I am trying to implement a security access scheme for Automotive Embedded Systems.I need to be able to generate a Random number(of my desired length), combine it with some secret data to send a Seed/Challenge, generate a Key internally using the same Seed/Challenge as one of the inputs to a function and then be able to compare the received key with the computed key. Could someone help me know whether mbedTLS /PolarSSL library has functions to support me in achieving my objectives? I am new to this topic and there are too many new terms that I do not fully understand.

Summary of my needs:

  1. Generate a RN of desired length (N1 bytes)
  2. Seed / Challenge: RN + secret_data1 (N2 bytes)
  3. Generate Key: f1(Challenge, secret_data2, fixed data bytes) -> N3 bytes
  4. Compare Key: f2(received key, generated key) -> return SUCCESS / FAILURE

Thank you in advance.

  • 1
    $\begingroup$ We can advise on the values of N1-N3 and the choices of f1 and f2. Actual help on the implementation / API is off-topic here and should be asked on stackoverflow.com $\endgroup$
    – SEJPM
    Oct 8, 2016 at 13:59
  • $\begingroup$ Thank you for your reply. I would be interested to know your suggestions on the choice of the values for N1-N2 and the functions f1, f2 too. $\endgroup$
    – GeekTom
    Oct 9, 2016 at 18:05
  • $\begingroup$ It's not clear from your description whether your proposed protocol is secure against message replay attacks or not. If not, you really should add some mechanism (e.g. sequential message numbers and/or timestamps) to prevent it. Of course, the message numbers and/or timestamps need to be authenticated too. $\endgroup$ Nov 11, 2016 at 21:13

1 Answer 1


As stated in the comments we can't / won't advise on whether PolarSSL is suitable to perform the operations required.

However, for your needs $N_1=N_2=N_3=32$ sounds like a reasonable choice, giving you a solid 256-bit security and no need to worry about truncation and the alike.

As for $f_1$, HMAC-SHA256 sounds like the obvious choice, also giving you $N_3=32$. You'd input the secret data as a key and the challenge and the fixed bytes as a message and you're good.

Finally for $f_2$, this needs to be the same choice as $f_1$ paired with a simple constant time comparison.

I can't promise anything, but all of this functionality is required for any TLS implementation right now, so if the low-level primitives are provided you can use the library.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.