Ingenico 6500 manual Security Options, Session Keys, Dukpt Keys, Wtpk, Wmack

Key (MCK)
Master Atalla Key	This key is used to XOR a value for PIN entry, MAC, or
	encrypt/decrypt to form master variant keys to decrypt for PIN
	entry, MAC, and COM session keys.

9.4.3Session Keys

These keys are loaded encrypted under the corresponding master keys. This means that the type and index of the working (session) key have to match the type and index of the corresponding master key that was used to encrypt it. For application based financial keys, the SSA will have a key structure matrix indexed by application ID.

The device can accommodate up to ten working (session) keys per application, or up to 64 working (session) keys per terminal. Available indexes for the working (session) keys are 0

–9 per application or 0 – 64 per terminal. These keys can be both single-length DES keys and double-length triple DES keys. Similar to the master keys, the device supports four types of working (session) keys.

Key Name	Description of Key
Working (session)	This key is loaded encrypted under the corresponding Master
Terminal PIN Key	Terminal PIN Key. It is used to encrypt the customer PIN for
(WTPK)	transmission to the host.
Working (session)	This key is loaded encrypted under the corresponding Master
Message	Message Authentication Code Key. It is used to authenticate the
Authentication	customer transaction.
Code Key
(WMACK)
Working (session)	This key is loaded encrypted under the corresponding Master
Communication	Communication Key. It is used to encrypt customer transaction
Key (WCK)	data between the debit terminal and the host.
Working (session)	This key is decrypted by the Master Atalla Variant Key, which is
Atalla Key	created from the Master Atalla Key according to the type of
	operation to be performed.

9.4.4DUKPT Keys

The Initial PIN Pad Keys (IPPKs) are loaded encrypted under the KTK. The device can accommodate up to ten separate DUKPT engines. Each engine is initialized with an IPPK. Available indexes for the DUKPT engines are 0 – 9. The IPPKs can be both single-length DES keys and double-length triple DES keys.

9.5Security Options

This section provides a synopsis of each security option. All the security options can be loaded during key injection. The user application can request the security options setting from an SSA API.

Ingenico 6500 User’s Guide 95