How can I derive the 3DES key from ECC shared secret to Generate an enciphered PIN Block for IBM 3624 Offset PIN?

Question

# What I want to achieve

I have a system that should generate customizable PIN protected by a HSM. I want to receive the Enciphered PIN Block directly from customer's application.

# Where I am now

I already generated the ECDH Key Pair on AWS Payment Cryptography, did all the flow to generate the party U key pair, signed the public key with a CA, imported the certificate into AWS Payment Cryptography. 
When I call the generate-pin-data, I receive the error "ValidationException: Invalid request for operation GeneratePinData". 
I know, by this that the following are OK:
1. The signed public certificate of the key matches the root certificate imported, and I am referencing the right one on the function call
2. The ECC curve from the ECC keys matches
3. The 3DES key parity is right

I suspect of the following variables: 
1. The "OtherInput" data may be wrong
2. I am using the wrong method to derive the key (I am using HKDF)
3. I am generating the derived key in the wrong way. (I generate 168 bits key, then add the parity bit for each 7-bits block)

re:Post Agent · Answer

To generate an enciphered PIN block for IBM 3624 Offset PIN using AWS Payment Cryptography, you need to ensure you're using the correct key types and parameters.

For IBM3624 PIN operations, you need two specific key types:
1. A PIN verification key (TR31_V1_IBM3624_PIN_VERIFICATION_KEY) with TDES_3KEY algorithm
2. A PIN encryption key (TR31_P0_PIN_ENCRYPTION_KEY) with either TDES_2KEY or TDES_3KEY algorithm

The PIN verification key must have the Generate mode of use enabled, and the PIN encryption key must have the appropriate modes of use (Encrypt, Wrap, etc.) depending on your specific operation.

For generating IBM3624 PIN data, you would use the `generate-pin-data` command with the following required parameters:
- generation-key-identifier (your IBM3624 PIN verification key)
- encryption-key-identifier (your PIN encryption key)
- primary-account-number (the PAN)
- pin-block-format (e.g., ISO_FORMAT_0)
- generation-attributes with the appropriate IBM3624 method

For IBM3624RandomPin, you need to provide:
- DecimalizationTable (e.g., "9876543210654321")
- PinValidationDataPadCharacter (e.g., "D")
- PinValidationData (typically the PAN)

The issue you're experiencing might be related to how you're trying to use the ECDH key pair. The AWS Payment Cryptography service doesn't directly support using an ECDH shared secret to derive a 3DES key for PIN block generation in a single operation.

Instead, you would need to:
1. First establish the shared secret using your ECDH key pair
2. Derive the 3DES key separately
3. Import the derived 3DES key as a TR31_P0_PIN_ENCRYPTION_KEY
4. Use this imported key in your generate-pin-data operation

The "ValidationException" error suggests that one or more parameters in your request don't meet the validation requirements for the GeneratePinData operation. Double-check that your key types match the requirements for IBM3624 PIN operations and that all required parameters are correctly formatted.  
**Sources**  
[Generate IBM3624 pin offset for a pin - AWS Payment Cryptography](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-ibm3624.html)  
[Valid keys for cryptographic operations - AWS Payment Cryptography](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html)  
[Creating keys - AWS Payment Cryptography](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html)

How can I derive the 3DES key from ECC shared secret to Generate an enciphered PIN Block for IBM 3624 Offset PIN?

What I want to achieve

Where I am now

Add your answer

Relevant content