Translate a ZEK/ZAK from ZMK to LMK Encryption

Command:	Translate a ZEK or ZAK from ZMK to LMK.
Notes:	If a 32-character ZMK is required, the HSM must be configured for double-length ZMKs using the CS (Configure Security) console command.

Field	Length & Type	Details
COMMAND MESSAGE
Message header	m A	(Subsequently returned to the Host unchanged).
Command code	2 A	Value FK.
Flag	1 N	0 for ZEK, 1 for ZAK.
ZMK	16H or 32H or 1A+32H or 1A+48H	ZMK encrypted under LMK pair 04-05.
ZEK/ZAK	16H or 1A+32H or 1A+48H	ZEK or ZAK encrypted under ZMK (ZEK when Flag is 0, ZAK when Flag is 1).
Atalla variant	1 N or 2 N	Optional. Atalla variant; for use in systems with Atalla equipment.
Delimiter	1 A	Optional. If present the following three fields must be present. Value “;”. If an option is not required by the command fill with a valid value or 0.
Reserved	1 A	Optional. If present must be 0.
Key scheme LMK	1 A	Optional. Key scheme for encrypting key under LMK.
Key check value type	1 A	Optional. Key check value calculation method 0 - KCV backwards compatible. 1 - KCV 6H.
End message delimiter	1 C	Optional. Must be present if a message trailer is present. Value X’19.
Message trailer	n A	Optional. Maximum length 32 characters.

Field	Length & Type	Details
RESPONSE MESSAGE
Message header	m A	Returned to the Host unchanged.
Response code	2 A	Value FL.
Error code	2 N	00 : No errors 10 : ZMK parity error 12 : No keys loaded in user storage 13 : LMK error; report to supervisor 15 : Error in input data 21 : Invalid user storage index
ZEK	16H or 1A+32H or 1A+48H	ZEK encrypted under LMK pair 30-31 (present only when Flag is 0).
ZAK	16H or 1A+32H or 1A+48H	ZAK encrypted under LMK pair 26-27 (present only when Flag is 1).
Check value	16 H or 6H	Result of encrypting 64 binary zeroes with the ZEK/ZAK. 16H or 6 depends upon KCV type option.
End message delimiter	1 C	Present only if present in the command message. Value X’19.
Message trailer	n A	Present only if present in the command message. Maximum length 32 characters.