I found old key letters used in EFT HSMs with TDES keys, parted in two halfs. The check value printed on this letters is called IBM CV and doubled IBM CV. My newer HSM does not support this kind of check value. Does anybody know how this value is calculated? Thanks in advance

  • $\begingroup$ So you want to import EFT HSM TDES keys into your "newer" HSM? $\endgroup$
    – DannyNiu
    Nov 10 '20 at 1:57
  • $\begingroup$ A common Key Check Value is obtained by enciphering the all-zero value with the key, and keeping the 6 left/first hexadecimal digits out of 16. Absent specifications, that's the first thing to try. I don't make this an answer because I have no clue about if that's "IBM CV" or "doubled IBM CV". $\endgroup$
    – fgrieu
    Nov 10 '20 at 6:37
  • $\begingroup$ @DannyNiu That's correct. I want to create a script for generating a new key letter which includes both values, the old IBM CV and the newer one. Therefore I want to understand how this CV is generated. $\endgroup$ Nov 10 '20 at 7:41
  • $\begingroup$ @fgrieu I tried the following things - TDES ECB encipher of 8 Byte zeros and check the left/right most 2 Bytes. - TDES ECB encipher of the key itself and check the left/right most 2 Bytes. Both didn't result the correct result. $\endgroup$ Nov 10 '20 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.