23 Sept 2026

  • CLA = 0x80
  • INS = 0xC3
  • P1 = ignored
  • P2 = 0x00
  • Data = a sequence of 32-bit integers (most significant byte first). Empty for the master key.
  • Response Data = LEE key template
  • Response SW = 0x9000 on success, 0x6985 if the card is not in LEE mode or the PIN is not verified
  • Preconditions: Secure Channel must be opened, user PIN must be verified, a LEE seed must be loaded

Introduced in 4.0 alongside LEE support. A card enters LEE mode when a seed is loaded with LOAD KEY P1 = 0x04, which derives a second, independent keychain alongside the BIP-32 one. The mode is visible in the SELECT status byte.

Response Data format:

  • Tag 0xA1 = key template
  • Tag 0x84 = ASK (32 bytes)
  • Tag 0x83 = NSK (32 bytes)
  • Tag 0x85 = VSK_D (32 bytes)
  • Tag 0x86 = VSK_Z (32 bytes)

The four components are the LEE key material derived at the requested path. Exporting them requires user authentication, exactly like EXPORT KEY.

Loading a plain BIP-32 seed (P1 = 0x03) clears the LEE keychain and the card leaves LEE mode.

Last edited
23 Sept 2026