Product Documentation

The generateKek operation generate a symmetric key - an AES 128-bit key - to be used as a key-encrypting key (KEK) for decrypting TR31 keyblocks sent by Apple Tap-to-Pay on iPhone (TTPoP) framework.


This webservice in the TR31 module generates a new key encrypting key (KEK) for use in decrypting TR31 keyblocks. It also generates a new key-pair for the KEK_TRANSPORT_AUTHENTICATION certificate, whose CSR will be generated as a response to this webservice. The CSR must be submitted to Apple TTPoP Business Register, who will then issue a digital certificate. The certificate must be stored using the storeDigitalCertificate webservice and associated with the KEK's signing keypair.


The generateKek web service requires twelve (12) parameters:

did

The unique encryption domain identifier.

svccred

The username (service credential) within the encryption domain with the authorization to call this web service. The credential requires the ENC, DEC, KMO, and KMA privileges.

password

The password of the username to authenticate the credential of the requester.

environment

The environment in which this key will be used.

Accepted values:
DEVELOPMENT, QA, PRODUCTION, NON_PRODUCTION, OTHER

kpid

The keypair ID of the KEK_TRANSPORT_SIGNING keypair.

kpsid

The SID of the server where the above signing keypair ID's associated keypair was generated.

keyAlg

The algorithm of the symmetric key to be used as a key-encrypting key (KEK). For now, only supports AES.

Accepted values:
AES, DBSIG, EC, ECDSA, FALCON, MLDSA, PICNIC, RSA, SLHDSA, OTHER - not supported yet

keySize

The size of the KEK. For now, only supports 128.

keyUsage

The usage of the new keypair. For now, only supports DATA and PIN.

Accepted values:
DATA, PIN, PCRT, TLSCA, OTHER - not supported yet

subjectDn

The full distinguished name (DN) of the unique DN of the KEK_TRANSPORT_AUTHENTICATION certificate for the specified environment.

status

Status of the certificate record.

Accepted values:
REQUESTED, REJECTED, CURRENT, EXPIRED, REVOKED, OTHER

notes [Optional] notes that you can provide to store information about the KEK being generated.