Atlassian uses cookies to improve your browsing experience, perform analytics and research, and conduct advertising. Accept all cookies to indicate that you agree to our use of cookies on your device. Atlassian cookies and tracking notice, (opens new window)
/
DUKPT

    DUKPT

    27 May, 2021

    A description of Derived Unique Key Per Transaction (DUKPT) key management scheme.

    What is DUKPT?

    Derived Unique Key Per Transaction (DUKPT) is a key management scheme. It uses one time encryption keys that are derived from a secret master key that is shared by the entity (or device) that encrypts and the entity (or device) that decrypts the data.

    Why DUKPT?

    Any encryption algorithm is only as secure as its keys. The strongest algorithm is useless if the keys used to encrypt the data with the algorithm are not secure. This is like locking your door with the biggest and strongest lock, but if you hid the key under the doormat, the lock itself is useless. When we talk about encryption, we also need to keep in mind that the data has to be decrypted at the other end.

    Typically, the weakest link in any encryption scheme is the sharing of the keys between the encrypting and decrypting parties. DUKPT is an attempt to ensure that both the parties can encrypt and decrypt data without having to pass the encryption/decryption keys around.

    How DUKPT Works

    DUKPT uses one time keys that are generated for every transaction and then discarded. The advantage is that if one of these keys is compromised, only one transaction will be compromised. With DUKPT, the originating (say, a Pin Entry Device or PED) and the receiving (processor, gateway, etc) parties share a key. This key is not actually used for encryption. Instead, another one time key that is derived from this master key is used for encrypting and decrypting the data. It is important to note that the master key should not be recoverable from the derived one time key.

    To decrypt data, the receiving end has to know which master key was used to generate the one time key. This means that the receiving end has to store and keep track of a master key for each device. This can be a lot of work for someone that supports a lot of devices. A better way is required to deal with this.

    This is how it works in real-life: The receiver has a master key called the Base Derivation Key (BDK). The BDK is supposed to be secret and will never be shared with anyone. This key is used to generate keys called the Initial Pin Encryption Key (IPEK). From this a set of keys called Future Keys is generated and the IPEK discarded. Each of the Future keys is embedded into a PED by the device manufacturer, with whom these are shared. This additional derivation step means that the receiver does not have to keep track of each and every key that goes into the PEDs. They can be re-generated when required.

    The receiver shares the Future keys with the PED manufacturer, who embeds one key into each PED. If one of these keys is compromised, the PED can be rekeyed with a new Future key that is derived from the BDK, since the BDK is still safe.

    Encryption and Decryption

    When data needs to be sent from the PED to the receiver, the Future key within that device is used to generate a one time key and then this key is used with an encryption algorithm to encrypt the data. This data is then sent to the receiver along with the Key Serial Number (KSN) which consists of the Device ID and the device transaction counter.

    Based on the KSN, the receiver then generates the IPEK and from that generates the Future Key that was used by the device and then the actual key that was used to encrypt the data. With this key, the receiver will be able to decrypt the data.

    , multiple selections available, Use left or right arrow keys to navigate selected items
    partners
    definitions

    Copyright 2018 Handpoint


    Handpoint Help Center
    Results will update as you type.
    • Card Reader User Manuals
    • Merchant Help Center
    • Partner Help Center
      • Technical Integration with Handpoint
      • Handpoint portal: Terminal Management System
      • Partner Guide : Co-branding - Theme guide for the Handpoint app
      • Partner Guide: Providing Support
      • Glossary
        • Payments Industry Terms
          • Acquirer
          • Card Acceptor
          • Cardholder and Card Issuer
          • DUKPT
          • Remote Key Injection
          • Shared Secret Keys
        • Acronyms
    • SWPs / ISVs Help Center
    • General Knowledge

    You‘re viewing this with anonymous access, so some content might be blocked.
    {"serverDuration": 82, "requestCorrelationId": "074a065a6ec44d81919de4c1181e3dde"}