Required commands

Edit online

The required commands for CSNBT31I.

The TR31 Key Import verb requires the following commands to be enabled in the active role:

Required commands for the TR31 Key Import verb, according to the rule-array wrap keyword
Rule-array keyword Offset Command
WRAP-ENH or WRAP-ECB X'0153' TR31 Import - Permit override of default wrapping method

Required commands for the TR31 Key Import verb, according to the TR-31 key block version ID
TR-31 key block version ID Offset Command
"A" (X'41') X'0150' TR31 Import - Permit version A TR-31 key blocks
"B" (X'42') X'0151' TR31 Import - Permit version B TR-31 key blocks
"C" (X'43') X'0152' TR31 Import - Permit version C TR-31 key blocks

Be aware of access control point X'017C' (TR31 Import - Permit V0/V1/V2:N to PINGEN/PINVER) for import of PINGEN or PINVER keys to TR-31 key blocks, key usage "V0", "V1", or "V2", and mode "N". TR-31 key blocks may use the same mode "N" for PINGEN as well as PINVER keys. Enabling a PINGEN and PINVER access-control point while enabling offset X'017C' (for mode "N") is NOT recommended. Failure to comply with this recommendation allows changing PINVER keys into PINGEN, and the other way around.

In addition to the required commands, the verb needs these additional commands to be enabled in the active role depending on the rule-array keyword provided:

Required commands for the TR31 Key Import verb, according to the rule-array keyword. Please note that this is a complex table not containing any blank cells.
Rule-array keyword Offset Command Specific key usage, version ID, and mode values
"C0": TR-31 CVK card verification keys
CVK-CSC X'015B' TR31 Import - Permit C0 to MAC/MACVER:AMEX-CSC See Table 2.
CVK-CVV X'015A' TR31 Import - Permit C0 to MAC/MACVER:CVVKEY-A
"K0" and "K1": TR-31 key encryption or wrapping, or key block protection keys
OKEYXLAT or EXPORTER X'015C' TR31 Import - Permit K0:E to EXPORTER/OKEYXLAT See Table 4.
X'015E' TR31 Import - Permit K0:B to EXPORTER/OKEYXLAT
X'0160' TR31 Import - Permit K1:E to EXPORTER/OKEYXLAT
X'0162' TR31 Import - Permit K1:B to EXPORTER/OKEYXLAT
IKEYXLAT or IMPORTER X'015D' TR31 Import - Permit K0:D to IMPORTER/IKEYXLAT
X'015F' TR31 Import - Permit K0:B to IMPORTER/IKEYXLAT
X'0161' TR31 Import - Permit K1:D to IMPORTER/IKEYXLAT
X'0163' TR31 Import - Permit V2 to PINVER:VISA-PVV
"M0", "M1", and "M3": TR-31 ISO MAC algorithm keys
N/A X'0164' TR31 Import - Permit M0/M1/M3 to MAC/MACVER:ANY-MAC See Table 5.
X'018C' T31X - Permit DES MACVER/DATAMV to M0:V
"M7": TR-31 HMAC keys
N/A X'017D' TR31 Import - Permit HMAC MAC See Table 6.
"P0", "V0", "V1": TR-31 PIN encryption or PIN verification keys
N/A X'0165' TR31 Import - Permit P0:E to OPINENC See Table 7.
X'0166' TR31 Import - Permit P0:D to IPINENC
PINGEN X'0167' TR31 Import - Permit V0 to PINGEN:NO-SPEC
X'0169' TR31 Import - Permit V1 to PINGEN:IBM-PIN/IBM-PINO
X'016B' TR31 Import - Permit V2 to PINGEN:VISA-PVV
X'017C' TR31 Import - Permit V0/V1/V2:N to PINGEN/PINVER
PINVER X'0168' TR31 Import - Permit V0 to PINVER:NO-SPEC
X'016A' TR31 Import - Permit V1 to PINVER:IBM-PIN/IBM-PINO
X'016C' TR31 Import - Permit V2 to PINVER:VISA-PVV
X'017C' TR31 Import - Permit V0/V1/V2:N to PINGEN/PINVER
"E0", "E1", "E2", "E3", "E4", and "E5": TR-31 EMC/chip issuer master-key keys
DKYL0 X'016D' TR31 Import - Permit E0 to DKYGENKY:DKYL0+DMAC See Table 9.
X'016E' TR31 Import - Permit E0 to DKYGENKY:DKYL0+DMV
X'0171' TR31 Import - Permit E1 to DKYGENKY:DKYL0+DMPIN
X'0172' TR31 Import - Permit E1 to DKYGENKY:DKYL0+DDATA
X'0175' TR31 Import - Permit E2 to DKYGENKY:DKYL0+DMAC
X'0179' TR31 Import - Permit E5 to DKYGENKY:DKYL0+DMAC
X'017A' TR31 Import - Permit E5 to DKYGENKY:DKYL0+DDATA
X'017B' TR31 Import - Permit E5 to DKYGENKY:DKYL0+DEXP
DKYL1 X'016F' TR31 Import - Permit E0 to DKYGENKY:DKYL1+DMAC See Table 9.
X'0170' TR31 Import - Permit E0 to DKYGENKY:DKYL1+DMV
X'0173' TR31 Import - Permit E1 to DKYGENKY:DKYL1+DMPIN
X'0174' TR31 Import - Permit E1 to DKYGENKY:DKYL1+DDATA
X'0176' TR31 Import - Permit E2 to DKYGENKY:DKYL1+DMAC
DMAC X'016D' TR31 Import - Permit E0 to DKYGENKY:DKYL0+DMAC See Table 9.
X'016F' TR31 Import - Permit E0 to DKYGENKY:DKYL1+DMAC
X'0175' TR31 Import - Permit E2 to DKYGENKY:DKYL0+DMAC
X'0176' TR31 Import - Permit E2 to DKYGENKY:DKYL1+DMAC
X'0179' TR31 Import - Permit E5 to DKYGENKY:DKYL0+DMAC
DMV X'016E' TR31 Import - Permit E0 to DKYGENKY:DKYL0+DMV See Table 9.
X'0170' TR31 Import - Permit E0 to DKYGENKY:DKYL1+DMV
DMPIN X'0171' TR31 Import - Permit E1 to DKYGENKY:DKYL0+DMPIN
X'0173' TR31 Import - Permit E1 to DKYGENKY:DKYL1+DMPIN
DDATA X'0172' TR31 Import - Permit E1 to DKYGENKY:DKYL0+DDATA See Table 9.
X'0174' TR31 Import - Permit E1 to DKYGENKY:DKYL1+DDATA
X'017A' TR31 Import - Permit E5 to DKYGENKY:DKYL0+DDATA
DEXP X'017B' TR31 Import - Permit E5 to DKYGENKY:DKYL0+DEXP See Table 9.
N/A X'0177' TR31 Import - Permit E3 to ENCIPHER
X'0178' TR31 Import - Permit E4 to DKYGENKY:DKYL0+DDATA