> For the complete documentation index, see [llms.txt](https://developer.magtek.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/commands/security-command-group-0xennn/encrypt-user-data-command-0xef09.md).

# Encrypt User Data - Command 0xEF09

The host uses this command to request that the device encrypt a block of user data embedded in the command string. The SRED ID 2 Key will be used for encryption. The TLVs of KSN and Encryption Type will be provided at the end of the string for decryption.

{% stepper %}
{% step %}

### Host request and device processing

The sequence of events is as follows:

* The host composes a command request in the format below and sends it to the device.
* The device will fetch the Real-Time Clock Date/Timestamp, retrieve the device's Serial Number, extract the data within 0xA3 TLV in the command string. And then concatenate all the collected TLVs as follows: + + \<User Data TLV(s)>. The format of the encrypted data string is shown in the Response Data below.
* If the command is invalid or encryption fails, then a response of failure will be sent to the host.
  {% endstep %}
  {% endstepper %}

## **Table EUD-1 - Request Data for Command 0xEF09 - Encrypt User Data**

<table><thead><tr><th width="211">Tag</th><th width="54.66668701171875">Len</th><th>Value / Description</th><th width="75.66668701171875">Typ</th><th width="76.6666259765625">Req</th><th width="97.333251953125">Default</th></tr></thead><tbody><tr><td>Beginning of any wrappers, at minimum including <strong>Request Message</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>EF09 = <strong>Encrypt User Data - Command 0xEF09</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>A3</td><td>var</td><td>User data parameters for item #0 to item #3. The maximum total size of 0xA3 TLV is 4,000 bytes.</td><td>B</td><td>R</td><td></td></tr><tr><td>/81</td><td>var</td><td>User data item #0, required, minimum 1 byte.</td><td>B</td><td>R</td><td></td></tr><tr><td>/82</td><td>var</td><td>User data item #1, optional</td><td>B</td><td>O</td><td></td></tr><tr><td>/83</td><td>var</td><td>User data item #2, optional</td><td>B</td><td>O</td><td></td></tr><tr><td>/84</td><td>var</td><td>User data Item #3, optional</td><td>B</td><td>O</td><td></td></tr><tr><td>End of any wrappers, at minimum including <strong>Request Message</strong></td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

## **Table EUD-2 - Response Data for Command 0xEF09 – Encrypt User Data**

<table><thead><tr><th width="239.6666259765625">Tag</th><th width="74.33331298828125">Len</th><th width="211.6666259765625">Value / Description</th><th width="74.33331298828125">Typ</th><th width="74.6666259765625">Req</th><th width="98">Default</th></tr></thead><tbody><tr><td>Beginning of any wrappers, at minimum including <strong>Response Message</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>EF09 = <strong>Encrypt User Data -</strong> <strong>Command 0xEF09</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>F8</td><td>var</td><td>Container for Encrypted Data</td><td>T</td><td>R</td><td></td></tr><tr><td>/DFDF59</td><td>var</td><td>Encrypted Data Primitive ( length includes padding) Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encryption Type parameter below to read its contents.</td><td>B</td><td>R</td><td></td></tr><tr><td>/DFDF56</td><td>var</td><td>Encrypted Data KSN</td><td>B</td><td>R</td><td></td></tr><tr><td>/DFDF57</td><td>01</td><td>Encrypted Data Encryption Type See <strong>Encryption Type</strong> for a list of valid values.</td><td>B</td><td>R</td><td></td></tr><tr><td>End of any wrappers, at minimum including Response Message </td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

