AES, CMAC and "3 pass authentication protocol" Explained

Question

I am struggling a bit to understand how authentication systems are properly used in NFC tag environments so I'm posting this thread to clarify some concepts.(In advance, this is not my field, so suppose gaps of knowledge)

AES : Its a ciphering algorithm based on symmetric keys (both sides have same key, being it able to cipher and decipher texts), the message is chunked in 10 parts, then each one will be encrypted (using the master key, and several transformation are made on a matrix), to be all joined together afterwards.

This standard is only for encryption and doesn't apply any authorization feature.
I suppose that only the master key is used to accomplish the ciphering.

(I read some thread talking about "key generations" from the master key, so maybe they are used in the algorithm instead? Is it not related at all? )

Its used to avoid "Passive attacks".

CMAC : Gaps here, I don`t know which of them it is. (or maybe none it is)

-It is an authentication protocol(MAC) where the input is a ciphered text (AES previously used), being able to satisfy the authentication part. (Data integrity covered by AES algorithm).

-It is an authentication protocol(MAC) but the input is a chopped plain text( no AES previously used), then the protocol is used along with some AES blocks to satisfy the authentication and integrity parts.

An explanation of what CMAC is will be truly welcome. ( I starting to think that is related somehow with Encrypt-then-MAC procedure)

It is handy to avoid some "Active attacks".

3-Pass-Mutual-Authentication : I think it is just a procedure when the CMAC it is used on both sides but many times, validating both devices if all of them give an positive response. ( I know that there more steps but I'm trying to figure out the general view of this)

Any sort of information to clarify all of this will be grateful, I know that all of them are related but I cant see the overall view.

Answer 1

AES is a block cipher. It permutes (maps) input blocks to output blocks of 16 bytes. The permutation that is used depends on the key. AES must be used in a mode of operation such as CBC to be able to be offer confidentiality of dynamically sized messages. CBC is commonly used in Smart Card environments. CBC offers confidentiality against (passive) eavesdroppers.

AES-CMAC is a MAC based on AES-CBC. It offers data integrity and authenticity. It is an alteration on CBC-MAC to make it secure for dynamically sized messages. Reusing CBC is of course a good idea for embedded environments (rather than relying on HMAC where the hash is commonly implemented in software).

Sometimes you may only need a MAC when communicating with a Smart Card or tag (e.g. when sending commands without confidential data). In that case you may directly perform MAC over the plaintext (command). If the data needs to be confidential then usually encrypt-than-mac is used instead of mac-then-encrypt. This is especially important when it comes to avoiding CBC padding oracle attacks.

Usually the message protection is performed by session keys, derived from the master key.

---

3-pass mutual authentication may also use encryption or MAC. There is not a single 3-pass protocol, there are multiple protocols that either use the master key or derived (session) authentication key, encryption or MAC. This protocol is used for entity authentication rather than message security. The (random) values used within this protocol that precedes message exchange may be used to derive the other session key(s).

---

Per session there may be as much as 6 session keys per pair of entities (e.g. card and reader). One key may be used for entity authentication, one for encryption and one for MAC. These 3 keys can have two sets: one for sending and one for receiving (authentication) messages. These may be generated directly or indirectly from one master key. Quite often the master key is however used directly for entity authentication, removing two keys from the list of session keys.