I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK. This blog post has an image where the sequence is:

  • BDK (Secret)
  • IPDK (Generated, used, then thrown away)
  • Future Key (Generated, used in devices)
  • One-Time encryption key (Generated, used to transmit data)

I know that given a Future Key and the transaction counter (which is also included in the transmitted data), the correct One-Time key can be generated to decrypt the data. What I'm failing to understand is why the BDK isn't used to generate the Future Key directly. Why go though the IPDK?


Derived Unique Key Per Transaction (DUKPT) is a key management scheme in which for every transaction, a unique key is used which is derived from a fixed key. Therefore, if a derived key is compromised, future and past transaction data are still protected since the next or prior keys cannot be determined easily. DUKPT is specified in ANSI X9.24 part 1

The key aspect of DUKPT is that for each transaction that is originated from the PIN device, the key for encryption shall be unique. The key shall not have any relation with the keys that were used in the past or the keys that might be used for future transactions. The encryption algorithm that shall be used is TDES.

IPEK is derived from Base Derivation Key(BDK). The inputs to create IPEK are the PIN Device ID and the Key-Set ID. The Key-Set ID uniquely identifies the BDK. So you can see that, with one BDK, you can have multiple IPEKs. One IPEK for each device with unique ID. The BDK shall not be known to the PIN device. The BDK is a super secret key which shall be known to the gateway with which all PIN devices communicate. The gateway shall store the BDK securely in a HSM device. The BDK cannot be shared among the PIN devices. Period. Thus comes the IPEK to rescue.

Once the terminal has been initialized with IPEK, it shall populate the 21 Future Key registers by invoking a non-reversible transformation process. The inputs to this would be IPEK and a value which is function of the register number. Then the IPEK is discarded. Now the terminal has 21 Future Keys stored in 21 registers. Now PIN device can communicate witht the gateway, encrypt with the generated key along with meta data which includes Key-Set ID and device ID. With this meta data and the BDK , the gateway also shall derive the key for decryption.

  • I don't think this answers my question. Why use the IPEK to generate the 21 future keys instead of the BDK? Or are you saying that the IPEK is sent to the device? Because that's not what my understanding of the article was, although I could certainly be wrong. – Bobson Apr 23 '14 at 11:11
  • Yes. BDK is not to be shared with one and all. It is secure with one entity with which all PIN devices shall connect. BDK is stored securely. Its the mother of all keys and if compromised, one can decrypt the data that is sent by the PIN device. By some mechanism the IPEK needs to be distributed to the PIN devices and have the IPEK injected. – Prabhu Apr 23 '14 at 11:24
  • That makes a lot of sense. Is the article just wrong when it says that it's the Future Keys that are shared to manufacturers? – Bobson Apr 24 '14 at 2:43
  • According to en.wikipedia.org/wiki/Derived_unique_key_per_transaction, yes, that is wrong. The IPEK is sent to the device, and the future keys are derived, by the device, from it. – Nik Aug 6 '14 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.