What is BDK key?
Essentially, one Base Derivation Key (BDK) is used to initiate the DUKPT process. The BDK itself is never exposed, but instead is used to create another key, called an initial key.
What is KSN DUKPT?
DUKPT in a POS environment—an overview: The base derivation key and POS device key serial number (KSN) are used to create a DUKPT initial key. The initial DUKPT key gets injected into the POS device. After the data is sent, the session key and KSN are used to create more derived keys if needed, then the key is erased.
What is key injection?
Key injection is the starting point for securely managing a device over its product lifetime in the IoT. Key injection gives every device an identity. To make sure device identities can not be hacked, the keys need to be generated by an HSM.
How does remote key injection work?
The Remote Key Injection (RKI) allows acquirers and payment service providers (PSP) to inject their keys without the help of an LKI by exploiting the security mechanisms active on the terminal itself, in a fast and secure way through the online service specifically certified PCI P2PE.
How is the derived unique key used in DUKPT?
In DUKPT each device is still initialized with a distinct key, but all of the initialization keys of an entire family of devices are derived from a single key, the base derivation key (BDK). To decrypt encrypted messages from devices in the field, the recipient need only store the BDK.
What do you need to know about DUKPT encryption?
Here’s a basic outline of the technique: You’re given a Base Derivation Key (BDK), which you assign to a swiper (note that the same BDK can be assigned to multiple swipers). You’ll use the BDK along with the device’s own unique Key Serial Number (KSN) to generate an Initial PIN Encryption Key (IPEK) for the device.
Which is the correct expression for the derivation function DK?
Such use may be expressed as DK = KDF(key, salt, iterations), where DK is the derived key, KDF is the key derivation function, key is the original key or password, salt is a random number which acts as cryptographic salt, and iterations refers to the number of iterations of a sub-function.
How does a derived unique key per transaction work?
As its name indicates, Derived Unique Key per Transaction generates a new key for each transaction. This technique involves the use of Base Derivation Key (BDK) and Key Serial Number (KSN). On each transaction, the PIN pad generates a new encryption keys that are derived from a secret BDK and a non-secret KSN.