Generate ZEK/ZAK

Command:

Generate a ZEK or ZAK.

Notes:

If a 32-character ZMK is required, the HSM must be configured for double-length ZMKs using the CS (Configure Security) console command.

Field

Length & Type

Details

COMMAND MESSAGE

Message header

m A

(Subsequently returned to the Host unchanged).

Command code

2 A

Value FI.

Flag

1 N

0 for ZEK, 1 for ZAK.

ZMK

16H or 32H or
1A+32H or 1A+48H

ZMK encrypted under LMK pair 04-05.

Atalla variant

1 N or 2 N

Optional. Atalla variant; for use in systems with Atalla equipment.

Delimiter

1 A

Optional. If present the following three fields must be present.  Value “;”.

If an option is not required by the command fill with a valid value or 0.

Key scheme ZMK

1 A

Optional. Key scheme for encrypting key under ZMK.

Key scheme LMK

1 A

Optional. Key scheme for encrypting key under LMK.

Key check value type

1 A

Optional. Key check value calculation method

0 - KCV backwards compatible.

1 - KCV 6H.

End message delimiter

1 C

Optional. Must be present if a message trailer is present. Value X’19.

Message trailer

n A

Optional. Maximum length 32 characters.

Field

Length & Type

Details

RESPONSE MESSAGE

Message header

n A

Returned to the Host unchanged.

Response code

2 A

Value FJ.

Error code

2 N

00 : No errors

10 : ZMK parity error

12 : No keys loaded in user storage

13 : LMK error; report to supervisor

15 : Error in input data

21 : Invalid user storage index

ZEK or ZAK for transmission

16H or
1A+32H or 1A+48H

ZEK or ZAK encrypted under ZMK (ZEK when Flag is 0, ZAK when Flag is 1).

ZEK for storage

16H or
1A+32H or 1A+48H

ZEK encrypted under LMK pair 30-31 (present only when Flag is 0).

ZAK for storage

16H or
1A+32H or 1A+48H

ZAK encrypted under LMK pair 26-27 (present only when Flag is 1).

Check value

16 H or 6 H

Result of encrypting 64 binary zeroes with the ZEK/ZAK. 

16H or 6H depends upon KCV type option.

End message delimiter

1 C

Present only if present in the command message. Value X’19.

Message trailer

n A

Present only if present in the command message. Maximum length 32 characters.