DUKPT

Derived Unique Key Per Transaction (DUKPT) is a symmetric key management scheme used to protect sensitive data in payment environments by generating a unique encryption key for each transaction. It is designed to reduce the impact of key exposure and simplify key management across large networks of point-of-sale devices.

DUKPT centers on three elements: a Base Derivation Key (BDK), an Initial PIN Encryption Key (IPEK) derived from the BDK, and a Key Serial Number (KSN) that identifies the current key state for a device. Each terminal is provisioned with an IPEK. For every transaction, a working key is derived from the IPEK using the KSN. This per-transaction key is used to encrypt sensitive data such as card PAN or PIN. The encrypted data, along with the KSN, is sent to the acquirer or processor, which uses the same derivation process to reconstruct the transaction key and decrypt the data.

Security and management properties include limiting data exposure to a single transaction and enabling centralized key recovery without storing every per-transaction key. Proper implementation requires secure storage of BDK, IPEK, and KSNs, tamper-resistant hardware, and a robust key-management framework. The KSN advances with each transaction, allowing the processor to derive the exact key used for decryption.

Algorithms used in DUKPT have traditionally been 3DES for derivation and encryption, with AES-based variants increasingly supported in modern deployments. DUKPT remains common in PCI PIN security and EMV environments for PIN and data protection at the point of sale, though it relies on coordinated security practices across issuing banks, acquirers, and terminals.