Zone Master Key (ZMK) also known as an Interchange key (IK), is a key-encrypting key which is distributed manually between two communicating sites, within a shared network, in order that further keys can be exchanged automatically. The ZMK is used to encrypt keys of a lower level (e.g. ZPK) for transmission.
The ZMK is exchanged using secured methods and Split knowledge policy. The IK is split into two components that are sent by two separate physical couriers to two nominated Security Officers of the other party. This is one of the most secure way to do it since no single person gains knowledge of the clear ZMK.
Here is the detailed Process. please note values indicated here are for testing only, in live environment the values will be exchanged securely.
Build ZMK Key manually:
This key is generated by two components, lets call them K1 and K2. To obtain the ZMK Key,
ZMK = K1 XOR K2
Test values provided,
K1 (clear) = 6D6B E51F 04F7 6167 4915 54FE 25F7 ABEF K2 (clear) = 6749 9B2C F137 DFCB 9EA2 8FF7 57CD 10A7 ZMK (clear) key = K1 XOR K2 = 0A227E33F5C0BEACD7B7DB09723ABB48; KCV = 05EE1D
Import ZMK into HSM
FK Key length [1,2,3]: 2 Key Type: 000 Key Scheme: U Component type [X,H,E,S]: X Enter number of components (2-9): 2 Enter component #1: 6D6BE51F04F76167491554FE25F7ABEF Enter component #2: 67499B2CF137DFCB9EA28FF757CD10A7 Encrypted key: U E685 8676 0A16 3026 C297 1007 3AB2 D7BE Key check value: 05EE1D
Zone PIN Key (ZPK) also known as a A PIN Protection Key (PPK), is a data encrypting key which is distributed automatically and is used to encrypt PINs. For security and protocol reasons the HSM where this key generated, never exposes the ZPK in clear. But it can be exported using another key called ZMK (Interchange Key). In this context exports actually means use the ZMK Key to encrypt the ZPK and give back to the user.
The following ZPK shared by communicating party, is encrypted under ZMK
ZPK encrypted under ZMK: AC4D3C5F603C1B502E5F45668A155C25 KCV: AFDA4F
From the host application, send the A6 commands with required arguments as following,
Atalla Variant = 00
Encrypted PPK Key = AC4D…….5C25
Key Scheme= X
Key Scheme LMK= U
Key Type = 001
ZMK = E68586760……..D7BE
ZMK Scheme = U
Response: 0000A700U5F2DC42E10C92B16BA54802314CE95F5AFDA4F ZPK under LMK: U5F2DC42E10C92B16BA54802314CE95F5 KCV: AFDA4F
Here we can compare KCV (AFDA4F) to check if key is imported successfully.
Hi, I need your help please. I Have a ZPK in clear, I use it for crypt a pin block of a pin; but when I try to validated this pin block in my HSM I have a error. I used 3DES to crypt pin block. I don´t know what I can to do. I have to use a specific IV? Thanks for read me.
Import the clear ZPK into the HSM, get the LMK(ZPK), then use the LMK(ZPK) to decrypt the PIN.