Reads and builds the key block a Thales payShield produces under a Key Block LMK: version ID "1", AES-protected, with the two header characters X9.143 leaves reserved carrying the LMK identifier, and a key usage table that adds Thales-only numeric codes such as 72 (ZPK) and 51 (TMK). Parse reads the header alone, Decode also decrypts the wrapped key and verifies the CMAC authenticator with the protection key, and Create wraps a clear key into a new version 1 block. Parse and Decode also accept X9.143/TR-31 versions A, B, C and D, so the same screen handles a block that left the HSM in either format.
Inputs
Tab: Which operation to run.
Thales Key Block: The block as printed by the HSM or logged by the host. ASCII: 16-character header, optional blocks, encrypted key data in hex, then the authenticator. Used by Parse and Decode.
KBPK — Key Block Protection Key: The key the block is protected under: the Key Block LMK for a local key, or the ZMK/TMK when the key is being imported or exported. Three preset cards load the Thales test AES LMK, the Thales test 3DES LMK, or a custom value of 32, 48 or 64 hex characters.
Clear Key (HEX): The key to wrap, in hex, even number of characters. Its length in bits is written as a 2-byte prefix inside the encrypted key data, then padded to the 16-byte AES block boundary with random bytes.
Key Usage (Thales): Two characters saying what the key is for. The list is the payShield set, which extends X9.143: letter codes (K0, P0, M6, V2, B0) are shared, numeric codes are Thales-only — 51 TMK, 52 ZMK, 54 KEK, 71 TPK, 72 ZPK, 41-43 BDK-2/3/4, 61-65 HMAC by hash.
Algorithm: Algorithm of the wrapped key.
Mode of Use: What operations the key is allowed to perform.
Exportability: How far the key may travel.
Key Version Number: Two characters, header positions 9-10. "00" means versioning is not used. A lowercase "c" in the first character marks the payload as a key component and the second character is the component number, e.g. "c2" — the parser preserves that case, because the header is MAC and IV input.
LMK ID: Two digits, header positions 14-15, identifying which LMK protects the key. This is where the Thales header departs from X9.143, which keeps those two characters reserved. The minimum is 00; the maximum depends on the LMK licence installed on the unit.
Optional Blocks: Extra header blocks, each 2-character ID + 2-character hex length + data, where the length covers ID and length as well. The picker offers CT certificate, HM HMAC hash algorithm, IK DUKPT initial key ID, KC KCV of the wrapped key, KP KCV of the KBPK, KS key set identifier, KV key block values, TS timestamp (YYMMDDHHmm) and ZZ proprietary.
Tips
Create always emits version 1 and always treats the KBPK as AES of 16, 24 or 32 bytes. Selecting the 3DES preset card there does not build a 3DES block — those 24 bytes are used as an AES-192 KBPK.
Version 1 encrypts first and MACs the ciphertext, using the 16 header characters as the CBC IV. Versions B and D MAC the clear key data and reuse that MAC as the IV, so a matching header does not make two blocks interchangeable.
The version 1 authenticator is 16 hex characters, AES-CMAC truncated to 8 bytes, against 32 for version D and 8 for versions A and C.
Decode prints the recovered key even when the authenticator comes back Invalid. Invalid means the wrong KBPK or an altered header — the whole header, LMK ID included, is inside the MAC.