I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal.

So far, when I receive KSN and encrypted data, I understand that I need to find encryption key. From my HSM I can get IPEK based on (KSN, BDK). But here is the confusion, based on articles I read, and terminal vendor's doc, encryption key will be one of the Future Keys.

  1. How would I know which Future Keys terminal uses as encryption key?
  2. How can HSM create Future Keys from IPEK?

Once I get correct Future Keys then I can derive data key variant and do decrypting in my HSM. I'm just stuck with these two questions.

Any explanation would be really helpful.

  • A 'host-side' HSM should be able to derive the transaction key for any KSN directly (not just the IDK for the IKSN i.e. counter 0). But if you really need to do 'future keys' yourself see (my) crypto.stackexchange.com/questions/53371/… May 7 at 2:20
  • Actually I just need to find transaction key directly. We have Luna HSM, I'm actually struggling to find a command for getting transaction key directly from KSN. Because the HSM only provide command to get direct Session keys if AES DUKPT (AES BDK), doesn't support direct session key for 3DES DUKPT. May 7 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.