Usage example

The scenario described shows how these functions might be combined in a real-life application to distribute a key to an ATM and keep a copy for local use. Some of the terminology used reflects typical terms used in ATM networks. The example illustrates a fairly complex real-world key distribution scenario, in which these values are produced.
  • A TMK (Terminal Master Key), which is the root KEK used by the ATM to exchange other keys, is produced in two forms: (1) encrypted under the ATM public key, so it can be sent to the ATM, and (2) as an RKX key token that will be used in subsequent calls to the Remote Key Export callable service to produce other keys.
  • A key-encrypting key KEK1 that is encrypted under the TMK in a form that can be understood by the ATM.
  • A PIN-encrypting key PINKEY be used by the ATM to encrypt customer-entered PINs and by the host to verify those PINs. The PINKEY is produced in two forms:
    1. Encrypted under KEK1 in a form that can be understood by the ATM.
    2. As a CCA internal DES key token with the proper PIN-key CV, encrypted under the CCA DES master key and suitable for use with the coprocessor.
It takes seven steps to produce these keys using the Remote Key Export callable service. These steps use a combination of five rules contained in a single trusted block. The rules in this example are referred to as GENERAT1, GENERAT2, EXPORT1, EXPORT2, and EXPORT3.
  1. Use the Remote Key Export callable service with rule ID "GENERAT1" to generate a TMK for use with the ATM. The key will be output in two forms:
    1. ePu(TMK): Encrypted under the ATM public key, supplied in the certificate parameter, CERT.
    2. RKX(TMK): As an RKX key token, suitable for subsequent input to the CSNDRKX callable service.
  2. Use the Remote Key Export callable service with rule ID "GENERAT2" to generate a key-encrypting key (KEK1) as an RKX key token, RKX(KEK1).
  3. Use the Remote Key Export callable service with rule ID "GENERAT2" to generate a PIN key (PINKEY) as an RKX key token: RKX(PINKEY).
  4. Use the Remote Key Export callable service with rule ID "EXPORT1" to export KEK1 encrypted under the TMK as a CCA DES key token using a variant of zeros applied to the TMK. This produces eTMK(KEK1).
  5. Use the Remote Key Export callable service with rule ID "EXPORT2" to export PINKEY encrypted under KEK1 as a CCA token using a variant of zeros applied to KEK1. This produces eKEK1(PINKEY).
  6. Use the Remote Key Export callable service with rule ID "EXPORT3" to export PINKEY encrypted under KEK2 as an existing CCA key-encrypting key on the local server. This produces eKEK2(PINKEY), with the CCA control vector for a PIN key.
  7. Use the Key Import callable service to import the PINKEY produced in step 6 into the local system as an operational key. This produces eMK(PINKEY), a copy of the key encrypted under the local DES master key (MK) and ready for use by CCA PIN API functions.