The secret or the plain text can be sent to the STSAFE-A120 in the command data of the WRAP LOCAL

ENVELOPE command. In the response, the STSAFE-A120 returns an envelope, which contains the encrypted

secret or plain text and a MAC. Such an envelope is known as a local envelope.

The local host can use the UNWRAP LOCAL ENVELOPE command to retrieve the temporary secret or plain text.

The wrapping and unwrapping processes utilize a key from one of the local envelope key slots and the AES key

wrap algorithm.

Local envelope key slots

The STSAFE-A120 supports two local envelope key slots.

Each slot can store an AES-128- or AES-256-bit key that can be used for the wrapping and unwrapping of local

envelopes.

A local envelope key is generated randomly by the STSAFE-A120 with the GENERATE KEY command, and it

never leaves the STSAFE-A120.

Command flow

1. Generation of the local envelope key:

–

The local host queries the STSAFE-A120 to randomly generate a local envelope key in one of the two

slots, using the GENERATE KEY command.

2. Wrapping of local envelope:

–

The local host builds the local envelope by using the STSAFE-A120 wrap local envelop command.

–

This command requires a local host’s C-MAC, plain text data (usually a cryptographic key that needs to

be encrypted with the host’s cipher key) and the local envelope key slot number (the key to use for

encryption of plain text data).

–

The response to the wrap local envelope command contains the envelope (plain text is encrypted using

the local envelope key).

3. Unwrapping of local envelope by receiver:

–

The local host provides the local envelope to the STSAFE-A120 by using the unwrap local envelop

command and the local envelope key slot.

–

The host must generate a local host’s C-MAC with the command.

–

The STSAFE-A120 provides the envelope cryptogram (usually a cryptographic key) decrypted with the

local envelope key) in its response.

–

The response is encrypted using the host’s cipher key.

–

The host decrypts the response with the host’s cipher key and obtains the decrypted envelope

cryptogram.

STSAFE-A120

Product use cases

DS14609 - Rev 1

page 7/38