1、 American National Standard for Financial Services ANSI X9.24-3-2017 Retail Financial Services Symmetric Key Management Part 3: Derived Unique Key Per Transaction Accredited Standards Committee X9, Incorporated Financial Industry Standards Date Approved: October 11, 2017 American National Standards
2、Institute American National Standards, Technical Reports and Guides developed through the Accredited Standards Committee X9, Inc., are copyrighted. Copying these documents for personal or commercial use outside X9 membership agreements is prohibited without express written permission of the Accredit
3、ed Standards Committee X9, Inc. For additional information please contact ASC X9, Inc., 275 West Street Suite 107, Annapolis, Maryland 21401 USA. This page intentionally left blankANSI X9.24-3-2017 ASC X9, Inc. 2017 All rights reserved iv Contents Page Figures vi Tables vii Foreword .viii Introducti
4、on ix 1 Purpose . 1 2 Scope 1 2.1 Application . 1 3 Normative references 2 4 Terms and definitions . 3 4.1 Advanced Encryption Standard (AES) 3 4.2 AES 3 4.3 algorithm . 3 4.4 ANSI 3 4.5 base derivation key (BDK) 3 4.6 BDK . 3 4.7 BDK ID . 3 4.8 cryptographic key 3 4.9 cryptographic key synchronizat
5、ion . 4 4.10 cryptographic strength . 4 4.11 derivation 4 4.12 derivation identifier (ID) 4 4.13 derivation key . 4 4.14 Derived Unique Key Per Transaction (DUKPT) . 4 4.15 Initial DUKPT key . 4 4.16 Initial Key 4 4.17 Initial Key ID . 5 4.18 ISO . 5 4.19 key . 5 4.20 PAN . 5 4.21 Personal Identific
6、ation Number (PIN) 5 4.22 Primary Account Number (PAN) 5 4.23 PIN . 5 4.24 Secure Cryptographic Device (SCD) . 5 4.25 SCD . 5 4.26 symmetric key 6 4.27 TDEA . 6 4.28 Transaction-Originating SCD . 6 4.29 Triple Data Encryption Algorithm (TDEA) . 6 4.30 Working Key . 6 5 Overview . 6 5.1 Key Managemen
7、t . 6 5.2 Cryptographic Key Synchronization . 9 5.3 Unique Initial Keys . 9 6 AES DUKPT 10 6.1 Algorithm Description .11 6.1.1 KSN Compatibility Mode .14 ANSI X9.24-3-2017 ASC X9, Inc. 2017 All rights reserved v 6.1.2 Derived Key OIDs. 15 6.1.3 Keys and Key Sizes . 15 6.2.2 Key Length Function . 16
8、6.3 Key Derivation Function . 16 6.3.1 Algorithm 16 6.3.2 Derivation Data 18 6.3.3 “Create Derivation Data” (Local Subroutine) . 21 6.3.4 Security Considerations . 22 6.4 Host Security Module Algorithm 23 6.5 Transaction-Originating Device Algorithm . 27 6.5.1 Algorithm Parameters . 27 6.5.2 Storage
9、 Areas 27 6.5.3 Processing Routines . 28 6.5.4 Base Cipher Definitions 32 Annex A. Annex A (Informative) Pseudocode Notation. 34 Annex B. Annex B (Informative) Test Vectors 37 Annex C. Annex C (Informative) TDEA Derived Unique Key per Transaction 42 ANSI X9.24-3-2017 vi ASC X9, Inc. 2017 All rights
10、reserved Figures Figure 1 - DUKPT at Receiving SCD . 8 Figure 2 - DUKPT at Originating SCD . 9 Figure 3 - KDF in Counter Mode 17 Figure 4 - Simplified DUKPT Data Flow 50 Figure 5 - Key Calculation for PIN Encrypting Key and MAC Keys .54 Figure 6 - Key Calculation for Data Encryption Keys .55 Figure
11、7 - 2 Key Triple DEA Initial Key .65 ANSI X9.24-3-2017 ASC X9, Inc. 2017 All rights reserved vii Tables Table 1 - AES DUKPT allowed working keys per BDK size 15 Table 2 - Terminal Key Derivation Data 18 Table 3 - Other Key Derivation Data . 19 Table 4 - BDK and Associated Data for Test Vectors . 37
12、Table 4 - Variant Constants for Transaction Keys 55 ANSI X9.24-3-2017 viii ASC X9, Inc. 2017 All rights reserved Foreword Approval of an American National Standard requires verification by ANSI that the requirements for due process, consensus, and other criteria for approval have been met by the sta
