The Local Master Keys (LMKs) are a set of Data Encryption Standard (DES) keys stored in the HSM. All other keys and secret data are encrypted under the LMKs for local storage. Up to 20 pairs of LMKs are used with a triple encryption technique which effectively doubles the length of a standard DES key (making it 112 bits long).
For an HSM to operate, the LMKs must be created and loaded. Because the DES algorithm depends on a key for secrecy, and because the security of all keys and data encrypted for storage depend on the LMKs, they must be created and maintained in a secure manner. Provision is made to allow the LMKs to be changed and keys or data encrypted under them to be translated to encryption under the new LMKs.
All keys when stored locally (i.e. not in transit between systems) are encrypted under the LMK.
A Zone Master Key (ZMK) is a key-encrypting key which is distributed manually between two (or more) communicating sites, within a shared network, in order that further keys can be exchanged automatically (without the need for manual intervention). The ZMK is used to encrypt keys of a lower level for transmission. For local storage, a ZMK is encrypted under one of the LMK pairs.
Within the VISA environment this is known as a ZCMK.
A Zone PIN Key (ZPK) is a data encrypting key which is distributed automatically and is used to encrypt PINs for transfer between communicating parties (for example, between acquirers and issuers). For transmission, a ZPK is encrypted under a ZMK; for local storage it is encrypted under one of the LMK pairs.
A Terminal Master Key (TMK) is a key-encrypting key which is distributed manually, or automatically under a previously installed TMK. It is used to distribute data-encrypting keys, within a local (non-shared) network, to an ATM or POS terminal or similar. The TMK is used to encrypt other TMKs or keys of a lower level for transmission. For local storage, a TMK is encrypted under one of the LMK pairs.
A Terminal PIN Key (TPK) is a data-encrypting key which is used to encrypt PINs for transmission, within a local network, between a terminal and the terminal data acquirer. For transmission, a TPK is encrypted under a TMK; for local storage it is encrypted under one of the LMK pairs.
A Terminal Authentication Key (TAK) is a data-encrypting key which is used to generate and verify a Message Authentication Code (MAC) when data is transmitted, within a local network, between a terminal and the terminal data acquirer. For transmission, a TAK is encrypted under a TMK or ZMK; for local storage it is encrypted under one of the LMK pairs.
A PIN Verification Key (PVK) is a data-encrypting key which is used to generate and verify PIN verification data and thus verify the authenticity of a PIN. For transmission, a PVK is encrypted under a TMK or under a ZMK; for local storage, it is encrypted under one of the LMK pairs.
A Card Verification Key (CVK) is similar to a PIN Verification Key, but for Card information instead of a PIN.
|
|
|
|
Master/Session Key
The master/session key management scheme involves setting up a master key between two communicating parties (for example an acquirer and an issuer or an acquirer and a terminal) under which data-encrypting keys are exchanged for use during a session. Key installation and updating must be organised by the institutions involved (i.e., within the application programs).
The HSM supports master/session key management in both shared and local networks, but distinguishes between the two and maintains separate key hierarchies.