DUKPT Key Mapping

Terms and Definitions

• DUKPT – Derived Unique Key Per Transaction

• OID – Object Identifier

• SRED - Secure Reading and Exchange of Data

There are 7 OIDs defined for these 7 SRED Data IDs.

Each OID value contains a two-byte DUKPT slot ID and a one-byte transformation ID.

DUKPT Slot IDs

The existing TR31 Module supports 32 MagTek DUKPT Slot IDs, from 0x2000 to 0x201F.

The Key Injection Software Tool shall inject DUKPT keys through these DUKPT Slot IDs.

Transformation IDs

This is the list of DUKPT transformations defined in both the Legacy and AES specifications.

During TR31 Key Injection, each DUKPT Slot ID contains a parameter indicates the purpose of a Key Set.

• Example 1: The restriction value is 0x3F

  • This Key Set can be used for all purposes.

• Example 2: The restriction value is 0x3E

SRED Data ID map configuration values (Slot ID and Transformation ID) must be checked and rejected if they don’t meet the following conditions.

• The DUKPT Slot ID must be loaded. (Table - Settings of Injected DUKPT Slot IDs)

• The loaded DUKPT Slot ID must allows this type of SRED Data ID. (Table - The Definition of Restriction Bitmap).

• The transformation must be allowed by Table - Allowed Key Mapping Table.

Here is the list of parameters of 4 DUKPT Slot IDs based on the existing Key Injection Tool.

If the Transformation ID of the latest key mapping request is different, then the original OID setting of the other SRED Data ID will be forced to match the latest OID setting. For example, SRED Data ID 2 has been mapped to 0x2007 0x04, user wants to map SRED Data ID 4 to 0x2007 0x05, then the OID setting of SRED Data ID 2 will be forced to 0x2007 0x05.

The following OID Values indicate that:

• 200701: Map PIN-TDES to DKPTM7-2007 PIN Encryption Variant.

• 20020B: Map Account Data to DKPTM2-2002 Data Encryption Usage.

• 200702: Map MAC to DKPTM7-2007 MAC Generate/Verify Variant.

Figure 1 - Configuration Usage Values