dukpt 0.0.1 → 0.0.2

data/README.md

@@ -20,6 +20,9 @@ Or install it yourself as:
 
     # Instantiate a decrypter with your base derivation key (BDK)
     decrypter = DUKPT::Decrypter.new("0123456789ABCDEFFEDCBA9876543210")
+
+    # You can specify whether you want to use "ecb" cipher mode if needed. The default is "cbc".
+    decrypter = DUKPT::Decrypter.new("0123456789ABCDEFFEDCBA9876543210", "ecb")
   
     # Pass the ciphertext and the current Key Serial Number (KSN), as hex encoded strings, to the decryptor to get back the plaintext
     ksn = "FFFF9876543210E00008"

data/lib/dukpt/decrypter.rb

@@ -3,8 +3,10 @@ module DUKPT
     include Encryption
     
     attr_reader :bdk
-    def initialize(bdk)
+
+    def initialize(bdk, mode=nil)
       @bdk = bdk
+      self.cipher_mode = mode.nil? ? 'cbc' : mode
     end
 
     def decrypt(cryptogram, ksn)

data/lib/dukpt/encryption.rb

@@ -10,7 +10,18 @@ module DUKPT
     KEY_MASK        = 0xC0C0C0C000000000C0C0C0C000000000
     PEK_MASK        = 0x00000000000000FF00000000000000FF
     KSN_MASK        = 0xFFFFFFFFFFFFFFE00000
-    
+    DEK_MASK        = 0x0000000000FF00000000000000FF0000 # Used by IDTECH reader
+
+    def cipher_mode=(cipher_type)
+      if cipher_type == "ecb"
+        @cipher_type_des = "des-ecb"
+        @cipher_type_tdes = "des-ede"
+      else
+        @cipher_type_des = "des-cbc"
+        @cipher_type_tdes = "des-ede-cbc"
+      end
+    end
+
     def derive_key(ipek, ksn)
       ksn_current = ksn.to_i(16)
       
@@ -51,10 +62,33 @@ module DUKPT
       hex_string_from_val((key.to_i(16) ^ PEK_MASK), 16)
     end
 
+    def dek_from_key(key)
+      key = key.to_i(16)
+
+      key = key ^ DEK_MASK
+
+      left = (key & MS16_MASK) >> 64
+      right = (key & LS16_MASK)
+
+      invariant_key_hex = hex_string_from_val(key, 16)
+
+      left = triple_des_encrypt(invariant_key_hex, hex_string_from_val(left, 8))
+      right = triple_des_encrypt(invariant_key_hex, hex_string_from_val(right, 8))
+
+      left = hex_string_from_val(left.to_i(16), 8)
+      right = hex_string_from_val(right.to_i(16), 8)
+
+      [left, right].join
+    end
+
     def derive_PEK(ipek, ksn)
       pek_from_key(derive_key(ipek, ksn))      
     end
 
+    def derive_DEK(ipek, ksn)
+      dek_from_key(derive_key(ipek, ksn))
+    end
+
     def derive_IPEK(bdk, ksn)
     	ksn_cleared_count = (ksn.to_i(16) & KSN_MASK) >> 16
     	left_half_of_ipek = triple_des_encrypt(bdk, hex_string_from_val(ksn_cleared_count, 8)) 
@@ -63,23 +97,36 @@ module DUKPT
     	ipek_derived = left_half_of_ipek + right_half_of_ipek
     end
     
+    def aes_decrypt(key, message)
+      openssl_encrypt("aes-128-cbc", key, message, false)
+    end
+    
     def triple_des_decrypt(key, message)
-    	openssl_encrypt("des-ede-cbc", key, message, false)
+    	openssl_encrypt(cipher_type_tdes, key, message, false)
     end
     
     def triple_des_encrypt(key, message)
-    	openssl_encrypt("des-ede-cbc", key, message, true)
+    	openssl_encrypt(cipher_type_tdes, key, message, true)
     end
-    
+
     def des_encrypt(key, message)
-    	openssl_encrypt("des-cbc", key, message, true)
+    	openssl_encrypt(cipher_type_des, key, message, true)
     end
     
