> For the complete documentation index, see [llms.txt](https://developer.magtek.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects/dukpt-key-mapping.md).

# DUKPT Key Mapping

## **Terms and Definitions**

* DUKPT – Derived Unique Key Per Transaction
* OID – Object Identifier
* SRED - Secure Reading and Exchange of Data

There are 7 OIDs defined for these 7 SRED Data IDs.

Each OID value contains a two-byte DUKPT slot ID and a one-byte transformation ID.

## Table DKM-1 - SRED Data IDs and OIDs

<table data-header-hidden><thead><tr><th></th><th width="184.6363525390625"></th><th width="104.54541015625"></th></tr></thead><tbody><tr><td>SRED Data ID</td><td>OID</td><td>OID Size</td></tr><tr><td>0: Not assigned</td><td>N/A</td><td>N/A</td></tr><tr><td>1: PIN-TDES (supported on PED devices Only)</td><td>0x010102040101</td><td>3</td></tr><tr><td>2: Account Data</td><td>0x010102040102</td><td>3</td></tr><tr><td>3: MAC</td><td>0x010102040103</td><td>3</td></tr><tr><td>4: Magneprint (supported on devices with MSR Only)</td><td>0x010102040104</td><td>3</td></tr><tr><td>5: MagTek Token</td><td>0x010102040105</td><td>3</td></tr><tr><td>6: User Data 1</td><td>0x010102040106</td><td>3</td></tr><tr><td>7: PIN-AES (supported on PED devices Only)</td><td>0x010102040107</td><td>3</td></tr></tbody></table>

**DUKPT Slot IDs**

The existing TR31 Module supports 32 MagTek DUKPT Slot IDs, from 0x2000 to 0x201F.

The Key Injection Software Tool shall inject DUKPT keys through these DUKPT Slot IDs.

**Transformation IDs**

This is the list of DUKPT transformations defined in both the Legacy and AES specifications.

## Restrictions of a DUKPT Slot ID <a href="#toc195691465" id="toc195691465"></a>

## Table DKM-2 - Transformation IDs for DUKPT Legacy and AES

<table data-header-hidden><thead><tr><th width="146.0909423828125"></th><th width="203.63641357421875"></th><th width="92.1817626953125"></th><th></th></tr></thead><tbody><tr><td><p>Transformation</p><p>ID #</p></td><td>Usage Name</td><td>Type</td><td>Data for calculation</td></tr><tr><td>0</td><td>Reserved</td><td> </td><td> </td></tr><tr><td>1</td><td>PIN Encryption</td><td>Legacy</td><td>00 00 00 00 00 00 00 FF</td></tr><tr><td>2</td><td>MAC Generate/Verify</td><td>Legacy</td><td>00 00 00 00 00 00 FF 00</td></tr><tr><td>3</td><td>MAC Verify</td><td>Legacy</td><td>00 00 00 00 FF 00 00 00</td></tr><tr><td>4</td><td>Data Enc/Decryption</td><td>Legacy</td><td>00 00 00 00 00 FF 00 00</td></tr><tr><td>5</td><td>Data Encryption</td><td>Legacy</td><td>00 00 00 FF 00 00 00 00</td></tr><tr><td>6</td><td>Reserved</td><td> </td><td> </td></tr><tr><td>7</td><td>PIN Encryption</td><td>AES</td><td>0x1000</td></tr><tr><td>8</td><td>MAC Generate</td><td>AES</td><td>0x2000</td></tr><tr><td>9</td><td>MAC Verify</td><td>AES</td><td>0x2001</td></tr><tr><td>A</td><td>MAC Generate/Verify</td><td>AES</td><td>0x2002</td></tr><tr><td>B</td><td>Data Encryption</td><td>AES</td><td>0x3000</td></tr><tr><td>C</td><td>Data Decryption</td><td>AES</td><td>0x3001</td></tr><tr><td>D</td><td>Data Enc/Decryption</td><td>AES</td><td>0x3002</td></tr></tbody></table>

## Table DKM-3 - The Definition of Restriction Bitmap

<table data-header-hidden><thead><tr><th width="71.18182373046875"></th><th width="73.90911865234375"></th><th width="73.45458984375"></th><th width="113.4544677734375"></th><th width="67.0909423828125"></th><th width="92.54541015625"></th><th width="147.272705078125"></th></tr></thead><tbody><tr><td>Bit #</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr><tr><td>Data Type</td><td><p>User Data</p><p>(RFU)</p></td><td><p>Token</p><p>(RFU)</p></td><td>Magneprint</td><td>MAC</td><td>Account Data</td><td>PIN</td></tr></tbody></table>

During TR31 Key Injection, each DUKPT Slot ID contains a parameter indicates the purpose of a Key Set.

