ZMK
Zone Master Key (ZMK) also known as an Interchange key (IK), is a key-encrypting key which is distributed manually between two communicating sites, within a shared network, in order that further keys can be exchanged automatically. The ZMK is used to encrypt keys of a lower level (e.g. ZPK) for transmission.
The ZMK is exchanged using secured methods and Split knowledge policy. The IK is split into two components that are sent by two separate physical couriers to two nominated Security Officers of the other party. This is one of the most secure way to do it since no single person gains knowledge of the clear ZMK.
Here is the detailed Process. please note values indicated here are for testing only, in live environment the values will be exchanged securely.
Build ZMK Key manually:
This key is generated by two components, lets call them K1 and K2. To obtain the ZMK Key,
ZMK = K1 XOR K2
Test values provided,
K1 (clear) = 6D6B E51F 04F7 6167 4915 54FE 25F7 ABEF
K2 (clear) = 6749 9B2C F137 DFCB 9EA2 8FF7 57CD 10A7
ZMK (clear) key = K1 XOR K2 = 0A227E33F5C0BEACD7B7DB09723ABB48;
KCV = 05EE1D
Import ZMK into HSM
FK
Key length [1,2,3]: 2
Key Type: 000
Key Scheme: U
Component type [X,H,E,S]: X
Enter number of components (2-9): 2
Enter component #1: 6D6BE51F04F76167491554FE25F7ABEF
Enter component #2: 67499B2CF137DFCB9EA28FF757CD10A7
Encrypted key: U E685 8676 0A16 3026 C297 1007 3AB2 D7BE
Key check value: 05EE1D
ZPK
Zone PIN Key (ZPK) also known as a A PIN Protection Key (PPK), is a data encrypting key which is distributed automatically and is used to encrypt PINs. For security and protocol reasons the HSM where this key generated, never exposes the ZPK in clear. But it can be exported using another key called ZMK (Interchange Key). In this context exports actually means use the ZMK Key to encrypt the ZPK and give back to the user.
Import ZPK
The following ZPK shared by communicating party, is encrypted under ZMK
ZPK encrypted under ZMK: AC4D3C5F603C1B502E5F45668A155C25
KCV: AFDA4F
From the host application, send the A6 commands with required arguments as following,
HSM Command:
0000A6001UE68586760A163026C29710073AB2D7BEXAC4D3C5F603C1B502E5F45668A155C25U00
Where,
Atalla Variant = 00
Encrypted PPK Key = AC4D…….5C25
Key Scheme= X
Key Scheme LMK= U
Key Type = 001
ZMK = E68586760……..D7BE
ZMK Scheme = U
Response:
0000A700U5F2DC42E10C92B16BA54802314CE95F5AFDA4F
ZPK under LMK: U5F2DC42E10C92B16BA54802314CE95F5
KCV: AFDA4F
Here we can compare KCV (AFDA4F) to check if key is imported successfully.
Cryptography & Payments 