K2 Components, split knowledge and dual control

Needs: Supporter

Lesson K2: How custodians create, exchange and verify keys without anyone knowing the whole key.

This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.

Sign in

Create a free account

See plans

The opening of the lesson

Why it matters

The keys at the top of the hierarchy must never be known by any one person:

HSM master keys;
ZMKs with partners;
ATM master keys;
BDKs.

Split knowledge (no one knows the whole key) and dual control (no one can act alone) are required by PCI PIN and by every network for these keys. Developers build the tooling; testers and custodians run the ceremonies.

In the full lesson

The concept
Step by step: a ZMK ceremony
In the real world
Common mistakes
What to test

What module K2 covers →

The rest of the lesson opens with a supporter pass, which you can try free for 7 days.