(Sony calls it "Send Key")

00: BYTE  Command byte A3
01: BYTE  unused (might contain LUN)
02: DWORD Object Number
06: BYTE  unused
07: BYTE  Magic Byte BD
08: WORD  Size of cryptographic data
0A: BYTE  key type
0B: BYTE  unused

(Sony calls it "Request Key")

00: BYTE  Command byte A4
01: BYTE  unused, send as Zero (might contain LUN)
02: DWORD Object Number
06: BYTE  unsused
07: BYTE  Magic Byte BD
08: WORD  Size of cryptographic data
0A: BYTE  key type
0B: BYTE  unused

This data packet is sent from the Host to the HiMD device

00: WORD  Length, must be 0012
02: WORD  unsused
04: BYTES 8 bytes "Leaf ID of Host"
0C: BYTES 8 bytes "Nonce from Host"

This data packet is sent from the HiMD device to the Host, the expected length is 43C (i.e. header + 64 keys?)

00: DWORD unknown, maybe length in first WORD
04: BYTES 16 bytes "Disc ID"
14: BYTES 8 bytes "MAC from Device"
1C: BYTES 8 bytes "Leaf ID of Device"
24: BYTES 8 bytes "Nonce from Device"
2C: BYTES The "local EKB of the Device" Starts with its length in 16 byte units - 1

This data packet is sent from the Host to the HiMD device

00: WORD  Length, must be 41A
02: WORD  unused
04: BYTES 8 bytes "MAC from Host"
0C: BYTES The "local EKB of the Host"

This data packet is sent from the HiMD device to the Host (expected length 404)

00: DWORD unknown, length?
04: BYTE  unknown, but used
05: BYTE  bit flags. Bits 6,7: encryption type (0=plain, 2=des ecb, 3=des cbc)
                     Bit  5:   MAC flag
                     Bit  4:   DIR flag
06: WORD  length of following data
08: DWORD unknown, but used
0C: BYTES data, length from field 6.

This data packet is sent from the Host to the HiMD device

00: WORD  length (must be 404)
02: WORD  unused
04: BYTE  ICV slot number (must be between 0 and 31)
05: BYTE  bit flags, same bits used as in Type 33
06: WORD  length of ICV data
08: WORD  Revision
0A: WORD  unknown, but used
0C: BYTES ICV data
XX: BYTES 8 Bytes MAC