Payment keys managed securely, from ceremony to cloud
We help issuers, acquirers, processors and terminal makers design key hierarchies, integrate Hardware Security Modules (HSMs) and run key processes that stand up to audit and scale from data center to cloud.
What our clients are up against
Keys spread across systems
Over time, keys accumulate across HSMs, hosts, terminals and partners, and keeping a clear inventory of each one becomes harder.
Manual ceremonies and key exchange
Key ceremonies and partner key exchanges often rely on paper components and in-person custodians, which slows new partner onboarding.
Algorithms and requirements on the move
Moving from Triple DES (TDES) to Advanced Encryption Standard (AES), adopting key blocks and using cloud HSMs all call for planned migration.
How we cover Key Management & HSM
HSM architecture and crypto-agility
Design HSM platforms that scale and adapt as algorithms change.
- HSM integration for issuing, acquiring and switching platforms
- On-premises, hosted and cloud HSM architecture
- HSM capacity, high availability and vendor evaluation
- Crypto-agility: key and algorithm inventory, TDES to AES migration
- Readiness planning for post-quantum cryptography
Key hierarchies and lifecycle
Define every key, its owner and its life from generation to destruction.
- Key hierarchy design from the Local Master Key (LMK) down
- Zone Master Key (ZMK) and Zone PIN Key (ZPK) exchange with partners
- Key generation, distribution, rotation and destruction
- Key ceremonies with dual control and split knowledge
- TR-31 key blocks that bind each key to its permitted use
- TR-34 certificate-based key distribution to devices
Terminal and device keys
Load and refresh keys across device estates without site visits.
- Remote key loading (RKL) for POS and unattended terminals
- Terminal Master Key (TMK) and terminal PIN key management
- Derived Unique Key Per Transaction (DUKPT), TDES and AES
- Key injection facility processes and controls
- Secure element and over-the-air (OTA) key management for mobile wallets
Issuer keys and PIN management
Protect the keys behind every card, PIN and cryptogram.
- Card Verification Key (CVK) and PIN Verification Key (PVK) management
- Card Verification Value (CVV) generation and EMV issuer master keys
- PIN generation, change, unblock and secure PIN delivery
- Issuer script control for PIN change and card blocking
- EMV cryptogram validation in the HSM
- PCI PIN Security requirements alignment
Ways to work with us
Architecture review
An independent review of your HSM estate, key hierarchy and key processes with a prioritized roadmap.
Migration planning
A phased plan for cloud HSM adoption, TDES to AES migration or key block conversion.
Certification readiness
Ceremony scripts, key inventories and evidence that prepare you for PCI PIN and PCI DSS assessments.
Build your team's capability
Our key management modules can be delivered as a standalone program or tailored to your HSM platform.
Request informationModules (some proposed)
- HSM Integration, Key Management and Issuer Script Control
- Secure Element and OTA Key Management
- Payment Key Hierarchies and Key CeremoniesProposed
- DUKPT, Remote Key Loading and TR-34Proposed
- TR-31 Key Blocks and PCI PIN ReadinessProposed
- Cloud HSM and Crypto-Agility PlanningProposed
Services, case studies and tools
Can we move our payment HSMs to the cloud?
Often, yes. Major cloud providers now offer payment HSM and payment cryptography services, alongside hosted options from HSM vendors. We assess which workloads suit the cloud, check PCI requirements, latency and resilience, and plan a phased migration of keys and applications, usually starting with lower-risk functions before the authorization path.
What are TR-31 and TR-34, and do we need them?
TR-31 defines key blocks: a format that binds each key to its intended use, so it can't be misused once exchanged. TR-34 uses public key cryptography to send keys to devices remotely, reducing manual key injection. PCI PIN Security requirements expect key blocks for key exchange, so most issuers, acquirers and processors need a TR-31 plan.
Do you run our key ceremonies?
We help you design ceremony procedures, scripts, roles and evidence, and we rehearse them with your team. Key custodians remain your own staff, so control of your keys stays inside your organization, as dual control and split knowledge require. The result is a repeatable ceremony your auditors can follow step by step.
What is DUKPT and when is it used?
DUKPT gives every terminal transaction its own encryption key, derived from a base key held only in the host HSM, so one compromised key exposes nothing else. It is widely used to protect PINs and card data in POS terminals. We help you plan the move from TDES to AES DUKPT and manage base keys across your estate.
Let's put your payment keys in order
Talk to a senior consultant about your HSM and key management roadmap.