CardGroove
Getting Started Downloads
TOOLS / KEY MANAGEMENT

DUKPT (AES)

ANSI X9.24-3 key derivation, PIN blocks, MAC, and data encryption.

Starting key
Working Key Length

16 HEX characters: initial key ID only. 24: ID plus 32-bit transaction counter. Counter zero returns the initial key only.

Calculator reference

Verification evidence and limitations →

What it calculates

Derives AES DUKPT initial, transaction and usage-specific working keys.

Inputs and methods

AES-128/192/256; BDK or IK; 8-byte initial ID or 12-byte KSN. PIN: 16-byte fields; MAC: AES-CMAC; data: ECB/CBC without padding.

Worked example

BDK FEDCBA9876543210F1F1F1F1F1F1F1F1, KSN 123456789012345600000001, AES-128.

PIN key: AF8CB133A78F8DC2D1359F18527593FB

Specification and limits

Host calculation only; no device state, update keys or TDES working keys. Counter zero returns only IK. Full ISO-4 requires a PAN field.

ASC X9 published test vectors ↗