id: c859ef079a364398a9f908ebd3278f25
parent_id: 
item_type: 1
item_id: 67dacd63422b4accbe2949fc7ebd0d24
item_updated_time: 1782811802918
title_diff: "[{\"diffs\":[[1,\"Keyfob Flow 1 — Content Supply: Ford IVSS/GIVIS → Clypeum KLMS\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":62}]"
body_diff: "[{\"diffs\":[[1,\"# Keyfob Flow 1 — Content Supply: Ford IVSS/GIVIS → Clypeum KLMS\\\n\\\n> The **OEM → supplier content-delivery plane**: how Ford's backend ships\\\n> per-fob provisioning data to Clypeum's KLMS, encrypted to a keypair generated\\\n> in the NetHSM, and maintained as a watchdog-governed cache. This flow carries\\\n> **application/personalization content only** — it does **not** touch the SCP03\\\n> master key or static keys (those are derived in Flow 2). Companion: **\\\"Keyfob\\\n> Flow 2 — Provisioning: Station ↔ Key Fob ↔ Clypeum\\\"**.\\\n\\\n> **Why `uid` matters here:** in Flow 2 the station sends **only the UID**, so the\\\n> KLMS must be able to resolve a fob's content by UID. Therefore the **UID is the\\\n> cache index key**, and each package **must** include the UID.\\\n\\\n---\\\n\\\n## 1. Actors\\\n\\\n| Actor | Role |\\\n|---|---|\\\n| **Ford IVSS / GIVIS** (OEM backend) | Holds per-fob data (FESN, SPID, certs, device key); builds + encrypts **bundles**; ships to Clypeum |\\\n| **Clypeum KLMS** (supplier) | Inventory **watchdog**; fetches bundles; asks the NetHSM to decrypt; caches decrypted **packages** indexed by **UID** |\\\n| **NetHSM** (Clypeum-side) | Holds the **bundle-decryption private key** (generated inside it); performs bundle decryption |\\\n\\\n> This is an **asynchronous** plane, fully decoupled from the factory line. The\\\n> watchdog keeps ≥ **2 weeks of production** buffered so provisioning never blocks\\\n> on Ford-side latency/availability.\\\n\\\n---\\\n\\\n## 2. Trust & invariants\\\n\\\n- The **bundle keypair is generated in the NetHSM**; the **private key never\\\n  leaves** it. Ford encrypts bundles with the exported **public key**.\\\n- Per-fob content (including the sensitive device private key, A003) is\\\n  **encrypted in transit** inside the bundle. Plaintext appears only inside the\\\n  NetHSM-decrypt step and the trusted KLMS cache.\\\n- **No SCP03 material** (master key, static keys, S-DEK) is involved here — that\\\n  is Flow 2's concern. The device private key here is *content*, later wrapped\\\n  with S-DEK during provisioning.\\\n\\\n---\\\n\\\n## 3. One-time setup\\\n\\\n| # | From → To | Message | Data |\\\n|---|---|---|---|\\\n| 1.0 | NetHSM → Ford IVSS | export bundle-encryption public key | HSM-generated keypair; **private key never leaves**; Ford provisions the public key on its encrypting side |\\\n\\\n---\\\n\\\n## 4. Per-fob package (the unit of content)\\\n\\\n```jsonc\\\n{\\\n  \\\"uid\\\":         \\\"00002317229409204524\\\",    // 10-byte JCOP UID — REQUIRED (KLMS cache index key)\\\n  \\\"fesn\\\":        \\\"1KM0001E\\\",                 // serial\\\n  \\\"spid\\\":        \\\"59918C0096F859EC8BF6DA454E2E554A14DD4BD1\\\", // → DGI A001\\\n  \\\"device_cert\\\": \\\"<DER hex>\\\",                // → DGI A002\\\n  \\\"private_key\\\": \\\"<32-byte P-256 scalar>\\\",   // → DGI A003 (S-DEK-encrypted later, in Flow 2)\\\n  \\\"irk\\\":         \\\"<16-byte hex>\\\"             // → DGI A006 (BLE)\\\n}\\\n```\\\n> Factory-wide **A004 (ICA)** and **A005 (CMS/Root)** certs are shared/static —\\\n> delivered once (not per-package) and stored at the KLMS.