translate_key_material
Convert an ECDH-wrapped TR-31 key block into a KEK-wrapped TR-31 key block without importing the working key into APC storage. Use for deriving shared session keys from ECC key pairs and certificates.
Instructions
Call this when implementing ECDH-based key agreement — for example, deriving a shared session key from an ECC key pair and a counterparty certificate, then wrapping the result as a TR-31 key block for local use. Also use when a key exchange protocol delivers a key via Diffie-Hellman and you need it in APC format.
Translate an ECDH-wrapped TR-31 key block into a KEK-wrapped TR-31 key block without ever importing the working key into APC storage.
The only documented use case is ECDH → TR-31 (KEK): incoming_key_material = { "DiffieHellmanTr31KeyBlock": { "CertificateAuthorityPublicKeyIdentifier": "", "KeyBlockHeaders": {...}, "PrivateKeyIdentifier": "", "PublicKeyCertificate": "", "DerivationData": "", "KeyAlgorithm": "AES_128", "KeyDerivationFunction": "NIST_SP800", "KeyDerivationHashAlgorithm": "SHA_256" } } outgoing_key_material = { "Tr31KeyBlock": { "WrappingKeyIdentifier": "" } }
key_check_value_algorithm: CMAC, ANSI_X9_24, HMAC, or SHA_1
Args: incoming_key_material: ECDH-wrapped TR-31 key block (DiffieHellmanTr31KeyBlock) outgoing_key_material: Target KEK-wrapped TR-31 output (Tr31KeyBlock) key_check_value_algorithm: Optional KCV algorithm for the output key block
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| incoming_key_material | Yes | ||
| outgoing_key_material | Yes | ||
| key_check_value_algorithm | No |