Key Management

This section discusses how keys are managed between POS Terminals or other Payment Channels. The system has support for Master Key Session and Derived Unique Key Per Transaction (DUKPT).

For Master Key session, the following are the keys to be exchanged:

1. Clear Terminal Master Key (CTMK): This key is transmitted in clear form and injected into the POS Terminal or other Payment Channels. This can be generated for a group of POS Terminals. A group could be a logical grouping by Payment Terminal Service Provider (PTSP) or Merchant Acquirers.

2. Encrypted Terminal Master Key (TMK): This key is transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into terminal manually. This is requested for online by the POS Terminal when it is being setup or if it is suspected that the key has been compromised. TMK is encrypted with CTMK.

3. Encrypted Terminal PIN Key (TPK): This key is usually transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into the terminal manually. POS terminal requests online for this key at predefined time from the CTMS. TPK is encrypted with the TMK. At transaction, this key is used to encrypt the PIN block if it is sent in the message.

4. Encrypted Terminal Session Key (TSK): This key is usually transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into terminal manually. POS Terminal requests online for this key at predefined time from the CTMS. TSK is encrypted with TMK. At transaction, this key is used for seeding the algorithm for generating hash value in DE64 or DE128.

For DUKPT, the following are the keys to be exchanged:

1. Clear Terminal Master Key (CTMK): This key is transmitted in clear form and injected into the POS Terminal or other Payment Channels. This can be generated for a group of POS Terminals. A group could be a logical grouping by Payment Terminal Service Provider (PTSP) or Merchant Acquirers.

2. Encrypted Terminal Master Key (TMK): This key is transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into terminal manually. This is requested for online by the POS Terminal when it is being setup or if it is suspected that the key has been compromised. TMK is encrypted with CTMK.

3. Base Derivation Key (BDK): This key is NOT transmitted to the POS Terminal. In clear form it is injected into the POS Terminal or other Payment Channels in two components manually. This can be generated for a group of POS Terminals.

4. Encrypted Terminal Session Key (TSK): This key is usually transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into terminal manually. POS Terminal requests online for this key at predefined time from the CTMS. TSK is encrypted with TMK. At transaction, this key is used for seeding the algorithm for generating hash value in DE64 or DE128.

5. Encrypted Initial PIN Encryption Key (IPEK) for Track 2 Data: This key is usually transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into terminal manually. POS Terminal requests online for this key at predefined time from the CTMS. IPEK is encrypted with TMK.

6. Encrypted Initial PIN Encryption Key (IPEK) for EMV: This key is usually transmitted in encrypted form to the POS Terminal or other Payment Channels. This is not injected into terminal manually. POS Terminal requests online for this key at predefined time from the CTMS. IPEK is encrypted with TMK.