0

I have generated a BDK Type3 key for DUKPT in Thales HSM. I have sent this BDK which is encrypted under the LMK of the HSM to the terminal manufacturer to generate the IPEK key and inject it into the terminal.

When I receive the encrypted data I have the KSN and now I need the BDK again to decrypt it.I am not storing the BDK anywhere in my HOST application.How can I get the BDK again for decryption.Is it stored somewhere in the HSM.If there are multiple BDKs how do I find the right one used for this particular terminal?

psh
  • 9
  • 1
  • 3
  • Definitely not a programming question and thus [off-topic](https://stackoverflow.com/help/on-topic). This might be on topic in [superuser](https://superuser.com/) – President James K. Polk Jul 17 '17 at 11:34

2 Answers2

5

The BDK (Base Derivation Key) should be kept in the HSM so it's available when you need to decrypt. During decrypt you would pass the KSN (Key Serial Number) as input to the HSM, and the HSM would then recreate the DUKPT key used by the terminal for encryption from the BDK.

Ebbe M. Pedersen
  • 7,250
  • 3
  • 27
  • 47
  • How can I get the BDK kept in HSM?What is the command for doing that? – psh Jul 19 '17 at 10:40
  • 1
    I do not know the Thales HSM .. but the whole point of the BDK is that it's kept super secret, e.g. never leaves the HSM in clear etc. If the BDK is exposed you need to have new keys loaded on all your terminals. – Ebbe M. Pedersen Jul 19 '17 at 12:10
0

For data decryption you can use THALES HSM command M2 with parameters

  • BDK (under LMK) - This is the key that you sent to the terminal
    manufacturer
  • Encrypted data - received from the terminal
  • KSN - received from the terminal

About BDK exchange (between you and the terminal manufacturer)

The straightforward process is:

  1. exchange ZMK (zone master key) between you and the manufacturer
  2. encrypt BDK under ZMK
  3. the manufacturer decrypts the BDK (using the ZMK) in a secure environment (key injection room)
  4. the manufacturer produces IPEK using the clear BDK

Your BDK is encrypted under LMK. In other words your BDK is protected by LMK, in this way none else can you use your BDK (super secret key). Consistently if you send your BDK (under LMK), your manufacturer can not use the BDK (clear) for IPEK generation. That's why you need a ZMK in your process.

Panagiotis Giannakis
  • 400
  • 1
  • 9
  • 19