3DES / AES Session Key Visualizer

Session Key Derivation in Smart Cards

Session keys are temporary symmetric keys derived from a master key for each communication session. They prevent replay attacks and limit the exposure of the master key. In smart card security, session keys are used for encrypting APDU data, computing MACs, and authenticating commands. Every time a secure channel is established — whether for card personalization, OTA provisioning, or post-issuance updates — fresh session keys are derived using a derivation function that combines the static key with unpredictable data exchanged between host and card.

Why Not Use the Static Key Directly?

Using the same static key for every session would create a replay attack surface — an attacker who captures one encrypted command could resubmit it. More critically, if the static key were ever recovered from a compromised session, all past and future communications would be exposed. Session key derivation solves both problems: each session uses a unique key derived from the static key and session-specific data (challenges, counters). Even if a session key is compromised, the static key remains safe, and other sessions' keys are independent.

Derivation Methods

Common derivation methods include: 3DES-based derivation (SCP02) uses a 2DES/3DES operation on the master key with diversification data (host challenge + card challenge + sequence counter). AES-based derivation (SCP03) uses CMAC with the master key on diversification data. Both methods produce session-specific keys that are computationally indistinguishable from random keys without knowing the master key. The derivation function must be a pseudorandom function (PRF) — 3DES-CBC and AES-CMAC both satisfy this property, ensuring that session keys inherit the full security strength of the master key.

Key Types and Their Roles

A typical SCP session uses multiple derived keys: S-ENC (encryption key) for data confidentiality — encrypts the data field of APDUs so an eavesdropper cannot read the command parameters. S-MAC (MAC key) for data integrity and command authentication — produces a MAC over the command header and data, preventing tampering and replay. S-RMAC (response MAC key, SCP03 only) for response authentication — the card produces a MAC over its response, allowing the host to verify the response came from the genuine card. S-DEK (data encryption key) for encrypting sensitive data that the S-ENC key does not cover, such as key values being injected into the card.

Derivation Constants and Their Meaning

In SCP02, the derivation constant is a 2-byte value where the first byte identifies the key type (0x01) and the second byte identifies the specific key (0x01=S-ENC, 0x02=S-MAC, 0x03=S-DEK). These constants ensure that different session keys are produced from the same static key, preventing key reuse across functions. In SCP03, the KDF uses a label ("SCP03" in ASCII), a counter (0x01 for S-ENC, 0x02 for S-MAC, 0x03 for S-RMAC), and a 16-byte context (host challenge + card challenge). The counter and label provide key separation, while the context binds the session keys to this specific session.

Visualizing CBC Key Derivation

This tool shows the internal workings of CBC-mode key derivation step by step. In 3DES-CBC, each 8-byte block is XORed with the previous ciphertext block before encryption. The first block uses the IV (typically zeros for key derivation). This visualization helps developers understand why a single-bit change in the derivation data produces a completely different session key — the CBC chaining effect amplifies the change across all blocks. For AES-CBC, the process is identical but operates on 16-byte blocks with a 128-bit key.

Sequence Counter Management

In SCP02, the sequence counter is a 2-byte value that increments with each INITIALIZE UPDATE command. The card and host must track this counter in lockstep — if the host sends a counter that the card has already seen, the card rejects the command to prevent replay. The counter is embedded in the derivation data, so each counter value produces a different session key. In SCP03, the role of the sequence counter is replaced by random challenges (host and card), providing stronger replay protection without the synchronization burden of a monotonically increasing counter.

For a detailed walkthrough of SCP02/SCP03 key derivation with actual computation, see our GP Session Key Calculator and Key Diversification Tool.