Track K · Key management

You will be able to

• Explain why remote key loading exists
• Follow the TR-34 two-pass and one-pass flows at a high level

The lesson

1. Why it matters
2. The concept
3. Step by step: two-pass
4. Key injection facility vs remote loading
5. In the real world
6. Common mistakes
7. What to test

In the module

• The lesson, with diagrams, common mistakes and what to test
• A worked example you can change: Remote key loading with TR-34
• Practice: 2 kinds of generated exercise, each with a step-by-step solution
• A quiz of 8 questions

Key terms

CMS (Cryptographic Message Syntax)

The standard structure for signed and enveloped data that TR-34 uses for its tokens.

Key distribution host (KDH)

In TR-34, the host that sends keys.

Key injection facility (KIF)

A secure room where devices are loaded with their keys and certificates under dual control.

Key receiving device (KRD)

In TR-34, the device (PIN pad, ATM EPP) that receives the key. Its certificate is issued at manufacturing.

Remote key loading (RKL)

Loading the first keys of a terminal or ATM over the network with public-key cryptography, instead of carrying components to it.

TR-34

The ASC X9 method for remote key loading: the host wraps a key for one device with the device's RSA public key and signs it, in CMS structures.

Tools for this module: TR-34 Flow

Read the opening of the lesson →