Secure channel initiation between card and host

A procedure for initiating a secure communication session between a card and a host, a static encryption key being assigned to the card and stored in the card, each of the card and the host providing a key version number and a key identifier of said static key, the procedure comprising steps at the card:

• receive, from the host, an INITIALIZE UPDATE command comprising a host challenge, which is a value unique to the session;
• generate a card challenge, which is a value unique to the session, herein processing at least the card's static encryption key, key diversification data and a sequence counter with a first cryptographic function;
• generate a session key (S-ENC), herein processing the card's static encryption key, the host challenge and the card challenge with a second cryptographic function;
• calculate a card cryptogram using the session key (S-ENC);
• send to the host an INITIALIZE UPDATE reply in which the card cryptogram, the sequence counter and the card challenge are comprised, to enable the host to verify the card cryptogram;
• wherein:
• each of the card and the host provide an SCP key identity associated with said key version number and said key identifier of the card's static encryption key;
• the INITIALIZE UPDATE command comprises the SCP key identity, and doesn't comprise said key version number and said key identifier;
• to generate the card challenge, in addition said key version number and said key identifier are processed with the first cryptographic function.