Blackberry PRD-09695-004 Technical Overview - Page 24

Application layer protocol encryption and authentication, Connection session key, Value, Description

Get Blackberry PRD-09695-004 - SMART Card Reader PDF manuals and user guides
UPC - 097738554967
View all Blackberry PRD-09695-004 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 24 highlights

Application layer protocol encryption and authentication By default, each data packet that a BlackBerry® device or computer and the BlackBerry® Smart Card Reader send between them is authenticated and encrypted using the following methods: • authenticated with HMAC using the negotiated SHA algorithm • encrypted with AES of the negotiated key size using CBC mode The following diagram shows the anatomy of a data packet formatted for transmission over the application layer: The connection key protocol opens a shared connection key CK from which the BlackBerry device or computer and the BlackBerry Smart Card Reader derive the four session keys that they use on the application layer to protect the data that they send between them. Connection session key Value KeySendEnc SHA-256( CK || S1 ) KeyRecEnc KeySendAuth SHA-256( CK || S2 ) SHA-256( CK || S3 ) KeyRecAuth SHA-256( CK || S4 ) Description This key is the AES-256 key that the BlackBerry device, the computer, or the BlackBerry Smart Card Reader generates to encrypt the data that it sends to the other party over the application layer. The other party must use KeyRecEnc to respond to KeySendEnc. This key is the AES-256 key that the BlackBerry device, the computer, or the BlackBerry Smart Card Reader generates to decrypt the data that it receives from the other party over the application layer. This key is the HMAC authentication key that the BlackBerry device, the computer, or the BlackBerry Smart Card Reader generates to authenticate the data that it sends to the other party over the application layer. The other party must use KeyRecAuth to respond to KeySendAuth. This key is the HMAC authentication key that the BlackBerry device, the computer, or the BlackBerry Smart Card Reader generates to authenticate the data that it receives from the other party over the application layer. Note: S1, S2, S3, and S4 are hard-coded strings that the BlackBerry device or computer and the BlackBerry Smart Card Reader use in the key derivation to prevent calculating session keys that are the same as each other. 24

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
Application layer protocol encryption and authentication
By default, each data packet that a BlackBerry® device or computer and the BlackBerry® Smart Card Reader send
between them is authenticated and encrypted using the following methods:
•
authenticated with HMAC using the negotiated SHA algorithm
•
encrypted with AES of the negotiated key size using CBC mode
The following diagram shows the anatomy of a data packet formatted for transmission over the application layer:
The connection key protocol opens a shared connection key
CK
from which the BlackBerry device or computer and
the BlackBerry Smart Card Reader derive the four session keys that they use on the application layer to protect the
data that they send between them.
Connection session key
Value
Description
KeySendEnc
SHA-256(
CK
||
S1
)
This key is the AES-256 key that the BlackBerry device, the
computer, or the BlackBerry Smart Card Reader generates
to encrypt the data that it sends to the other party over the
application layer.
The other party must use KeyRecEnc to respond to
KeySendEnc.
KeyRecEnc
SHA-256(
CK
||
S2
)
This key is the AES-256 key that the BlackBerry device, the
computer, or the BlackBerry Smart Card Reader generates
to decrypt the data that it receives from the other party
over the application layer.
KeySendAuth
SHA-256(
CK
||
S3
)
This key is the HMAC authentication key that the
BlackBerry device, the computer, or the BlackBerry Smart
Card Reader generates to authenticate the data that it
sends to the other party over the application layer.
The other party must use KeyRecAuth to respond to
KeySendAuth.
KeyRecAuth
SHA-256(
CK
||
S4
)
This key is the HMAC authentication key that the
BlackBerry device, the computer, or the BlackBerry Smart
Card Reader generates to authenticate the data that it
receives from the other party over the application layer.
Note
:
S1
,
S2
,
S3
, and
S4
are hard-coded strings that the BlackBerry device or computer and the BlackBerry Smart
Card Reader use in the key derivation to prevent calculating session keys that are the same as each other.
24