K1 Key hierarchy and key types
Needs: Supporter
From the HSM master key to working keys: every key type and its single purpose.
This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.
What this module covers
You will be able to
- Draw the hierarchy from the HSM master key to working keys
- Name each key type and its single purpose
- Explain key separation
The lesson
- Why it matters
- The concept
- In the real world
- Common mistakes
- What to test
In the module
- The lesson, with diagrams, common mistakes and what to test
- A worked example you can change: A key under a key
- Practice: 3 kinds of generated exercise, each with a step-by-step solution
- A quiz of 8 questions
Key terms
- Cryptoperiod
- How long a key may be used before it must be changed.
- Key encryption key (KEK)
- A key used only to encrypt other keys for transport or storage.
- Key hierarchy
- Keys protecting keys: a master key in the HSM protects key encryption keys, which protect working keys, which protect data.
- Key separation
- The rule that each key has one purpose (PIN, MAC, data, key encryption) and cannot be used for another. Variants and key blocks enforce it.
- Master/session
- The scheme where a terminal holds a master key and receives new session (working) keys encrypted under it.
- Terminal master key (TMK)
- The key encryption key of a terminal, used to load its working keys under the master/session scheme.
- Terminal PIN key (TPK)
- The PIN encryption key between a terminal and its host when DUKPT is not used.
- Working key
- A key that protects transaction data, such as a PIN key, MAC key or data key. It is changed often.
- Zone master key (ZMK, ZCMK)
- A key encryption key shared between two hosts, used to exchange their working keys.
- Zone PIN key (ZPK)
- A PIN encryption key shared between two hosts. PIN blocks between them travel under it.
The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.