The generateKek operation generate a symmetric key - an AES 128-bit key - to be used as a key-encrypting key (KEK) for decrypting TR31 keyblocks sent by Apple Tap-to-Pay on iPhone (TTPoP) framework.
This webservice in the TR31 module generates a new key encrypting key (KEK) for use in decrypting TR31 keyblocks. It also generates a new key-pair for the KEK_TRANSPORT_AUTHENTICATION certificate, whose CSR will be generated as a response to this webservice. The CSR must be submitted to Apple TTPoP Business Register, who will then issue a digital certificate. The certificate must be stored using the storeDigitalCertificate webservice and associated with the KEK's signing keypair.
The generateKek web service requires twelve (12) parameters:
|
did |
The unique encryption domain identifier. |
|
svccred |
The username (service credential) within the encryption domain with the authorization to call this web service. The credential requires the ENC, DEC, KMO, and KMA privileges. |
|
password |
The password of the username to authenticate the credential of the requester. |
|
environment |
The environment in which this key will be used. Accepted values: |
|
kpid |
The keypair ID of the KEK_TRANSPORT_SIGNING keypair. |
|
kpsid |
The SID of the server where the above signing keypair ID's associated keypair was generated. |
|
keyAlg |
The algorithm of the symmetric key to be used as a key-encrypting key (KEK). For now, only supports AES. Accepted values: |
|
keySize |
The size of the KEK. For now, only supports 128. |
|
keyUsage |
The usage of the new keypair. For now, only supports DATA and PIN. Accepted values: |
|
subjectDn |
The full distinguished name (DN) of the unique DN of the KEK_TRANSPORT_AUTHENTICATION certificate for the specified environment. |
| status |
Status of the certificate record. Accepted values: |
| notes | [Optional] notes that you can provide to store information about the KEK being generated. |