All Tools
Tools/TR-34 Protocol Diagram
📊
CryptographyAvailable

TR-34 Protocol Diagram

Interactive TR-34 key distribution diagram. Configure key attributes and actor names — the sequence diagram and KTKDH token formula update live with your values.

Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →

KRD
KDH
🏧KRDATM EPP
🏦KDHBank HSM
Phase 1Bind Phase — Credential ExchangeMust complete before key transport
A1

Send CTKRD

CTKRD = { CertKRD }
── CTKRD ──────────────────────────────────────────────▶
B1

Validate CertKRD — store

Verify: chain(CertKRD) → CA root
keyUsage = keyEncipherment
B2

Send CTKDH

CTKDH = { CertKDH ‖ CRLCA_KDH }
◀── CTKDH (CertKDH + CRL) ────────────────────────────
A2

Validate CTKDH — store credentials

store( CertKDH, CRLCA_KDH ) in secure boundary
Phase 2Key Transport — 2-Pass (RKRD nonce)
A1

Generate nonce — send RTKRD

RTKRD = { RKRD: 8F9FFB55FDCFE3F7 }
── RTKRD { 8F9FFB55FDCFE3F7 } ──────────────────────────▶
B1

Receive RKRD

store( RKRD = 8F9FFB55FDCFE3F7 )
B2

Generate Kn + build KBH

Kn = random Triple DES (3DES)
KBH = B0096P0TE00N0000
B3

Generate ephemeral key KE

KE = random TDEA-192  // never reused
B4

Encrypt key block → BE

BE = EKE( Version ‖ IDKDH ‖ Kn ‖ B0096P0TE00N0000 )
B5

RSA-encrypt ephemeral key → EncryptedKey

EncryptedKey = RSA-OAEP( PubKRD, KE )
B6

Assemble & sign KTKDH

8F9FFB55FDCFE3F7 ‖ B0096P0TE00N0000 ‖ EncryptedKey ‖ BE ‖ SKDH(...) ‖ CRL
◀── KTKDH ────────────────────────────────────────────
A2

Verify signature + check RKRD

Verify SKDH(RKRD ‖ KBH ‖ EncKey ‖ BE) using CertKDH
Assert: token RKRD == 8F9FFB55FDCFE3F7
A3

Decrypt KE → decrypt BE → verify

KE = DPrivKRD(EncryptedKey)
(Ver, ID, Kn, KBH) = DKE(BE)
Assert: ID == CertKDH fingerprint && KBH == B0096P0TE00N0000
A4

Load Kn — compute KCV

Load Kn as PIN Encryption Key (ZPK), Triple DES (3DES), Encrypt only, Non-exportable
KCV(Kn) = 3DES-ECBKn(0x0000000000000000)[0:3]

KTKDH Token — Field Assembly

Your configured values substituted into the exact X9 TR34-2012 token formula

RKRD
8F9FFB55FDCFE3F7
8-byte KRD nonce — cleartext, part of signed data. KRD asserts it matches the nonce it sent.
KBH
B0096P0TE00N0000
TR-31 Key Block Header — cleartext, signed. Describes key attributes. Also inside BE (must match).
EncryptedKey
RSA-OAEP(PubKRD, KE)
Ephemeral key KE RSA-encrypted with KRD public key. KRD decrypts with PrivKRD to recover KE.
BE
EKE(Ver‖IDKDH‖Kn‖B0096P0TE00N0000)
Encrypted block: Version, KDH Credential ID (prevents signature-stripping), Kn, and inner KBH.
Signature
SKDH(body) sha256WithRSAEncryption OID 1.2.840.113549.1.1.11
RSA signature by KDH over all body fields. Verified by KRD using stored CertKDH.
CRLCA_KDH
CA Certificate Revocation List
Always included so KRD can verify CertKDH is not revoked without an online query.
Formula: KTKDH = RKRD ‖ KBH ‖ EncryptedKey ‖ BE ‖ SKDH(RKRD ‖ KBH ‖ EncKey ‖ BE) ‖ CRLCA_KDH

Related tools

🔑TR-34 Key Distribution🔏TR-31 Key Block