How can I ensure my unit is injected with the correct key for my purposes?
ID TECH is a KIF (Key Injection Facility). We currently more than one hundred production keys. Every Key we manage has an ID TECH part number (i.g. IDT-KEYINJ-D01). If you need a unit injected with the specific key, an ID TECH sales person will be able to tell you if the key is already managed by ID TECH or if the key will need to be transferred to ID TECH via a Secure Key Transfer process.
ID TECH has a service where we can create a new key. This service is referred to as a Key Generation service.
Cryptographic Keys are identified/validated by the KCV key check value. When we Transfer Keys, the Key will be split into components (usually 2. sometime 3) in our HSM. Each component will be handled separately... by separate operators. The components will be placed in tamper evident bags and shipped to different receiving parties via different carriers. All of this ensures that the Key never exists in whole outside the protection of an HSM.
How to know with what key your reader is injected?
If you have a reader and you are not sure if it has been injected, you can look for the IDT_KEYINJ sticker like shown below:
We can look up this key part number and tell you what it is.
You can also look at the KSN (key serial number). This 10 Byte hex number is always available in plain text with any encrypted data. If the KSN begins with 629949, then it is a key ID TECH created and very likely injected into your reader. You can let us know the KSN and we can share what can be learned from it. Also, we can look up the readers sales history using the serial number on the reader. Often we can track down the sales invoice that may include key injection service that specifies the key to be injected
Can the customer inject the encryption key by themselves?
Unless the product support RKI, only a Certified Key Injection Facility can inject the encryption key.
What's the structure of a KSN?
Refer to TS-1938
A KSN is 10 bytes fixed. It starts with the 3 bytes(6 digits, e.g. 629949 for our Demo key) IIN (Issuer Identification Number), and next byte(2 digits) is the Customer ID which is fixed too, the next byte(two digits) is the Group ID (varies), next 19 bits is the Device ID which is unique to each device and the last 21 bits is the counter which increases by 1 for every swipe. You can tell the key is different by the first few bytes of the KSN.
Example:
KSN: 62994900750003c0000f (as highlighted in the screenshot attached below)
Where:
IIN: 629949
CID: 00
Group ID: 75
Device ID: 0000 0000 0000 0011 110 ( 19 bit in binary) this is from the hex code 00003c with the last bit of the "c" goes to the Counter field
Counter: 0 0000 0000 0000 0000 1111 (21 bits in binary) this is the last bit of the hex "c" plus the hex "0000f"
How to tell if the Augusta has an encryption key injected and how to activate the encryption with the key pre-injected?
Refer to TS-1938 & TS-9219
Can you show me how to decrypt the encrypted data or provide the decryption Dll used by your Demo? search the Knowledge Base for severral articles on how to perform decryption. Note: Encryption/Decription with production keys happens with an HSM (hardware security module). You can perform decryption with a reader that was injected with a demo key instead of a production
Do you provide the key generating service?
Yes. Please contact our Sales team
Can SecuRED and SREDKey be remotely key injected?
No, as of now.
What's the key press sequence to put the SREDKey into the KeyInjection mode?
Refer to TS-5821
" # Cancel BS Cancel Enter #" within 5 seconds after the device powered up with Ready displayed (for SREDKey)
Which IDTECH products support multiple key slots?
refer to TS-6213
What's the key injection protocol and converter cable for Augusta?
Refer to TS-7474.
Augusta takes the following settings (and needs the 007 converter)
- 9600 Baud
- 8 data bits
- N parity
Firmware version of your HSM will need to support IDTECH NGA protocol. And a LCL KEK must be created for the 3rd party key injection party to be able to inject our Augusta
What is LCL-KEK, KTK and how a LCL-KEK can be securely transferred to a 3rd party KIF(Key Injection Facility)?
The LCL-KEK or Local key injection key is present in all current emv readers. It is designed to prevent unauthorized key injection/modification. When performaing injection the HSM must validate the lcl-kek. ie the reader's stored LCL-KEK will need to also exist on the injecting HSM system. A KTK or a key transport key is used to protect a key while in transport. The KTK must get transferred to your HSM in multiple compnents first. However, once that's done, then we can send keys encrypted with the KTK. This is far simpler than spiting the key, sending to 2 diffent recipients via 2 different carriers.
For K100, Is there a way to check whether a unit has the Production LCLKEK or the Demo LCLKEK loaded? If yes, how to do so?
Refer to TS-8585
You can use command "Get Key status"(78 46 25) to get the key status with uDemo
Where can I find out the correct key injection cable and protocol for injecting an IDTECH product (Internal Only)?
Spreadsheet in the Key Management folder on the Snap server
What a transferred key look like? (Internal)
Here is a test key transfer key parts: (from TS-9209)
Key Value: 95036100
KCV (entire Key): E45B50
Key Component: 1 of 2
Check Digit: 3218A6
Key Component: F2D53475FBAE1C3BDCFE9DDCBC23E96B
Key Component: 2 of 2
Check Digit: 8F9627
Key Component: 1AA1B5676BF243736B45DF9840B5A8B3
Related Articles: