A blob or key blob consists of a key, its ACL and application data encrypted in some way. A variety of encryption schemes are used depending on the type of security world and the purpose of the blob.

The most frequently used blobs are working blobs. These are for day-to-day use: an application may start by loading one or more keys from their working blobs. Working blobs may be encrypted either under a module key or a logical token (i.e. an OCS or softcard). The module key or logical token functions both to keep the application key confidential and to authorize its use. These blobs always use the Module or Token format and creating them is authorized by Act_MakeBlob.

Even public keys are encrypted in working blobs, but the well-known module key is used, so no confidentiality is provided.

Recovery blobs encrypt the key (and ACL, etc.) under an asymmetric key (usually an RSA key). Since encryption uses the public key, KRE need not be loaded during the generation of recoverable application keys, but must be loaded to recover them. In the recovery process confidentiality and authorization are partially split: KRE provides confidentiality and the authorization to use open permission groups in the keys' ACL, while KNSO provides authorization to use the 'trump operations' group. These blobs use the Indirect format (in DES3 worlds) or UserKey (in AES worlds) and creating them is authorized by Act_MakeArchiveBlob.

Temporary blobs are used during ACS replacement. These blobs use the Direct format (in DES3 worlds) or UserKey (in AES worlds) and creating them is authorized by Act_MakeArchiveBlob.

The mechanisms used are discussed in the sections below.

In AES worlds, key blobs are made using one of the 'new' blob encryption mechanisms:

The blobbing key might be a module key, a logical token or an application key.

In blobcryptv2 and later, the blob itself is encrypted and then protected with a MAC under single-use session keys derived from the blobbing key (in the symmetric case) or encrypted under it (asymmetric), rather than using the blobbing key directly.

Application key blobs are stored in the privblob member of the NFKM_Key structure, or pubblob for public keys. Recovery blobs are stored in the privblobrecov member of the NFKM_Key structure.

Triple-DES worlds should no longer be used.

In DLf1024s160mDES3, DLf1024s160mRijndael and DLf3072s256mRijndael worlds, public key blobs always use the DES3 KMWK and the old blobbing scheme. In DLf3072s256mAEScSP800131Ar1 worlds they use the AES KMWK and the working blob mechanism for that world.

PIN recovery blobs consist of the hash of the PIN, encrypted using an RSA key. These are not key blobs and the module has no special knowledge about their format – they are simply encrypted messages created by the NFKM library. So the term "blob" is a bit misleading in this context.