Cryptnox Docs

cryptnox-logo

DECRYPT Command

The command allows secure data decryption or symmetric key derivation using an internal EC key from the device’s BIP32 seed tree. Inspired by OpenPGP smartcards, it enables asymmetric encryption and decryption using a fixed derivation path, ensuring that only the private key securely stored on the card can the content using the corresponding public key.

This command supports two operational modes:

  • P1 = 0: Outputs the symmetric key derived from ECDH.
  • P1 ≠ 0: Uses the symmetric key internally to encrypt data using AES-CBC.



  def decrypt(pub_key: Any, PIN: str):
      card.decrypt(pub_key, PIN)

  # For example:
  decrypt(pub_key, "123456")

📘

Note

  • A secure channel must be opened.
  • Either PIN authentication or user signature authentication is required.
  • The card must have a seed or extended key loaded before using this command.

Application Protocol Data Unit (APDU) Components

The following table outlines the components of the Application Protocol Data Unit (APDU).

Field

Description

Value

CLA

This field specifies the class of the instruction.

0x80

INS

This field specifies the particular command or operation that the smart card or secure element should execute.

0xC4

P1

First parameter of the instruction that specifies the details about the operation being requested.

provide symmetric key OR decryption in card

Data

Key data

PIN (in case not user auth) | PubKey | dataEncrypted (when P1=1)

Command Modes

Condition

Data Value

P1 = 0x00 & Secure Channel Opened & No User Auth (PIN required) & Data Length = 74 bytes

  • Outputs symmetric key
  • Data: PIN (9 bytes padded to 9) + PubKey (65 bytes)
  • Performs SHA256(PrivateKey . PubKey) → returns 32-byte symmetric key

P1 = 0x00 & Secure Channel Opened & User Authenticated via Signature (no PIN) & Data Length = 65 bytes

  • Outputs symmetric key
  • Data: PubKey (65 bytes)
  • Performs SHA256(PrivateKey . PubKey) → returns 32-byte symmetric key

P1 = 0x01 & Secure Channel Opened & No User Auth (PIN required) & Data Length ≥ 74 bytes & EncData % 16 == 0

  • card using internal AES-128-CBC
  • Data: PIN (9 bytes) + PubKey (65 bytes) + EncryptedData (N bytes)
  • ECDH Key: SHA256(PrivateKey . PubKey) → Split into `IV

P1 = 0x01 & Secure Channel Opened & User Authenticated via Signature (no PIN) & Data Length ≥ 65 bytes & EncData % 16 == 0

  • Decrypts in-card using internal AES-128-CBC
  • Data: PubKey (65 bytes) + EncryptedData (N bytes)
  • ECDH Key: SHA256(PrivateKey . PubKey) → Split into `IV

📘

Note

  • PubKey Format: Must be 65 bytes in X9.62 uncompressed format: 0x04 | X (32B) | Y (32B)
  • Encrypted Data (EncData): Must be padded to 16-byte boundaries (AES block size)
  • PIN: Right-padded with 0x00 to 9 bytes if present
  • PIN Effects:
  • If correct: state changes to "authed"
  • If incorrect: state resets (user auth invalidated)

Response

The following table outlines the possible responses that you will receive:

Response Code

Description

0x9000

Success

0x6A80

the data length is not correct

0x6985

no

key/seed loaded

0x63Cx

the PIN is not correct

0x6982

(outside secure channel) the

data input length is far too long

Product Documentation

Admin Commands

Signature Commands

Menu
Menu
cryptnox-logo
Menu