IBM Computer Hardware 2 User Manual download pdf (Page 170)

CCA Release 2.54

therefore it is very important to handle the key-generating key with a high degree of

security lest the interactions with the whole population of cards be placed in

jeopardy.

In the current implementation, several methods of diversifying a key are supported:

CLR8-ENC, TDES-ENC, TDES-DEC, SESS-XOR, TDES-XOR, and TDESEMV2

and TDESEMV4. The first two methods triple-encrypt data using the

generating_key to form the diversified key. The diversified key is then

multiply-enciphered by the master key modified by the control vector for the output

key. The TDES-DEC method is similar except that the data is triple-decrypted.

The SESS-XOR method provides a means for modifying an existing DATA,

DATAC, MAC, DATAM, or MACVER, DATAMV single- or double-length key. The

provided data is exclusive-ORed into the clear value of the key. This form of key

diversification is specified by several of the credit card associations.

The TDES-ENC and TDES-DEC methods permit the production of either another

key-generating key, or a “final” key. Control-vector bits 19-22 associated with the

key-generating key specify the permissible type of final key. (See DKYGENKY on

page C-6.) Control-vector bits 12-14 associated with the key-generating key

specify if the diversified key is a final key or another in a series of key-generating

keys. Bits 12 to 14 specify a counter that is decreased by one each time the

Diversified_Key_Generate verb is used to produce another key-generating key. For

example, if the key-generating key that you specify has this counter set to B'010',

then you must specify the control vector for the generated_key with a DKYGENKY

key type having the counter bits set to B'001' and specifying the same final key

type in bits 19-22. Use of a generating_key with bits 12-14 set to B'000' results in

the creation of the final key. Thus you can control both the number of

diversifications required to reach a final key, and you can closely control the type of

the final key.

The TDESEMV2, TDESEMV4, and TDES-XOR methods also derive a key by

encrypting supplied data including a transaction counter value received from an

EMV smart card. The processes are described in detail at“VISA and EMV-Related

Smart Card Formats and Processes” on page E-17 . Refer to “Working With EMV

Smart Cards” on page 8-13 to understand the various verbs you can use to

operate with EMV smart cards.

Storing Keys in Key Storage

Only internal key-tokens can be stored in key storage. The verbs that you use to

create, write, read, delete, and list records in key storage, and the format of the key

label used to access these records, are described in Chapter 7, “Key-Storage

Verbs.”

Note: To use key storage, the Compute_Verification_Pattern command must first

be authorized. This command is used to validate that the symmetric master-key

used to encipher keys within the key-storage file had the same value as the

symmetric master-key in the cryptographic facility when the key-storage file is

opened.

5-20 IBM 4758 CCA Basic Services, Release 2.54, February 2005

1 2 ... 165 166 167 168 169 170 171 172 173 174 175 ... 507 508

Comments to this Manuals

No comments

IBM Computer Hardware 2 User Manual Page 170

Comments to this Manuals

Related products and manuals for Software IBM Computer Hardware 2