User's Manual

PIN Pad 791 Programmer’s Manual (PCI POS-A) UDN PM0103-U Rev. 06
Appendix A – Key management 2015-04-20
Page321
Uniform Industrial Corp. Proprietary and Confidential Total 342 pages
MAC value by key derived from KLK
2. For key with usage “K0”, the length must be 16 bytes or 24 bytes.
3. For MAC key with usage “M1”, the length of key must be 8 bytes (DES-MAC).
4. For MAC key with usage “M3”, the length of key must be 16 bytes (TDES-MAC).
5. Duplicate key injection is not allowed. (except IPEK0 and IPEK1)
6. The length of injected key in cipher-text should be equal to or less then the length of KLK.
Key Injection
To inject clear-text key (Key ID: 0~9, A~G) into PP791, the default attributes will be as following,
Key usage = “K0”, Algorithm = “T”, Mode = “D”, Version = “00” and export = “N”
To inject cipher-text key into PP791, user has to assign these attributes.
For Key 0 ~ 9,
Key usage should be “K0” or “P0”, algorithm should be “T” or “D”, mode should be “D” (If for “K0”
usage) or “E” (If for “D0” usage).
For Key B ~ E,
Key usage should be “K0”, “M1” or “M3”, algorithm should be “T” (If for “K0” or “M3” usage) or “D”
(If for “M1” usage), mode should be “D” (If for “K0” usage) or “G” (If for “M1” or “M3” usage).
For Key G,
Key usage should be “K0” or “D0”, algorithm should be “T” (If for “K0”) or “D”.
For Key F,
Key usage should be “K0”, algorithm should be “T”.
For IPEK 0~1
Key usage could be any 2 bytes data, algorithm should be “D” or “T”, mode should be “E”.
Inject key in cipher-text (TR31 format)
For Key 0~9, A~G
<SI>02[Key ID][KBH][Encrypted KEY][MAC]<SO>, where [KBH] + [Encrypted KEY] + [MAC] is
TR31 block.
For IPEK0
<STX>90[KBH][Optional KBH][DUKPT0][MAC]<ETX>, where [KBH and Optional KBH] +
[IPEK0] + [MAC] is TR31 block.
For IPEK1
<STX>94[KBH][Optional KBH][DUKPT1][MAC]<ETX>, where [KBH and Optional KBH] +
[IPEK1] + [MAC] is TR31 block.
KBH (Key Block Header – ASCII format):
A[4byte – length of TR31 block][2byte - Usage][1byte - Algorithm] [1byte - Mode][2byte -
Version][1byte - Export][2byte - option][2byte - rfu]