# TDES (Triple DES) DUKPT decryption

We have a POS (Ingenico) that uses DES3-CBC encryption using a derived key. It sends encrypted data, and 10 bytes size Key Serial Number (KSN). I tried to use CKM_DES3_CBC_ENCRYPT_DATA to derive the key, and decrypted the data using DES3-CBC mech. However, I get some gibberish data something like this:

\ufffd\u001dl\ufffdP\ufffdl\ufffd\ufffd\ufffd+\ufffd\ufffd[\ufffd\ufffdl\u0017\ufffd\ufffd\ufffd\u001f?E\ufffd[*\ufffdmd\u0014\u0009ay\ufffd\ufffd3\ufffd\ufffd



I am not sure if I am using correct mechanism to derive the key, or even using the correct mechanism to decrypt the data.

Can someone please help me understand what could have been wrong? Some info says I need to pad the KSN.

Edit: I asked a similar question on Github/PKCS

• Can you show the data as binary encoded to hexadecimals instead of 16 bit unicode code points? Base 64 would also be fine. – Maarten Bodewes Feb 23 at 22:07
• @MaartenBodewes Thanks for responding. Here's the binary: [255 193 32 23 3 0 1 0 0 1 255 255 255 255 255 255] the 255s at the ends are what I padded. – onesick1 Feb 25 at 14:42

## 1 Answer

I solved the problem. So for people who are hunting for the answer, you need to consider what mechs your HSM supports. Every logic I had in the code was correct. The only problem was the mechanism that I used to derive the key was wrong. There are several mechs that are available to derive the key with, which was the hard part to figure out since it did not specify. I started with CKM_DES3_CBC_ENCRYPT_DATA as stated in the question, but turns out, I had to use CKM_DES2_DUKPT_DATA. And this mech was not defined in any wrapper libraries such as c# interlop pkcs11 library or the one I use, golang. Because this is a vendor defined mechanisms, I had to define it myself, and use it accordingly.

I hope this helps anyone in the future!