Understanding Security APIs - CrySyS Lab

Figure 3.1: The RG7000 Hardware Security Module
3.2.1 XOR to Null Key Attack
Until recently ATMs had to support offline operation, so when banks set up new
ATMs, they needed a way to securely transfer the PIN derivation keys used to
calculate customer PINs from PANs. The VSM used a system of dual control to
achieve this. The idea was that two service engineers would each take one component
of a master key to the ATM, and enter it in. Once both components were entered,
the ATM could combine the components using the XOR function. The resulting
‘Terminal Master Key’ (TMK) would be shared with the VSM and could be used
for communicating all the other keys. A transaction was first run twice at the VSM
to generate the components:
HSM -> Printer : TMK1 (Generate Component)
HSM -> Host : { TMK1 }Km
HSM -> Printer : TMK2 (Generate Component)
HSM -> Host : { TMK2 }Km
The VSM only had very limited internal storage, yet there might be many different
ATMs it needed to hold keys for. The paradigm of working with encrypted keys
evolved: instead of keeping keys internally, the VSM only held a few master keys,
and other keys were passed in as arguments to each transaction encrypted under one
of these master keys. So, in response to the above transaction, the VSM returned an
encrypted copy of the component to the host computer, encrypted under its master
key, Km (and of course printed a clear copy onto a special sealed mailer for the
23