TOOLS / KEY MANAGEMENT

TR-34 Key Block

Parse and create RSA-based symmetric key transport blocks.

TR-34 Key Block (DER HEX, Base64 or PEM)KRD Private Key (PEM, optional)

Key recovery also requires the KDH signing certificate and the expected recipient nonce.

KDH Signing Certificate (PEM, optional for parsing) Expected Recipient Nonce (HEX, optional for parsing)

8-16 bytes. For a real exchange, use the recipient’s independently supplied nonce.

Supported profile

X9_TR34_2012 two-pass layout demonstrated by the AWS sample: RSA-OAEP with SHA-256 and MGF1-SHA256, RSA PKCS#1 v1.5 signatures with SHA-256, and AES-128-CBC or TDES-CBC content encryption.

RSA keys: 2048-4096 bits. One signer and one recipient; certificates supplied separately. This tool does not accept arbitrary CMS layouts, one-pass timestamps, optional key-header blocks, or proprietary extensions.

Certificates and roles

KDH is the sender and signs the block. KRD is the receiver: its public certificate protects the transport key, and its private key recovers it. A bare public key cannot identify the recipient certificate’s issuer and serial number.

What verification means

Without the KDH certificate, Parse only inspects structure and checks the envelope digest. Key recovery requires a matching signature and supplied nonce. Certificate-chain trust, revocation, nonce freshness and replay prevention remain external checks. No HSM policy is enforced.

Worked example

Generate a synthetic example to create two RSA-2048 pairs and self-signed test certificates. Create a block, then Use in Parse. The recovered key should be 00112233445566778899AABBCCDDEEFF.

References

AWS TR-34 sample ↗ · License

TR-34 key import workflow ↗

TR-31 Key Block →