13、ndards developer. Consensus is established when, in the judgment of the ANSI Board of Standards Review, substantial agreement has been reached by directly and materially affected interests. Substantial agreement means much more than a simple majority, but not necessarily unanimity. Consensus require
14、s that all views and objections be considered, and that a concerted effort be made toward their resolution. The use of American National Standards is completely voluntary; their existence does not in any respect preclude anyone, whether he has approved the standards or not from manufacturing, market
15、ing, purchasing, or using products, processes, or procedures not conforming to the standards. The American National Standards Institute does not develop standards and will in no circumstances give an interpretation of any American National Standard. Moreover, no person shall have the right or author
16、ity to issue an interpretation of an American National Standard in the name of the American National Standards Institute. Requests for interpretation should be addressed to the secretariat or sponsor whose name appears on the title page of this standard. CAUTION NOTICE: This American National Standa
17、rd may be revised or withdrawn at any time. The procedures of the American National Standards Institute require that action be taken to reaffirm, revise, or withdraw this standard no later than five years from the date of approval. Published by Accredited Standards Committee X9, Incorporated Financi
18、al Industry Standards 275 West Street Suite 107 Annapolis, MD 21401 USA X9 Online http:/www.x9.org Copyright 2017 ASC X9, Inc. All rights reserved. No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without prior written permission of the publi
19、sher. Published in the United States of America. ANSI X9.24-3-2017 ASC X9, Inc. 2017 All rights reserved ix Introduction NOTE The users attention is called to the possibility that compliance with this standard may require use of an invention covered by patent rights. By publication of this standard,
20、 no position is taken with respect to the validity of this claim or of any patent rights in connection therewith. The patent holder has, however, filed a statement of willingness to grant a license under these rights on reasonable and nondiscriminatory terms and conditions to applicants desiring to
21、obtain such a license. Details may be obtained from the standards developer. Suggestions for the improvement or revision of this Standard are welcome. They should be sent to the X9 Committee Secretariat, Accredited Standards Committee X9, Inc., Financial Industry Standards, 275 West Street, Suite 10
22、7, Annapolis, MD 21401 USA. This Standard was processed and approved for submittal to ANSI by the Accredited Standards Committee on Financial Services, X9. Committee approval of the Standard does not necessarily imply that all the committee members voted for its approval. The X9 committee had the fo
23、llowing members: Roy C. DeCicco, X9 Chair Angela Hendershott, X9 Vice Chair Steve Stevens, X9 Executive Director Janet Busch, Program Manager Organization Represented Representative ACI Worldwide Doug Grote American Bankers Association .Diane Poole American Express Company David Moore Bank of Americ
24、a .Daniel Welch Bank of New York Mellon .Arthur Sutton Blackhawk Network Anthony Redondo Bloomberg LP .Corby Dear Capital One .Marie LaQuerre Citigroup, Inc. Karla McKenna CLS Bank Ram Komarraju Conexxus, Inc. Gray Taylor CUSIP Service Bureau .Gerard Faulkner Delap LLP .Andrea Beatty Delap LLP .Darl
25、ene Kargel Deluxe Corporation .Angela Hendershott Diebold Nixdorf .Bruce Chapa Discover Financial Services .Michelle Zhang eCurrency .David Wen Federal Reserve Bank Mary Hughes First Data Corporation Lisa Curry FIS Stephen Gibson-Saxty Fiserv Dan Otten ANSI X9.24-3-2017 x ASC X9, Inc. 2017 All right
