Hallo!

Für ein Projekt soll ich die unten stehende Verschlüsselungsroutine mit re-keying implementieren. Leider kenne ich mich da nicht so gut aus und stehe auf der Leitung.
Kann mir bitte jemand erklären welche Schritte ich tun muß um die jeweils richtigen Ergebnisse zu bekommen?
z.B. Verschlüssle das per DES mit dem KEY X und IV X, usw...

Das würde mir sehr weiterhelfen!

Beste Grüsse

Bernhard




It is proposed that a terminal manufacturer specific key is loaded into a secure area of the terminal (PIN Pad?). This will act as a seed key for the Terminal Key Encrypting Key (TKEK) and will be used by the host and terminal only during the first PIN voucher request that a terminal sends to the PIN server to encrypt a Terminal Session Key (TSK) that will be passed to the terminal and used to decrypt the PIN code in all messages.

The terminal manufacturer will be supply a triple des key called the Terminal Manufacturer Key(TMK) to the network provider. This key will be used to encrypt the Terminal Key Encrypting Key (TKEK) so that the latter can be securely downloaded into the terminal during initialisation to Mipbase. The TMK will be pre-loaded by the terminal manufacturer into the terminal.

The TMK will be supplied to the network provider encrypted with a Terminal Manufacturer Transport Key (TMTK). The TMTK will be generated from two keys, TMTK1 and TMTK2. The following algorithm is used to derive the master key:

TMTK = TMTK1 XOR TMTK2
TMK = d*TMTK(e* TMTK (TMK))
A = e*TMK(TKEK)
A1 = First 8 bytes of A.
A2 = Second 8 bytes of A.

A1 and A2 are then entered into the appropriate dataset field. The encrypted TMK , TMTK1 and TMTK2 will be delivered in separate envelopes to the network provider's security officers and must be handled by them securely, as is done for electronic cash keys.


A number of Terminal Session Keys will be generated and stored under a reference of the Manufacturer Id and Key Version number. The key version number will be allocated independently of any external parameter with the first key allocated a number of 01, the second 02 etc and passed to the terminal in a separate sub-field (84). This is to avoid any issues with auto key updates on year end or making unnecessary dependencies in case of a key compromise situation.

The TSK will be sent to the terminal encrypted under the TKEK.