← Payment Reference GuidesKey Management Standards
TR-31 & TR-34
The two foundational ANSI X9 standards for secure cryptographic key exchange between Hardware Security Modules. TR-31 defines the key block format that binds usage attributes to the key value. TR-34 defines the RSA-based protocol for distributing those key blocks from a Key Distribution Host to receiving devices without human key ceremonies.
TR-31 Field Reference
Complete lookup tables for all TR-31 header field codes. Every field in the 16-character header is defined by these values.
Key Usage Codes
| Code | Key Type | Typical HSM Command |
|---|---|---|
B0 | Base Derivation Key (BDK) — DUKPT | GenerateBDK, InjectIPEK |
B1 | Initial Derivation Key (IPEK) | DeriveIPEK |
B3 | DUKPT Initial Key | LoadIPEK |
C0 | Card Verification Key (CVK / CVK-A, CVK-B) | GenerateCVV, VerifyCVV |
C1 | Card Verification Key for CVC3 (contactless) | GenerateCVC3 |
D0 | Data Encryption Key (symmetric) | Encrypt, Decrypt data blocks |
E0 | EMV Issuer Master Key — Application Cryptogram (ARQC/AC) | GenerateARQC, VerifyARQC |
E1 | EMV Issuer MK — Secure Messaging Confidentiality | SM Encrypt |
E2 | EMV Issuer MK — Secure Messaging Integrity | SM MAC |
E4 | EMV Issuer MK — Dynamic Numbers | GenerateDynNum |
K0 | Key Encryption / Wrapping Key (KEK / ZMK) | EncryptKey, ExportKey |
K1 | TR-31 Key Block Protection Key (KBPK) | ImportKeyBlock, ExportKeyBlock |
K2 | TR-34 Asymmetric Key (for transport) | TR34ImportKey |
M0 | ISO 16609 MAC Key (3DES) | GenerateMAC, VerifyMAC |
M6 | CMAC Key (AES, ISO 9797-1 Alg 5) | GenerateCMAC |
M7 | HMAC Key | GenerateHMAC |
P0 | PIN Encryption Key (PEK / ZPK) | EncryptPIN, TranslatePIN |
S0 | Asymmetric Signing Key-Pair | Sign, Verify |
V0 | PIN Verification Key (PVK) | VerifyPIN (IBM 3624) |
V1 | PVV Key (Visa PIN Verification Value) | GeneratePVV, VerifyPVV |
Algorithm Codes
| Code | Algorithm |
|---|---|
A | AES — 128, 192, or 256-bit |
D | DEA — Single DES (56-bit, legacy) |
E | Elliptic Curve (EC) |
H | HMAC (key material) |
R | RSA |
T | Triple DEA — 2TDEA or 3TDEA (3DES) |
Mode of Use Codes
| Code | Allowed Operations |
|---|---|
B | Both — Encrypt and Decrypt |
C | MAC Calculate only |
D | Decrypt only |
E | Encrypt only |
G | MAC Generate only |
N | No special restriction |
S | Signature only |
T | Both — Sign and Decrypt |
V | Verify only |
X | Key Derivation only |
Y | Create Key Variants only |
Exportability Codes
| Code | Meaning |
|---|---|
E | Exportable. May be wrapped under another KEK and exported. Typically used for KEKs and ZMKs that need to travel between entities. |
N | Non-exportable. Must never leave the HSM boundary, even wrapped. Enforced by the HSM firmware. Typical for PIN keys, CVKs, and IMKs. |
S | Sensitive. May only be exported under a specifically authorised trusted key. Intermediate between E and N. |
Version / Binding Methods
| Version | Binding | Key Size |
|---|---|---|
A | DES, variant binding | 56-bit DEA (deprecated) |
B | 2TDEA, variant binding | 112-bit 2TDEA |
C | 3TDEA, variant binding | 168-bit 3TDEA (deprecated) |
D | AES, CMAC binding | 128/192/256-bit AES |
TR-34 Cryptographic Requirements
| Component | Algorithm | Notes |
|---|---|---|
| Asymmetric key size | RSA-2048 minimum | RSA-3072 or RSA-4096 recommended for new deployments. EC not defined in TR-34. |
| Asymmetric encryption | RSA-OAEP with SHA-256 | Encrypts the Content Encryption Key (CEK) for the KRD. |
| Symmetric encryption (CMS) | AES-128-CBC or AES-256-CBC | The CEK encrypts the key payload inside the EnvelopedData. |
| Signature algorithm | RSA with SHA-256 (PKCS#1 v1.5 or RSA-PSS) | Signs the entire EnvelopedData structure. |
| Certificate format | X.509v3 | Must include KeyUsage and ExtendedKeyUsage extensions appropriate for key transport. |
| Message format | CMS (RFC 5652 / ANS X9.73) | DER-encoded ASN.1 binary, typically Base64 for transport. |
| Replay protection (2-pass) | 8-byte random nonce (RKRD) | Generated by KRD; included in encrypted payload. |
| Replay protection (1-pass) | UTC timestamp + sequence number | Replay window ±5 minutes; sequence must be monotonically increasing. |
Related articles
Keys & HSMPost-Quantum PaymentsWhat quantum breaks in EMV ODA, TR-34 and TLS; ML-KEM / ML-DSA migration planRead article Card RailsPayment TokenizationFPAN→DPAN lifecycle, VTS vs MDES, TAVV cryptogramsRead article Card RailsISO 8583 ProtocolMessage structure, bitmap mechanics, 128 data elements, network variationsRead article ContactlessEMV Contactless Kernels 2–8Kernel hierarchy, the runtime tap sequence, and convergence to Kernel 8Read article