TOOLS / KEY MANAGEMENT

TR-31 Key Block

Parse, create and decode ANSI TR-31 / X9.143 symmetric key blocks.

Connected workflow: Generate key → KCV → TR-31

Inspect the header and optional blocks. Parsing does not verify the MAC.

Version

A · Variant (legacy)B · CMAC/TDESC · Variant (legacy)D · CMAC/AES

Clear Key (HEX)

Key Usage Algorithm Mode of Use Exportability

Key Version Number

Optional blocks

Two-character ID and printable ASCII data. PB padding is added automatically.

TR-31 Key Block (ASCII)

Supported methods

A/C use legacy TDES variant binding. B uses TDES key derivation and CMAC. D uses AES key derivation and CMAC. Version A is deprecated.

Create accepts AES, DES, TDES and HMAC keys, up to 99 optional blocks including PB. Random padding conceals AES/TDES key length within their algorithm family; output changes on each creation.

Limits

Maximum block size: 9,999 characters. Decode checks authentication before exposing key material. Optional-block values are displayed as supplied; algorithm-specific policy and key-strength checks belong to the receiving system. Only byte-aligned keys and reserved field 00 are supported for decoding. No TR-34 or proprietary key blocks.

Worked example

Load the synthetic example, choose Create, then Use in Decode. The recovered key is 00112233445566778899AABBCCDDEEFF.

References

IBM TR-31 header reference ↗

psec implementation and test vectors ↗ · MIT notice