diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml new file mode 100644 index 0000000..383e65c --- /dev/null +++ b/.github/workflows/pylint.yml @@ -0,0 +1,23 @@ +name: Pylint + +on: [push] + +jobs: + build: + runs-on: ubuntu-latest + strategy: + matrix: + python-version: ["3.8", "3.9", "3.10"] + steps: + - uses: actions/checkout@v3 + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v3 + with: + python-version: ${{ matrix.python-version }} + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install pylint + - name: Analysing the code with pylint + run: | + pylint $(git ls-files '*.py') diff --git a/README.md b/README.md index 88788ab..e6aad0b 100644 --- a/README.md +++ b/README.md @@ -12,4 +12,5 @@ pip install -r requirements.txt ``` ## References -* [Specification of Secure Hardware Extensions, AUTOSAR FO R19-11](https://www.autosar.org/fileadmin/user_upload/standards/foundation/19-11/AUTOSAR_TR_SecureHardwareExtensions.pdf) +* [AUTOSAR Specification of Secure Hardware Extensions - R22-11](https://www.autosar.org/fileadmin/standards/R22-11/FO/AUTOSAR_TR_SecureHardwareExtensions.pdf) +* [Description of the M* values](./m_value_description.md) diff --git a/m_value_description.md b/m_value_description.md new file mode 100644 index 0000000..92e3624 --- /dev/null +++ b/m_value_description.md @@ -0,0 +1,52 @@ +# M1 + +| UID' | ID | AuthID | +| --- | --- | --- | +| 120 bits | 4 bits | 4 bits | + +M1 = UID' | ID | AuthID + +# M2 + +> **Note** K1 is the derived encryption key used in M2 + +K1 = KDF(KAuthID, KEY_UPDATE_ENC_C) + +CID = 28 bit counter value for key + +FID = 5 bit key flag value + +M2 = ENCCBC,K1,IV=0(CID | FID | "0...0"95 | KID) + +# M3 + +> **Note** K2 is the derived CMAC authentication key used in M3. + +K2 = KDF(KAuthID, KEY_UPDATE_MAC_C) + +M3 = CMACK2(M1|M2) + +# M4 + +> **Note** K3 is the derived encryption key used in M4 + +K3 = KDF(KID, KEY_UPDATE_ENC_C) + +> **Note** +> AES ECB mode is used in the spec. Since we are only encrypting 1 block, this is equivalent to CBC mode with an IV=0. + +M4 = UID | ID | AuthID | ENCECB,K3(CID) + +# M5 + +K4 = KDF(KID, KEY_UPDATE_MAC_C) + +M5 = CMACK4(M4) + +# Key Derivation + +Keys are derived using the Miyaguchi-Preneel compression algorithm based on [NIST800_108]. Derived +keys are calculated by compressing the correctly preprocessed concatenation of a secret K and +a constant C. + +KDF(K,C) = AES-MP(K | C)