diff --git a/ipc/keymaster_ipc.cpp b/ipc/keymaster_ipc.cpp
index 5c3bd6c..bcaf2ab 100644
--- a/ipc/keymaster_ipc.cpp
+++ b/ipc/keymaster_ipc.cpp
@@ -611,6 +611,11 @@
         return do_dispatch(&TrustyKeymaster::GenerateCsr, msg, payload_size,
                            out, out_size);
 
+    case KM_GENERATE_CSR_V2:
+        LOG_D("Dispatching KM_GENERATE_CSR_V2, size %d", payload_size);
+        return do_dispatch(&TrustyKeymaster::GenerateCsrV2, msg, payload_size,
+                           out, out_size);
+
     case KM_CONFIGURE_VENDOR_PATCHLEVEL:
         LOG_D("Dispatching KM_CONFIGURE_VENDOR_PATCHLEVEL, size %d",
               payload_size);
diff --git a/ipc/keymaster_ipc.h b/ipc/keymaster_ipc.h
index bac8ae9..b7706b1 100644
--- a/ipc/keymaster_ipc.h
+++ b/ipc/keymaster_ipc.h
@@ -61,6 +61,7 @@
     KM_CONFIGURE_VENDOR_PATCHLEVEL = (33 << KEYMASTER_REQ_SHIFT),
     KM_GET_ROOT_OF_TRUST = (34 << KEYMASTER_REQ_SHIFT),
     KM_GET_HW_INFO = (35 << KEYMASTER_REQ_SHIFT),
+    KM_GENERATE_CSR_V2 = (36 << KEYMASTER_REQ_SHIFT),
 
     // Bootloader calls.
     KM_SET_BOOT_PARAMS = (0x1000 << KEYMASTER_REQ_SHIFT),
diff --git a/rules.mk b/rules.mk
index b9dc790..e8df11e 100644
--- a/rules.mk
+++ b/rules.mk
@@ -165,6 +165,11 @@
 
 endif
 
+TRUSTY_KM_RKP_VERSION ?= 3
+ifdef TRUSTY_KM_RKP_VERSION
+    MODULE_COMPILEFLAGS += -DTRUSTY_KM_RKP_VERSION=$(TRUSTY_KM_RKP_VERSION)
+endif
+
 include $(LOCAL_DIR)/atap/rules.mk
 include $(LOCAL_DIR)/ipc/rules.mk
 
diff --git a/trusty_remote_provisioning_context.cpp b/trusty_remote_provisioning_context.cpp
index bb4991d..5315ded 100644
--- a/trusty_remote_provisioning_context.cpp
+++ b/trusty_remote_provisioning_context.cpp
@@ -43,6 +43,7 @@
 using cppcose::VERIFY;
 
 constexpr uint32_t kMacKeyLength = 32;
+constexpr uint32_t kRkpVersion = TRUSTY_KM_RKP_VERSION;
 
 static const uint8_t kMasterKeyDerivationData[kMacKeyLength] =
         "RemoteKeyProvisioningMasterKey";
@@ -143,7 +144,7 @@
                                      ? 0
                                      : 1);
         result->add("security_level", "tee");
-        result->add("version", 2);
+        result->add("version", kRkpVersion);
     }
 
     result->canonicalize();
@@ -189,10 +190,46 @@
 
 void TrustyRemoteProvisioningContext::GetHwInfo(
         GetHwInfoResponse* hwInfo) const {
-    hwInfo->version = 2;
+    hwInfo->version = kRkpVersion;
     hwInfo->rpcAuthorName = "Google";
     hwInfo->supportedEekCurve = 2 /* CURVE_25519 */;
-    hwInfo->uniqueId = "Google Trusty Default Implementation";
+    hwInfo->uniqueId = "Google Trusty Implementation";
+}
+
+cppcose::ErrMsgOr<cppbor::Array> TrustyRemoteProvisioningContext::BuildCsr(
+        const std::vector<uint8_t>& challenge,
+        cppbor::Array keysToSign) const {
+    auto deviceInfo = std::move(*CreateDeviceInfo());
+    auto signedDataPayload = cppbor::Array()
+                                     .add(1 /* version */)
+                                     .add("keymint" /* CertificateType */)
+                                     .add(std::move(deviceInfo))
+                                     .add(challenge)
+                                     .add(std::move(keysToSign))
+                                     .encode();
+
+    std::vector<uint8_t> signedData(HWBCC_MAX_RESP_PAYLOAD_SIZE);
+    std::vector<uint8_t> bcc(HWBCC_MAX_RESP_PAYLOAD_SIZE);
+    size_t actualSignedDataSize = 0;
+    size_t actualBccSize = 0;
+
+    int rc = hwbcc_get_protected_data(
+            false /* test_mode */, EDDSA, signedDataPayload.data(),
+            signedDataPayload.size(), NULL, 0, signedData.data(),
+            signedData.size(), &actualSignedDataSize, bcc.data(), bcc.size(),
+            &actualBccSize);
+    if (rc != 0) {
+        LOG_E("Error: [%d] Failed hwbcc_get_protected_data()", rc);
+        return "Failed hwbcc_get_protected_data";
+    }
+    signedData.resize(actualSignedDataSize);
+    bcc.resize(actualBccSize);
+
+    return cppbor::Array()
+            .add(3 /* version */)
+            .add(cppbor::Map() /* UdsCerts */)
+            .add(cppbor::EncodedItem(std::move(bcc)))
+            .add(cppbor::EncodedItem(std::move(signedData)));
 }
 
 void TrustyRemoteProvisioningContext::SetBootParams(
diff --git a/trusty_remote_provisioning_context.h b/trusty_remote_provisioning_context.h
index a57688e..28ea072 100644
--- a/trusty_remote_provisioning_context.h
+++ b/trusty_remote_provisioning_context.h
@@ -50,6 +50,10 @@
     std::optional<cppcose::HmacSha256> GenerateHmacSha256(
             const cppcose::bytevec& input) const override;
     void GetHwInfo(GetHwInfoResponse* hwInfo) const override;
+    cppcose::ErrMsgOr<cppbor::Array> BuildCsr(
+            const std::vector<uint8_t>& challenge,
+            cppbor::Array keysToSign) const override;
+
     void SetBootParams(const BootParams* bootParams);
     void SetVendorPatchlevel(uint32_t vendor_patchlevel) {
         vendor_patchlevel_ = vendor_patchlevel;