Wrap and Register a Key on the Smart Card

Wrap a plain key using the smart card's public wrapping key and then register the wrapped result on the Volkano smart card. The wrap stage uses volkano_utils.exe -cmd wrap_key (not volkano.exe); the final registration uses the generic execute_action(action="register_key", params={...}) tool, which covers KUID, KUID_RF, KUID_PRE_FA, ODAK, ADK1, and ADK2.

ADKP is the only key type that can be registered in plain form. Every non-ADKP key type must be wrapped first.

When to use

Use this skill when the user has a plain key but needs it stored through a wrapped-key registration path (typically KUID-oriented flows). It covers exporting the public wrapping key, wrapping plain material, and registering the wrapped result, while preserving family-specific requirements (OID, key index, ADK2 key type, minimum applet version).

Do not use it for plain ADKP registration (use s32sdaf-register-key), challenge-response authentication, deleting records, guessing whether the user intended wrapped vs plain registration, or inventing OIDs/indexes/keys.

Available Capabilities

Type	Name	Invocation
Tool	status	verify MCP server / install state
Tool	execute_action(action="export_wrapkey", params={...})	export the public wrapping key
Tool	execute_action(action="wrap_key", params={...})	wrap plain key (backed by volkano_utils.exe -cmd wrap_key)
Tool	execute_action(action="register_key", params={...})	generic final registration for all wrapped families
Tool	execute_action(action="discover", params={...})	inspect registered UIDs before/after mutation
Tool	execute_action(action="find_installation")	locate Volkano install
Reference	Per-family requirements + error handling	references/key-families.md

Quickstart

1. If readiness is unknown, run status.
2. If the user already has a valid 512-hex wrapped key, or wants plain ADKP, switch to s32sdaf-register-key (do not wrap again).
3. Validate UID (16/32 hex) and plain key (hex); validate family-specific fields per references/key-families.md.
4. Export the public wrapping key with execute_action(action="export_wrapkey", params={...}).
5. Wrap with execute_action(action="wrap_key", params={...}); confirm the result is 512 hex chars.
6. Register with execute_action(action="register_key", params={...}); optionally verify via execute_action(action="discover", params={...}).

Workflow

1. Confirm readiness. Use status; inspect card contents with execute_action(action="discover", params={...}) if unsure. For explicit applet-version proof (1.4+/1.5+), route through s32sdaf-discovery-and-status and use volkano.exe --version rather than inferring from command success.
2. Validate inputs locally. UID hex (16/32); plain key hex. For OID- sensitive or index-sensitive families, validate per references/key-families.md (ODAK/ADK1/ADK2 need a 32-hex UID; ADK1/ADK2 need OID and key_index 0..15; ADK2 needs key type AES/ECC).
3. Export the public wrapping key. If not already available and trusted for this card, call execute_action(action="export_wrapkey", params={...}) and capture the result.
4. Wrap the plain key. Call execute_action(action="wrap_key", params={...}) with plain_key, exported public_key, optional volkano_folder. The underlying operation is volkano_utils.exe -cmd wrap_key; if the wrapper reports command-construction failures, treat it as a tooling defect and preserve that path. Validate the result is exactly 512 hex characters.
5. Register the wrapped key. Call execute_action(action="register_key", params={...}) with uid, key_type, wrapped key, and optional oid, key_index, adk2_key_type, password, volkano_folder. State applet-version requirements explicitly when the command is gated.
6. Verify result. Optionally confirm with execute_action(action="discover", params={...}).

Show clear step boundaries (export -> wrap -> register) and never wrap a key twice.

Guardrails

Scope - Export and wrap are preparatory; the final registration is a persistent smart-card write that creates/updates a UID record and consumes storage capacity.

Destructive actions - Registration mutates the card. Confirm intent before registering. Never invent passwords, UID, wrapping keys, OIDs, key selectors, or key indexes.

Secrets - Do not echo the smart-card password unnecessarily.

Refuse-and-escalate -

• User already has a 512-hex wrapped key, or wants plain ADKP: stop; switch to s32sdaf-register-key.
• Wrapped result not 512 hex chars: stop before registration.
• Family selector missing/invalid (OID, key_index, adk2_key_type): stop and request it.
• See references/key-families.md for the full failure catalog.

Validation loop

1. Confirm the user starts from a plain key intended for a wrapped family (not already wrapped, not plain ADKP).
2. Confirm UID/plain-key/family-specific fields validate.
3. Export wrapkey (or reuse a trusted current key), wrap, confirm 512 hex chars.
4. Register via the generic register-key tool.
5. Pass criterion: registration completes, applet constraints are stated where relevant, and next-step guidance (auth or debug-card) is provided.

Out of scope

• Plain ADKP registration and registering already-wrapped material.
• Challenge-response authentication and record deletion.
• ADK2-backed debug-card / DCAT work (use s32sdaf-generate-debug-card).

See Also

• references/key-families.md - per-family requirements, decision logic, and the full error-handling catalog.
• Related skills: s32sdaf-register-key (already-wrapped or plain ADKP), s32sdaf-export-wrapkey and s32sdaf-wrap-key (individual stages), s32sdaf-auth-device / s32sdaf-hse2-authentication (next-step auth), s32sdaf-generate-debug-card (ADK2 debug-card target), s32sdaf-discovery-and-status (readiness / applet-version proof).