We are having our P2PE Solution validated against the PCI P2PE standard. We currently use a TDEA 2-key based BDK, and IPEK in both the encryption and decryption environments. ANSI X9.24-1 (2009) states that the BDK can be either 2-key or 3-key and the QSA is insisting that the BDK must be TDEA 3-key as per Appendix C in the standard. Our encryption environment can't perform encryption using TDEA 3-key (hardware limitation). The assessor has asserted that mixed sizes of BDKs can be used with DUKPT, based on his reading of ANSI X9.24-1 (2009). Is that true? Can DUKPT encrypt plaintext with an IPEK derived from a 2-key BDK and successfully decrypt that data from that same IPEK in a decryption environment with a 3-key BDK?
As this is symmetric key encryption the key used to encrypt the data must be used to decrypt the data so if a double-length TDES key encrypted the data, the same double-length TDES key can decrypt the data. A triple-length TDES key cannot decrypt data encrypted by a double-length TDES key and vice versa.
The P2PE requires that the minimum length for a TDES key be triple-length, i.e. 192-bits (168-bit excluding parity). However, if implemented as part of a DUKPT key management scheme, the TDES keys may be double-length. This is detailed in the footnotes of Appendix C.