Production Kit · DUKPT

DUKPT key derivation and crypto

Enter a base derivation key (BDK) or an already-derived IPEK, and the key serial number from the terminal. The tool derives the transaction key for that KSN and its PIN, MAC and data keys, with key check values, for TDES DUKPT (ANSI X9.24-1) or AES DUKPT (X9.24-3). Then use any of those keys to encrypt or decrypt a PIN block or data, or to generate a MAC. The published X9.24 test vectors load by default so you can check the results.

Test keys onlyEverything runs in your browser and nothing is sent anywhere. Even so, never paste live production keys or real cardholder PINs into a web page: use test keys and test cards.

1 · Base key and KSN

Base derivation key (BDK)32 hex · 16 bytesKey serial number (KSN)20 hex · 10 bytes

Data keys: apply the one-way step (variant encrypted with itself)

2 · Derived keys

IPEK6AC2 92FA A131 5B4D 858A B3A3 D7D5 933AInitial KSN FFFF9876543210E00000 · transaction key 042666B49184CFA368DE9628D0397BC9

Counter1 (0x1)

PIN encryption0426 66B4 9184 CF5C 68DE 9628 D039 7B36KCV A10107

MAC (request)0426 66B4 9184 30A3 68DE 9628 D039 84C9KCV 91A1BB

MAC (response)0426 66B4 6E84 CFA3 68DE 9628 2F39 7BC9KCV 7F62E4

Data (request)448D 3F07 6D83 0403 6A55 A3D7 E005 5A78KCV 156B9F

Data (response)AD7B FC8B 06AD 3A08 A560 B410 5CF8 D9E5KCV F5CBDE

3 · Encrypt, decrypt or MAC

Key

Operation

Clear PIN block (8 bytes)16 hex · 8 bytes

Result1B9C 1845 EB99 3A7A

Loading…