What does PCI PIN-compliant key management look like? It is a process covering the full key lifecycle – generation, distribution, loading, usage, administration and destruction – conducted exclusively inside secure cryptographic devices (SCDs), under dual control and split knowledge, in line with the 7 Control Objectives of PCI PIN Security Requirements v3.1.
Canonical definition: Key management under PCI PIN Security is the set of controls covering the generation, distribution, loading, usage, administration and destruction of cryptographic keys protecting cardholder PINs, performed inside SCDs under dual control and split knowledge.
This article distils the standard’s requirements into two lists: five rules that must work in every key management programme, and five mistakes that most often derail assessments.
PCI PIN key management – key takeaways:
- A clear-text key never exists outside an SCD – beyond the device it may exist only as a key block encrypted under a key of at least equal strength, or as components split between separate custodians.
- The standard’s two foundational techniques are dual control (no key operation can be performed single-handedly) and split knowledge (no individual knows the full key value).
- Key exchange requires key block formats binding usage attributes to the key – all three phases of requirement 18-3 are in force, the last since 1 Jan 2025 (PCI SSC and Visa bulletins).
- Every key has exactly one purpose, and POI keys must be unique per device – hence the widespread use of DUKPT under ANSI X9.24-3.
- Annex C of the standard (rewritten in v3.1 for alignment with NIST nomenclature) defines minimum key sizes and strengths for approved algorithms.
- Patronusec, an accredited QSA, audits and designs key management processes – from key ceremonies and custodian documentation to QPA assessment readiness.
Table of Contents
What does the key lifecycle look like across the 7 Control Objectives?
The key lifecycle in PCI PIN Security runs through six stages – generation, distribution, loading, usage, administration and destruction – and the standard’s seven Control Objectives map onto those stages almost one to one. A QPA assessment verifies each stage separately, through documents, observation and testing.
| Lifecycle stage | Control Objective | Key controls |
|---|---|---|
| Processing environment | 1 | PTS POI devices and HSMs (FIPS 140-2/140-3 Level 3 or PCI HSM), approved algorithms |
| Generation | 2 | Randomness guaranteed by the SCD; no key predictable |
| Distribution / conveyance | 3 | Key components via separate channels, transport keys, key blocks (TR-31, TR-34) |
| Loading | 4 | Key loading devices, dual control, encrypted loading where required |
| Usage | 5 | Single purpose per key, key zone separation, no key sharing between organisations |
| Administration | 6 | Custodians, inventory, replacement after compromise, documented destruction |
| Equipment | 7 | HSM and POI lifecycle: from receipt, through operation, to decommissioning with key zeroisation |
Two techniques bind all the stages together. Dual control means no single person can carry out a key operation end to end. Split knowledge means the full key value is known to nobody – custodians know only their own components, and the key materialises only inside an SCD.
In the PCI PIN Security model, a cryptographic key is neither a file nor a password – it is an object that is created, operates and dies exclusively inside certified hardware, while people handle at most its encrypted forms and components.
Top 5 rules – what must work in every key management programme?
The five rules below carry most of the evidentiary weight of a QPA assessment. An organisation that has them implemented and documented can demonstrate compliance with the substance of Control Objectives 2-7; a gap in any of them almost always means non-compliance.
Keys live only in SCDs. Generation happens in an HSM or KLD with guaranteed randomness, and the clear-text form never leaves the device. Outside the SCD a key exists only as a key block encrypted under a key of at least equal strength, or as components split between custodians.
Dual control and split knowledge on every operation. Key ceremonies (generation, loading, replacement) require at least two authorised custodians acting simultaneously, with a documented run. Components are stored in separate safes with separate access registers.
Key blocks in every exchange. Requirement 18-3 has been fully in force since 1 Jan 2025 (Phase 3): a key’s usage attributes must be cryptographically bound to the key so that altering them renders the key unusable. In practice this means ANSI TR-31 (symmetric exchange) and TR-34 (distribution using asymmetric techniques).
