TR-34 Key Distribution
Interoperable Method for Distribution of Symmetric Keys using Asymmetric Techniques — interactive protocol diagrams, message structure, and use cases for RSA-based key transport between HSMs.
Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →
What is TR-34?
TR-34 (ANS X9.143) defines how symmetric cryptographic keys are securely distributed between a Key Distribution Host (KDH) and a Key Receiving Device (KRD) using RSA asymmetric cryptography.
Instead of requiring physical key ceremonies or manual key component entry, TR-34 enables fully automated, auditable key transport over networks. The KRD proves its identity with an X.509 certificate; the KDH encrypts the symmetric key with the KRD's RSA public key so only the legitimate KRD can decrypt it.
The result is a signed, encrypted token (CTKDH) that provides both confidentiality (RSA-OAEP encryption) and authenticity (RSA signature + certificates).
Key Roles
KDH — Key Distribution Host
The entity that generates, manages, and distributes symmetric keys. Typically a bank's HSM cluster or a processor's key management server. The KDH owns the source of truth for all working keys.
KRD — Key Receiving Device
The device or HSM that receives and loads the distributed keys. Examples: ATM EPP, POS terminal HSM, card bureau HSM, payment gateway HSM. Each KRD has its own RSA key-pair and X.509 certificate.
Cryptographic primitives
KRD Lifecycle States
Factory / Unbound
Device leaves factory. RSA key-pair generated. CA-signed certificate installed. No symmetric working keys loaded.
Bound
Device completed bind phase. Working keys received from KDH and loaded. Device can process transactions.
Unbound
Device had its working keys deleted (e.g. tamper or scheduled rotation). Must re-run bind to receive new keys.