← All tools
Payments
DUKPT key derivation: TDES (X9.24-1) and AES (X9.24-3)
Derive a PIN pad's initial key from a Base Derivation Key and its Key Serial Number, step the transaction counter, and watch every intermediate and working key appear, in both TDES DUKPT and AES DUKPT.
What's happening under the hood →·Read the Password hashing & key derivation: PBKDF2, bcrypt, scrypt, Argon2 module for the full explanation →·See the DUKPT: a fresh key for every card payment at the counter use case →·See the PIN blocks: encrypting a 4-digit number like it's a nuclear launch code use case →·See the Key ceremonies and the HSM key hierarchy: where every payment key comes from use case →
1. Base Derivation Key and Key Serial Number