CKM_DES2_DUKPT_DATA

The CKM_DES2_DUKPT family of key derive mechanisms create keys used to protect EFTPOS terminal sessions. The mechanisms implement the algorithm for server side DUKPT derivation as defined by ANSI X9.24 part 1.

Summary

FIPS approved?	No
Supported functions	Derive
Functions restricted from FIPS use	N/A
Minimum key length (bits)	128
Minimum key length for FIPS use (bits)	N/A
Minimum legacy key length for FIPS use (bits)	N/A
Maximum key length (bits)	192
Block size	0
Digest size	0
Key types	Symmetric
Algorithms	None
Modes	None
Flags	None

Usage

This mechanism has the following attributes:

>Only CKK_DES2 keys can be derived. The mechanism will force the CKA_KEY_TYPE attribute of the derived object to equal CKK_DES2. If the template does specify a CKA_KEY_TYPE attribute then it must be CKK_DES2.

>The mechanism takes a CK_KEY_DERIVATION_STRING_DATA structure as a parameter.

>The pData field of the parameter must point to a 10 byte array which holds the 80 bit Key Sequence Number (KSN).

>This mechanism contributes the CKA_CLASS and CKA_KEY_TYPE and CKA_VALUE to the resulting object.

The DUKPT MAC and DATA versions will default to the appropriate usage mechanism as described in the following table:

Mechanism	CKA_SIGN	CKA_VERIFY	CKA_DECRYPT	CKA_ENCRYPT
CKM_DES2_DUKPT_MAC	True	True
CKM_DES2_DUKPT_MAC_RESP	True
CKM_DES2_DUKPT_DATA			True	True
CKM_DES2_DUKPT_DATA_RESP				True

Example

#define CKM_DES2_DUKPT_PIN		(CKM_VENDOR_DEFINED + 0x611)
#define CKM_DES2_DUKPT_MAC		(CKM_VENDOR_DEFINED + 0x612)
#define CKM_DES2_DUKPT_MAC_RESP  	(CKM_VENDOR_DEFINED + 0x613)
#define CKM_DES2_DUKPT_DATA		(CKM_VENDOR_DEFINED + 0x614)
#define CKM_DES2_DUKPT_DATA_RESP 	(CKM_VENDOR_DEFINED + 0x615)

CK_OBJECT_HANDLE hBDKey; // handle of CKK_DES2 or CKK_DES2 Base Derive Key
CK_OBJECT_HANDLE hMKey;   // handle of CKK_DES2 MAC session Key
CK_MECHANISM svMech = { CKM_DES3_X919_MAC , NULL, 0};

CK_KEY_DERIVATION_STRING_DATA param;
CK_MECHANISM kdMech = { CKM_DES2_DUKPT_MAC , NULL, 0};
CK_CHAR ksn[10];
CK_CHAR inp[any length];
CK_CHAR mac[4];
CK_SIZE len;

// Derive MAC verify session key
param.pData=ksn;
param.ulLen = 10;

kdMech.mechanism = CKM_DES2_DUKPT_MAC;
kdMech.pParameter = &param;
kdMech.ulParameterLen = sizeof parram;

C_DeriveKey(hSes, &kdMech, hBDKey , NULL, 0, &hMKey);

// Single part verify operation

C_VerifyInit(hSes, &svMech, hMKey);
len = sizeof mac;
C_Verify(hSes, inp, sizeof inp, mac, len);

// clean up

C_DestroyObject(hSes, hMKey);

// Test vectors