TR-31 & TR-34
The two foundational ANSI X9 standards for secure cryptographic key exchange between Hardware Security Modules. TR-31 defines the key block format that binds usage attributes to the key value. TR-34 defines the RSA-based protocol for distributing those key blocks from a Key Distribution Host to receiving devices without human key ceremonies.
TR-31 Key Block
A TR-31 key block is an ASCII string that carries a symmetric key and its attributes in a single, tamper-evident package. The 16-character header describes the key; the encrypted payload contains the key value; the MAC authenticates them together under the Key Block Protection Key (KBPK).
Block Anatomy
All characters are ASCII printable. Block length includes all segments. MAC is 8 bytes (DES) or 16 bytes (AES), encoded as hex = 16 or 32 characters.
Example Key Block
B 0096 P0 T E 00 E 00 00 | <64c encrypted key> | <16c MAC>BVersion B — 2TDEA with variant key binding0096Total block length: 96 charactersP0Key usage: PIN Encryption Key (PEK / ZPK)TAlgorithm: Triple DES (2TDEA / 3TDEA)EMode of use: Encrypt only00Key version number: not usedEExportability: Exportable (under another KEK)00Number of optional blocks: none00Reserved: must be "00"Version Identifiers
| Version | Binding Method | Key Algorithm | Status |
|---|---|---|---|
A | Variant key binding | Single DES (DEA) | Deprecated |
B | Variant key binding | Double-length 3DES (2TDEA) | Current |
C | Variant key binding | Triple-length 3DES (3TDEA) | Deprecated |
D | CMAC key binding | AES-128 / AES-192 / AES-256 | Recommended |
What "Binding" Means
❌ Legacy KEK wrapping (not TR-31)
The plaintext key is encrypted with a Key Encryption Key. The ciphertext carries no header — key usage is implied by context. An attacker (or software bug) can reuse the same ciphertext as a different key type. PCI HSM prohibits this.
EncryptKEK( KEY ) → CIPHERTEXTNo attribute protection — usage determined out-of-band
✓ TR-31 binding
The header (usage, algorithm, mode, exportability) is part of the authenticated data. Changing any header byte invalidates the MAC. The wrapped key cannot be presented as a different type.
EncryptKBPK( KEY ) ‖ MACKBPK( HEADER ‖ KEY )Header is authenticated — tampering detected
Key Block Protection Key (KBPK)
The KBPK is the key used to encrypt and authenticate TR-31 blocks. It is itself never transmitted in a TR-31 block — it is the shared secret between two HSMs that enables them to exchange all other keys securely. Two HSMs share one KBPK; that KBPK is loaded by a traditional two-custodian key ceremony (or via TR-34) and is then stored permanently in each HSM's secure boundary. All subsequent key exchanges between those two HSMs use TR-31 blocks protected by that KBPK.
KBPK for DES blocks (version B): must be a double-length 3DES key (128-bit / 16 bytes). KBPK for AES blocks (version D): must be AES-128, AES-192, or AES-256 — at least as strong as the key being wrapped.
Optional Blocks
Optional blocks extend the fixed 16-character header with additional metadata. Each optional block starts with a 2-character ID, a 2-character hex length, then the data. The count of optional blocks is declared in the header at position 12–13.
| ID | Name | Typical Content |
|---|---|---|
KC | Key Check Value | 3-byte KCV of the wrapped key (encrypted zeros, first 3 bytes) |
KP | KCV of KBPK | Check value of the KBPK that protects this block |
IK | Initial Key ID | DUKPT KSN — used when exporting IPEK blocks |
KS | Key Set ID | HSM-assigned identifier for the key set |
LB | Label | Free-text label for key management UI display |
TS | Timestamp | ISO 8601 timestamp of key creation |
CT | Certificate | PEM-encoded certificate associated with an asymmetric key |
PB | Padding Block | Explicit padding to align block to boundary |