Add pure SDM MAC helper

Author: shinaji

src/schnee/adapters/ntag/core.py

@@ -13,7 +13,12 @@
 from schnee.adapters.backend.core import Backend
 from schnee.adapters.backend.pcsc import PcscApduClient, PcscBackend
 from schnee.adapters.ntag.apdu import Ntag424ApduPreset
-from schnee.adapters.ntag.crypt import aes_decrypt, aes_encrypt, xor_bytes
+from schnee.adapters.ntag.crypt import (
+    aes_decrypt,
+    aes_encrypt,
+    calculate_sdm_mac,
+    xor_bytes,
+)
 from schnee.adapters.ntag.utils import (
     Offset,
     build_ndef_url_file_data,
@@ -777,27 +782,12 @@ def verify_sdm_mac(
     # 通常のSDM実装では「Little Endian」として扱う必要があります。
     ctr_bytes_le = ctr_bytes[::-1]
 
-    # 2. セッション鍵生成用のSystem Vector (SV) の作成
-    # SV = 3C C3 00 01 00 80 + UID(7bytes) + Counter(3bytes, Little Endian)
-    # "3C C3 00 01 00 80" は NXP AN12196 で定義される定数(File 2の場合)
-    sv_prefix = binascii.unhexlify("3CC300010080")
-    sv_bytes = sv_prefix + uid_bytes + ctr_bytes_le
-
-    c_ses = CMAC.new(key_bytes, ciphermod=AES)
-    c_ses.update(sv_bytes)
-    session_key = c_ses.digest()
-
-    # 4. SDM-MAC の計算
-    # 入力データは「空 (empty)」またはミラーされたデータそのもの。
-    # 標準的なSDM設定(File Dataの暗号化なし)では、MACは空入力に対して計算されます。
-    c_mac = CMAC.new(session_key, ciphermod=AES)
-    c_mac.update(b"")  # 空データ
-    full_mac = c_mac.digest()
-
-    # 5. トランケーション (短縮)
-    # フルCMAC(16バイト)から、奇数インデックス(1, 3, 5...)のバイトを抽出して8バイトにします。  # noqa: E501
-    # (仕様書では "Even bytes" と書かれることがありますが、実装上は [1::2] が正解となるケースが大半です)  # noqa: E501
-    calculated_mac = full_mac[1::2]
+    calculated_mac = calculate_sdm_mac(
+        sdm_key=key_bytes,
+        signed_data=b"",
+        uid=uid_bytes,
+        counter=ctr_bytes_le,
+    )
 
     print(f"Calculated MAC: {calculated_mac.hex().upper()}")
     print(f"Received MAC:   {mac_hex.upper()}")

src/schnee/adapters/ntag/crypt.py

@@ -2,6 +2,8 @@
 from Crypto.Hash import CMAC
 from Crypto.Util.Padding import pad
 
+SDM_SV2_PREFIX = bytes.fromhex("3CC300010080")
+
 
 def aes_encrypt(key: bytes, data: bytes, iv: bytes | None = None) -> bytes:
     """AES-128 CBC encryption"""
@@ -53,6 +55,28 @@ def calculate_ev2_mac(  # noqa: PLR0913
     return bytes(list(full_mac)[1::2])
 
 
+def calculate_sdm_mac(
+    sdm_key: bytes,
+    signed_data: bytes,
+    uid: bytes | None = None,
+    counter: bytes | None = None,
+) -> bytes:
+    """Calculate the truncated 8-byte SDM MAC for NTAG 424 DNA."""
+    sv2 = SDM_SV2_PREFIX
+    if uid is not None:
+        sv2 += uid
+    if counter is not None:
+        sv2 += counter
+
+    session_key_cmac = CMAC.new(key=sdm_key, ciphermod=AES)
+    session_key_cmac.update(sv2)
+    session_mac_key = session_key_cmac.digest()
+
+    sdm_mac_cmac = CMAC.new(key=session_mac_key, ciphermod=AES)
+    sdm_mac_cmac.update(signed_data)
+    return sdm_mac_cmac.digest()[1::2]
+
+
 def aes_cbc_encrypt_for_ev2(
     session_key_enc: bytes,
     plain_data: bytes,

tests/schnee/adapters/ntag/test_crypt.py

@@ -0,0 +1,71 @@
+"""Tests for NTAG cryptographic helpers."""
+
+from Crypto.Cipher import AES
+from Crypto.Hash import CMAC
+
+from schnee.adapters.ntag.crypt import SDM_SV2_PREFIX, calculate_sdm_mac
+
+TRUNCATED_SDM_MAC_LENGTH = 8
+
+
+def test_calculate_sdm_mac_with_uid_and_counter() -> None:
+    """SDM MAC includes the UID and counter in SV2 when both are present."""
+    assert (
+        calculate_sdm_mac(
+            sdm_key=bytes.fromhex("00112233445566778899AABBCCDDEEFF"),
+            signed_data=bytes.fromhex("DEADBEEF00"),
+            uid=bytes.fromhex("04782E21801D80"),
+            counter=bytes.fromhex("010203"),
+        ).hex()
+        == "7db100f509613111"
+    )
+
+
+def test_calculate_sdm_mac_with_uid_only() -> None:
+    """SDM MAC includes only the UID when no counter is provided."""
+    assert (
+        calculate_sdm_mac(
+            sdm_key=bytes.fromhex("00112233445566778899AABBCCDDEEFF"),
+            signed_data=bytes.fromhex("DEADBEEF00"),
+            uid=bytes.fromhex("04782E21801D80"),
+        ).hex()
+        == "a8e8cc437f54250a"
+    )
+
+
+def test_calculate_sdm_mac_without_uid_or_counter() -> None:
+    """SDM MAC can be derived from the fixed SV2 prefix alone."""
+    assert (
+        calculate_sdm_mac(
+            sdm_key=bytes.fromhex("00112233445566778899AABBCCDDEEFF"),
+            signed_data=bytes.fromhex("DEADBEEF00"),
+        ).hex()
+        == "8330e2018ec638ce"
+    )
+
+
+def test_calculate_sdm_mac_truncates_to_odd_indexed_bytes() -> None:
+    """SDM MAC returns the 8-byte [1::2] truncation of the full CMAC."""
+    sdm_key = bytes.fromhex("00112233445566778899AABBCCDDEEFF")
+    signed_data = bytes.fromhex("DEADBEEF00")
+    uid = bytes.fromhex("04782E21801D80")
+    counter = bytes.fromhex("010203")
+
+    session_key_cmac = CMAC.new(key=sdm_key, ciphermod=AES)
+    session_key_cmac.update(SDM_SV2_PREFIX + uid + counter)
+    session_mac_key = session_key_cmac.digest()
+
+    full_mac_cmac = CMAC.new(key=session_mac_key, ciphermod=AES)
+    full_mac_cmac.update(signed_data)
+    full_mac = full_mac_cmac.digest()
+
+    assert (
+        calculate_sdm_mac(
+            sdm_key=sdm_key,
+            signed_data=signed_data,
+            uid=uid,
+            counter=counter,
+        )
+        == full_mac[1::2]
+    )
+    assert len(full_mac[1::2]) == TRUNCATED_SDM_MAC_LENGTH