Commission Implementing Regulation (EU) 2016/799Show full title

12. VU — MOTION SENSOR PAIRING AND COMMUNICATION

12.1. General

CSM_216 A vehicle unit and a motion sensor shall communicate using the interface protocol specified in [ISO 16844-3] during pairing and in normal operation, with the changes described in this chapter and in section 9.2.1.

Note: readers of this chapter are supposed to be familiar with the contents of [ISO 16844-3].

12.2. VU — Motion Sensor Pairing Using Different Key Generations

As explained in section 9.2.1, the motion sensor master key and all associated keys are regularly replaced. This leads to the presence of up to three motion sensor-related AES keys K_M-WC (of consecutive key generations) in workshop cards. Similarly, in motion sensors up to three different AES-based encryptions of data (based on consecutive generations of the motion sensor master key K_M) may be present. A vehicle unit contains only one motion sensor-related key K_M-VU.

CSM_217 A second-generation VU and a second-generation motion sensor shall be paired as follows (compare Table 6 in [ISO 16844-3]):

1.

A second-generation workshop card is inserted into the VU and the VU is connected to the motion sensor.

2.

The VU reads all available K_M-WC keys from the workshop card, inspects their key version numbers and chooses the one matching the version number of the VU's K_M-VU key. If the matching K_M-WC key is not present on the workshop card, the VU aborts the pairing process and shows an appropriate error message to the workshop card holder.

3.

The VU calculates the motion sensor master key K_M from K_M-VU and K_M-WC, and the identification key K_ID from K_M, as specified in section 9.2.1.

4.

The VU sends the instruction to initiate the pairing process towards the motion sensor, as described in [ISO 16844-3], and encrypts the serial number it receives from the motion sensor with the identification key K_ID. The VU sends the encrypted serial number back to the motion sensor.

5.

The motion sensor matches the encrypted serial number consecutively with each of the encryptions of the serial number it holds internally. If it finds a match, the VU is authenticated. The motion sensor notes the generation of K_ID used by the VU and returns the matching encrypted version of its pairing key; i.e. the encryption that was created using the same generation of K_M.

6.

The VU decrypts the pairing key using K_M, generates a session key K_S, encrypts it with the pairing key and sends the result to the motion sensor. The motion sensor decrypts K_S.

7.

The VU assembles the pairing information as defined in [ISO 16844-3], encrypts the information with the pairing key, and sends the result to the motion sensor. The motion sensor decrypts the pairing information.

8.

The motion sensor encrypts the received pairing information with the received K_S and returns this to the VU. The VU verifies that the pairing information is the same information which the VU sent to the motion sensor in the previous step. If it is, this proves that the motion sensor used the same K_S as the VU and hence in step 5 sent its pairing key encrypted with the correct generation of K_M. Hence, the motion sensor is authenticated.

Note that steps 2 and 5 are different from the standard process in [ISO 16844-3]; the other steps are standard.

Example: Suppose a pairing takes place in the first year of the validity of the ERCA (3) certificate; see Figure 2 in section 9.2.1.2. Moreover

• Suppose the motion sensor was issued in the last year of the validity of the ERCA (1) certificate. It will therefore contain the following keys and data:

  • N_s[1]: its serial number encrypted with generation 1 of K_ID,

  • N_s[2]: its serial number encrypted with generation 2 of K_ID,

  • N_s[3]: its serial number encrypted with generation 3 of K_ID,

  • K_P[1]: its generation-1 pairing key(1), encrypted with generation 1 of K_M,

  • K_P[2]: its generation-2 pairing key, encrypted with generation 2 of K_M,

  • K_P[3]: its generation-3 pairing key, encrypted with generation 3 of K_M,

• Suppose that the workshop card was issued in the first year of the validity of the ERCA (3) certificate. It will therefore contain the generation 2 and generation 3 of the K_M-WC key.

• Suppose the VU is a generation-2 VU, containing the generation 2 of K_M-VU.

In this case, the following will happen in steps 2 — 5:

• Step 2: The VU reads generation 2 and generation 3 of K_M-WC from the workshop card and inspects their version numbers.

• Step 3: The VU combines the generation-2 K_M-WC with its K_M-VU to compute K_M and K_ID.

• Step 4: The VU encrypts the serial number it receives from the motion sensor with K_ID.

• Step 5: The motion sensor compares the received data with N_s[1] and doesn't find a match. Next, it compares the data with N_s[2] and finds a match. It concludes that the VU is a generation-2 VU, and therefore sends back K_P[2].

12.3. VU — Motion Sensor Pairing and Communication using AES

CSM_218 As specified in Table 3 in section 9.2.1, all keys involved in the pairing of a (second-generation) vehicle unit and a motion sensor and in subsequent communication shall be AES keys, rather than double-length TDES keys as specified in [ISO 16844-3]. These AES keys may have a length of 128, 192 or 256 bits. Since the AES block size is 16 bytes, the length of an encrypted message must be a multiple of 16 bytes, compared to 8 bytes for TDES. Moreover, some of these messages will be used to transport AES keys, the length of which may be 128, 192 or 256 bits. Therefore, the number of data bytes per instruction in Table 5 of [ISO 16844-3] shall be changed as shown in Table 6:

Table 6
Number of plaintext and encrypted data bytes per instruction defined in [ISO 16844-3]
Instruction	Request / reply	Description of data	# of plaintext data bytes according to [ISO 16844-3]	# of plaintext data bytes using AES keys	# of encrypted data bytes when using AES keys of bitlength
					128	192	256
10	request	Authentication data + file number	8	8	16	16	16
11	reply	Authentication data + file contents	16 or 32, depend on file	16 or 32, depend on file	16 / 32	16 / 32	16 / 32
41	request	MoS serial number	8	8	16	16	16
41	reply	Pairing key	16	16 / 24 / 32	16	32	32
42	request	Session key	16	16 / 24 / 32	16	32	32
43	request	Pairing information	24	24	32	32	32
50	reply	Pairing information	24	24	32	32	32
70	request	Authentication data	8	8	16	16	16
80	reply	MoS counter value + auth. data	8	8	16	16	16

CSM_219 The pairing information that is sent in instructions 43 (VU request) and 50 (MoS reply) shall be assembled as specified in section 7.6.10 of [ISO 16844-3], except that the AES algorithm shall be used instead of the TDES algorithm in the pairing data encryption scheme, thus resulting in two AES encryptions, and adopting the padding specified in CSM_220 to fit with the AES block size. The key K'_p used for this encryption shall be generated as follows:

• In case the pairing key K_P is 16 bytes long: K'_p = K_P XOR (N_s||N_s)

• In case the pairing key K_P is 24 bytes long: K'_p = K_P XOR (N_s||N_s||N_s)

• In case the pairing key K_P is 32 bytes long: K'_p = K_P XOR (N_s||N_s||N_s||N_s)

where N_s is the 8-byte serial number of the motion sensor.

CSM_220 In case the plaintext data length (using AES keys) is not a multiple of 16 bytes, padding method 2 defined in [ISO 9797-1] shall be used.

Note: in [ISO 16844-3], the number of plaintext data bytes is always a multiple of 8, such that padding is not necessary when using TDES. The definition of data and messages in [ISO 16844-3] is not changed by this part of this Appendix, thus necessitating the application of padding.

CSM_221 For instruction 11 and in case more than one block of data must be encrypted, the Cipher Block Chaining mode of operation shall be used as defined in [ISO 10116], with an interleave parameter m = 1. The IV to be used shall be

• For instruction 11: the 8-byte authentication block specified in section 7.6.3.3 of [ISO 16844-3], padded using padding method 2 defined in [ISO 9797-1]; see also section 7.6.5 and 7.6.6 of [ISO 16844-3].

• For all other instructions in which more than 16 bytes are transferred, as specified in Table 6: ‘00’ {16}, i.e. sixteen bytes with binary value 0.

Note: As shown in section 7.6.5 and 7.6.6 of [ISO 16844-3], when the MoS encrypts data files for inclusion in instruction 11, the authentication block is both

• Used as the initialization vector for the CBC-mode encryption of the data files

• Encrypted and included as the first block in the data that is sent to the VU.

12.4. VU — Motion Sensor Pairing For Different Equipment Generations

CSM_222 As explained in section 9.2.1, a second-generation motion sensor may contain the TDES-based encryption of the pairing data (as defined in Part A of this Appendix), which allows the motion sensor to be paired to a first-generation VU. If this is the case, a first-generation VU and a second-generation motion sensor shall be paired as described in Part A of this Appendix and in [ISO 16844-3]. For the pairing process either a first-generation or a second-generation workshop card may be used.

Notes:

— It is not possible to pair a second-generation VU to a first-generation motion sensor.

— It is not possible to use a first-generation workshop card for coupling a second-generation VU to a motion sensor.

(1)

Note that the generation-1, generation-2 and generation-3 pairing keys may actually be the same key, or may be three different keys having different lengths, as explained in CSM_117.