Annex A Cryptographic Key Life Cycles Examples – – Key Key Algorithm Length Purpose of Use Generation Distribution Storage HSMs Loading Destruction Update Name * (HEX) ZMK 112 Encrypts keys during The Inside HSM Affina PSG 3 Key Custodians Not planned Bank brings ZMK transmission between party entity components on 1 KM two entities. ZMK key Bank or site. Head of CPC types include: vendor Vendor ZMK sent ZMK Bank encrypts in three paper For ZMK Bank keys (PEK, MDK, based components dCVV) between the 3 bank personnel also present issuer and vendor. ZMK vendor encrypts keys (KMC) used to lock the chip between pre-personaliser and personaliser PEK 2TDES 112 Encrypts PIN Block Issuer Encrypted under Inside HSM Affina PSG 1 Key Custodian Not planned Not planned ZMK Bank between Issuer and 1 KM vendor Head of CPC MDK 2TDES 112 Issuer Master Issuer Encrypted ZMK Inside HSM Affina PSG 1 Key Custodian Not planned Not planned Bank Application Keys, 1 KM derivatives of which are Head of CPC for Authentication, Secure Messaging Integrity and Secure Messaging Confidentiality. dCVV 2TDES 112 Master Key, derivatives Issuer Encrypted under Inside HSM Affina PSG 1 Key Custodian Not planned Not planned ZMK Bank of which are used in 1 KM contactless application Head of CPC to create a dynamic CVV KMC 2TDES 112 Locks chips between Chip vendor Encrypted under Inside HSM Affina PSG 1 Key Custodian Not planned Not planned ZMK Bank card manufacturer and 1 KM vendor Head of CPC
Annex A – Cryptographic Key Life Cycles – Examples Key Name * Algorithm Key Length (HEX) Purpose of Use Generation Distribution Storage HSMs Loading Destruction Update ZMK 112 Encrypts keys during transmission between two entities. ZMK key types include: ZMK Bank encrypts keys (PEK, MDK, dCVV) between the issuer and vendor. ZMK vendor encrypts keys (KMC) used to lock the chip between pre-personaliser and personaliser The party entity Bank or vendor Bank brings ZMK components on site. Vendor ZMK sent in three paper based components Inside HSM Affina PSG 3 Key Custodians 1 KM Head of CPC For ZMK Bank 3 bank personnel also present Not planned PEK 2TDES 112 Encrypts PIN Block between Issuer and vendor Issuer Encrypted under ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned MDK 2TDES 112 Issuer Master Application Keys, derivatives of which are for Authentication, Secure Messaging Integrity and Secure Messaging Confidentiality. Issuer Encrypted ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned dCVV 2TDES 112 Master Key, derivatives of which are used in contactless application to create a dynamic CVV Issuer Encrypted under ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned KMC 2TDES 112 Locks chips between card manufacturer and vendor Chip vendor Encrypted under ZMK Bank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned
PCI_CP_v1_1_ROC_Reporting_Template_Logical_form_a.docx