I have been working on the payment side with RSA and AES encryption which I got a fairly well technical understanding of encrypting credit card details.

Recently, We adopted a new chip and pin device which supports DUKPT and combined with 3DES seems to be stronger than RSA and AES.

DUKPT is something completely new for me and what I understood are: - the server stores Master Key (KSN) not sharable - the chip and pin device stores 2 keys of 8 bytes each, but it is also requiring the KSN.

Does the device really need the KSN to get generate the IPEk or there is a misunderstanding from my interpretation?

NOTE: the device will work on offline mode and any communication required with the server to encrypted the data will no longer be possible. Is it ok for DUKPT?

1 Answer 1


I'm not fully sure what you mean by offline mode but I'm going to guess you mean offline PIN verification. The PIN can be validated within the terminal based on the PIN entered by the customer and the PIN on the Integrated Chip within the credit/debit card. This is not a DUKPT related process and offline for this process is fine.

DUKPT will be used to provide a key management system whereby sensitive data from each transaction is encrypted using a specific and unique key. Once a key is used a counter increases such that the appropriate KSN (Key Serial Number) and related key can be identified for decrypting the data later on. The next transaction will use the next available key for encryption.

I'd suggest reading up a bit more on DUKPT functionality (search DUKPT on google) to cover Base Derived Keys (BDK), IPEK and Future Keys. Chip and PIN terminals will often be loaded with thousands of keys to permit DUKPT. Without DUKPT a terminal is more likely to use a static symmetric key for encryption and public keys for signing transactions.

  • thanks for attention on that @andyMac.....Actually, I would like to know if DUPKT key management is able to work offline because no internet connection will be provided to the CHIP Pin card reader, so it will not be able to connect to a server to get any IPEK or Future keys or any other kind of key...
    – Devester
    Sep 9, 2013 at 15:59
  • the encryption keys will be stored on the terminal in order to encrypt data received from cards (track data or PAN data). The keys will have been injected into the terminal either at a key injection facility or through certificate based encryption. You'll need to decrypt the data in order to switch the transaction to a Payment Service Provider, acquirer or card scheme. If the terminal is offline, you can store the details until it reconnects (store and batch forwarding). In all, the terminal can work offline for PIN validation and offline transactions but authorisation won't happen until later
    – AndyMac
    Sep 12, 2013 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .