0
$\begingroup$

If you were to have an MDKac key that you need to send to two parties you would need to encrypt this key with two different KEK/ZCMKs.

Will the KCV of the MDKac under KEK1 provide the same KCV as MDKac under KEK2?

This is using DES3 - ECB encryption.

$\endgroup$
1
$\begingroup$

The KCV generally consists of a single encryption of a block of all zeros using the key itself - and then taking a number of leftmost bytes, usually displayed as hexadecimals.

That means that the KCV doesn't change. The whole idea of a KCV is that it is deterministic; if it would be different for an identical key then it would lose its function.


Note that I didn't see any KCV calculation in the EMV specifications. Other methods may use e.g. a hash over the key value - but this isn't common. So in the end it depends on how it is specified outside of the EMV standards - if at all. However, the KCV should only be determined by the key value.

For 3DES keys the usual encryption of a zero block makes more sense, as some implementations ignore the parity bits, while others do not. This means that a functionally identical key could lead to different KCV values if hashing would be used. The KCV of 3DES keys that only differ with regard to the parity bits will be identical.

However, the use of a zero valued block encryption is dangerous as well: if a zero block encrypt is ever used in the protocol then the KCV will leak information about the value (e.g. when CTR mode encryption is used with a zero IV).

$\endgroup$
  • $\begingroup$ Wrote this down here as it is more than fits in a comment and might well answer the question. However, note that I'm not an expert for the given EMV specifications, so I might well miss something important. $\endgroup$ – Maarten Bodewes Feb 8 '18 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.