id: 2f0b7242dc1b4ef2b3b706b184f82aa7
parent_id: 2f45323433a24e5f9cba3b699c607f1b
item_type: 1
item_id: fa9e72ee12554f978a86ab3f7888cc63
item_updated_time: 1786962986595
title_diff: "[]"
body_diff: "[{\"diffs\":[[-1,\"# Keyfob Station — SCP03 / KLMS Flow Reference\\\nID: fa9e72ee12554f978a86ab3f7888cc63\\\nNotebook ID: 283dd54f183a4ce69366648f091336d1\\\nCreated: 1782487881636\\\nUpdated: 1782802444698\\\nIs Todo: No\\\nTags: rust, scp03, nfc, ford, active-project\\\n\\\n---\\\n\\\n\"],[0,\"# Ke\"]],\"start1\":0,\"start2\":0,\"length1\":243,\"length2\":4},{\"diffs\":[[0,\"tail\"],[-1,\" now\\\n>\"],[0,\" liv\"]],\"start1\":123,\"start2\":123,\"length1\":14,\"length2\":8},{\"diffs\":[[0,\"s in\"],[-1,\" two dedicated notes\"],[0,\":\\\n> \"]],\"start1\":132,\"start2\":132,\"length1\":28,\"length2\":8},{\"diffs\":[[0,\"ypeum\\\"**\"],[1,\" (updated 2026-08-17 to the REST transport)\"],[0,\"\\\n>\\\n> For\"]],\"start1\":270,\"start2\":270,\"length1\":16,\"length2\":59},{\"diffs\":[[0,\" offload\"],[1,\" — IMPLEMENTED & HW-VERIFIED\"],[0,\"\\\n\\\n**Goal\"]],\"start1\":502,\"start2\":502,\"length1\":16,\"length2\":44},{\"diffs\":[[0,\" bundles\"],[-1,\",\"],[1,\" and\"],[0,\" the Net\"]],\"start1\":1001,\"start2\":1001,\"length1\":17,\"length2\":20},{\"diffs\":[[0,\"them\"],[-1,\", and a decrypted-package cache is kept at ≥ **2 weeks** of stock.\\\n \"],[1,\" into their backend.\"],[0,\" *No\"]],\"start1\":1036,\"start2\":1036,\"length1\":76,\"length2\":28},{\"diffs\":[[0,\"ion \"],[-1,\"send\"],[1,\"identifie\"],[0,\"s th\"]],\"start1\":1132,\"start2\":1132,\"length1\":12,\"length2\":17},{\"diffs\":[[0,\"fob \"],[-1,\"UID + handshake\\\n  to Clypeum\"],[1,\"(SELECT ISD\\\n  + GET DATA → OEF/UID), runs INITIALIZE UPDATE, and requests a container\"],[0,\" via\"],[1,\"\\\n\"],[0,\" \"],[-1,\"a\"],[0,\" **\"],[-1,\"DLL\"],[1,\"REST\"],[0,\" ove\"]],\"start1\":1151,\"start2\":1151,\"length1\":48,\"length2\":106},{\"diffs\":[[0,\"LS**\"],[-1,\". Clypeum looks up cached content and uses the\\\n  NetHSM to derive **static keys (KDF3, master+UID)** → **session keys** +\\\n  cryptograms + A003 S-DEK encryption,\"],[1,\" (`POST /cryptoContainers`, form: typeID/seedUUID/productSerial +\\\n  `extra` JSON carrying the handshake metadata; seed from `POST /seeds` at connect).\\\n  The KLMS derives keys via the NetHSM and\"],[0,\" return\"],[-1,\"ing\"],[1,\"s\"],[0,\" a **\"],[-1,\"container** (session keys +\\\n  pre\"],[1,\"binary Clypeum container**\\\n  (13 TLV fields: session keys, host cryptogram, content incl. the card-ready\\\n  S-DEK\"],[0,\"-enc\"]],\"start1\":1261,\"start2\":1261,\"length1\":216,\"length2\":326},{\"diffs\":[[0,\"crypted \"],[-1,\"content\"],[1,\"A003\"],[0,\"). The s\"]],\"start1\":1586,\"start2\":1586,\"length1\":23,\"length2\":20},{\"diffs\":[[0,\"ion \"],[-1,\"then runs\"],[1,\"verifies the card cryptogram locally, then\\\n \"],[0,\" EXT\"]],\"start1\":1609,\"start2\":1609,\"length1\":17,\"length2\":52},{\"diffs\":[[0,\"ORE DATA\"],[-1,\"\\\n \"],[0,\" → lifec\"]],\"start1\":1684,\"start2\":1684,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"roize.\\\n\\\n\"],[1,\"**Status (2026-08-17):** implemented in `kf-dev-station`'s KLMS panel and verified\\\nend-to-end on hardware (two fobs, GA ECDSA signatures passing). `kf-prod-station`\\\nstill runs the mock client.\\\n\\\n\"],[0,\"**What t\"]],\"start1\":1722,\"start2\":1722,\"length1\":16,\"length2\":210},{\"diffs\":[[0,\"ted \"],[-1,\"by Clypeum\"],[1,\"twice: by the KLMS\"],[0,\" (`c\"]],\"start1\":2282,\"start2\":2282,\"length1\":18,\"length2\":26},{\"diffs\":[[0,\"am` \"],[-1,\"check) before keys issue.\\\n\\\n**Implemented as (our boundary):**\\\n- `Scp03Channel::establish_from_session_keys` — inject the container's session keys.\\\n- `KlmsProvisioner` — rejects items flagged `encrypt_with_dek=true`\"],[1,\"gate, Phase C)\\\n  **and locally by the station** before EXTERNAL AUTHENTICATE.\\\n\\\n**Implemented as (our boundary):**\\\n- `klms_client.rs` (kf-dev-station) — REST client: token auth, seed, generate,\\\n  report_usage (wired pending KLMS status semantics).\\\n- `Scp03Channel::establish_from_session_keys` — inject the container's session keys.\\\n- `ContainerTlvSource` — tag-keyed field extraction; card-ready A003 forwarded\\\n  untouched (CBC+IV0+M2, verified 2026-08-17)\"],[0,\".\\\n- \"]],\"start1\":2320,\"start2\":2320,\"length1\":222,\"length2\":464},{\"diffs\":[[0,\"bles\"],[-1,\", request/response JSON, and ASCII\"],[1,\" and the PlantUML note for\"],[0,\" dia\"]],\"start1\":2975,\"start2\":2975,\"length1\":42,\"length2\":34},{\"diffs\":[[0,\"station`\"],[1,\" (keys from `dev_profiles.toml`)\"],[0,\". The Ph\"]],\"start1\":3176,\"start2\":3176,\"length1\":16,\"length2\":48},{\"diffs\":[[0,\" KDF can\"],[-1,\" \"],[1,\"\\\n\"],[0,\"also be \"]],\"start1\":3229,\"start2\":3229,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\" the dev\"],[-1,\"\\\n\"],[1,\" \"],[0,\"master k\"]],\"start1\":3260,\"start2\":3260,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"the main\"],[-1,\" \"],[1,\"\\\n\"],[0,\"note + N\"]],\"start1\":3311,\"start2\":3311,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\" for dev\"],[-1,\"\\\n\"],[1,\" \"],[0,\"samples.\"]],\"start1\":3339,\"start2\":3339,\"length1\":17,\"length2\":17}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-17T10:39:06.504Z
created_time: 2026-08-17T10:39:06.504Z
is_locked: 0
type_: 13