     private
+
+    def cipher_type_des
+      @cipher_type_des || "des-cbc"
+    end
+
+    def cipher_type_tdes
+      @cipher_type_tdes || "des-ede-cbc"
+    end
     
     def hex_string_from_val val, bytes
       val.to_s(16).rjust(bytes * 2, "0")
     end
+
     def encrypt_register(curkey, reg_8)
       left_key_half = (curkey & MS16_MASK) >> 64
   	  right_key_half = curkey & LS16_MASK
@@ -96,7 +143,6 @@ module DUKPT
     	is_encrypt ? cipher.encrypt : cipher.decrypt
     	cipher.padding = 0
     	cipher.key = [key].pack('H*')
-    	# No Initial Vector is used in the process.
     	cipher_result = ""
     	cipher_result << cipher.update([message].pack('H*'))
     	cipher_result << cipher.final

data/lib/dukpt/version.rb

@@ -1,3 +1,3 @@
 module DUKPT
-  VERSION = "0.0.1"
+  VERSION = "0.0.2"
 end

data/test/decrypter_test.rb

@@ -10,7 +10,7 @@ class DUKPT::DecrypterTest < Test::Unit::TestCase
     ciphertext = "C25C1D1197D31CAA87285D59A892047426D9182EC11353C051ADD6D0F072A6CB3436560B3071FC1FD11D9F7E74886742D9BEE0CFD1EA1064C213BB55278B2F12"
     plaintext = "%B5452300551227189^HOGAN/PAUL      ^08043210000000725000000?\x00\x00\x00\x00"
     
-    decrypter = DUKPT::Decrypter.new(bdk)
+    decrypter = DUKPT::Decrypter.new(bdk, "cbc")
     assert_equal plaintext, decrypter.decrypt(ciphertext, ksn)
   end
   

data/test/encryption_test.rb

@@ -84,10 +84,35 @@ def test_derive_pek_counter_EFF800
     assert_equal '2542353435323330303535313232373138395e484f47414e2f5041554c2020202020205e30383034333231303030303030303732353030303030303f00000000', data_decrypted
   end
   
+  def test_triple_des_decrypt_with_ecb
+    self.cipher_mode = "ecb"
+    ciphertext = "C25C1D1197D31CAA87285D59A892047426D9182EC11353C051ADD6D0F072A6CB3436560B3071FC1FD11D9F7E74886742D9BEE0CFD1EA1064C213BB55278B2F12"
+    data_decrypted = triple_des_decrypt('27f66d5244ff621eaa6f6120edeb427f', ciphertext)
+    assert_equal '2542353435323330f2692820a5e12b9bbf110311e7d5453a0989597b8d3373e0718df68ec04a96ff0704673b0041cc2fe12da84c41b85772e98ed0f0d1ea1064', data_decrypted
+  end
+
   def test_unpacking_decrypted_data
     data_decrypted = '2542353435323330303535313232373138395e484f47414e2f5041554c2020202020205e30383034333231303030303030303732353030303030303f00000000'
     expected = "%B5452300551227189^HOGAN/PAUL      ^08043210000000725000000?\x00\x00\x00\x00"
     assert_equal expected, [data_decrypted].pack('H*')
   end
     
+  def test_cipher_mode_ecb
+    self.cipher_mode = "ecb"
+    assert_equal cipher_type_des, "des-ecb"
+    assert_equal cipher_type_tdes, "des-ede"
+  end
+
+  def test_dek_from_key 
+    key = "27F66D5244FF62E1AA6F6120EDEB4280"
+    dek = dek_from_key(key)
+    assert_equal "C39B2778B058AC376FB18DC906F75CBA", dek.upcase
+  end
+
+  def test_derive_dek_counter_13
+    ksn = "FFFF9876543210E00013"
+    dek = derive_DEK('6ac292faa1315b4d858ab3a3d7d5933a', ksn)
+    assert_equal '44893E3434ABDD6A817CE2841825E1FD', dek.upcase
+  end
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dukpt
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
   prerelease: 
 platform: ruby
 authors:
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-18 00:00:00.000000000 Z
+date: 2013-05-21 00:00:00.000000000 Z
 dependencies: []
 description: Implements a Derived Unique Key Per Transaction (DUKPT) decrypter
 email: