5 - Encryption, Decryption, and Key Management
eDynamo| Secure Card Reader Authenticator | Programmer’s Manual (COMMANDS)
Page 36 of 245 (D998200115-17)
5 Encryption, Decryption, and Key Management
Some data exchanged between the device and the host is encrypted. This includes Encrypted Track
Data, Encrypted MagnePrint Data, Encrypted Session ID, and parts of the ARQC Messages (EMV
Only) and Transaction Result Messages (EMV Only). To decrypt this data, the host must first
determine what key to use, then decrypt the data.
5.1 Determining Key
When the device and the host are using TDES DUKPT key management and the device is encrypting data
(see Security Levels), the host software must do the following to generate a key (the “derived key”) to
use for decryption:
1) Determine the value of the Initial Key loaded into the device. The lookup methods the host
software uses depend on the overall solution architecture, and are outside the scope of this document.
However, most solutions do this in one of two ways, both of which use the Initial Key Serial Number
that arrives with the encrypted data (see Command 0x09 - Get Current TDES DUKPT KSN for
details about interpreting the KSN):
a) Look up the value of the Base Derivation Key using the Initial KSN portion of the current KSN
as an index value, then use TDES DUKPT algorithms to calculate the value of the Initial Key; or
b) Look up the value of the Initial Key directly, using the Initial KSN portion of the current KSN as
an index value.
2) Derive the current key. Apply TDES DUKPT algorithms to the Initial Key value and the encryption
counter portion of the KSN that arrives with the encrypted data.
3) Determine which variant of the current key the device used to encrypt. The variants are defined
in ANS X9.24-1:2009 Annex A, which programmers of host software must be familiar with. Which
variant the host should use depends on the type of data the host is decrypting or encrypting, and on
device settings:
a) Encrypted MagnePrint Data is encrypted according to the setting in Property 0x56 -
MagnePrint Data Encryption Variant (MSR Only, Configurable MagnePrint Variants
Only), if the device supports it. Otherwise, it is encrypted according to the setting in Property
0x54 - Card Data Encryption Variant (MSR Only, Configurable MSR Variants Only), if the
device supports it. Otherwise, it is encrypted using the PIN Encryption variant.
b) Encrypted Track Data and Encrypted Session ID is encrypted according to the setting in
Property 0x54 - Card Data Encryption Variant (MSR Only, Configurable MSR Variants
Only), if the device supports it. Otherwise, it is encrypted using the PIN Encryption variant.
c) EMV data is encrypted according to the setting in Property 0x67 - EMV Data Encryption
Variant (EMV Only).
4) Use the variant algorithm with the current key to calculate that variant.
5) Decrypt the data according to the steps in section 5.2 Decrypting Data.
To Next Page
