MAC verification fails

Question

I am having the problem with mac verification on card. I am not sure where to find an error. The story goes like this. The card and terminal know DH parameters P, Q and G. Card calculates KICC = GˇPrK.ICC.DH mod P where PrK.ICC.Dh is the random number between 0 and Q-1. That number is sent to the terminal. From the terminal the card receives the KIFD number. Then card calculates the KSEED=PuK.IFD.DHˇPrK.ICC.DH mod P. Then this calculation is performed:
KENC = SHA-1(KSEED || 0001)
KMAC= SHA-1(KSEED || 0002)
These two keys are used for the encryption and for the mac calculation. At the bottom you can find how I make KSEED. At this part of the code the KSEED is stored in the crypto.tmpBytes variable. After that the secure messaging channel is established and the card receives the message. First the MAC is checked. The MAC check failed. Then, only for the test purpose I uncomment that. Then MAC is not checked and the decryption is performed. The decrypted message was well formed and the decrypted message had correct value. What conclusion can I make. I believe that the keys are correctly defined because if it is not done properly, then the decryption would not result with the expected value. Right? If that is so, why the MAC calculation failed on my side. There could be several reasons. The first is that the MAC key on both side is not the same. But if we assume that we define the keys properly we could eliminate this as a problem. The next thing that can influence the MAC check fails is that the MAC is done differently on both side.
Can I really eliminate the key definition as the cause of the problem.
// Calculation of the KSEED
crypto.randomData.generateData(buffer, (byte)0, (short) (dh.q.length - 1));
          ((RSAPublicKey)crypto.publicKeys[5].key).setExponent(buffer, (short) 0, (short) (dh.q.length - 1));
          ((RSAPublicKey)crypto.publicKeys[5].key).setModulus(dh.p, (short) 0, (short)dh.p.length);
        Cipher c = crypto.publicKeys[5].getCipher(Cipher.ALG_RSA_NOPAD);
        c.init((RSAPublicKey)crypto.publicKeys[5].key, Cipher.MODE_ENCRYPT);
        short encLen = c.doFinal(crypto.ifdMaterialKeyAsym, (short)0, (short) crypto.ifdMaterialKeyAsym.length, crypto.tmpBytes, (short)0);
//Calculation of the session keys
crypto.secureMessagingAsym(algorithm);
//Calculation of the KICC (The terminal uses it to generate KSEED) 
          encLen = c.doFinal(dh.g, (short)0, (short) dh.g.length, crypto.tmpBytes, (short) 6);
          Util.arrayCopy(crypto.tmpBytes, (short) 6, crypto.iccMaterialKeyAsym, (short) 0, (short) encLen);
public void secureMessagingAsym(byte algorithm) {
         // calculate session keys
        short keysPos = SM_ASYM_TRANSPORT_KEY_LENGTH;
        deriveKey(tmpBytes, (short)0, SM_ASYM_TRANSPORT_KEY_LENGTH, MAC_MODE, keysPos, algorithm);
        short macKeyPos = keysPos;
        keysPos += SESSION_KEY_LENGTH;
        deriveKey(tmpBytes, (short)0, SM_ASYM_TRANSPORT_KEY_LENGTH, ENC_MODE, keysPos, algorithm);
        short encKeyPos = keysPos;
        keysPos += SESSION_KEY_LENGTH;
        setSecureMessagingKeys(tmpBytes, macKeyPos, tmpBytes, encKeyPos);
public void deriveKey(byte[] buffer, short keySeedOffset, short keySeedLength, byte mode, short keyOffset, byte alg)
         throws CryptoException {
        // only key_offset is a write pointer
        // sanity checks
        if ((short)buffer.length < (short)((short)(keyOffset + keySeedLength) + c.length)) {
            ISOException.throwIt((short)0x6d66);
        if(keySeedOffset > keyOffset) {
            ISOException.throwIt((short)0x6d66);
        c[(short)(c.length-1)] = mode;
        // copy seed || c to key_offset
        Util.arrayCopyNonAtomic(buffer, keySeedOffset, buffer, keyOffset, keySeedLength);
        Util.arrayCopyNonAtomic(c, (short) 0, buffer, (short)(keyOffset + keySeedLength), (short)c.length);
        // compute hash on key_offset (+seed len +c len)
        short length = 0;
        if(alg == ALG_MUTUAL_AUTH_SHA1 || alg == ALG_ASYM_AUTH_SHA1) {
             messageDigest1.doFinal(buffer, keyOffset, (short)(keySeedLength + c.length), buffer, keyOffset);
             messageDigest1.reset();
             length = 56;
        else if(alg == ALG_MUTUAL_AUTH_SHA256 || alg == ALG_ASYM_AUTH_SHA256) {
             messageDigest256.doFinal(buffer, keyOffset, (short)(keySeedLength + c.length), buffer, keyOffset);
             messageDigest256.reset();
             length = 80;
        // parity bits
        for (short i = keyOffset; i < (short)(keyOffset + length); i++) {
            if (PKIUtil.evenBits(buffer) == 0)
buffer[i] = (byte) (buffer[i] ^ 1);

Answer 1

Hi,
The first step I would take is to eliminate the keys as the issue. Can you use the MAC key pair for an encryption/decryption operation as you did for the other keys? If this works then you can be sure the key pair is correct. There is a good chance there is an issue with the MAC calculation and the keys are correct but first you should be sure.
Cheers,
Shane