* Example 1:  The restriction value is 0x3F
  * This Key Set can be used for all purposes.
* Example 2:  The restriction value is 0x3E
  * This Key Set can be used for all purposes, except PIN Encryption.
* Example 3:  The restriction value is 0x01
  * This Key Set can be used for PIN Encryption only.

## The Rules of Key Mapping <a href="#toc195691466" id="toc195691466"></a>

SRED Data ID map configuration values (Slot ID and Transformation ID) must be checked and rejected if they don’t meet the following conditions.

* The DUKPT Slot ID must be loaded. (Table - Settings of Injected DUKPT Slot IDs)
* The loaded DUKPT Slot ID must allows this type of SRED Data ID. (Table - The Definition of Restriction Bitmap).&#x20;
* The transformation must be allowed by Table - Allowed Key Mapping Table.

## The settings of DUKPT Slot IDs injected through TR31 <a href="#toc195691467" id="toc195691467"></a>

Here is the list of parameters of 4 DUKPT Slot IDs based on the existing Key Injection Tool.

## Table DKM-4 - Settings of Injected DUKPT Slot IDs

<table data-header-hidden><thead><tr><th width="168.0909423828125"></th><th width="131.72735595703125"></th><th></th></tr></thead><tbody><tr><td>DUKPT Slot ID</td><td>Key Type</td><td>Restrictions</td></tr><tr><td>DKPTM0-2000</td><td>TDES</td><td>0x3E</td></tr><tr><td>DKPTM2-2002</td><td>AES-128</td><td>0x3F</td></tr><tr><td>DKPTM3-2003</td><td>AES-256</td><td>0x3F</td></tr><tr><td>DKPTM7-2007</td><td>TDES</td><td>0x3F</td></tr></tbody></table>

## The Allowed Key Mapping Table <a href="#toc195691468" id="toc195691468"></a>

## Table DKM-5 - Allowed Key Mapping Table

<table data-header-hidden><thead><tr><th width="73.3636474609375"></th><th></th><th width="145.8182373046875"></th><th width="147.54541015625"></th></tr></thead><tbody><tr><td><p>SRED</p><p>Data ID</p></td><td><p>Data Type</p><p>(Working Key Purpose)</p></td><td><p>Allowed Legacy</p><p>DUKPT</p><p>Transforms</p></td><td><p>Allowed AES</p><p>DUKPT</p><p>Transforms</p></td></tr><tr><td>0</td><td>Not assigned</td><td>-</td><td>-</td></tr><tr><td>1</td><td>PIN-TDES (supported on PED devices Only)</td><td>01</td><td>Not allowed</td></tr><tr><td>2</td><td>Account Data</td><td>01, 04, 05</td><td>0B, 0D</td></tr><tr><td>3</td><td>Transaction MAC</td><td>02</td><td>08, 0A</td></tr><tr><td>4</td><td>MagnePrint (supported on devices with MSR Only)</td><td>01, 04, 05</td><td>0B, 0D</td></tr><tr><td>5</td><td>MagTek Token (RFU)</td><td>RFU</td><td>RFU</td></tr><tr><td>6</td><td>User Data #1 (RFU)</td><td>RFU</td><td>RFU</td></tr><tr><td>7</td><td>PIN-AES (supported on PED devices Only)</td><td>Not allowed</td><td>07</td></tr><tr><td>…</td><td>RFU</td><td>-</td><td>-</td></tr></tbody></table>

{% hint style="info" %}
**Note**: If SRED Data ID 2 and 4 are mapped to the same Key Set, then they must have the same Transformation ID.
{% endhint %}

If the Transformation ID of the latest key mapping request is different, then the original OID setting of the other SRED Data ID will be forced to match the latest OID setting. For example, SRED Data ID 2 has been mapped to 0x2007 0x04, user wants to map SRED Data ID 4 to 0x2007 0x05, then the OID setting of SRED Data ID 2 will be forced to 0x2007 0x05.

## **Examples of Key Mapping**

The following OID Values indicate that:

* 200701:  Map PIN-TDES to DKPTM7-2007 PIN Encryption Variant.
* 20020B:  Map Account Data to DKPTM2-2002 Data Encryption Usage.
* 200702:  Map MAC to DKPTM7-2007 MAC Generate/Verify Variant.
* 20030B:  Map MangePrint to DKPTM3-2003 Data Encryption Usage.
* 000004:  MagTek Token is RFU, 0000 ID does not exist (this is default value).
* 000004:  User Data is RFU, 0000 ID does not exist (this is default value).
* 200207:  Map PIN-AES to DKPTM2-2002 PIN Encryption Usage.

<p align="center"> <img src="/files/b2LVGpFKaMhAknGQRytT" alt=""></p>

<p align="center"><strong>Figure 1 - Configuration Usage Values</strong></p>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects/dukpt-key-mapping.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.