(Sony calls it "Send Key")

00: BYTE  Command byte A3
01: BYTE  unused (might contain LUN)
02: DWORD Object Number
06: BYTE  unused
07: BYTE  Magic Byte BD
08: WORD  Size of cryptographic data
0A: BYTE  key type
0B: BYTE  unused

(Sony calls it "Request Key")

00: BYTE  Command byte A4
01: BYTE  unused, send as Zero (might contain LUN)
02: DWORD Object Number
06: BYTE  unsused
07: BYTE  Magic Byte BD
08: WORD  Size of cryptographic data
0A: BYTE  key type
0B: BYTE  unused

This data packet is sent from the Host to the HiMD device

00: WORD  Length, must be 0012
02: WORD  unsused
04: BYTES 8 bytes "Leaf ID of Host"
0C: BYTES 8 bytes "Nonce from Host"

This data packet is sent from the HiMD device to the Host, the expected length is 43C (i.e. header + 64 keys?)

00: DWORD unknown, maybe length in first WORD
04: BYTES 16 bytes "Disc ID"
14: BYTES 8 bytes "MAC from Device"
1C: BYTES 8 bytes "Leaf ID of Device"
24: BYTES 8 bytes "Nonce from Device"
2C: BYTES The "local EKB of the Device" Starts with its length in 16 byte units - 1

This data packet is sent from the Host to the HiMD device

00: WORD  Length, must be 41A
02: WORD  unused
04: BYTES 8 bytes "MAC from Host"
0C: BYTES The "local EKB of the Host"

This data packet is sent from the HiMD device to the Host (expected length 404)

00: DWORD unknown, length?
04: BYTE  unknown, but used
05: BYTE  bit flags. Top 2 Bits are one field, the next two bits are further fields
                     Low 4 bits unused.
06: WORD  length of following data
08: DWORD unknown, but used
0C: BYTES data, length from field 6.