I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC key on the response than used on the request.

This particular variant key seems to course some trouble in our HSM (it's don't work .. ), and I'm wondering if it is standard to have two keys in use on DUKPT MAC. Many references seems to only talk about one MAC key when talking about DUKPT.

  • $\begingroup$ DUKPT seems to refer to a specific algorithm used for banks (of old?). Is there any specification that you can point out? Note that having a separate MAC key for receiving and sending definitely is good practice - you don't want to have your own messages played back to you by an adversary. If this is also the case for your particular protocol remains to be seen. $\endgroup$ – Maarten Bodewes Oct 5 '17 at 21:58
  • $\begingroup$ @MaartenBodewes: Yes DUKPT was designed for banks (ATMs in fact) a good while ago but it's still used for many payment processing systems; the spec is X9.24 from x9.org but is not free. We have several Qs on it already; crypto.stackexchange.com/questions/27533/… and especially stackoverflow.com/questions/37281574/… look closest. $\endgroup$ – dave_thompson_085 Oct 6 '17 at 4:05

Browse other questions tagged or ask your own question.