"Key" to Secure Data - P2PE - Derived Unique Key Per Transaction (DUKPT)
Written by Andrew McKenna, PCI QSA, PCIP at Foregenix
The encryption key infrastructure usually used in PCI P2PE solutions is based on the DUKPT (pronounced duck-putt) model. This key hierarchy was initially designed by Visa in 1987 and is documented in ANSI x9.24. DUKPT means Derived Unique Key Per Transaction and means that every transaction is protected using a different encryption key such that compromise of a single encryption key will not compromise the overall solution. In a P2PE solution, this works as follows:
A BDK (Base Derivation Key) is created on the HSM (Hardware Security Module). The BDK is the top level key in the hierarchy. In a P2PE solution, all encryption will take place on the PED (PIN Entry Device) and all decryption will take place on the HSM. The BDK on the HSM must be able to identify which encryption key was used to encrypt the transaction data in order to derive the appropriate key for decryption.
Note that while the BDK is created on the HSM, the BDK will often have been transported to Key Injection Facilities in order that the IPEK can be derived from the BDK for each device and the IPEK injected to derive the future keys on the terminal. This process can also be automated for remote key distribution though the mechanisms are the same.
If you’d like more information on this topic, you may be interested in checking out this reference: ANSI X9.24-1:2009 Retail Financial Services Symmetric Key Management Part 1: Using Symmetric Techniques (available at http://webstore.ansi.org/FindStandards.aspx?SearchString=X9.24-1&SearchOption=0&PageNum=0&SearchTermsArray=null%7cX9.24-1%7cnull)
Please contact us if you'd like to chat about P2PE & your business.