oxirush-security 0.1.0

5G security algorithms — KDF, NIA1/2/3, NEA0/1/2/3, SUCI concealment per TS 33.501
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

//! Demonstrate NAS integrity algorithms (NIA1, NIA2, NIA3) per TS 33.501.
//!
//! Each algorithm computes a 32-bit MAC over the same message, showing
//! how to use the unified `nas_mac()` function and the individual
//! `nia1_mac`, `nia2_mac`, `nia3_mac` functions.

use oxirush_security::*;

fn main() {
    // Example 128-bit integrity key (KNASint)
    let key: [u8; 16] = [
        0x2b, 0xd6, 0x45, 0x9f, 0x82, 0xc5, 0xb3, 0x00, 0x95, 0x2c, 0x49, 0x10, 0x48, 0x81,
        0xff, 0x48,
    ];

    // NAS security parameters
    let count: u32 = 0x38a6f056; // NAS COUNT
    let bearer: u8 = 0x01; // NAS bearer (always 1 for 5G NAS)
    let direction: u8 = 0; // 0 = uplink, 1 = downlink

    // Example NAS message payload
    let message = b"Hello 5G NAS integrity!";

    println!("=== NAS Integrity MAC computation ===\n");
    println!(
        "Key:       {}",
        key.iter().map(|b| format!("{b:02x}")).collect::<String>()
    );
    println!("COUNT:     0x{count:08x}");
    println!("Bearer:    {bearer}");
    println!("Direction: {direction} (uplink)");
    println!("Message:   {:?}\n", String::from_utf8_lossy(message));

    // NIA1 — SNOW 3G (128-EIA1)
    let mac_nia1 = nas_mac(&key, count, bearer, direction, message, 0x01);
    println!("NIA1 (SNOW 3G)  MAC: 0x{mac_nia1:08x}");

    // NIA2 — AES-CMAC (128-EIA2)
    let mac_nia2 = nas_mac(&key, count, bearer, direction, message, 0x02);
    println!("NIA2 (AES-CMAC) MAC: 0x{mac_nia2:08x}");

    // NIA3 — ZUC (128-EIA3)
    let mac_nia3 = nas_mac(&key, count, bearer, direction, message, 0x03);
    println!("NIA3 (ZUC)      MAC: 0x{mac_nia3:08x}");

    // NEA0 — null integrity (always returns 0)
    let mac_nia0 = nas_mac(&key, count, bearer, direction, message, 0x00);
    println!("NIA0 (null)     MAC: 0x{mac_nia0:08x}");
    assert_eq!(mac_nia0, 0, "NIA0 must always return 0");

    // Each algorithm produces a different MAC for the same input
    assert_ne!(mac_nia1, mac_nia2);
    assert_ne!(mac_nia2, mac_nia3);
    println!("\nAll MACs computed successfully.");
}