Command 0xF017 - Establish Ephemeral KBPK
The host uses this command to complete the ECDHE-ECDSA Key Exchange protocol, which enables the host and the device to generate the same TEMP KBPK key to use with Command 0xEF01 - Load Key Using TR-31 to load the Master Transport Key (MTK).
The sequence of events is as follows:
The host uses Command 0xE001 - Get Challenge to establish a secure session with the device.
The host constructs Command 0xF017 - Establish Ephemeral KBPK per the request table below.
The host constructs Command 0xEEEE - Send Secured Command to Device using the previously constructed command request as the payload, and sends that command request to the device as a Request Message.
Because this command is secured using a signature, read Property 2.1.2.2.2.6 Key Type to determine which fixed key to use to generate the signature.
Build the Security Parameters Type portion of the wrapper with:
Table 46 - Encrypted Signature Capture File Type Operation Type = Command Authorization Using Signature
Operation Algorithm = ECDSA (indeterministic)
Operation Hash = SHA-256
Operation Curve = P521
The device does the following:
Validates the secure wrapper around the command, and terminates if the signature is invalid.
Determines if the Master Transport Key (MTK) has already been loaded. If it has, the device rejects the command request.
Generates a pair of keys, saves the Device Private Key for calculation.
Generates and saves 8 bytes of Device Random Token for calculation.
Calculates the TEMP KBPK based on Host Public Key and Host Random Token passed in with the command request, and the Device Private Key and Device Random Token the device generated.
The device sends a Response Message to the host to indicate the result. The response message includes Device Random Token and Device Public Key.
The host calculates a matching TEMP KBPK as defined in NIST SP800-56A, using the Host Private Key, Host Random Token, Device Public Key, and Device Random Token. It can then use this key to perform encryption operations on secret data in the Master Transport Key (MTK).
The device uses its copy of the matching TEMP KBPK to decrypt the secret information encrypted by the host using the same key. On successful MTK load, the device erases the TEMP KBPK. It also erases the TEMP KBPK if the device is power cycled or reset, and the host would need to restart the process with a new TEMP KBPK.
Table - Request Data for Command 0xF017 - Establish Ephemeral KBPK
Beginning of any wrappers, at minimum including Request Message
F017 = Command 0xF017 - Establish Ephemeral KBPK
A1
var
Security Parameters — This contains a Security Parameters Type TLV data object with only the first parameter populated with:
01 = Key Agreement
01 = ECDHE
05 = Curve P521
01 = SP800-56A
B
R
83
var
Host Ephemeral Public Key — This parameter is in ASN.1 format. The information of the cipher and key size are included in the ASN.1 Public Key file (PKCS#8).
B
R
84
08
Host Random Token
This contains an 8 byte random number generated by the host.
B
R
Table - Response Data for Command 0xF017 - Establish Ephemeral KBPK
Beginning of any wrappers, at minimum including Response Message
F017 = Command 0xF017 - Establish Ephemeral KBPK
A1
var
Security Parameters — This contains a Security Parameters Type TLV data object populated entirely with 0x00 padding to indicate that all values are the same as the corresponding values in the Request.
B
R
83
var
Device Ephemeral Public Key — This parameter is in ASN.1 format. The information of the cipher and key size are included in the ASN.1 key file.
B
R
84
08
Device Random Token — This contains an 8 byte random number generated by the device.
B
R
End of any wrappers, at minimum including Response Message found
Table - Request Example
Table - Response Example
Last updated