DUKPT Key Derivation
Derive IPEK and session keys from a Base Derivation Key (BDK) and Key Serial Number (KSN) per ANSI X9.24-1 (Triple-DES DUKPT).
Follows ANSI X9.24-1:2009 Annex A (TDES DUKPT)IPEK, future keys, PIN / MAC request / MAC response variants, data request / response keys with the extra TDES step·verified Oct 2026· double-checked Oct 2026— reproduces the published IPEK, the encrypted PIN blocks for counters 1–5 and the A.4.2 data and MAC values; 610 random cases match moov-io/dukpt
Try it as a puzzle: deliver an encrypted PIN to the issuer →
Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →
How DUKPT derives a unique key per transaction
Derived Unique Key Per Transaction: every transaction uses a fresh key derived from a device-specific initial key, so compromising one transaction never exposes past or future ones (forward & backward security).
1BDK
Base Derivation Key
The Base Derivation Key is held only in the acquirer’s (or key-injection facility’s) HSM. It never leaves it and is shared across a whole fleet of devices — individual devices never see the BDK.