1
$\begingroup$

We have a POS (Ingenico) that uses DES3-CBC encryption using a derived key. It sends encrypted data, and 10 bytes size Key Serial Number (KSN). I tried to use CKM_DES3_CBC_ENCRYPT_DATA to derive the key, and decrypted the data using DES3-CBC mech. However, I get some gibberish data something like this: 

\ufffd\u001dl\ufffdP\ufffdl\ufffd\ufffd\ufffd+\ufffd\ufffd[\ufffd\ufffdl\u0017\ufffd\ufffd\ufffd\u001f?E\ufffd[*\ufffdmd\u0014\u0009ay\ufffd\ufffd3\ufffd\ufffd

I am not sure if I am using correct mechanism to derive the key, or even using the correct mechanism to decrypt the data.

Can someone please help me understand what could have been wrong? Some info says I need to pad the KSN.

Edit: I asked a similar question on Github/PKCS

Improve this question
$\endgroup$
2
  • $\begingroup$ Can you show the data as binary encoded to hexadecimals instead of 16 bit unicode code points? Base 64 would also be fine. $\endgroup$
    – Maarten Bodewes ♦
    Feb 23, 2020 at 22:07
  • $\begingroup$ @MaartenBodewes Thanks for responding. Here's the binary: [255 193 32 23 3 0 1 0 0 1 255 255 255 255 255 255] the 255s at the ends are what I padded. $\endgroup$
    – onesick1
    Feb 25, 2020 at 14:42

1 Answer 1

Reset to default
1
$\begingroup$

I solved the problem. So for people who are hunting for the answer, you need to consider what mechs your HSM supports. Every logic I had in the code was correct. The only problem was the mechanism that I used to derive the key was wrong. There are several mechs that are available to derive the key with, which was the hard part to figure out since it did not specify. I started with CKM_DES3_CBC_ENCRYPT_DATA as stated in the question, but turns out, I had to use CKM_DES2_DUKPT_DATA. And this mech was not defined in any wrapper libraries such as c# interlop pkcs11 library or the one I use, golang. Because this is a vendor defined mechanisms, I had to define it myself, and use it accordingly.

I hope this helps anyone in the future!

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.