1

I use JCManager tool load applets on my java-cards. This software has three fields for authentication keys in the top named S_ENC, S_MAC and DEK.

As I know, ENC stands for Encryption, MAC stands for Message Authentication Code and DEK stands for Data Encryption Key.

I want to know when they used (which step in communication? INITIAL UPDATE , EXTERNAL AUTHENTICATION? ... )?

Does all of these three keys, used in every communications or some of them are optional to use?

and where? (Card or Terminal or both?)

And also, I want to know what is KEK? Is there any KEK in smart cards?

TheGoodUser
  • 1,188
  • 4
  • 26
  • 52
  • 4
    I've answered this time, but I sense a strong unwilling on your part to perform any kind of research. Please do not turn anything that you don't understand immediately into a question. – Maarten Bodewes Oct 04 '14 at 13:26

1 Answers1

5

Read the Global Platform Card specifications (registration required) on how the keys are used. The way they are used during authentication differs in the Global Platform specification, so it's better to go straight to the source. For instance E.4.2. of GPC 2.2 specifies:

Generating or verifying an authentication cryptogram uses the S-ENC session key and the signing method described in appendix B.1.2.1 - Full Triple DES.

The DEK - or a key derived from the given DEK - is uses for additional encryption of confidential data, such as keys. It would for instance allow for wrapping of keys within a Hardware Security Module, before sending it over the secure message channel (which may not encrypt at all, mind you). For older schemes it was required to also derive a DEK session key, which - paired with the awkward proprietary key derivation - made it near impossible to do so without programming the HSM specifically for Global Platform.

DEK is a more generic term than KEK (Key Encryption Key). I can be used for any data that needs to be kept confidential separate from the transport channel.

Maarten Bodewes
  • 90,524
  • 13
  • 150
  • 263