I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal.
So far, when I receive KSN and encrypted data, I understand that I need to find encryption key. From my HSM I can get IPEK based on (KSN, BDK). But here is the confusion, based on articles I read, and terminal vendor's doc, encryption key will be one of the Future Keys.
- How would I know which Future Keys terminal uses as encryption key?
- How can HSM create Future Keys from IPEK?
Once I get correct Future Keys then I can derive data key variant and do decrypting in my HSM. I'm just stuck with these two questions.
Any explanation would be really helpful.