I am struggling a bit to understand how authentication systems are properly used in NFC tag environments so I'm posting this thread to clarify some concepts.(In advance, this is not my field, so suppose gaps of knowledge)
AES : Its a ciphering algorithm based on symmetric keys (both sides have same key, being it able to cipher and decipher texts), the message is chunked in 10 parts, then each one will be encrypted (using the master key, and several transformation are made on a matrix), to be all joined together afterwards.
This standard is only for encryption and doesn't apply any authorization feature.
I suppose that only the master key is used to accomplish the ciphering.
(I read some thread talking about "key generations" from the master key, so maybe they are used in the algorithm instead? Is it not related at all? )
Its used to avoid "Passive attacks".
CMAC : Gaps here, I don`t know which of them it is. (or maybe none it is)
-It is an authentication protocol(MAC) where the input is a ciphered text (AES previously used), being able to satisfy the authentication part. (Data integrity covered by AES algorithm).
-It is an authentication protocol(MAC) but the input is a chopped plain text( no AES previously used), then the protocol is used along with some AES blocks to satisfy the authentication and integrity parts.
An explanation of what CMAC is will be truly welcome. ( I starting to think that is related somehow with Encrypt-then-MAC procedure)
It is handy to avoid some "Active attacks".
3-Pass-Mutual-Authentication : I think it is just a procedure when the CMAC it is used on both sides but many times, validating both devices if all of them give an positive response. ( I know that there more steps but I'm trying to figure out the general view of this)
Any sort of information to clarify all of this will be grateful, I know that all of them are related but I cant see the overall view.