Replacing initial ISD keyset (KVN 0xFF)

nc-adnan — Tue, 07 May 2024 09:47:58 GMT

Hi,

Using the JCOP 4.5 P71 (JCOP-ID-2) product, we would like to replace the initial ISD keys (SCP03, AES), which have the Key Version Number is 255 (0xFF), with new keys having a different KVN, for example 0x01.

I have found an example JCShell scripts, but we are using a different tool in production to send the APDU commands so I would like to understand which GlobalPlatform APDU commands to use and how.

Example in JCShell script:

# update the key-set # the keys are defined in the authISD script if ${replaceKeyset} put-keyset -m replace -r ${replaceKeyset;q} ${newKeySet} else put-keyset -r 255 ${newKeySet} end

In the GlobalPlatform Card Specification v2.3.1, the PUT KEY command to replace existing keys does not allow the value 0xFF to be specified in the P1 parameter.

Is KVN 0xFF a special case? How can we replace the keys in this case?

Thanks,

Re: Replacing initial ISD keyset (KVN 0xFF)

Kan_Li — Wed, 08 May 2024 01:45:44 GMT

Hi @nc-adnan ,

Actually P71 is not a mass market product so the related technical discussion is not allowed here. Would you please create a private ticket instead? Please kindly refer to the following for details.

https://www.nxp.com/video/tutorial-for-nxp-support-case-portal:NCP-VIDEO

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

topic Replacing initial ISD keyset (KVN 0xFF) in Secure Authentication

Replacing initial ISD keyset (KVN 0xFF)

Re: Replacing initial ISD keyset (KVN 0xFF)