User guide

The content protection key is a semi-permanent key that uses AES-256 encryption. If the user changes the BlackBerry device
password, the BlackBerry device uses the new password to derive a new ephemeral key. The BlackBerry device uses the new
ephemeral key to re-encrypt the versions of the content protection key and ECC private key that are in flash memory.
For more information about the DSA PRNG function, see Federal Information Processing Standard - FIPS PUB 186-2. For more
information about PKCS #5, visit www.rsa.com to see PKCS #5: Password-Based Cryptography Standard.
Process flow: Deriving an ephemeral key that protects a content protection key and ECC
private key
A BlackBerry® device uses an ephemeral key to encrypt a content protection key and ECC private key. The BlackBerry device
derives the ephemeral key, which is an AES-256 encryption key, from the BlackBerry device password using PKCS #5.
To derive an ephemeral key, the BlackBerry device performs the following actions:
1. selects a 64-bit salt (which is random data that the BlackBerry device mixes with the BlackBerry device password)
The salt prevents two identical passwords from turning into the same key.
2. concatenates the salt, password, and salt again into a byte array (for example, Salt|Password|Salt)
3. hashes the byte array with SHA-256
4. stores the resulting hash in a byte array that is called a key
(key) =
SHA256(Salt|Password|Salt)
5. hashes the key 18 more times and stores the result in the key each time
For example, for i=0 to 18, the BlackBerry device performs the following actions:
(key) = SHA256(key)
i++
done
The final hash creates the ephemeral key.
For more information, visit www.rsa.com to see PKCS #5: Password-Based Cryptography Standard.
Principal encryption keys
When you or a user turns on content protection for device transport keys, a BlackBerry® device generates a principal encryption
key and stores it in flash memory. The BlackBerry device uses the principal encryption key to encrypt the device transport keys
that are stored on the BlackBerry device in flash memory and the PIN encryption key that is specific to your organization. The
BlackBerry device encrypts the principal encryption key using the content protection key. When the BlackBerry device receives
data that the device transport key encrypts while the BlackBerry device is locked, the BlackBerry device uses the principal
encryption key to decrypt the device transport key that is in flash memory.
Security Technical Overview
Principal encryption keys
27