I'm studying this white-paper: http://jessekornblum.com/publications/di09.pdf
The author says that using AES-CCM with the external key (highlighted in green at page 9, figure 4) and with the nonce at offset
0x3662B8 (highlighted in red, figure 5) you can decrypt the data at offset
I don't understand how AES-CCM works in BitLocker. Can someone please explain it to me?
I have the following doubts:
- The length of IV should be of 16 bytes, but I have a nonce of 12 bytes.
- How is the MAC calculated?