Reference

Payment Certification Levels

A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.

EMV Chip Key Management & Exchange

The complete lifecycle of cryptographic keys — from the Certificate Authority root of trust through issuer HSM master keys, per-card unique derived keys, and per-transaction session keys generated at the point of sale.

CA / Root of Trust

RSA Asymmetric

IMK — Issuer Master Key (HSM)

UDK — Unique Derived Key (per card)

SK — Session Key (per transaction)

PIN / Transport Key

Key Hierarchy — 4 Levels

Every EMV symmetric key is derived top-down. The RSA chain runs in parallel for offline card authentication. No key at a lower level can compromise a higher level key.

Certificate AuthorityScheme-operated root of trust (Visa RID A000000003, MC RID A000000004…)

RSA Private

CA Private Key

1152 – 2048 bit

Signs Issuer Public Key Certificates. Kept in air-gapped HSM at CA facility. Never distributed.

RSA Public

CA Public Key

1152 – 2048 bit · Exponent + Modulus

Distributed to all terminals via scheme key update. Identified by RID + CA Key Index. Used to verify Issuer PK Certificate.

↓ CA signs Issuer Public Key → creates Issuer Public Key Certificate

Issuer

Card Issuing Bank — HSMAll symmetric master keys never leave the HSM. RSA keys managed by issuer security team.

RSA Private

Issuer Private Key

1152 – 2048 bit

Signs ICC Public Key Certificates during card personalization. HSM-only.

RSA Public · Certificate

Issuer Public Key Cert

Signed by CA · Stored on card (tag 90)

Terminal reads from card and verifies using CA Public Key to recover Issuer Public Key.

Symmetric — IMK

IMK-AC

3DES 112-bit or AES-128

Application Cryptogram master. Source for all UDK-AC keys. Never leaves issuer HSM.

HSM only

Symmetric — IMK

IMK-SMI

3DES 112-bit or AES-128

Secure Messaging Integrity master. Source for all script MAC keys (SK-SMI).

HSM only

Symmetric — IMK

IMK-SMC

3DES 112-bit or AES-128

Secure Messaging Confidentiality master. Source for all script encryption keys (SK-SMC).

HSM only

↓ Per-card derivation (card personalization): 3DES(IMK, PAN ‖ PAN_SEQ_NUM)

Card

EMV Chip — Secure ElementLoaded during personalization. Keys are write-once and physically protected. ICC Private Key generated on-chip and never exported.

RSA Private — On-chip

ICC Private Key

1152 – 2048 bit

Generated inside the chip. Used to create dynamic signatures for DDA / CDA. Never leaves the chip.

RSA Public · Certificate

ICC Public Key Cert

Signed by Issuer · tag 9F46

Terminal reads from card, verifies with Issuer PK to recover ICC Public Key. Used to verify card dynamic signature.

Symmetric — UDK

UDK-AC

3DES 112-bit or AES-128

Unique to this card. Source for all per-transaction session keys used in ARQC / ARPC generation.

Symmetric — UDK

UDK-SMI

3DES 112-bit or AES-128

Unique to this card. Source for session keys used to verify script MAC integrity (tags 71 / 72).

Symmetric — UDK

UDK-SMC

3DES 112-bit or AES-128

Unique to this card. Source for session keys used to decrypt sensitive issuer script content (e.g. new PIN).

↓ Per-transaction derivation (at POS): 3DES(UDK, ATC ‖ 00F0 ‖ ATC...)

Session Keys — Per TransactionDerived independently by both card (at POS) and issuer (online). Never transmitted — both sides compute the same key from the same inputs.

Session — Cryptogram

SK-AC

3DES 112-bit or AES-128

Derived from UDK-AC + ATC. Card uses it to generate ARQC. Issuer re-derives to validate ARQC and generate ARPC. Discarded after transaction.

Session — Script Integrity

SK-SMI

3DES 112-bit or AES-128

Derived from UDK-SMI + ATC. Issuer uses it to compute script MAC. Card verifies MAC before applying script commands.

Session — Script Cipher

SK-SMC

3DES 112-bit or AES-128

Derived from UDK-SMC + ATC. Issuer encrypts sensitive data (new PIN block) — card decrypts and applies. Used only when script confidentiality required.