26、s reserved FIX Protocol Ltd - FPL . Jim Northey Futurex . Ryan Smith Gilbarco Bruce Welch Harland Clarke . John McCleary Hewlett Packard . Terence Spies IBM Corporation . Todd Arnold Independent Community Bankers of America . Cary Whaley Ingenico . Rob Martin ISARA Corporation Alexander Truskovsky I
27、SITC Jason Brasile ITS, Inc. (SHAZAM Networks) . Manish Nathwani J.P. Morgan Chase Roy DeCicco KPMG LLP . Mark Lundin MagTek, Inc. Mimi Hart MasterCard Europe Sprl Mark Kamers NACHA The Electronic Payments Association Priscilla Holland National Security Agency . Paul Timmel Nautilus Hyosung . Joe Mi
28、litello NCR Corporation . David Norris Office of Financial Research, U.S. Treasury Department . Thomas Brown Jr. PCI Security Standards Council Troy Leach RouteOne . Chris Irving RouteOne . Jenna Wolfe SWIFT/Pan Americas Karin DeRidder SWIFT/Pan Americas Frank Vandriessche Symcor Inc. Debbi Fitzpatr
29、ick TECSEC Incorporated . Ed Scheidt The Clearing House . Sharon Jablon U.S. Bank . John King U.S. Commodity Futures Trading Commission (CFTC) Robert Stowsky USDA Food and Nutrition Service . Kathy Ottobre Vantiv LLC . john hall VeriFone, Inc. . Dave Faoro VISA . Kim Wagner Wayne Fueling Systems Ste
30、ven Bowles Wells Fargo Bank. Mark Schaffer ANSI X9.24-3-2017 ASC X9, Inc. 2017 All rights reserved xi The X9F subcommittee on Data and Information Security had the following members: Dave Faoro, Chair Steven Bowles, Vice Chair Ed Scheidt, Vice Chair Organization Represented Representative ACI Worldw
31、ide Doug Grote ACI Worldwide Dan Kinney ACI Worldwide Julie Samson American Bankers Association .Tom Judd American Express Company Farid Hatefi American Express Company John Timar American Express Company Kevin Welsh Bank of America .Amanda Adams Bank of America .Peter Capraro Bank of America .Andi
32、Coleman Bank of America .Lawrence LaBella Bank of America .Will Robinson Bank of America .Michael Smith Bank of America .Daniel Welch BlackBerry Limited Daniel Brown Blackhawk Network Vijay Bolina Blackhawk Network Anthony Redondo Bloomberg LP .Erik Anderson Bloomberg LP .Corby Dear Capital One .Mar
33、ie LaQuerre Capital One .Johnny Lee Cipherithm Scott Spiker comForte 21 GmbH Thomas Gloerfeld comForte 21 GmbH Henning Horst Communications Security Establishment .Jonathan Hammell Communications Security Establishment .David Smith Conexxus, Inc. Alan Thiemann CUSIP Service Bureau .Scott Preiss Dela
34、p LLP .Andrea Beatty Delap LLP .David Buchanan Delap LLP .Darlene Kargel Deluxe Corporation .Angela Hendershott Deluxe Corporation .Margiore Romay Deluxe Corporation .Andy Vo Diebold Nixdorf .Christoph Bruecher Diebold Nixdorf .Andrea Carozzi Diebold Nixdorf .Bruce Chapa Diebold Nixdorf .Michael Nol
35、te Diebold Nixdorf .Michael Ott Diebold Nixdorf .Dave Phister Discover Financial Services .Cheryl Mish Discover Financial Services .Diana Pauliks Discover Financial Services .Jordan Schaefer eCurrency .David Wen Federal Reserve Bank Patrick Adler Federal Reserve Bank Guy Berg Federal Reserve Bank Ma
36、rianne Crowe ANSI X9.24-3-2017 xii ASC X9, Inc. 2017 All rights reserved Federal Reserve Bank . Amanda Dorphy Federal Reserve Bank . Mary Hughes Federal Reserve Bank . Heather Hultquist Federal Reserve Bank . Janet LaFrence Federal Reserve Bank . Susan Pandy Federal Reserve Bank . Patti Ritter Feder
37、al Reserve Bank . Daniel Rozycki First Data Corporation . Annmarie Corrigan First Data Corporation . Lisa Curry First National Bank of Omaha Sherry Rewolinski First National Bank of Omaha Kristi White FIS . Chelsea Lopez FIS . John Soares FIS . Sunny Wear Fiserv . Bud Beattie Fiserv . Dan Otten Futu
