Annex A – Cryptographic Key Life Cycles – Examples Key Name * Algorithm Key Length (HEX) Purpose of Use Generation Distribution Storage HSMs Loading Destruction Update ZMK 112 Encrypts keys during transmission between two entities. ZMK key types include: ZMK Bank encrypts keys (PEK, MDK, dCVV) between the issuer and vendor. ZMK vendor encrypts keys (KMC) used to lock the chip between pre-personaliser and personaliser The party entity Bank or vendor Bank brings ZMK components on site. Vendor ZMK sent in three paper based components Inside HSM Affina PSG 3 Key Custodians 1 KM Head of CPC For ZMK Bank 3 bank personnel also present Not planned PEK 2TDES 112 Encrypts PIN Block between Issuer and vendor Issuer Encrypted under ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned MDK 2TDES 112 Issuer Master Application Keys, derivatives of which are for Authentication, Secure Messaging Integrity and Secure Messaging Confidentiality. Issuer Encrypted ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned dCVV 2TDES 112 Master Key, derivatives of which are used in contactless application to create a dynamic CVV Issuer Encrypted under ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned KMC 2TDES 112 Locks chips between card manufacturer and vendor Chip vendor Encrypted under ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned
ISK/IPK RSA 1152/ 1408 RSA Keys ISK is used to create ICC Certificate. IPK is placed on the card in Certificate format. Vendor IPK sent to Visa in self-signed format. Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC As per procedures. Depends on Scheme Key Expiry dates. ICCK RSA 1152 DDA keys. ICSK is personalised in chip. ICPK is placed on the card in Certificate format. If separate PIN encipherment key required – also generated. Vendor Not distributed, coded on chip card Not stored Affina PSG Automated N/A N/A LMK 3DES 32 Master Key Used to encrypt keys in database. Generated on SafeNet PSG HSM. Not distributed. In memory of HSM and as 3 paper based components. SafeNet PSG Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Not Confirmed ZMK 3DES 32 Zone Master Key Shared between a third party and vendor. Generated on SafeNet PSG HSM or by third party. 3 paper-based components sent via different couriers In memory of HSM and as paper based components. SafeNet PSG Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Annually KEK/ KTK 3DES 32 Key Encryption Key / Key Transport Key Shared between internal cryptographic zones. Generated on SafeNet PSG HSM by key custodian. 3 paper-based components used internally by the custodians. In memory of HSM and as paper based components. SafeNet PSG / Thales Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Not Confirmed
MPK 3DES 32 Master Personalisation Key Used by the card supplier to lock the chips Generated by the chip producer and distributed as a cryptogram. Distributed only as a cryptogram protected under a zone master key. As cryptogram in protected memory of HSM SafeNet PSG Translated from under ZMK Deletion from the memory of the HSM Physical destruction in cross cut shredder Per batch of chips MDK 3DES 32 Master Derivation Key Used by the data system to generate the UDKs Generated by the issuer Ciphered with a ZMK As cryptogram in protected memory of HSM SafeNet PSG Translated from under ZMK Deletion from the memory of the HSM Physical destruction in cross cut shredder On request of issuer