Key Block Wasm Tool

Introduction

This TR-31 Key Block Web Tool is based on the paysec Rust library and a WebAssembly (Wasm) binding, providing a test interface for handling cryptographic keys according to the TR-31 key block format, specifically version 'D'. This format is consistent with ANS X9.24 Retail Financial Services Symmetric Key Management Part 1, ensuring secure exchange and storage of keys between devices sharing a symmetric key exchange key.

The Key Block structure comprises three parts: a non-encrypted Key Block Header (KBH) detailing key and block attributes, the confidential data / payload (the key or sensitive data, including padding), and a 16-byte MAC for integrity and authentication. This tool currently supports only version 'D' for wrapping and unwrapping key blocks, which utilizes AES-CMAC for the derivation of encryption and authentication key.

This tool serves as an educational and testing resource, demonstrating the principles of key wrapping and unwrapping in line with TR-31 standards. For copyright and license information, refer to the paysec GitHub repository.

Usage Notes

To generate a Key Block Header as input for the Wrapping Mechanism, use the Header Generator.
The interface supports up to 3 optional blocks for added flexibility.
The header generator finalizes a header by adding a "PB" padding block if necessary to ensure length is a multiple of the cipher block size.
While the Key Block Length remains "0000" during header generation, it is automatically calculated and updated within the wrapping mechanism.
Currently, only Version D (AES-CMAC Key Derivation) is supported. Headers not starting with "D" will not work for wrapping and unwrapping.
Random Seed: Random data used for padding. If not provided, a random seed is generated using window.crypto.getRandomValues. The seed must be at least as long as the calculated padding length.
Keys: Keys should be provided in hex-ASCII format.
Masked Key Length: Minimum length to mask the true length of shorter keys. If it is 0 or less than the actual key length, the key length will not be masked.

This tool is designed for ease of use and flexibility, accommodating both simple header generation and key wrapping use cases. It allows comprehensive testing and experimentation with TR-31 key block formats. For feedback or issues, please contact David Schmid at mail@join.tech.

TR-31 Header Generator

Version ID:

Key Usage:

Algorithm:

Mode of Use:

Key Version Number (2AN):

Exportability:

Optional Block 1

Optional Block 1 ID:

Optional Block 1 Data (ASCII):

Optional Block 2

Optional Block 2 ID:

Optional Block 2 Data (ASCII):

Optional Block 3

Optional Block 3 ID:

Optional Block 3 Data (ASCII):

Generated Header:

TR-31 Key Wrapping Method D

Header String:

KBPK as AES-128, AES-192 or AES-256 (Hex):

Key (Hex):

Masked Key Length:

Random Seed (Hex): Note: The random seed is used for the padding of the confidential payload and will be generated if no value is provided. See usage notes for details on how random data is handled.

Generated Key Block:

Example

Header: D0000P0AE00E0000
KBPK (AES-256): 88E1AB2A2E3DD38C1FA039A536500CC8A87AB9D62DC92C01058FA79F44657DE6
Key: 3F419E1CB7079442AA37474C2EFBF8B8
Random Seed: 1C2965473CE206BB855B01533782
Masked Key Length: 16
Generated Key Block: D0112P0AE00E0000B82679114F470F540165EDFBF7E250FCEA43F810D215F8D207E2E417C07156A27E8E31DA05F7425509593D03A457DC34

TR-31 Key Unwrapping Method D

Key Block (ASCII String):

KBPK as AES-128, AES-192 or AES-256 (Hex):

Unwrapped Key:

Examples

Key Block: D0112P0AE00E0000B82679114F470F540165EDFBF7E250FCEA43F810D215F8D207E2E417C07156A27E8E31DA05F7425509593D03A457DC34
KBPK (AES-256): 88E1AB2A2E3DD38C1FA039A536500CC8A87AB9D62DC92C01058FA79F44657DE6
Unwrapped Key: 3F:41:9E:1C:B7:07:94:42:AA:37:47:4C:2E:FB:F8:B8