uint8_t	k1[16],
		std::uint8_t	k2[16]
	)

inline

◆ Gmul()

std::uint8_t se050::scp03::crypto::Gmul	(	std::uint8_t	a,
		std::uint8_t	b
	)

inline

◆ IncCommandCounter()

void se050::scp03::crypto::IncCommandCounter ( std::uint8_t counter[16] )

inline

◆ InvMixColumns()

void se050::scp03::crypto::InvMixColumns ( std::uint8_t s[16] )

inline

◆ InvShiftRows()

void se050::scp03::crypto::InvShiftRows ( std::uint8_t s[16] )

inline

◆ InvSubBytes()

void se050::scp03::crypto::InvSubBytes ( std::uint8_t s[16] )

inline

◆ IsoPad80()

bool se050::scp03::crypto::IsoPad80	(	std::uint8_t *	buf,
		std::size_t *	len,
		std::size_t	cap
	)

inline

◆ IsoUnpad80()

bool se050::scp03::crypto::IsoUnpad80	(	const std::uint8_t *	padded,
		std::size_t	padded_len,
		std::size_t *	plain_len
	)

inline

◆ LeftShift1()

void se050::scp03::crypto::LeftShift1 ( std::uint8_t in[16] )

inline

◆ MixColumns()

void se050::scp03::crypto::MixColumns ( std::uint8_t s[16] )

inline

◆ ResponseIcv()

void se050::scp03::crypto::ResponseIcv	(	const std::uint8_t	senc[kAes128KeyLen],
		const std::uint8_t	counter[16],
		std::uint8_t	icv[16]
	)

inline

Response ICV: counter with MSB 0x80, then AES-ECB(SENC, ·).

◆ SecureZero()

void se050::scp03::crypto::SecureZero	(	void *	p,
		std::size_t	len
	)

inlinenoexcept

Overwrite len bytes at p with zeros in a way the compiler cannot drop.

Stores go through a volatile pointer and a compiler barrier follows, so the wipe survives dead-store elimination even when the buffer is never read again (the explicit_bzero / memset_s pattern). Use it for session keys, round keys, MAC subkeys and key-derived intermediates.

◆ ShiftRows()

void se050::scp03::crypto::ShiftRows ( std::uint8_t s[16] )

inline

◆ StaticKeysUsable()

bool se050::scp03::crypto::StaticKeysUsable	(	const std::uint8_t *	enc,
		std::size_t	enc_len,
		const std::uint8_t *	mac,
		std::size_t	mac_len
	)

inline

◆ SubBytes()

void se050::scp03::crypto::SubBytes ( std::uint8_t s[16] )

inline

◆ XorBlock()

void se050::scp03::crypto::XorBlock	(	std::uint8_t *	a,
		const std::uint8_t *	b
	)

inline

◆ Xtime()

std::uint8_t se050::scp03::crypto::Xtime ( std::uint8_t x )

inline

Variable Documentation

◆ kAes128KeyLen

constexpr std::size_t se050::scp03::crypto::kAes128KeyLen = 16U

inlineconstexpr

◆ kChallengeLen

constexpr std::size_t se050::scp03::crypto::kChallengeLen = 8U

inlineconstexpr

◆ kCmacLen

constexpr std::size_t se050::scp03::crypto::kCmacLen = 16U

inlineconstexpr

◆ kCryptogramLen

constexpr std::size_t se050::scp03::crypto::kCryptogramLen = 8U

inlineconstexpr

◆ kDeriveCardCryptogram

constexpr std::uint8_t se050::scp03::crypto::kDeriveCardCryptogram = 0x00U

inlineconstexpr

◆ kDeriveHostCryptogram

constexpr std::uint8_t se050::scp03::crypto::kDeriveHostCryptogram = 0x01U

inlineconstexpr

◆ kDeriveSenc

constexpr std::uint8_t se050::scp03::crypto::kDeriveSenc = 0x04U

inlineconstexpr

◆ kDeriveSmac

constexpr std::uint8_t se050::scp03::crypto::kDeriveSmac = 0x06U

inlineconstexpr

◆ kDeriveSrmac

constexpr std::uint8_t se050::scp03::crypto::kDeriveSrmac = 0x07U

inlineconstexpr

◆ kInvSbox

constexpr std::uint8_t se050::scp03::crypto::kInvSbox[256]

inlineconstexpr

Initial value:

= {
    0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e,
    0x81, 0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87,
    0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32,
    0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
    0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,
    0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16,
    0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50,
    0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
    0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05,
    0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,
    0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41,
    0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
    0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,
    0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89,
    0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,
    0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
    0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59,
    0x27, 0x80, 0xec, 0x5f, 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d,
    0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d,
    0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
    0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63,
    0x55, 0x21, 0x0c, 0x7d}

◆ kKdfCounter

constexpr std::uint8_t se050::scp03::crypto::kKdfCounter = 0x01U

inlineconstexpr

◆ kLabelLen

constexpr std::size_t se050::scp03::crypto::kLabelLen = 12U

inlineconstexpr

◆ kLen128Bit

constexpr std::uint16_t se050::scp03::crypto::kLen128Bit = 0x0080U

inlineconstexpr

◆ kLen64Bit

constexpr std::uint16_t se050::scp03::crypto::kLen64Bit = 0x0040U

inlineconstexpr

◆ kRcon

constexpr std::uint8_t se050::scp03::crypto::kRcon[10]

inlineconstexpr

Initial value:

= {0x01, 0x02, 0x04, 0x08, 0x10,

0x20, 0x40, 0x80, 0x1b, 0x36}

◆ kSbox

constexpr std::uint8_t se050::scp03::crypto::kSbox[256]

inlineconstexpr

Initial value:

= {
    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,
    0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
    0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,
    0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
    0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
    0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
    0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,
    0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
    0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,
    0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
    0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,
    0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
    0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,
    0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
    0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
    0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
    0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,
    0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
    0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,
    0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
    0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,
    0xb0, 0x54, 0xbb, 0x16}

Classes

Functions

Variables

Function Documentation

◆ AddRoundKey()

◆ Aes128CbcDecrypt()

◆ Aes128CbcEncrypt()

◆ Aes128Cmac()

◆ Aes128DecryptBlock()

◆ Aes128EncryptBlock()

◆ CmacFinish()

◆ CmacStart()

◆ CmacUpdate()

◆ CommandIcv()

◆ ComputeCryptogram()

◆ ConstantTimeEqual()

◆ DeriveSessionKey()

◆ ExpandKey()

◆ FillDerivationData()

◆ GenerateSubkeys()

◆ Gmul()

◆ IncCommandCounter()

◆ InvMixColumns()

◆ InvShiftRows()

◆ InvSubBytes()

◆ IsoPad80()

◆ IsoUnpad80()

◆ LeftShift1()

◆ MixColumns()

◆ ResponseIcv()

◆ SecureZero()

◆ ShiftRows()

◆ StaticKeysUsable()

◆ SubBytes()

◆ XorBlock()

◆ Xtime()

Variable Documentation

◆ kAes128KeyLen

◆ kChallengeLen

◆ kCmacLen

◆ kCryptogramLen

◆ kDeriveCardCryptogram

◆ kDeriveHostCryptogram

◆ kDeriveSenc

◆ kDeriveSmac

◆ kDeriveSrmac

◆ kInvSbox

◆ kKdfCounter

◆ kLabelLen

◆ kLen128Bit

◆ kLen64Bit

◆ kRcon

◆ kSbox