How DUKPT key management works in POS environments

The post How DUKPT key management works in POS environments appeared first on Intertrust Technologies.

Point-of-sale (POS) systems include multiple mechanisms to protect cardholder data and prevent transaction fraud. Most of these work behind the scenes, invisible to consumers and merchants, but critical for developers to get right, especially since POS systems remain a target of attack. The DUKPT key management scheme is one of the cryptographic protocols essential to strong POS security.

What is DUKPT key management?

Derived Unique Key Per Transaction, or DUKPT (pronounced duck-putt), is a key management scheme initially developed by VISA in the late 1980s and covered in Part 3 of the ANSI X9.24 guidelines for Retail Financial Services Symmetric Key Management. Under DUKPT, every transaction uses a one-time encryption key so that the compromise of one transaction key does not compromise any other transactions or the system. Each one-time key is derived from a secret base key, which is never exposed.

Why is DUKPT important for POS environments?

DUKPT key management is a widely used standard in the financial industry that significantly reduces cybercrime and fraud in POS transactions. However, any cryptographic algorithm can be broken if you can get a hold of its keys. Generally, the most vulnerable point in an encryption scheme comes when keys are shared between the encrypting and decrypting entities. In a POS transaction, the POS device encrypts the data and the payment service provider decrypts it. How can they do so without sharing the encryption/decryption keys? This is where DUKPT comes in.

In DUKPT, the POS device generates a unique derived key along with a unique associated key serial number (KSN). It encrypts the data with the one-time key and sends the encrypted data and KSN to the payment service provider. The payment service provider then uses information in the unique KSN to generate that same key on its side and decrypt the data—the keys themselves are never exchanged.  

How does DUKPT key management work?

The DUKPT process begins with a Base Derivation Key (BDK), which is created and securely stored on the payment service provider side and never exposed. The same BDK can be used for many POS devices.

The BDK and a unique initial device identifier—usually the POS device serial number—are used to create an Initial Key for the POS device. The Initial Key is injected into the POS device along with a unique key serial number (KSN). The KSN is based on the initial device identifier and an internal transaction counter. This Initial Key is used to create a set of derived future keys and then is erased from the POS device.

For each transaction, one of the derived keys is used to encrypt the transaction data and a unique KSN is generated (based on the transaction count). The encrypted data, KSN, and other transaction data get sent to the payment service provider. At this point, the one-time key is erased from the POS device and the transaction count is incremented.

On the payment service provider side, the KSN is used to locate the associated BDK and recreate the Initial Key for the POS device used in that transaction. The Initial Key then undergoes a process similar to what was done on the device side to derive the one-time encryption key for the transaction. The data gets decrypted and sent on for any further processing, with no keying information retained.

DUKPT in a POS environment—an overview:

1. The base derivation key and POS device key serial number (KSN) are used to create a DUKPT initial key.
2. The initial DUKPT key gets injected into the POS device.
3. The initial key is used to create a group of unique derived encryption keys, each with their own KSN, and is then erased from the POS device.
4. During a transaction, one of the derived keys (session key) and its KSN are used to encrypt the transaction.
5. The KSN counter is incremented.
6. After the data is sent, the session key and KSN are used to create more derived keys if needed, then the key is erased.

whiteCryption Secure Key Box supports DUKPT

While DUKPT key management significantly boosts POS security and keeps transaction information safe, it can be cumbersome to implement and requires cryptographic expertise. In order to help developers of software-based payment systems build secure and compliant apps more quickly, whiteCryption Secure Key Box includes out-of-the-box DUKPT support among other features geared toward software-based POS security. It can also help protect the injection of the Initial Key using its support for dynamic keys.

Secure Key Box is a leading white-box cryptography solution and part of the whiteCryption in-app protection suite from Intertrust Technologies.

Building a tap-to-phone application? Check out our white paper for a detailed look at what you need to comply with the PCI CPoC Standard.

*** This is a Security Bloggers Network syndicated blog from Intertrust Technologies - Security Blogs authored by Juris Olekss. Read the original post at: https://www.intertrust.com/blog/how-dukpt-works-in-pos-environments/