I'm baffled by everything about the intended authentication path?! TFA has like 6 paragraphs which reduce to;

  CRC32(MD5(Pin)||Nonce)[0:1]

My eyes! Is something wrong with HMAC?