One key, one purpose, one location. A PIN encryption key may not double as a MAC key or a data encryption key; a key from one zone may not appear in another; POI device keys must be unique per device. The DUKPT scheme (Derived Unique Key Per Transaction, ANSI X9.24-3) goes a step further: a unique key for every transaction.
Administration with full accountability. A current key inventory (identifier, purpose, algorithm, strength, location, activation date), formally appointed custodians with signed responsibility statements, replacement procedures for suspected compromise, and minuted destruction – including zeroisation of keys in decommissioned HSMs and terminals.
The fix: if you cannot support any of these five rules today with a document, a register or a ceremony record, that is the first item on your remediation plan before the assessment.
Patronusec Insight: In our project experience, organisations preparing for a PIN Security assessment underestimate key ceremony documentation more than anything else. A correctly performed ceremony is not enough on its own – the assessor expects a ceremony script prepared beforehand, a custodian attendance list, a protocol signed at the end, and consistency of all three with the key inventory. Good practice is to run ceremonies from a fixed template and to walk the entire process through with an internal auditor before the QPA arrives.
Top 5 mistakes – what should you avoid in key management?
The five mistakes below recur in assessments most often, and each one on its own can block compliance. The common denominator: operational convenience winning over separation of duties.
❌ One key for multiple purposes or across multiple devices. The same key used for PIN encryption and for MAC, or a single shared key loaded into an entire terminal estate, breaks the single-purpose and per-device uniqueness rules – one compromised point compromises the whole population.
❌ Key components in the hands of one person. Two components in one safe, one custodian with access to both compartments, or a colleague “covering” for an absent custodian with their envelope – each of these defeats split knowledge, even if two custodians exist on paper.
❌ Clear-text keys outside SCDs. Key values in scripts, configuration files, e-mails, deployment documentation or ceremony notes. The standard allows no exceptions: a clear-text key outside a cryptographic device is a direct non-compliance.
❌ Legacy key exchange after 1 Jan 2025. Passing keys as variants or in formats without cryptographically bound attributes is, after Phase 3 of requirement 18-3, non-compliant also at the interface with merchant hosts, POS devices and ATMs.
❌ No inventory and no end-of-life procedures. An outdated key register, retired terminals and KLDs sold or scrapped without key zeroisation, no destruction protocols for components – a gap the assessor exposes with one question: “where is the key with this identifier, and who can confirm it?”.
The most common cause of non-compliance in key management assessments is not weak cryptography but the human shortcut: a single person performing an operation designed for two.
Which technologies and formats are required – TR-31, TR-34, DUKPT and Annex C?
The standard does not mandate specific products, but it does mandate specific classes of solutions: certified SCDs, key block formats for key exchange, and algorithms and key lengths compliant with Annex C. Technology choice becomes free only above those thresholds.
- Devices: PIN pads and terminals approved under the PCI PTS POI programme; HSMs meeting FIPS 140-2/140-3 Level 3 or higher, or PCI PTS HSM; key loading devices (KLDs).
- Exchange formats: TR-31 (ANSI X9 TR 31) for symmetric key exchange with cryptographically bound attributes; TR-34 for symmetric key distribution using asymmetric techniques, typically for remote loading of a terminal master key; remote distribution involving CA/RA operations falls under Annex A of the standard.
- Terminal key schemes: DUKPT under ANSI X9.24-3 as the dominant unique-key-per-transaction scheme; per-device master/session keys where DUKPT is not used.
- Algorithms and key strengths: Annex C (rewritten in v3.1 for consistency with NIST nomenclature) sets minimum and equivalent key strengths for approved algorithms; the ecosystem’s migration direction is away from TDEA towards AES, with the ISO PIN block format 4 support dates suspended by PCI SSC’s Mar 2021 bulletin.
The fix: when buying HSMs, terminals or host software, require the vendor’s written commitment to TR-31/TR-34 and AES support – replacing hardware unable to handle key blocks was the single largest cost of Phase 3 across ATM networks.
