All Tools
Tools/TR-34 Key Distribution
🔑
CryptographyAvailable

TR-34 Key Distribution

Interoperable Method for Distribution of Symmetric Keys using Asymmetric Techniques — interactive protocol diagrams, message structure, and use cases for RSA-based key transport between HSMs.

Use test data only. All calculations run locally in your browser — PayProbe never sees, transmits, or stores your PAN, CVV, keys, PINs, or cryptographic inputs. How we handle data →

What is TR-34?

TR-34 (ANS X9.143) defines how symmetric cryptographic keys are securely distributed between a Key Distribution Host (KDH) and a Key Receiving Device (KRD) using RSA asymmetric cryptography.

Instead of requiring physical key ceremonies or manual key component entry, TR-34 enables fully automated, auditable key transport over networks. The KRD proves its identity with an X.509 certificate; the KDH encrypts the symmetric key with the KRD's RSA public key so only the legitimate KRD can decrypt it.

The result is a signed, encrypted token (CTKDH) that provides both confidentiality (RSA-OAEP encryption) and authenticity (RSA signature + certificates).

Key Roles

🏦

KDH — Key Distribution Host

The entity that generates, manages, and distributes symmetric keys. Typically a bank's HSM cluster or a processor's key management server. The KDH owns the source of truth for all working keys.

🏧

KRD — Key Receiving Device

The device or HSM that receives and loads the distributed keys. Examples: ATM EPP, POS terminal HSM, card bureau HSM, payment gateway HSM. Each KRD has its own RSA key-pair and X.509 certificate.

Cryptographic primitives

Asymmetric enc.RSA-OAEP with SHA-256
SignatureRSA-PSS or PKCS#1 v1.5 with SHA-256
Message formatCMS (ANS X9.73 / RFC 5652)
CredentialsX.509v3 certificates, CA-signed
Transported keys3DES (2-key / 3-key) or AES-128/256
Key metadataTR-31 Key Block Header (KBH)

KRD Lifecycle States

🏭

Factory / Unbound

Device leaves factory. RSA key-pair generated. CA-signed certificate installed. No symmetric working keys loaded.

🔒

Bound

Device completed bind phase. Working keys received from KDH and loaded. Device can process transactions.

🔓

Unbound

Device had its working keys deleted (e.g. tamper or scheduled rotation). Must re-run bind to receive new keys.

Factory / UnboundBoundKDH Bind Phase (send keys)2-pass
BoundUnboundUnbind (key deletion / tamper)
UnboundBoundRebind (send replacement keys)2-pass or 1-pass