\\\n\\\n---\\\n\\\n## 5. Bundle\\\n\\\nA **bundle** = many per-fob packages, encrypted to the NetHSM public key:\\\n\\\n```\\\nbundle = Enc_to_pubHSM( packages[], metadata{ batch_id, count, created_at } )  +  Sig_Ford\\\n```\\\n\\\n---\\\n\\\n## 6. Message table (EA sequence)\\\n\\\n| # | From → To | Message | Data |\\\n|---|---|---|---|\\\n| 1.0 | NetHSM → Ford IVSS | export public key | bundle-encryption keypair; private key stays in HSM |\\\n| 1.1 | Ford IVSS → Clypeum | deliver encrypted bundle | `Enc(packages) to pubHSM` (+ Ford sig); push or pull |\\\n| 1.2 | Clypeum → NetHSM | decrypt bundle | ciphertext |\\\n| 1.3 | NetHSM → Clypeum | decrypted packages | per-fob packages → cache (plaintext, trusted service) |\\\n| 1.4 | Clypeum (self) | cache + index **by UID** | index `uid → {fesn, spid, certs, keys}`; stock counter++ |\\\n| 1.5 | watchdog → Ford IVSS | request more bundles | when `stock < 2-week threshold` |\\\n\\\n---\\\n\\\n## 7. ASCII overview\\\n\\\n```\\\nFord IVSS / GIVIS                Clypeum KLMS (watchdog)          NetHSM\\\n────────────────────────────────────────────────────────────────────────\\\n (1.0) ◄── export bundle pub key ───────────────────────────────── generated keypair\\\n                                                                    (privkey never leaves)\\\n encrypt bundle of packages\\\n (1.1) ──── deliver Enc(packages) ────►\\\n                                     (1.2) decrypt bundle ──────────►\\\n                                     (1.3) ◄── decrypted packages ────\\\n                                     (1.4) cache + index by UID (→fesn/spid/keys)\\\n                                     (1.5) stock < 2-wk? ──► request more bundles\\\n```\\\n\\\n---\\\n\\\n## 8. Open decisions\\\n\\\n- [ ] Bundle encryption scheme (RSA-OAEP / ECIES / AES-KW) + key size.\\\n- [ ] **Push** (Ford pushes) vs **pull** (Clypeum fetches) + cadence/trigger.\\\n- [ ] **2-week stock sizing** (line rate × hours × margin) + low-water mark.\\\n- [ ] Bundle **signature** (Ford signing key) for authenticity/integrity.\\\n- [ ] Inventory/availability **API** between the Clypeum watchdog and Ford IVSS.\\\n- [x] ~~Is `uid` in packages?~~ → **Yes — required.** It is the KLMS cache index\\\n      key (Flow 2 sends only the UID, so content must be resolvable by UID).\\\n- [ ] UID uniqueness per fob (confirm the 10-byte JCOP UID is unique across the fleet).\\\n- [ ] Failure/retry semantics; partial-bundle / duplicate handling.\\\n- [ ] Cache storage: encrypted-at-rest vs plaintext (trusted service) + retention.\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":5301}]"
metadata_diff: {"new":{"id":"67dacd63422b4accbe2949fc7ebd0d24","parent_id":"283dd54f183a4ce69366648f091336d1","latitude":"0.00000000","longitude":"0.00000000","altitude":"0.0000","author":"","source_url":"","is_todo":0,"todo_due":0,"todo_completed":0,"source":"joplin-desktop","source_application":"net.cozic.joplin-desktop","application_data":"","order":1782806682460,"markup_language":1,"is_shared":0,"share_id":"","conflict_original_id":"","master_key_id":"","user_data":"","deleted_time":0},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-06-30T09:37:46.164Z
created_time: 2026-06-30T09:37:46.164Z
type_: 13