K4 TR-31 key blocks

Needs: Supporter

The header, the key usage and mode of use, versions A to D, wrapping, unwrapping and the MAC.

This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.

Sign in

Create a free account

See plans

What this module covers

Track K · Key management

The lesson, with diagrams, common mistakes and what to test
A worked example you can change: Wrapping a key in a TR-31 block, then reading it back
Practice: 4 kinds of generated exercise, each with a step-by-step solution
A quiz of 9 questions

Exportability: The TR-31 header field that says whether the key may be exported: E under a trusted key, N never, S sensitive.
Key block header: The first 16 characters of a TR-31 block: version, length, key usage, algorithm, mode of use, key version, exportability, number of optional blocks.
Key block protection key (KBPK): The key encryption key from which the TR-31 encryption and MAC keys are derived.
Key block version: The first character of a TR-31 block: B for triple DES with key derivation, D for AES; A and C are the older variant-binding methods.
Key usage: Two characters in the TR-31 header saying what the key is for: B0 BDK, K0 key encryption, P0 PIN encryption, M3 retail MAC, D0 data encryption, C0 card verification.
Mode of use: One character in the TR-31 header: E encrypt only, D decrypt only, B both, G generate, V verify, C generate and verify, X derive keys, N no restriction.
Optional block: An extra header field in a TR-31 block, such as the KSN of a DUKPT initial key or a key check value.
TR-31 key block: An interoperable format for exchanging a symmetric key: a readable header, the encrypted key and a MAC over both, so the usage cannot be changed.

The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.