Standard Transfer Specification Association
Standard Transfer Specification Association
SIMPLE > TRUSTED > SECURE

Definitions: CRYPTOGRAPHY

CERT - Certified public key

A public key that has been certified as valid by the issuer of the public key.

CMID - CrytopgraphicModuleIdentifier

A unique identifier for a cryptographic module, usually set by the manufacturer for the module

CRC - CyclicRedundancyCheck

The CRC is a checksum field used to verify the integrity of the data transferred for all STS tokens, except for Class 0 with SubClass 4 to 7, which uses CRC_C. The checksum is derived using the following CRC generator polynomial:

 

x16+ x15+ x2+ 1

 

The last 16 bits of a token comprise the CRC checksum that is derived from the preceding 50 bits of the token data. See example below (all values in hexadecimal).

Original 50 bits  0 00 4A 2D 90 0F F2
Left padded to make 7 bytes00 00 4A 2D 90 0F F2
Checksum calculated0FFA

CRC_C - CyclicRedundancyCheck for Currency Tokens

The CRC_C is a checksum field used to verify the integrity of the data transferred for token Class 0 with SubClass 4 to 7 and is calculated as defined in in the CRC above, but with the following change:

 

A single byte with the value of 01 hex is appended to the 50-bit value before calculation

starts. See example below (all values in hexadecimal).

Original 50 bits  0 00 4A 2D 90 0F F2
Left padded to make 7 bytes00 00 4A 2D 90 0F F2
​01 hex appended to the end
00 00 4A 2D 90 0F F2 01
Checksum calculated
7BC4

DAC - DeviceAuthenticationCode

A code that is allocated to a device that uniquely identifies that device.

DEA - Data Encryption Algorithm 

A finite sequence of well-defined, computer-implementable instructions, used to render useable data into un-useable data until decrypted by a decryption algorithm. Also officially the Data Encryption Algorithm used in DES. 

DES - Data Encryption Standard

In cryptography, DES, officially the Data Encryption Algorithm, is a symmetric-key block cipher, which applies the DES cipher algorithm once to each data block. 

DFCONCAT - Delimited Field Concatenation 

DFCONCAT (mnemonic: “Delimited Field Concatenation”) is a formatting function that produces an ordered concatenation of printable ASCII strings that are separated from each other by a delimiter from the printable ASCII alphabet. The output is prefix-free with respect to all other outputs for the same number of input fields. [STS600-4-2]

DKR - DecoderKeyRegister

The storage register in a payment meter for the storage of the decoder key. This register is never accessible for reading and only accessible for writing with a key-change tokens set in order to change the decoder key.

ECB - Electronic Code Book 

The simplest of the encryption modes is the electronic codebook (ECB) mode (named after conventional physical codebooks. The message is divided into blocks, and each block is encrypted separately. ECB is not recommended for use in modern cryptographic protocols.

FAC - FirmwareAuthenticationCode

​Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process employs the use of a cryptographic hash to validate authenticity and integrity. The resulting signature is the FAC. [Wikipedia]

HMAC - Hash Message Authentication Code

In cryptography, an HMAC is a specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message. [Wikipedia]

KDF - Key Derivation Function

In cryptography, a key derivation function is a cryptographic hash function that derives one or more secret keys from a secret value such as a main key, a password, or a passphrase using a pseudorandom function. [Wikipedia]

KEK - KeyExchangeKey

In cryptography, a key exchange key is a secret key used to transport other secret keys securely between cryptographic devices.

LRC - LongitudinalRedundancyCheck

A longitudinal redundancy check, or horizontal redundancy check, is a form of redundancy check that is applied independently to each of a parallel group of bit streams. The data must be divided into transmission blocks, to which the additional check data is added. [Wikipedia]


    lrc = 0

    for each byte b in the buffer

    {

        lrc = (lrc + b) and 0xFF

    }

    lrc = (((lrc XOR 0xFF) + 1) and 0xFF)

LVCONCAT - Length Value Concatenation 

​(Mnemonic: “Length-Value Concatenation”) LVCONCAT is a formatting function that produces an ordered concatenation of octet strings each with a length prefix. The output is a one-to-one mapping of the inputs, can be parsed unambiguously into the original inputs, and is prefix-free. [STS600-4-2]

RND - RandomNumber

A random number is a number chosen as if by chance from some specified distribution such that selection of a large set of these numbers reproduces the underlying distribution. Almost always, such numbers are also required to be independent, so that there are no correlations between successive numbers. [Mathworld]

SHA - Secure Hash Algorithm 

The Secure Hash Algorithms are a family of cryptographic hash functions published by the National Institute of Standards and Technology as a U.S. Federal Information Processing Standard, including: SHA-0: A retronym applied to the original version of the 160-bit hash function published in 1993 under the name "SHA" [Wikipedia]

STA - Standard Transfer Algorithm 

The STS StandardTransferAlgorithm (EA07) based on DES.

TDEA / TDES - Triple Data Encryption Algorithm Triple Data Encryption Standard

In cryptography, Triple DES (TDES), officially the Triple Data Encryption Algorithm (TDEA), is a symmetric-key block cipher, which applies the DES cipher algorithm three times to each data block. [Wikipedia]

NKHO - NewKeyHighOrder

The high order 32 bits of the new decoder key transferred to the payment meter by means of a key change token set.

NKLO - NewKeyLowOrder

The low order 32 bits of the new decoder key transferred to the payment meter by means of a key change token set.