I found old key letters used in EFT HSMs with TDES keys, parted in two halfs. The check value printed on this letters is called IBM CV and doubled IBM CV. My newer HSM does not support this kind of check value. Does anybody know how this value is calculated? Thanks in advance

  • $\begingroup$ So you want to import EFT HSM TDES keys into your "newer" HSM? $\endgroup$
    – DannyNiu
    Commented Nov 10, 2020 at 1:57
  • $\begingroup$ A common Key Check Value is obtained by enciphering the all-zero value with the key, and keeping the 6 left/first hexadecimal digits out of 16. Absent specifications, that's the first thing to try. I don't make this an answer because I have no clue about if that's "IBM CV" or "doubled IBM CV". $\endgroup$
    – fgrieu
    Commented Nov 10, 2020 at 6:37
  • $\begingroup$ @DannyNiu That's correct. I want to create a script for generating a new key letter which includes both values, the old IBM CV and the newer one. Therefore I want to understand how this CV is generated. $\endgroup$ Commented Nov 10, 2020 at 7:41
  • $\begingroup$ @fgrieu I tried the following things - TDES ECB encipher of 8 Byte zeros and check the left/right most 2 Bytes. - TDES ECB encipher of the key itself and check the left/right most 2 Bytes. Both didn't result the correct result. $\endgroup$ Commented Nov 10, 2020 at 7:43


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.