I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way:
a unique 128-bit key is used;
the plaintext is first encrypted in classical counter mode with AES, with counter = fixedData1 | nonce | blockCounter;
- a MAC is then computed with CMAC AES, on the following message: B0 | ciphertext, where B0 is a block: B0 = fixedData2 | nonce | messageLength; the MAC is truncated an appended to the ciphertext.
I am unable to find any reference to this mode of operation. It seems to be a variation of EAX, but I could not find anything.
Does someone know this mode of operation?