> For the complete documentation index, see [llms.txt](https://developer.magtek.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.magtek.com/guides/guides/security-and-key-management.md).

# Security & Key Management

This section covers how DynaFamily readers protect cardholder data and manage keys: encrypting data at the point of read, the keys and key-serial numbers behind DUKPT, verifying message integrity with MACs, loading keys with TR-31, and the PCI requirements deployers must meet. These pages are the concepts and procedures; the <mark style="color:red;">**security commands**</mark> and <mark style="color:red;">**data objects**</mark> that implement them live in the <mark style="color:red;">**API & Command Reference**</mark>.

{% hint style="success" %}
Applies to: DynaFamily (DynaFlex II PED, Go, SCR, DynaProx). The core concepts — DUKPT, KSN, MAC, TR-31 — apply to MagTek MMS SCRAs generally.
{% endhint %}

### In This Section

<table data-header-hidden><thead><tr><th valign="middle"></th><th></th></tr></thead><tbody><tr><td valign="middle"><strong>Reference Section</strong></td><td><strong>Information Available</strong></td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/dukpt-3des-tdea-greater-than-aes-migration"><mark style="color:red;"><strong>DUKPT: 3DES/TDEA --> AES Migration</strong></mark></a></td><td>How DUKPT derives a unique key per transaction, and the path (and reasons) for moving from legacy 3DES/TDEA DUKPT to AES DUKPT on your devices and host.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/key-serial-numbers-ksns"><mark style="color:red;"><strong>Key Serial Numbers (KSN)</strong></mark></a></td><td>What a KSN is, how it's structured, and how it identifies the unique key used to encrypt a given transaction under DUKPT.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/message-authentication-codes-mac"><mark style="color:red;"><strong>Message Authentication Codes (MAC)</strong></mark></a></td><td>How a MAC lets the host and device confirm a message hasn't been altered in transit, and when one is required.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/encryption-and-decryption"><mark style="color:red;"><strong>Encryption &#x26; Decryption</strong></mark></a></td><td>How the reader encrypts data at the point of read (SRED), how to determine which key was used, and how to decrypt the output on your host.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/tr-31-key-blocks"><mark style="color:red;"><strong>TR-31 Key Blocks</strong></mark></a></td><td>The ANSI TR-31 key-block format used to transport and load keys securely into the device.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/pci-requirements"><mark style="color:red;"><strong>PCI requirements (24-hour Reset, device lock)</strong></mark> </a></td><td>The operational requirements the device enforces for PCI compliance: the 24-hour automatic reset and the device lock feature.</td></tr></tbody></table>

### Where to Find Security Information

The [<mark style="color:red;">**Guides**</mark>](https://developer.magtek.com/guides) section (where you are now) contains articles on implementation. actual commands and objects live in the [<mark style="color:red;">**API & Command Reference**</mark>](https://developer.magtek.com/api-and-command-reference) section:

**Key Security Commands**

<table data-header-hidden><thead><tr><th valign="middle"></th><th></th></tr></thead><tbody><tr><td valign="middle"><strong>Reference Section</strong></td><td><strong>Information Available</strong></td></tr><tr><td valign="middle"><mark style="color:red;"><strong>0xE001 - Get Challenge</strong></mark></td><td>Requests a random challenge from the device, used to build a secured command.</td></tr><tr><td valign="middle"><mark style="color:red;"><strong>0xEEEE - Send Secured Command to Device</strong></mark> </td><td>Transmits another command to the device securely.</td></tr><tr><td valign="middle"><mark style="color:red;"><strong>0xEF01 - Load Key using TR-31</strong></mark></td><td>Loads a key into one of the device's secure key slots.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/commands/0xennn-security/0xef07-change-device-lock-passcode"><mark style="color:red;"><strong>0xEF07 - Challenge Device Lock State/Passcode</strong></mark></a></td><td>Change the device's lock state or its lock passcode.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/commands/0xennn-security/0xef11-get-key-info"><mark style="color:red;"><strong>Get Key Info</strong></mark></a></td><td>Retrieves information about a key slot and the key stored in it.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/guides/guides/security-and-key-management/pci-requirements"><mark style="color:red;"><strong>PCI requirements (24-hour Reset, device lock)</strong></mark> </a></td><td>The operational requirements the device enforces for PCI compliance: the 24-hour automatic reset and the device lock feature.</td></tr></tbody></table>

### Security Data Objects

Individual Security Data Objects can be found in the [<mark style="color:red;">**Data Types & Shared TLV Objects**</mark>](https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects) section.&#x20;

<table data-header-hidden><thead><tr><th valign="middle"></th><th></th></tr></thead><tbody><tr><td valign="middle"><strong>Reference Section</strong></td><td><strong>Information Available</strong></td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects/security-operation-type"><mark style="color:red;"><strong>Security Operation</strong></mark></a></td><td>This non-TLV data structure consists of four or five bytes that describes a security operation, including the algorithms and methods to be used in that operation.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects/security-parameters-type"><mark style="color:red;"><strong>Security Parameters</strong></mark></a></td><td>This structure contains an Encrypted Signature Capture FileType specifying the operation to be performed.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects/key-information-type"><mark style="color:red;"><strong>Key Information</strong></mark></a></td><td> Identifies the key being used for operation.</td></tr><tr><td valign="middle"><a href="https://developer.magtek.com/api-and-command-reference/scra-dynafamily-programmers-manual/data-types-and-shared-tlv-data-objects/tr-31-key-block-type"><mark style="color:red;"><strong>TR-31 Key Block</strong></mark></a></td><td>The data object, its tags, and structure (in the command reference).</td></tr></tbody></table>

### For More Help

{% hint style="info" %}
**Need Help?**

For additional support, please contact MagTek Support:

**Technical Support:**

* 📧 **Email:** <support@magtek.com>
* 📞 **Phone:** 1-800-788-6835 (US) | +1-562-546-6616 (International)
* 🕐 **Hours:** Monday-Friday, 6:00 AM - 5:00 PM PST

**Online Resources:**

* 🌐 **Official Site:** [https://www.magtek.com](https://www.magtek.com/)
* 💬 **Developer Forum:** [https://forum.magtek.com](https://forum.magtek.com/)

**Documentation Feedback:**

Help us improve this documentation! [Submit feedback](broken://spaces/1lWLescKFIPsMeIJI6Cd/pages/5314c528980689961380bea0044c1256aaeb39bc)
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.magtek.com/guides/guides/security-and-key-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.