Module handshake 

Annex D.4 secure-channel handshake.

Both sides start out sharing only the SCBK (out-of-band install key, or a previously-keyset session key). The handshake derives matching session keys, proves possession to each end, and seeds the rolling-ICV chain that every subsequent SCS_15..=18 frame uses.

sequenceDiagram
    participant ACU
    participant PD
    Note over ACU,PD: Both share SCBK out-of-band
    ACU->>PD: osdp_CHLNG (RND.A)
    PD->>PD: derive S-ENC, S-MAC1, S-MAC2 from SCBK ⊕ RND.A
    PD->>PD: pick RND.B; compute ClientCryptogram
    PD->>ACU: osdp_CCRYPT (cUID, RND.B, ClientCryptogram)
    ACU->>ACU: derive same keys; verify ClientCryptogram
    ACU->>ACU: compute ServerCryptogram
    ACU->>PD: osdp_SCRYPT (ServerCryptogram)
    PD->>PD: verify ServerCryptogram; compute initial R-MAC
    PD->>ACU: osdp_RMAC_I (initial R-MAC)
    ACU->>ACU: verify R-MAC matches own
    Note over ACU,PD: Session is Secure;<br/>SCS_15..=18 frames carry rolling ICV