Commands And Security Levels - Magtek MagneSafe V5 Reference Manual

MagneSafe V5
Annex A. Note that data supplied to the MAC algorithm should NOT be converted to the
ASCII-Hex, rather it should be supplied in its raw binary form. The MAC key to be used is as
specified in the same document ("Request PIN Entry 2" bullet 2). Calculating the MAC requires
knowledge of the current DUKPT KSN, which can be retrieved using the Get DUKPT KSN
and Counter command. For each command processed successfully, the DUKPT Key is
advanced.

COMMANDS AND SECURITY LEVELS

The following table shows how security levels affect the various commands. "Y" means the
command can run. "N" means the command is prohibited. "S" means the command is protected
(requires MACing). "X" means other (notes to follow).
Number Command
0x00 Get Property
0x01 Set Property
0x02 Reset Device
0x03 Get Keymap Item
0x04 Set Keymap Item
0x05 Save Custom Keymap
0x09 Get DUKPT KSN and Counter
0x0A Set Session ID
0x10 Activate Authenticated Mode
0x11 Activation Challenge Reply
0x12 Deactivate Authenticated Mode
0x14 Get Reader State
0x15 Set Security Level
Get Transaction count Command (Flash
0x16
Reader Only)
Read Oldest Transaction Command
0x17
(Flash Reader Only)
Erase Oldest Transaction Command
X018
(Flash Reader Only)
0x1C Get Encryption Counter
Power Down Command (Wireless USB
0x28
Reader Only)
Get Battery Status Command (Wireless
0x29
USB Reader Only)
0x30 Encrypt Bulk Data Command
* The Reset command has special behavior. When an Authentication sequence has failed, only a
correctly MACd Reset command can be used to reset the reader. This is to prevent a dictionary
attack on the keys and to minimize a denial of service attack.
2
Level 2 Level 3
Y Y
Y S
Y X*
Y Y
Y S
Y S
Y Y
Y Y
N Y
N Y
N Y
Y Y
S S
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
N Y
Level 4
Y
S
X*
Y
S
S
Y
Y
Y
Y
Y
Y
S
Y
Y
Y
Y
Y
Y
Y