Relay ACK MIC incorrectly calculated

[StevenCellist]

Hi team,

In my opinion, the MIC of the ACK message is not correctly calculated. According to TS011-1.0.0 section 6.2, the CMAC is calculated over block B_0, AckUplinkEnc and WOR, where "WOR contains the data received in the WOR Relay Class A Uplink".
I read this as follows: the Frequency and Datarate fields in the WOR block should be the Frequency and Datarate as received in the WOR frame.
However, in LBM, the MIC is calculated using the Frequency and Datarate of the ACK message:

SWL2001/lbm_lib/smtc_modem_core/lr1mac/src/relay/relay_tx/relay_tx.c

Lines 596 to 609 in 0ad056a

	const relay_tx_channel_config_t* conf =
	( infos->last_ch_idx == 0 ) ? &infos->default_ch_config : &( infos->relay_tx_config.second_ch );
	wor_ack_mic_info_t ack_mic_info = {
	.dev_addr = lorawan_api_devaddr_get( relay_stack_id ),
	.wfcnt = infos->fcnt,
	.frequency_hz = conf->freq_hz,
	.datarate = conf->dr,
	};
	// SMTC_MODEM_HAL_TRACE_PRINTF( "frequency_hz = %d, infos->last_ch_idx = %d , .dev_addr = %x, datarate = %d\n",
	// conf->ack_freq_hz,infos->last_ch_idx,lorawan_api_devaddr_get( relay_stack_id ),conf->dr);
	// Key is set to NULL because it is already save in the crypto element (soft or hard)
	const uint32_t mic_calc = wor_compute_mic_ack( &ack_mic_info, infos->buffer, NULL );

SWL2001/lbm_lib/smtc_modem_core/lr1mac/src/relay/common/wake_on_radio.c

Lines 284 to 287 in 0ad056a

	tmp[3] = mic_info->datarate & 0x0F;
	tmp[4] = ( uint8_t )( freq_step );
	tmp[5] = ( uint8_t )( freq_step >> 8 );
	tmp[6] = ( uint8_t )( freq_step >> 16 );

I think that these fields should refer to the WOR payload's Freq/Dr instead. Please let me know your thoughts!

[mluis1]

Duplicate of #62

[StevenCellist]

Ah, sorry, the name of that issue somehow didn't strike my eye as being a duplicate. Thanks! I'll close this one.