TR-31 Key Block
Interoperable Secure Key Exchange — parse TR-31 key blocks, explore the header structure, and understand real-world use cases for secure key distribution between HSMs.
Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →
What is TR-31?
TR-31 (ANS X9.143) defines a standard format for wrapping cryptographic keys when exchanging them between secure modules (HSMs, PEDs, ATMs). The standard ensures that a key's intended usage, algorithm, and exportability are cryptographically bound to the key value — preventing mis-use or substitution attacks.
A TR-31 key block is an opaque ASCII string that contains a 16-character header, optional extension blocks, the encrypted key value, and an authentication MAC — all protected by a Key Block Protection Key (KBPK).
Why TR-31 matters
- Attribute binding — usage and algorithm are authenticated, not just encrypted
- Prevents key substitution — a PIN key cannot be re-used as a MAC key
- Interoperability — Thales, Futurex, Utimaco, nCipher all support the same block format
- PCI HSM compliance — TR-31 is the PCI-mandated format for key exchange between HSMs
- Required for DUKPT, ZPK, and EMV key distribution in modern payment deployments
Key Block Structure
A TR-31 block is an ASCII string. Each coloured segment maps to a header field.
Version Identifiers
Version A
DES, variant key binding
DeprecatedVersion B
2TDEA (double-length), variant key binding
Version C
3TDEA, variant key binding
DeprecatedVersion D
AES-128/192/256, CMAC key binding