I have actually been able to carry out a DUKPT data decryption successfully, which was also been confirmed with the BP-Tools - Cryptographic Calculator.

After understanding the differences between the DUKPT PIN and DUKPT DATA from their respective Variant Constant "according to ANSI X9.24, Part 1 document the DUKPT section".

I already changed the index of my keys [Varaint Constant] tallying with the Variant Constant, for the PIN decryption which are 7 and 15 compared to that of the DUKPT DATA which are 5 and 13 which worked successfully.

What i would now want to understand is this, after checking through this git used for the DUKPT data decryption

What am i actually getting wrong in this process, or what am i yet to really understand.

Because, trying out the BP-tools DUKPT data decryption, it is really working out with the git provided above, but still having a slight issue to getting the DUKPT pin work out, while been compared with the BP-Tools Calculator.

The question is: Is there any other thing to take note of, apart from the Variant Constant when doing a DUKPT PIN decryption?


Had to use the BP-Tools to clarify the output I am getting so as to know the main difference between the DUKPT-PIN and the DUKPT-DATA.

For the DUKPT-PIN: The entered PEK value will be XOR-ed with the value of 00000000000000FF 00000000000000FF (see ANSI X9.24-2004 Appendix A, A.5, page 42) as part of the processing.

For the DUKPT-DATA: As part of the processing, if the data variant key = tdesEnc(key, key);is checked XORing it with 0000000000FF0000 0000000000FF0000

All i need to do was just to comment out the key = tdesEnc(key, key); which serves the same function as that of the Data Variant which is not used in the process of carrying out DUKPT-PIN

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.