## **Table EUD-3 - Response Data for Encrypt User Data (after decryption) - Command 0xEF09**

<table><thead><tr><th width="251.3333740234375">Tag</th><th width="75.6666259765625">Len</th><th width="202">Value / Description</th><th width="76">Typ</th><th width="77.6666259765625">Req</th><th width="98.6666259765625">Default</th></tr></thead><tbody><tr><td>Beginning of any wrappers, at minimum including <strong>Response Message</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>EF09 = <strong>Encrypt User Data - Command 0xEF09</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>F8</td><td>var</td><td>Container for Encrypted Data</td><td>T</td><td>R</td><td></td></tr><tr><td>/DFDF59</td><td>var</td><td>Encrypted Data Primitive, length includes padding</td><td>T</td><td>R</td><td></td></tr><tr><td>//FC</td><td>var</td><td>Decrypted Data Container, length excludes padding</td><td>T</td><td>R</td><td></td></tr><tr><td>///81</td><td>04</td><td>Real Time Clock, Epoch Time in seconds, unsigned 32 bits. The date and time shall be Universal Time Coordinated (UTC).</td><td>B</td><td>R</td><td></td></tr><tr><td>///82</td><td>04</td><td>Device Serial Number</td><td>B</td><td>R</td><td></td></tr><tr><td>///A3</td><td>var</td><td>User data parameters for item #0 to item #3. The maximum total size of 0xA3 TLV is 4,000 bytes.</td><td>B</td><td>R</td><td></td></tr><tr><td>////81</td><td>var</td><td>User data item #0, required, minimum 1 byte</td><td>B</td><td>R</td><td></td></tr><tr><td>////82</td><td>var</td><td>User data item #1, optional</td><td>B</td><td>O</td><td></td></tr><tr><td>////83</td><td>var</td><td>User data item #2, optional</td><td>B</td><td>O</td><td></td></tr><tr><td>////84</td><td>var</td><td>User data item #3, optional</td><td>B</td><td>O</td><td></td></tr><tr><td>PKCS7 padding, maximum 16 bytes, minimum 1 byte</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>/DFDF56</td><td>var</td><td>Encrypted Data KSN</td><td>B</td><td>R</td><td></td></tr><tr><td>/DFDF57</td><td>01</td><td>Encrypted Data Encryption Type See section 4.4 Encryption Type for a list of valid values.</td><td>B</td><td>R</td><td></td></tr><tr><td>End of any wrappers, at minimum including Response Message </td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

## **Table EUD-4 - Request Example**

{% code title="Example (hex)" %}

```
AA-00 81-04-01-03-EF-09 // P1, Message Info, 0xEF09 Command
84-3E-EF-09 // P4, Request Payload
A3-3A // User data parameters, total 58 bytes
81-20 // User data item #0, 32 bytes
00-01-02-03-04-05-06-07-08-09-0A-0B-0C-0D-0E-0F
10-11-12-13-14-15-16-17-18-19-1A-1B-1C-1D-1E-1F
82-06 // User data item #1, 6 bytes
00-01-02-03-04-05
83-06 // User data item #2, 6 bytes
06-07-08-09-0A-0B
84-06 // User data item #3, 6 bytes
0C-0D-0E-0F-10-11
```

{% endcode %}

## **Table EUD-5 - Response Example**

{% code title="Example (hex)" %}

```
AA-00
81-04-82-03-EF-09 // P1, Message Info, 0xEF09 Response
82-04-00-00-00-00 // P2, Response Status
84-82-00-6F-EF-09 // P4, Response payload
F8-82-00-69 // Encrypted Data Container
DF-DF-59-82-00-50 // Encrypted Data Primitive
31-4D-0E-4B-52-EB-96-33-FD-D4-D6-9D-C9-D8-12-56
2C-09-CF-2A-E6-09-34-F9-55-AF-57-42-EB-AE-F4-B3
7B-2D-94-DF-E5-35-6F-4F-9D-36-5F-D1-F7-9F-40-F2
B6-1D-B6-97-C8-0E-2F-E2-1B-04-62-E8-3D-0A-EF-87
77-06-F6-07-0F-8C-9C-0A-51-76-E8-D3-78-05-AF-13
DF-DF-56-0A // Encryption KSN
FF-FF-98-76-54-32-10-20-00-02
DF-DF-57-01 // Encryption Type
```

{% endcode %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/commands/security-command-group-0xennn/encrypt-user-data-command-0xef09.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.