User's Manual

USER MANUAL PREVIEW

PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER

F.2 USER2_PIN_HASH example

We consider a PTM 535BZ module with the following 64 bit globally unique NFC ID:

NFC_ID = E0022400F340E0D4

PTM 535BZ provides the following USER2_PIN_HASH:

USER2_PIN_HASH = 1234

We further consider that a connected NFC tool wants to test if PTM 535BZ uses the default

USER1_PIN as described in Chapter 5.1.2:

USER1_PIN = 030035E5

To do so, we first construct the hash input as described in Chapter 5.7.5.1:

Byte 0 Byte 1…4 Byte 5..12 Byte 13…15

USER_ID PIN_CODE NFC_ID PADDING

02 (USER2)

030035E5

E0022400F340E0D4

800068

With these settings, we obtain HASH_INPUT:

HASH_INPUT = 02030035E5E0022400F340E0D4800068

We now encrypt HASH_INPUT using AES128 and a key of {0}, meaning the zero vector.

At the time of writing, an online AES128 calculator could be found in [8]. With this, we can

calculate H1 as follows:

H1 = AES128(HASH_INPUT, {0})

H1 = AES128(02030035E5E0022400F340E0D4800068,00000000000000000000000000000000)

H1 = 463B6C6FD67AEA16F21E51B9EE4AB229

USER2_PIN_HASH equals the most significant 16 bit of H1, meaning:

USER2_PIN_HASH = 463B

The calculated USER2_PIN_HASH (9E1A) does not match the one provided by PTM 535BZ

(1234). PTM 535BZ therefore does not use the tested USER2_PIN (030035E5).