MAC and encryption keys used in financial transactions have always been stored encrypted as cryptograms (of same length) on ostensibly unassailable hardware devices using 3DES. Now the requirement is that these cryptograms be replaced with key blocks of greater length in which the key and other data is embedded. The reasoning is that they will be harder to break this way.

But since all PIN blocks must at some point in a transaction be translated from one key to another, and PIN blocks, which have a known format, would be the easiest things to decrypt, key blocks don't seem to add any security. And still, as in all symmetric systems, if one key is broken, all are.

I'm trying to understand and appreciate the need for this cumbersome new layer.

  • $\begingroup$ Do you maybe have links to the requirement and technical specs thereof? What "other data" are we talking about? Is there any reasoning in the official standards, you say "The reasoning is that they will be harder to break this way." but could you provide a quote on this? $\endgroup$ – Maarten Bodewes Nov 26 '19 at 20:07
  • $\begingroup$ This seems to best present the rationalizations: pcisecuritystandards.org/documents/… $\endgroup$ – Chris Miller Nov 27 '19 at 21:57
  • $\begingroup$ That document contains a "why" section, that displays why an authentication tag is required for a key block (using reordering of keys in TDEA as an example how an altered, wrapped key can be dangerous), and how the additional data can restrict the usage of a key. How is that in any way not clear? Note that HSM's in the past (and, unfortunately, probably the present and future) rely often on ECB or zero IV-CBC for key wrapping / unwrapping. $\endgroup$ – Maarten Bodewes Nov 27 '19 at 22:03
  • $\begingroup$ Yes, I've read it, but don't really understand. A pin block's format is unique enough that an HSM could easily detect its decryption and refuse. Plus they already use key modifiers so the pin key wouldn't work in decryption anyway. A cryptogram is just an encrypted TDES key. Pin blocks must be translated from one to another in communicating with ATM and POS devices and card issuers. So one cracked cryptogram still renders the whole system useless. To my mind, these key blocks change nothing security-wise. And TDES? Really? Almost 20 years after AES? $\endgroup$ – Chris Miller Nov 29 '19 at 20:01

Browse other questions tagged or ask your own question.