Local Master Key Variants

To protect key usage, variants of the Local Master Key are used for encryption of defined keys or key components. The Key Type Table defines the LMK pairs and variants that are used to protect various types of keys. For example, an MK-SMI is encrypted using LMK 28-29 variant 2.

In order to create an LMK variant, a non-secret fixed value (known as a variant) is XOR’ed with the first byte of the LMK. The variants used by the HSM are:

Variant 1 : A6

Variant 2 : 5A

Variant 3 : 6A

Variant 4 : DE

Variant 5 : 2B

Variant 6 : 50

Variant 7 : 74

Variant 8 : 9C

Variant 9 : FA

The example below demonstrates how a Local Master Key variant is calculated for key type  MK-SMI

1.    Refer to the Key Type Table to select the appropriate LMK pair for the type of key that you wish to encrypt. For example, for key type MK-SMI, LMK 28-29 is used:                                                                             

Test LMK 28-29: 1A1A 1A1A 1A1A 1A1A 1C1C 1C1C 1C1C 1C1C

2.    Identify from the Key Type Table which Variant of the LMK is required. For key type MK-SMI variant 2 is used:

Variant 2: 5A.

3.    Exclusive-OR  the selected variant with the first byte of the LMK pair :

1A XOR 5A = 40

4.    Replace the left-most byte of the LMK pair with the result of Step 3 and use the resulting key to encrypt the MK-SMI:

LMK Variant 2 = 401A 1A1A 1A1A 1A1A 1C1C 1C1C 1C1C 1C1C

When the Variants are applied to the standard test LMK set, the left-most bytes of the sets are as follows: