TR-31 Key Blocks

TR-31 is an ANSI standard format for securely transporting a cryptographic key from one system to another. Instead of sending a key as raw bytes, the sender wraps it in a key block that binds the key to information about how it may be used — so a key can't be moved to a device and then used for a purpose it was never intended for. Dyna-family readers use TR-31 to load keys into their secure key slots.

Two pieces work together:

• TR-31 Key Block (data object) — the format itself: a header describing the key's attributes (type, algorithm, allowed usage, mode) plus the encrypted key and a MAC that protects the whole block from tampering. This is what you build and hand to the device.

• — the command that delivers a TR-31 key block to the reader and loads it into a key slot. The device validates the block, then stores the key for use.

Loading or rotating a key on the device — for example, provisioning an initial DUKPT key or updating a key later in the field. The TR-31 format is how the key gets there safely; how DUKPT then uses that key per transaction is covered in the security guides.