2
$\begingroup$

We are having our P2PE Solution validated against the PCI P2PE standard. We currently use a TDEA 2-key based BDK, and IPEK in both the encryption and decryption environments. ANSI X9.24-1 (2009) states that the BDK can be either 2-key or 3-key and the QSA is insisting that the BDK must be TDEA 3-key as per Appendix C in the standard. Our encryption environment can't perform encryption using TDEA 3-key (hardware limitation). The assessor has asserted that mixed sizes of BDKs can be used with DUKPT, based on his reading of ANSI X9.24-1 (2009). Is that true? Can DUKPT encrypt plaintext with an IPEK derived from a 2-key BDK and successfully decrypt that data from that same IPEK in a decryption environment with a 3-key BDK?

$\endgroup$
  • $\begingroup$ More information is needed. Specifically which standard is the QSA referencing Appendix C from: PCI P2PE or ANSI X9.24-1 (2009)? Exactly what is the wording in the section. Note: my QSA sees no reason that what you want to do is not allowed-barring more information. $\endgroup$ – zaph Aug 13 '18 at 21:12
  • $\begingroup$ The QSA is referring to the table in P2PE v2.0 r1.1 Appendix C. That table emphatically states that TDEA keys used in a P2PE solution must be 3-length (168 effective bits) if those keys reside outside a POI device. Inside of a POI device, the keys can be 2-length (112 effective bits) $\endgroup$ – Robert MacKinnon Aug 18 '18 at 21:43
  • $\begingroup$ The QSA is referring to the table in P2PE v2.0 r1.1 Appendix C. That table emphatically states that TDEA keys used in a P2PE solution must be triple-length (168 effective bits) if those keys reside outside a POI device. Inside of a POI device, the keys can be double-length (112 effective bits). I think I was misinformed about the concern. The concern lies with the IPEK. How is it possible to generate a double length IPEK from a triple length BDK and a double length KSN? ANSI X9.24-1 (2009) gives examples of IPEK generation using double length BDKs only. $\endgroup$ – Robert MacKinnon Aug 18 '18 at 21:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.