Skip to main content
Optimization Protection

Key Management API

The Key Management API enables industry-standard key management and PIN encryption for card-present/in-person payment processing.

Availability

The following table shows the supported regions, cryptography algorithms, and formats:

Supported regions, cryptography algorithms, and formats
Regions Cryptography Formats
  • EU
  • UK
  • Advanced Encryption Standard (AES)
  • TR-31 key block
  • ISO-4 PIN block (preferred)
  • ISO-0 PIN block (supported as fallback)

Zone Master Key (ZMK) exchange

The Zone Master Key (ZMK) exchange is a one-time implementation activity performed outside of the API. After the ZMK has been established, it can be used to securely exchange operational keys, such as Zone PIN Keys (ZPKs).

How ZMK works

  1. Key custodians generate the AES ZMK using split knowledge procedures.
  2. ZMK components are securely transmitted to you through an agreed offline channel (manual/secure courier process).
  3. You load the received components and reconstructs the ZMK.
  4. You generate a Key Check Value (KCV) and compare it with the received KCV to confirm both parties have the same key.
  5. You convert the ZMK into the format required by the application.
  6. The ZMK is then used to securely exchange operational keys.

ZMK rotation policies

Key rotation policies and best practices are confirmed during implementation.

ZMK rotation policies
Trigger Rotation policy
Time-based Typically annual.
Transaction Count As per the agreement during implementation.
Compromise Event Immediate key exchange and replacement required.

Generate a Zone PIN Key
Retrieve Zone PIN Keys

Is this page helpful?