Cryptographic key management methods: fixed key, MK/SK and DUKPT

When symmetric cryptographic keys are used for the protection of stored or transmitted data, it is necessary to establish certain protocols for their loading, transmission, rotation or blocking. In PCI SSC standards (mainly PCI PIN and P2PE), when the data to be protected is account data or PIN data using algorithms TDEA o AES, the use of three methods is allowed: fixed key, MK/SK and DUKPT, all described in the ANSI X9.24 standard. Each of these methods will be reviewed in this article.

Fixed key

The simplest method for managing cryptographic keys is by using fixed keys, described in the standard ANSI X9.24-1-2017 Retail Financial Services Symmetric Key Management Part 1: Using Symmetric Techniques. This method uses a dedicated key for data encryption. These keys can be physically loaded from a key-loading device (Key Loading Device – KLD), by using components in clear or shares (m-of-n) or remotely through asymmetric cryptography. They are called "fixed keys" because the only way to replace them is by using any of the load mechanisms described above (i.e.: there is no symmetric transport key that can be used to remotely ‘rotate’ the data encryption key).

The concept of ‘fixed key’ should not be confused with that of ‘static key’. While the first refers to the impossibility of rotating the key unless the same techniques that were used in the initial load are used, the concept of "static key" refers to a key that has no defined cryptoperiod and is not changed regularly.

Master Key/Sesion Key (MK/SK)

The method Master Key/Session Key (MK/SK) is also described in the standard ANSI X9.24-1-2017 Retail Financial Services Symmetric Key Management Part 1: Using Symmetric Techniques. This method involves the use of two independent keys:

• A transport key (called Master Key), which must be used exclusively for the encryption of other keys (i.e.: cannot encrypt data) and must use an algorithm and a key length equal to or greater than that of the key to be protected. This key is, to all intents and purposes, a fixed key. It must be loaded using components, shares or symmetric cryptography. You cannot use this key to transport your own replacement.
• A data encryption key (called Session Key), which must be used exclusively for data encryption (PIN, account data or any other sensitive data).

Using this method, it is possible to "rotate" or "replace" the data key (SK) remotely by using the transport key (MK), this being the main differential with the fixed key method. This action must be performed each time the cryptoperiod of the data key is met.

Depending on the scenario and the channel in which this method is implemented, MK/SK keys can be given different names:

• In generic connections:
  • Key Encrypting Key (KEK) or Key Transport Key (KTK) for the MK
  • Key Working Key (KWK) or Key Transaction Key (KTK) for SK

• In connection with terminals (point-of-sale devices or electronic tellers):
  • Terminal Master Key (TMK) for the MK
  • Terminal Working Key (TWK) or Terminal PIN Key (TPK – if used for PIN encryption) for the SK

• In connections host-to-host:
  • Zone Master Key (ZMK) or Zone Control Master Key (ZCMK) for MK
  • Zone Working Key (ZWK) or Zone PIN Key (ZPK – if used for PIN encryption) for SK
  • Acquirer Master Key (AMK) and Acquirer Working Key (AWK) for connections with acquirers
  • Issuer Master Key (IMK) and Issuer Working Key (IWK) for connections with emitters (issuers)

Derived Unique Key Per Transaction (DUKPT)

Finally, the third key management method is described in the standard ANSI X9.24-3-2017 Retail Financial Services Symmetric Key Management Part 3: Derived Unique Key Per Transaction. DUKPT (pronounced duck-putt) allows the device that initiates the transaction and sends the data (a payment terminal or an electronic teller machine) to be able to generate unique keys for each transaction without the need to store any previously used key records.  On the other side of the transaction, the entity receiving the data escapes from ‘regenerating’ the key used by the issuing device by means of a basic bypass key (so-called Derivation Key Base – BDK) and a series of data contained in the transaction without the need to ‘synchronise’ with the source device.

The following elements are involved in this process:

1. Derivation Key Base (BKD): It is the main cryptographic key of the whole process, being able to be a TDEA key of double or triple length or AES. This key must be present in the receiver of the transaction to derive the transactions received from the source devices. Likewise, it must be shared with the entity that performs the injection of the initial keys (called Key Injection Facility – KIF).
2. BDK ID: It is the identifier of the BDK key used in the process.
3. Derivation Identifier (ID): It is a unique number associated with each origin terminal within the environment.
4. Transaction counter: It is a counter that increases every time a transaction is processed
5. Initial Key: Is the result of encrypting (BDK ID + Derivation ID + Transaction counter zero) with the BDK. The key resulting from this process is injected into the origin terminal during initialization.
6. Future Key (FK): Each time a transaction is processed on the source device, the Transaction counter is increased (usually by 1, although it is parameterizable). Every time the Transaction counter increments, is encrypted with the key used in that transaction (old key) and that result becomes a new key that will be used in the next transaction. Once generated the future key, the old key is deleted from the system.
   
7. Variants: Using a Future Key as the source, it is possible to generate a set of additional keys for encryption of PIN data (PINkey), account data (Datakey) and MAC functions (MACkey). These keys are generated by applying a preset binary mask to the FK. This step is optional.
8. Key Serial Number (KSN): It is the data transmitted by the source terminal together with the encrypted data, composed of the BKD ID, the Derivation ID and the Transaction Counter. This data is sent by the source device with the encrypted transaction data, so that it can be decrypted in the receiving environment.

Once the receiving environment receives the encrypted transaction and the KSN, it can internally regenerate the key used in the associated transaction by using the BKD.

Conclusion

One of the main problems posed by encryption with symmetric keys is the need for both points in communication to have the same key before proceeding with any data exchange. Once the keys are established, all data transmitted from that moment will be protected. However, this process assumes that the cryptographic keys are already deployed at the points in communication, which is – by far – the most sensitive task from a security point of view.

For this management different methods are used (fixed key, MK/SK and DUKPT) with their pros and cons. It is the decision of the entity to implement them based on the number of elements in communication, whether there are physical restrictions or not or whether the data encryption keys need to be rotated remotely.