ID TECH Spectrum Air User Manual
Copyright © 2020, International Technologies & Systems Corporation. All rights reserved.
Page | 20
8.
Security Features
The Secure MIR Reader features configurable security settings. Before encryption feature can be
enabled, Key Serial Number (KSN) and Base Derivation Key (BDK) must be loaded before encrypted
transactions can take place. The keys are to be injected by certified key injection facility.
There are five security levels available on the reader:
•
Security Level 0:
Security Level 0 is a special case where all DUKPT keys have been used
(exhausted) and is set automatically when it runs out of DUKPT keys. The lifetime of DUKPT
keys is 1 million. After the key’s end of lifetime is reached, user should inject DUKPT keys
again.
•
Security Level 1:
By default, non-secure readers from the factory are configured to have this
security level. There is no encryption process, no key serial number transmitted with decoded
data. The reader functions as a non-encrypting reader.
•
Security Level 2:
Key Serial Number and Base Derivation Key have been injected but the
encryption process is not yet activated. The reader would send out decoded track data in
default format, the same as security level 1.
•
Security Level 3:
By default, secure readers from the factory have this security level. Both Key
Serial Number and Base Derivation Keys are injected and encryption mode is turned on. For
payment cards, both encrypted data and masked clear text data are sent out. Users can select
the data masking area; and the encrypted data format.
•
Security Level 4:
When the reader is at Security Level 4, a correctly executed Authentication
Sequence is required before the reader sends out data for a card. Commands that require
security must be sent with a four-byte Message Authentication Code (MAC) at the end. Note
that data supplied to MAC algorithm should NOT be converted to ASCII-Hex, rather it should
be supplied in its raw binary form. Calculating MAC requires knowledge of current DUKPT
KSN, this could be retrieved using Get DUKPT KSN and Counter command.
Default reader properties are configured to have security level 1 (no encryption). In order to output
encrypted data, the reader has to be key injected with encryption feature enabled. After the reader
has been configured to security level 2, 3 or 4, it cannot be reverted to a lower security level.
8.1.
Encryption Management
The Encrypted read supports TDES and AES encryption standards for data encryption. Encryption can
be turned on via a command. TDES is the default.
If the reader is in security level 3, for the encrypted fields, the original data is encrypted using the
TDES/AES CBC mode with an Initialization Vector starting at all binary zeroes and the Encryption Key
associated with the current DUKPT KSN.
