Automotive Cryptography Fundamentals

#!/usr/bin/env python3
# HKDF key derivation hierarchy for automotive SecOC key management
import hmac, hashlib

def hkdf_extract(salt: bytes, ikm: bytes) -> bytes:
    return hmac.new(salt, ikm, hashlib.sha256).digest()

def hkdf_expand(prk: bytes, info: bytes, length: int) -> bytes:
    output = b""; t = b""; counter = 1
    while len(output) < length:
        t = hmac.new(prk, t + info + bytes([counter]), hashlib.sha256).digest()
        output += t; counter += 1
    return output[:length]

def derive_key(root: bytes, context: str, length: int = 16) -> bytes:
    prk = hkdf_extract(b"automotive-v1", root)
    return hkdf_expand(prk, context.encode(), length)

root_key = bytes.fromhex("0102030405060708090a0b0c0d0e0f10")
vin = "WBA12345678901234"

vms            = derive_key(root_key,  f"VehicleMasterSecret|{vin}")
esk_can0_tx    = derive_key(vms,       "ECU_TCU|CAN0|TX")
esk_can0_rx    = derive_key(vms,       "ECU_TCU|CAN0|RX")
esk_gw_can1_tx = derive_key(vms,       "ECU_GW|CAN1|TX")

print(f"VMS:            {vms.hex()}")
print(f"TCU CAN0 TX:    {esk_can0_tx.hex()}")
print(f"TCU CAN0 RX:    {esk_can0_rx.hex()}")
print(f"Gateway CAN1:   {esk_gw_can1_tx.hex()}")
print("Compromise of one ESK reveals NOTHING about VMS or other ECU keys")

/* AUTOSAR Csm TRNG: Infineon Aurix TC3xx eHSM */
#include "Csm.h"

/* TRNG quality: NIST SP 800-90B continuous health tests in HSM:
   - Repetition Count Test: detects stuck TRNG output
   - Adaptive Proportion Test: detects TRNG bias
   TRNG feeds HMAC-DRBG (SP 800-90A) for higher throughput       */

Std_ReturnType Generate_Secure_Random(uint8* buf, uint32 bytes)
{
    Std_ReturnType result = Csm_RandomGenerate(
        CSM_JOB_RANDOM_256BIT, buf, bytes);

    if (result != CSM_E_OK) {
        /* TRNG failure: do NOT fall back to software PRNG */
        Dem_ReportErrorStatus(DEM_EVENT_CSM_TRNG_FAIL, DEM_EVENT_STATUS_FAILED);
        return E_NOT_OK;
    }
    return E_OK;
}

/* PROHIBITED: software PRNG seeded from cycle counter
   - Cycle counter predictable from timing side channels
   - 32-bit seed space = only 2^32 possible sequences = trivially brute-forced
   - Use Csm_RandomGenerate() ONLY; never srand(DWT->CYCCNT)             */