TR-31 Key Blocks

TR-31 is an ANSI standard format for securely transporting a cryptographic key from one system to another. Instead of sending a key as raw bytes, the sender wraps it in a key block that binds the key to information about how it may be used — so a key can't be moved to a device and then used for a purpose it was never intended for. Dyna-family readers use TR-31 to load keys into their secure key slots.

Two pieces work together:

• TR-31 Key Block (data object) — the format itself: a header describing the key's attributes (type, algorithm, allowed usage, mode) plus the encrypted key and a MAC that protects the whole block from tampering. This is what you build and hand to the device.

• Load Key Using TR-31 (command) — the command that delivers a TR-31 key block to the reader and loads it into a key slot. The device validates the block, then stores the key for use.

When you'll use it

Loading or rotating a key on the device — for example, provisioning an initial DUKPT key or updating a key later in the field. The TR-31 format is how the key gets there safely; how DUKPT then uses that key per transaction is covered in the security guides.

Learn more

Reference Section	Information Available
TR-31 Key Block	The data object, its tags, and structure (in the command reference).
Load Key using TR-31	Loads a key into one of the device's secure key slots.
Security & Key Management	DUKPT, key serial numbers (KSN), and how keys are used once loaded.

Need Help?

For additional support, please contact MagTek Support:

Technical Support:

• 📧 Email: [e-mail]

• 📞 Phone: [phone] (US) | [phone] (International)

• 🕐 Hours: Monday-Friday, 6:00 AM - 5:00 PM PST

Online Resources:

• 🌐 Official Site: https://www.magtek.com

• 💬 Developer Forum: https://forum.magtek.com

Documentation Feedback:

Help us improve this documentation! Submit feedback