38、rex . Ryan Smith GEOBRIDGE Corporation . Donna Gem GEOBRIDGE Corporation . Jason Way Gilbarco Scott Turner Gilbarco Bruce Welch Harland Clarke . Joseph Filer Heartland Payment Systems . Scott Meeker Hewlett Packard . Luther Martin Hewlett Packard . Terence Spies IBM Corporation . Todd Arnold Indepen
39、dent Community Bankers of America . Cary Whaley Ingenico . Rob Martin ISARA Corporation Mike Brown ISARA Corporation Philip Lafrance ISARA Corporation Alexander Truskovsky ITS, Inc. (SHAZAM Networks) . Manish Nathwani J.P. Morgan Chase Bruce Geller J.P. Morgan Chase Kathleen Krupa J.P. Morgan Chase
40、Jackie Pagn J.P. Morgan Chase Darryl Scott K3DES LLC Azie Amini KPMG LLP . Mark Lundin MagTek, Inc. Jeff Duncan MagTek, Inc. Mimi Hart MasterCard Europe Sprl Mark Kamers MasterCard Europe Sprl Joshua Knopp MasterCard Europe Sprl Larry Newell MasterCard Europe Sprl Adam Sommer MasterCard Europe Sprl
41、Michael Ward National Institute of Standards and Technology (NIST) Elaine Barker National Institute of Standards and Technology (NIST) Lily Chen National Institute of Standards and Technology (NIST) Paul Grassi National Security Agency . Mike Boyle National Security Agency . Paul Timmel Nautilus Hyo
42、sung . Joe Militello Nautilus Hyosung . Jay Shin NCR Corporation . Tanika Eng NCR Corporation . Charlie Harrow NCR Corporation . David Norris ANSI X9.24-3-2017 ASC X9, Inc. 2017 All rights reserved xiii Onboard Security Mark Etzel Onboard Security Virendra Kumar Onboard Security William Whyte Onboar
43、d Security Lee Wilson Onboard Security Zhenfei Zhang PCI Security Standards Council .Leon Fell PCI Security Standards Council .Troy Leach PCI Security Standards Council .Ralph Poore RSA, The Security Division of EMC .Steve Schmalz SafeNet Infotech Pvt. Ltd. .Amit Sinha Safeway Gary Zempich TECSEC In
44、corporated Ed Scheidt TECSEC Incorporated Dr. Wai Tsang TECSEC Incorporated Jay Wack Thales UK Limited Larry Hines Thales UK Limited James Torjussen The Clearing House Mark Fitlin The Clearing House Sharon Jablon The Clearing House Hirak Patel The Clearing House Miguel Sanchez Trustwave .John Amaral
45、 Trustwave .Tim Hollebeek U.S. Bank Stephen Case U.S. Bank Peter Skirvin Vantiv LLC John Hall Vantiv LLC Jeffrey Singleton Vantiv LLC Bill Weingart Vantiv LLC James Zerfas VeriFone, Inc. .John Barrowman VeriFone, Inc. .David Ezell VeriFone, Inc. .Dave Faoro VeriFone, Inc. .Doug Manchester VeriFone,
46、Inc. .Brad McGuinness VeriFone, Inc. .Joachim Vance VISA Shahzad Khan VISA Kim Wagner Wayne Fueling Systems .Steven Bowles Wells Fargo Bank .William Felts, IV Wells Fargo Bank .Phillip Griffin Wells Fargo Bank .Jan Kohl Wells Fargo Bank .Garrett Macey Wells Fargo Bank .Kelly ODonnell Wells Fargo Ban
47、k .Mark Schaffer Wells Fargo Bank .Jeff Stapleton XYPRO TechnologySteve Tcherchian Under ASC X9, Inc. procedures, a working group may be established to address specific segments of work under the ASC X9 Committee or one of its subcommittees. A working group exists only to develop standard(s) or guid
48、eline(s) in a specific area and is then disbanded. The individual experts are listed with their affiliated organizations. However, this does not imply that the organization has approved the content of the standard or guideline. (Note: Per X9 policy, company names of non-member participants are liste
49、d only if, at the time of publication, the X9 Secretariat received an original signed release permitting such company names to appear in print.) ANSI X9.24-3-2017 xiv ASC X9, Inc. 2017 All rights reserved The X9F6 Cardholder Authentication and ICCs group which developed this standard had the following members: Scott Spiker, Chair Andrea Beatty, Vice Chair Joachim Vance, Susan Langford and Tim Hollebeek, Project Editor Organization Represented Representative ACI Worldwide . Doug Grote ACI Worldwide . Dan Kinney ACI Worldwide . Julie Samson Amer
