Traceability from the ERTMS/ETCS baseline documents to this library. Keep current: a change to a module updates the row that names it.

As of 2026-09, the actual controlled documents (Subset-037-2 v4.0.0 "EuroRadio FIS - Safety Layer" and Subset-098 v4.0.0 "RBC-RBC Safe Communication Interface") are available and the MAC engine, KSMAC derivation and PDU layouts below were rewritten against their text, replacing an earlier, self-invented construction (see git history on src/mac/mac.c / src/saf/saf.c around 2026-09-21/22). Clause numbers below are Subset-037-2's own.

Subset-037-2 (EuroRadio FIS - Safety Layer)

Clause	Concern	Module / symbol	Status
§5	Sa-* service primitives	saf/saf.h (service model)	functional equivalent implemented (safecomm_saf_connect/send/recv/disconnect), not the literal primitive names
§6.2.2	Generic MAC-Calculation (CBC-MAC, "modified MAC algorithm 3", ISO/IEC 9797-1 Padding Method 1)	mac/mac.c safecomm_mac_compute	implemented and verified against the Annex B worked example (tests/test_mac_kat.c): every block but the last is single-DES under K1; the last is E(K3,D(K2,E(K1,·))); zero-padding, no extra block when the message is already 64-bit aligned
§6.2.3.2.1	Message origin authentication (MAC input = length‖DA‖m, DA = the receiver's own ETCS ID)	saf/saf.c mac_over_da_body	implemented from the clause text; no official per-PDU test vector exists to check it against (only the generic CBC-MAC primitive has one — see above)
§6.2.3.2.2 / Fig.6	Peer entity authentication (AU1/AU2/AU3 handshake, MAC over Text3/Text5 + RA/RB/DA)	saf/saf.c safecomm_saf_connect	implemented from the clause text and Figure 6; not verified against an official vector
§6.2.3.2.3.13-16	KSMAC derivation (RA/RB split into left/right halves, KS3 with reversed key order)	mac/mac.c safecomm_mac_derive_ksmac	implemented from the formula; the document gives no worked KSMAC example, so this is checked only for internal consistency, not a controlled-document answer
§6.2.4.2.12-15	AR (authentication response) confirmation	saf/saf.c (sent by the responder, awaited by the initiator before DATA)	implemented

| §6.2.5 | SaPDU structure (AU1 13 / AU2 21 / AU3 9 / AR 9 / DT 1+n+8 / DI 3 octets, packed ETY|MTI|DF header, 24-bit ETCS IDs) | saf/saf.c | implemented per Tables 6-13 | | §6.2.3.3.3.2 | Sa-DISCONNECT needs no authentication (release only affects availability) | saf/saf.c safecomm_saf_recv/safecomm_saf_disconnect | implemented: DI carries no MAC and no identity field, matching Table 6; any well-formed (right length, right type) DI is honoured | | §6.2.5.1.7 | Direction flag (reflection-attack defence) | saf/saf.c (header_df, checked before the MAC) | implemented and tested | | §6.3.2.3 / §6.9.2 | Connection establishment timer Testab | t_connect_ms, safecomm_saf_set_time | implemented and tested (default value not enforced by the library — caller-supplied) | | — | Sequence numbering (repetition / deletion / re-ordering defence) | saf/saf.c seq_tx/seq_rx, 4 bytes inside the SaUD area | not part of Subset-037-2's own DT PDU (Table 12 carries no sequence field) — that defence belongs to the Subset-098 SAI sub-layer below, which is not implemented. This library adds its own 4-byte sequence number inside the MAC-covered user-data area as a stand-in; it is a project extension, not conformant to any subset on its own | | — (out of scope) | Communication Functional Module, TCP/mobile bearer | transport/transport.h callback | n/a — the consumer supplies the transport |

Subset-098 (RBC-RBC Safe Communication Interface)

Clause	Concern	Module / symbol	Status
§5.2/5.3	Reuse of the Subset-037-2 Safety Layer as the SFM's lower half	saf/, rbc_rbc/rbc_rbc.c	the Safety Layer itself is implemented per Subset-037-2 above
§5.4.7 sequence numbering, §5.4.9 EC counter	Delay/re-ordering/repetition defence above the Safety Layer	sai/sai.c safecomm_sai_*	implemented (EC variant only): 16-bit sequence window (§5.4.7.2), EC-start exchange and the Delta/state freshness check (§5.4.9.3/.4). Tested end to end over a real SaF handshake (tests/test_sai.c). Not implemented: Triple Time Stamping (§5.4.8, the alternative technique — a materially larger 5-message clock-offset protocol), the long-term drift correction of §5.4.9.5, and the separate transmission-delay-detection heartbeat of §5.4.9.6
§6 (CFM: TCP/IP, ALE, redundancy)	Communication Functional Module	out of scope — transport/transport.h callback	n/a
§7.4	Key management guideline	KMAC supplied by the consumer as pre-shared material	out of scope, matches the guideline's own scoping
Subset-039 handover logic	Application-level handover decisions	out of scope — belongs in RBC_GP*	n/a

Key management

KMAC is supplied by the consumer as pre-shared 24-byte material (safecomm_*_config_t.kmac). Online distribution (Subset-038) and the KMC are out of scope.

Cryptographic caveat (SIL / security)

The MAC is a 3DES/single-DES hybrid CBC-MAC exactly as Subset-037-2 §6.2.2 specifies it ("single DES with modified MAC algorithm 3"). DES/3DES have a 64-bit block and are deprecated for general use; the EuroRadio construction has known academic weaknesses (birthday-bound collisions on long-lived sessions). It is implemented here because interoperability with deployed trackside requires exactly this algorithm. A future AES-based EuroRadio MAC (Subset-037-3 / FRMCS era) is planned as an additional safecomm_mac_alg_t, selected per connection — not a replacement of the 3DES path. Any safety case using this library must record the 3DES MAC as an accepted, standard-mandated constraint, not an implementation choice.