Module checkmac 

CheckMac command.

Verifies a host-computed MAC against the contents of a slot. The chip takes the slot value as key, computes SHA256(key || challenge || other_data || padding), and compares the result with the host-supplied client_resp. A match yields status byte 0x00, a mismatch yields 0x01 (crate::error::ChipError::CheckMacOrVerifyFailed).

The flow used in this project is PIN verification. Slot 5 stores SHA256(PIN || salt). The host computes the same digest from the PIN the user typed, builds the corresponding MAC, and asks the chip to cross-check it. If the user has fat-fingered the PIN, the MAC does not match, the chip reports miscompare, and the relevant counter is bumped. That counter eventually reaches the LimitedUse threshold (5 for PIN, 10 for PUK) and blocks the slot from any further CheckMac.

Reference: CryptoAuthLib lib/calib/calib_checkmac.c, constants CHECKMAC_MODE_CHALLENGE (0x00), CHECKMAC_CHALLENGE_SIZE (32), CHECKMAC_CLIENT_RESPONSE_SIZE (32), CHECKMAC_OTHER_DATA_SIZE (13).

Constants

CHECKMAC_CHALLENGE_SIZE

Size of the challenge block sent to the chip.

CHECKMAC_CLIENT_RESPONSE_SIZE

Size of the client response block (the host-computed MAC under test).

CHECKMAC_DATA_SIZE

Total size of the data field sent with a CheckMac command.

CHECKMAC_MODE_CHALLENGE 🔒

param1 mode: challenge is taken from the input data field, key from the slot identified by param2.

CHECKMAC_OTHER_DATA_SIZE

Size of the other_data block.