How does a companion device verify the service HMAC comes from a Windows device?

The Windows Companion Device Framework (CDF) is a Windows framework that defines a security protocol between a Windows device and a companion device (e.g., Android phone.) so that a companion device can unlock a Windows device.

The question is, how does a companion device verify the service HMAC comes from a Windows device?

The answer was not provided by the old version of CDF site page, but I found, the answer appeared in the latest updated version, 9/19/2016.

In the Authentication protocol section, it describes:

Validate Service HMAC = HMAC (authentication key, service nonce||device nonce||session nonce).

I write the process of verification as below for coding better.

• The companion device accepts data from the Windows device.
• (HmacSrv, NonceSrv, NonceDk, NonceSk)
• It verifies the data by the formula.
• HmacSrv2 = HMAC-SHA256 (AuthKey, NonceSrv||NonceDk||NonceSk)
• It checks if HmacSrv equals to HmacSrv2.
• If yes, continue to unlock the Windows device.

Another question is why does the companion device need to verify HmacSrv? The reason is to make sure that data comes from the windows device that was trusted by the companion device because both has been registered each other in the registration process.

-Count