How do you document compliance ahead of a QPA assessment?
Evidence of compliance is a coherent set: a key management policy, key and device inventories, custodian documentation, ceremony protocols and access registers – all mutually consistent as to identifiers, dates and people. The QPA assessment concludes with a ROC and an AOC using PCI SSC templates.
The minimum documentation set an assessor asks for:
- key management policy and procedures (per key type and per operation),
- a key inventory and an SCD inventory (HSMs, KLDs, POIs) with lifecycle history,
- custodian appointment records with signed responsibility statements and training evidence,
- key ceremony scripts and protocols (generation, loading, replacement, destruction),
- access registers for safes and secure rooms, HSM logs,
- procedures for responding to suspected key compromise, with evidence of testing.
The assessment goes beyond paperwork: the QPA observes operations, verifies HSM configurations and compares reality against the registers. A discrepancy between the inventory and the facts is often worse than a missing procedure, because it undermines the credibility of the entire evidence system.
Patronusec prepares organisations for this stage within its PCI PIN Security service: from documentation review and rehearsal ceremonies to support during the QPA assessment itself.
FAQ – PCI PIN key management
What is a key ceremony?
A key ceremony is a formal, minuted key operation (generation, loading, replacement or destruction) performed by at least two custodians under dual control, following a script prepared in advance. The ceremony documentation – script, attendance list, signed protocol – is key evidence in a QPA assessment.
How does dual control differ from split knowledge?
Dual control concerns operations: no single person can perform one alone. Split knowledge concerns information: nobody knows the full key value, and custodians hold only their own components. The standard requires both techniques together – one does not substitute for the other.
Can a key be stored in a database?
Yes, but only encrypted under a key of at least equivalent strength, in a key block format binding its usage attributes. Phase 1 of requirement 18-3 has covered such storage since 1 Jun 2019. A clear-text key outside an SCD is always non-compliant.
What is DUKPT and when is it used?
DUKPT (Derived Unique Key Per Transaction, ANSI X9.24-3) is a scheme in which every transaction is encrypted under a different key derived from a base derivation key (BDK). It is widely used in POS terminals: compromising one transaction’s key reveals neither earlier nor future keys.
How often should cryptographic keys be replaced?
The standard requires replacement whenever compromise is known or suspected, and in line with the organisation’s cryptoperiod, chosen for the algorithm’s strength and the key’s exposure. A practical rule: the more data a key protects and the more widely it is distributed, the shorter its lifecycle should be.
Who can act as a key custodian?
A formally appointed employee who has signed a responsibility statement, completed training, and holds no roles that break separation of duties (for example, not simultaneously the second custodian of the same component pair, nor the administrator of access registers for both safes). Custodian numbers must allow cover without breaking split knowledge.
How much does building a key management process with Patronusec cost?
The cost depends on the number of key types, the locations involved (KIFs, HSM sites), the state of documentation, and whether we build the process from scratch or tidy an existing one. After a free scope-assessment call we present a fixed-price quote covering the gap analysis, the full procedure set and QPA assessment readiness.
Recommend reading
A reading path for keys and PIN security:
- PCI PIN Security – who needs the standard – the foundation: scope, roles and the requirements timeline.
- P2PE component, solution and application – validation routes for providers – the KIF, KMCP and KLCP roles in ecosystem practice.
- P2PE vs E2EE vs NESA – 3 approaches to payment encryption – where the keys you manage end up.
- MPoC, SPoC and CPoC: a revolution in secure mobile payments – key management when the terminal is a smartphone.
- PCI DSS compliance: navigating the scope without confusion – how key environments relate to PCI DSS scope.
Key management and PCI PIN Security – free consultation
Patronusec, an accredited QSA, designs and audits key management processes within its PCI PIN Security service. Book a free scope-assessment call to gauge your key programme’s readiness for a QPA assessment.
