We are having our P2PE Solution validated against the PCI P2PE standard. We currently use a TDEA 2-key based BDK, and IPEK in both the encryption and decryption environments. ANSI X9.24-1 (2009) states that the BDK can be either 2-key or 3-key and the QSA is insisting that the BDK must be TDEA 3-key as per Appendix C in the standard. Our encryption environment can't perform encryption using TDEA 3-key (hardware limitation). The assessor has asserted that mixed sizes of BDKs can be used with DUKPT, based on his reading of ANSI X9.24-1 (2009). Is that true? Can DUKPT encrypt plaintext with an IPEK derived from a 2-key BDK and successfully decrypt that data from that same IPEK in a decryption environment with a 3-key BDK?