K7 DUKPT AES
Needs: Supporter
AES DUKPT: derivation data, key types and usages, the 32-bit counter and the move from TDES DUKPT.
This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.
What this module covers
You will be able to
- Build derivation data for a key usage and type
- Derive initial and working keys
- Explain the differences from TDES DUKPT
- Plan a migration
The lesson
- Why it matters
- The concept
- Step by step
- In the real world
- Common mistakes
- What to test
In the module
- The lesson, with diagrams, common mistakes and what to test
- A worked example you can change: AES DUKPT: initial key and a working key
- Practice: 3 kinds of generated exercise, each with a step-by-step solution
- A quiz of 9 questions
Key terms
- AES DUKPT
- The AES version of DUKPT (ANSI X9.24-3): a 12-byte KSN, a 32-bit counter and working keys of AES or triple DES, derived with derivation data.
- Derivation data
- The 16 bytes encrypted under a parent key to derive an AES DUKPT key. It encodes the key usage, algorithm, length and part of the KSN.
- Initial key ID
- The left 8 bytes of an AES DUKPT KSN: the BDK ID and the derivation ID of the device.
- Intermediate derivation key
- An AES DUKPT key derived along the counter's bits on the way to the transaction key.
The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.