Using M2 command on Thales Payshield 9000 HSM to decrypt a message

Question

I am provided with an HSM Encrypted message (HEX format), and I'm supposed to implement the decryption using M2 command of that message. I have:

• Encrypted data: M1000030DF29D4728FE8365D1FA6ACF96E50A3CFC7F4013A6C8D6624
• Keys:
  • ZMK clear 1: <32 HEX digit key>
  • ZMK clear 2: <32 HEX digit key>
  • ZMK clear 3: <32 HEX digit key>
  • IWK/ZMK encrypted: <32 HEX digit key> / Key Check Value: <6 HEX digit key>

Provided the above data, how can I implement the decryption in Python?

Answer 1

Combine the ZMK key by XOR 3 clear components of ZMK. And use the combined key to Import the IWK (encrypted under LMK). At last use the IWK to decrypt the message from M100.

To form the M2 message, you may refer to the sample structure below: