TOOLS / KEY MANAGEMENT

Thales Key Block

Parse, create and decode Thales payShield version 1 key blocks.

Inspect the header and optional blocks. Parsing does not verify the MAC.

Version 1 · AES protection

LMK ID

Random KBPK size

AES-128AES-192AES-256

Clear Key (HEX)

Key Usage Algorithm Mode of Use Exportability

Key Version Number

Optional blocks

Two-character ID and printable ASCII data. PB padding is added automatically.

Thales / TR-31 Key Block (ASCII)

Version 1

AES-CBC encrypts the key data, using the 16-character header as the IV. An 8-byte AES-CMAC authenticates the header, optional blocks and ciphertext. LMK ID is included in that authentication.

The protected key can be DES, TDES, AES or HMAC. The protection key is always AES, including when wrapping a TDES key.

Parse and Decode

Accepts version 1 and TR-31 A-D, including an optional S prefix for version 1 or R prefix for TR-31. The prefix is outside the declared block length. Parse does not authenticate. Decode exposes the key only after the MAC passes.

Limits

Create emits version 1. Version 0 and proprietary extensions are not supported. Maximum 9,999 block characters, byte-aligned keys, and 99 optional blocks including padding. Optional-block values are preserved without enforcing their vendor-specific meaning.

This is a format calculator, not an HSM: it does not enforce key usage, exportability or LMK access policy. Interoperability is tested against public implementation vectors, not a physical payShield.

Worked example

Load the synthetic example, Create, then Use in Decode. The recovered key is 00112233445566778899AABBCCDDEEFF. Random padding makes each created block different.

References

Version 1 implementation vectors ↗ · MIT notice

TR-31 reference implementation ↗ · MIT notice

TR-31 Key Block →