Key Management Tools

Introduction

Key Management Tools cluster around four jobs:

• Build keys — generate and combine raw key material.
• Wrap keys — bind a key to its usage / algorithm via TR-31 or Thales key blocks.
• Distribute keys — split into shares for multi-custodian loading and validate the resulting halves.
• Compute key check values — for vendor HSMs and operational sign-off.

SSL / X.509 certificate handling is also grouped here for projects that need terminal or host-to-host TLS.

All tools

Every tool in this category — each card links to the detailed reference below.

DEA Keys (DES / 3DES Utility)

A multi-tab tool focused on raw 3DES key material.

Tabs

• Key Generator — Generate cryptographically random DES, 2-key 3DES, or 3-key 3DES keys.
• Key Combination — XOR multiple key components together to reconstruct a key from shares.
• Parity Enforcement — Adjust the LSB of each byte so each byte has odd parity (DES requirement).
• Key Validation — Check parity, detect weak keys, and compute KCV (Key Check Value) using 00 00 00 00 00 00 00 00.

Key Combination

Components XOR together into the key. Pick the Key Type / Length — e.g. TDES — Double length (16B / 32H) — and the fields resize to match.

There is room for eight components, and each carries its own KCV box beside it, with one more for the combined result. That is what makes a bad component obvious: check each custodian’s KCV against their envelope before you trust the total.

Parity Enforcement

DES ignores the low bit of each byte, so specs use it as a parity bit. Paste a Key (Hex), choose Odd or Even, and Enforce Parity adjusts each byte to match — the key value is unchanged as far as the cipher is concerned.

Key Validation

The validation tab is a Key Lookup: give it a key and it reports what the key actually is.

• Key (Hex)
• Check KCV? — When ticked, the KCV (Optional) field is compared against the computed value instead of just reporting it.
• Parity — Any, Odd or Even; the check fails if the key does not match the parity you assert.

Button: Lookup Key.

Keyshare Generator

Splits a single key into n shares such that all n are required to reconstruct the key (XOR-based component scheme). Useful for multi-custodian key loading.

Inputs

• Global Options — Parity (Ignore by default) and Key Type (DES/TDES), applied to the whole operation.
• 2 Parts / 3 Parts — A tab pair rather than a count field; each tab shows exactly that many part fields.
• Part 1, Part 2 (and Part 3) — Leave them empty to have the tool generate them.

Button: Generate 2 Parts (or 3). The Combined Key and its KCV appear together at the bottom, so the reconstructed value can be checked before it leaves the screen.

Output

• Random components for shares 1 to n−1.
• Final component computed so XOR of all components = the master key.
• KCV of each share for safe transport verification.

TR-31 Key Block

ASC X9.143 (formerly TR-31) defines a key block format that binds a key to its allowable usage, algorithm, mode, and exportability. A TR-31 block is opaque to anything outside the issuing HSM but lets two HSMs exchange keys without losing metadata.

Tabs

• Wrap — Build a key block from a clear key under a Key Block Protection Key (KBPK).
• Unwrap — Decode a key block, validate its MAC, and reveal the contents.

Inputs (Wrap)

• KBPK — 32 / 48 hex chars (3DES) or 64 hex (AES).
• Clear Key — Key to wrap.
• Key Usage — Two-character code (e.g. P0 = PIN encryption, M0 = MAC, K0 = Key Encryption Key).
• Algorithm — D = DES, T = TDES, A = AES, etc.
• Mode of Use — E = encrypt, D = decrypt, B = both, N = no restriction.
• Key Version Number — Two characters.
• Exportability — E = exportable, S = sensitive (no clear export), N = no export.

Output

An ASCII key block string starting with the version (A, B, C, D) plus encrypted key, MAC, and optional optional blocks.

A0072P0TE00E0000ABC...   (D variant TR-31 block)

Thales Key Block

The Thales-specific key block format used by PayShield HSMs. Similar in concept to TR-31 but with Thales’ own header and key usage codes.

Workflow

• Pick a Thales Key Type — ZMK, ZPK, TMK, BDK, ZEK, etc.
• Provide the LMK Variant applicable to that key type.
• Provide the clear key material.
• The tool returns the encrypted key under LMK along with its KCV.

Thales Key Calculator

Vendor-aware calculations matching Thales PayShield host commands.

Operations

• Key Generation — Equivalent to A0 (Generate a Key) host command.
• Key Translation — Equivalent to A6 (Translate a Key from One ZMK to Another).
• KCV Computation — Match Thales-style 6-digit KCVs for operational sign-off.
• Variant Application — Apply LMK and ZMK variants used during key wrapping.

Atalla Key Calculator

Atalla / Utimaco AKB-style key block helpers, in both directions: build a key block from a clear key, or take one apart.

Key Encryption

• Key (Hex) — The clear key to wrap.
• AKB Header (Hex) — The attribute header that travels inside the block.
• MFK Key (Hex) — The Master File Key the block is encrypted under.

Button: Encrypt Key.

AKB Decode

• AKB (Atalla Key Block) — The block to open.
• Check KCV? and KCV (S) — Verify the recovered key against a known check value rather than trusting the decode.
• Parity — None by default.
• MFK Key (Hex)

Button: Decode AKB.

Safenet Key Calculator

Safenet / Thales Luna key calculations for legacy and modern formats.

SSL / X.509 Certificate Tool

An end-to-end certificate workflow tool for terminal-host TLS.

Tabs

• Keys — Generate RSA key pairs (2048 / 3072 / 4096-bit) or read existing keys.
• CSRs — Build a Certificate Signing Request from a key and DN parameters (CN, OU, O, L, S, C).
• Read CSR — Parse and display the contents of an existing CSR.
• Self-Signed — Issue a self-signed certificate from a key + DN, with configurable validity.
• Read Certificate — Parse and display an X.509 certificate, including extensions.

Inputs

• Common Name (CN)
• Organisation (O), Org. Unit (OU)
• Locality (L), State (S), Country (C)
• Validity (Days)
• Key Size — 2048 / 3072 / 4096.

Outputs are displayed as PEM and as parsed fields side-by-side, with a copy button per artifact.

RSA DER Public Key Tool

An RSA public key is a modulus and an exponent, but what a host expects on the wire is those two numbers wrapped in DER. This encoder does that wrapping, and is the tool to reach for when a certificate library rejects a key you know is correct.

Inputs

• Modulus with its own Modulus Encoding selector.
• Exponent with an Exponent Encoding selector — commonly 03 or 010001.
• Toggle Modulus Negative — DER reads the leading bit as a sign, so a modulus starting above 0x7F needs a leading zero byte. This is the switch for that case.

Button: Encode Key.

Tips

• Always verify the KCV after combining shares or unwrapping a key block. A wrong KCV almost always means a typo in one share.
• For TR-31, watch out for case sensitivity in the header — the key usage and mode codes are uppercase.
• If your HSM rejects an imported key, compare the version byte (A vs B vs C vs D) — older HSMs may only accept specific versions.
• For SSL, generate the key first, then the CSR, then the cert — the tool will pre-fill DN parameters from a previous CSR if you stay on the same session.