Usage notes

These separate variations of the DUKPT key derivation process provide key separation between the keys derived for PIN purposes, message authentication, and data encryption purposes. Unique Key Derive can produce from one to three derived keys, up to one for each variation depending on the desired key purpose, in operational DES key tokens. The combination of key tokens for these three purposes is based on the specified output key selection rule array keywords.

The verb can optionally produce an external initial PIN encryption key (IPEK), either in a non-CCA key-token or TR-31 key block, TDES-wrapped using the key identified by the transport_key_identifier parameter. The IPEK is created by taking the base derivation key and encrypting the 59-bit initial key serial number that is contained within the derivation data (the same value that was loaded when the PIN keypad was initialized).

The DUKPT key derivation process that is defined in the ANS X9.24 standard describes the use of the derived keys in terms of a terminal, which sends requests, and a host, which processes those requests and sends responses.

Beginning with Release 5.5, two direction or initiation rule-array keyword groups are added, one group for deriving MAC keys, and the other group for deriving data encryption keys. The use of these keywords is to specify the purpose of the key (MAC or data encryption) and whether the key is to be used to send or receive a request or to send or receive a response.