Unique Key Derive (CSNBUKD)

The Unique Key Derive (CSNBUKD) verb can perform the key derivation process for DES-DUKPT as defined in ANSI X9.24 2007 Part 1 or the key derivation process for AES-DUKPT as defined in ANSI X9.24 2017 Part 3.

The process derives keys from two values: the base derivation key and the derivation data:

• The base derivation key is the key from which the others are derived. For DES-DUKPT, this must be a CCA DES KEYGENKY with the UKPT bit (bit 18) set to 1 in the control vector, or a TR-31 DES key token with the following attributes:
  • TR-31 key usage: B0
  • Algorithm: T
  • TR-31 mode of key use: X

  For AES-DUKPT, this must be a CCA AES DKYGENKY key with the A-DUKPT bit set to 1 in the low-order byte of key usage field 1, or a TR-31 AES key token with the following attributes:

  • TR-31 key usage: B0
  • Algorithm: A
  • TR-31 mode of key use: X
• The derivation data is used to make the derived key specific to a particular device and to a specific transaction from that device. The derivation data, called the Current Key Serial Number (CKSN), is the 80-bit concatenation of the device's 59-bit Initial Key Serial Number value and the 21-bit value of the current encryption counter which the device increments for each new transaction. The derivation data for AES-DUKPT, as described in ANSI X9.24-3, is used to provide input parameters for the AES DUKPT key derivation function. The derivation data for AES-DUKPT is defined in AES-DUKPT reference.

The initial pin encryption key (IPEK) is derived from the base derivation key and the initial derivation data. Specify the K3IPEK rule array keyword to return the IPEK.

Rule array keywords determine the types and number of keys derived on a particular call. See the rule array parameter description for more information.

Output keys are wrapped using the mode configured as the default wrapping mode, either enhanced wrapping mode (WRAP-ENH) or original ECB wrapping mode (WRAP-ECB).