End-to-End Key Lifecycle — 8 Phases

CA & Scheme Setup (one-time per scheme cycle)

CA Scheme (Visa / MC / Amex) selects CA Key Index (e.g. RID + index 0x92 for Visa)

RSA CA generates 2048-bit RSA key pair in its offline signing HSM

RSA CA Public Key (exponent + modulus + expiry) is bundled into terminal firmware updates and acquirer terminal management system (TMS) downloads

RSA CA Private Key remains permanently in air-gapped HSM — never exported

Issuer Registration & HSM Key Loading (issuer onboarding)

RSA Issuer generates RSA key pair (1152–2048 bit) in its HSM

RSA Issuer sends Issuer Public Key to scheme via secure channel — CA signs it → Issuer Public Key Certificate

IMK Issuer loads symmetric master keys into production HSM under key ceremony (split knowledge, dual control): IMK-AC, IMK-SMI, IMK-SMC

IMK IMKs are stored in HSM key store — never appear in plaintext outside HSM. Key check value (KCV) verified by custodians.

Card Personalization (card bureau, per card)

UDK Issuer HSM derives UDK-AC = 3DES(IMK-AC, PAN[12 digits] ‖ PAN_SEQ_NUM ‖ fill)

UDK Issuer HSM derives UDK-SMI and UDK-SMC using same derivation with respective IMKs

RSA ICC RSA key pair generated inside the chip (on-chip key generation, never exported) or by HSM for pre-seeded cards

RSA Issuer signs ICC Public Key → ICC Public Key Certificate (tag 9F46). Includes ICC PK exponent (tag 9F47) and remainder (9F48 if present).

UDK Secure personalization transport writes to chip: UDK-AC, UDK-SMI, UDK-SMC, ICC Private Key, ICC PK Cert, Issuer PK Cert — all in single encrypted session

Terminal Deployment (acquirer, per terminal)

RSA Terminal Management System (TMS) downloads CA Public Key entries — up to 6 CA keys per RID, each with index, exponent, modulus, expiry, and hash

RSA CA Public Keys stored in terminal NVRAM. Verified against embedded checksum before use.

PIN Terminal PIN Encryption Key (PEK / TEK) loaded via DUKPT or zone key injection for Online PIN path

Transaction — Offline Data Authentication (at POS)

RSA Terminal reads Issuer PK Certificate (tag 90) from card → verifies hash using CA Public Key (identified by RID + CA Key Index tag 8F) → recovers Issuer Public Key

RSA Terminal reads ICC PK Certificate (tag 9F46) → verifies hash using recovered Issuer Public Key → recovers ICC Public Key

RSADDA / CDA: Terminal sends Unpredictable Number (9F37) → Card signs it with ICC Private Key → Terminal verifies signature with ICC Public Key — proves card is genuine (not cloned)

RSASDA only: Terminal verifies static Signed Static Application Data (93) using Issuer PK — no card interaction needed (weaker, vulnerable to pre-play)

Transaction — Session Key Derivation & ARQC (at POS, inside chip)

SK Card derives SK-AC from UDK-AC + ATC (9F36): SK-AC_left = 3DES(UDK-AC, ATC ‖ 0x00F0) · SK-AC_right = 3DES(UDK-AC, ATC ‖ 0x00F1)

SK Card computes ARQC (9F26) = MAC-3DES(SK-AC, CDOL1 data: amount, currency, date, TVR, UN…)

PINOnline PIN: Cardholder PIN encrypted by PIN pad with PEK/TEK (DUKPT or zone key) → forwarded in ISO 8583 DE52. Issuer decrypts under zone key.

RSAOffline Encrypted PIN: PIN block encrypted with ICC Public Key by PIN pad → Card decrypts with ICC Private Key, compares to stored reference.

Issuer Validation — ARQC Verify & ARPC Generate (issuer host, online)

IMK Issuer HSM reads PAN + PAN_SEQ from DE55/DE2 → re-derives UDK-AC = 3DES(IMK-AC, PAN ‖ PAN_SEQ) — same computation as personalization time

SK Issuer derives SK-AC from UDK-AC + ATC (from DE55) — identical result to what the card computed at POS

SK Issuer computes expected ARQC using SK-AC over CDOL1 data in DE55 → compares to received ARQC (9F26) → cryptographic proof the card is genuine

SK Issuer generates ARPC: Method 1 = ARQC XOR RC ‖ 0000…; Method 2 = MAC-3DES(SK-AC, transaction + response data). ARPC returned in ISO 8583 DE55.

Script Processing — Secure Messaging (second GENERATE AC, contact only)

SK-SMI Issuer derives SK-SMI from UDK-SMI + ATC → computes MAC over script command (PUT DATA, EXTERNAL AUTH…). Card verifies MAC using its own SK-SMI before applying.

SK-SMC For sensitive scripts (e.g. PIN change): Issuer derives SK-SMC from UDK-SMC + ATC → encrypts new PIN block. Card decrypts and stores new PIN reference.

SK Card executes scripts: unblock PIN counter, update limits, reset ATC, update IAD. Card confirms execution in second GENERATE AC response (TC or AAC).

IMK Issuer IMKs are NOT used directly in any transaction — they only appear during offline UDK derivation (personalization and real-time re-derivation in HSM). This limits exposure to single-card scope.

Key Types Reference

Key

Type

Algorithm

Location

Scope

Purpose

CA Private Key

RSA

RSA 2048-bit

CA HSM (air-gapped)

1 per scheme cycle

Signs Issuer PK Certificates

CA Public Key

RSA

RSA 2048-bit

All terminals (NVRAM)

All issuers in scheme

Verify Issuer PK Certificate

Issuer Private Key

RSA

RSA 1152–2048 bit

Issuer HSM

1 per issuer key pair

Signs ICC PK Certificates

Issuer PK Cert (tag 90)

RSA

RSA public + CA signature

Card chip (tag 90)

All cards from issuer

Terminal recovers Issuer PK via CA PK

ICC Private Key

RSA

RSA 1152–2048 bit

Chip only (never exported)

1 per card

Signs dynamic auth data for DDA / CDA

ICC PK Cert (tag 9F46)

RSA

RSA public + Issuer signature

Card chip (tag 9F46)

1 per card

Terminal recovers ICC PK via Issuer PK

IMK-AC

IMK

3DES 112-bit / AES-128

Issuer HSM only

All cards from issuer

Derives UDK-AC per card

IMK-SMI

IMK

3DES 112-bit / AES-128

Issuer HSM only

All cards from issuer

Derives UDK-SMI (script integrity)

IMK-SMC

IMK

3DES 112-bit / AES-128

Issuer HSM only

All cards from issuer

Derives UDK-SMC (script cipher)

UDK-AC (tag: N/A)

UDK

3DES 112-bit / AES-128

Card chip + Issuer HSM

1 per card

Source for per-transaction SK-AC

UDK-SMI

UDK

3DES 112-bit / AES-128

Card chip + Issuer HSM

1 per card

Source for per-transaction SK-SMI

UDK-SMC

UDK

3DES 112-bit / AES-128

Card chip + Issuer HSM

1 per card

Source for per-transaction SK-SMC

SK-AC

3DES 112-bit / AES-128

Card RAM + Issuer RAM

1 per transaction

Generate ARQC; validate ARQC; generate ARPC

SK-SMI

3DES 112-bit / AES-128

Card RAM + Issuer RAM

1 per transaction (if script)

MAC for issuer script integrity

SK-SMC

3DES 112-bit / AES-128

Card RAM + Issuer RAM

1 per transaction (if confidential)

Encrypt sensitive script data (new PIN)

PEK / TEK (DUKPT)

3DES (DUKPT X9.24-1)

PIN pad + acquirer HSM

Per terminal session

Encrypt Online PIN in transit to issuer

CVN10 vs CVN18 derivation: The Cryptogram Version Number (from IAD tag 9F10) tells the issuer which derivation method the card used. CVN10 uses the full 3DES derivation above. CVN18 (Visa) adds an additional counter component and derives the session key differently — issuers must implement both to support their card portfolio. Mastercard uses its own equivalent via the Mchip spec (CVN 10/18 mapping is scheme-specific).

Related Tools

Use these tools to work with the cryptographic primitives that underpin terminal and card security.

🗝️ DUKPT Key Derivation 🔢 PIN Block Encoder 🧮 ARQC Calculator 🔓 EMV TLV Decoder 🏷️ MAC Calculator 🔐 DES / 3DES Calculator