Dukpt Method - VeriFone MX800 series Programmer's Manual

The following illustrates an MS encryption session.
Master Device
Forwards the encrypted working
1
key, account number, and PIN to
the IPP.
Appends the PIN block to the
2
request packet.
Forwards the packet to the host.
3

DUKPT Method

The IPP encrypts the customer's PIN according to the ANSI X9.8 standard and
Visa's ANSI X9.24 DUKPT key management method, based on the ANSI X3.92
DES algorithm implemented in the IPP firmware.
Before actual operation, each IPP must be loaded with a unique initial KSN (key
serial number) and a unique initial PEK (PIN Encryption Key). And the encryption
counter of the IPP is set to zero. The initial PEK is generated by encrypting the
initial KSN using appropriate derivation key.
The encryption per transaction of IPP during actual operation is as follows:
1
The master device sends an account number and a PIN to the IPP.
2
The IPP generates the clear-text PIN block using the account number and
PIN.
3
Using the generated PEK based on the encryption counter which is updated
after each transaction, the IPP do a special encrypt to the PIN block using the
DES algorithm and PEK, then sends the encrypted PIN block with current
KSN (the concatenation of the initial KSN and the encryption counter) to the
master device.
4
The master device then appends the encrypted PIN block and current KSN to
a request packet and forwards the completed request packet to the host.
IPP MS DUKPT C
AND OMMUNICATIONS
IPP
Decrypt the working key using
1
the master key.
Encrypts the PIN block with
2
the decrypted working key.
Sends the PIN block to the
3
master device.
X
M 800 S P
ERIES ROGRAMMERS
P
ACKETS
Packets
279
G
UIDE