Diagram illustrating the structure of ISO 8583 Field 53, PIN Encryption Control Information

F53 - PIN Encryption Control Information. When online PIN data is present,
sending the F53 value is mandatory, except in cases where DUKPT information is carried in Field 63, Tag 01.

F53 consists of the following components:

PositionDescriptionDescription
1-2Key Type Identifier01 - TPK
02 - ZPK
3-4Key identifier0 - 32
5-16Reserved for future use000000000000

Why is F53 required?

The PIN block sent in field F52 is encrypted. The card-issuing bank or the institution relaying the message must know which key and format were used to encrypt the PIN in order to decrypt this block. F53 carries this information. As shown in the table above, the key type and the key identifier are contained in this field.

The difference between TPK and ZPK

  • TPK (Terminal PIN Key): The key used to encrypt the PIN while it travels between the terminal and the merchant's bank.
  • ZPK (Zone PIN Key): The key used to encrypt the PIN while it travels between two institutions, for example between the merchant's bank and the card-issuing bank.

The party receiving the message determines which key to use to decrypt the PIN block by looking at the key type in F53.

Why does a key identifier exist?

Multiple keys may be defined between institutions at the same time. For example, during a key change, the old and new keys may both be used together for a short period. The key identifier indicates which of these keys was used to encrypt the PIN.

DUKPT

DUKPT (Derived Unique Key Per Transaction), mentioned in this article, is a method in which a different PIN encryption key is derived for each transaction. With this method, even if the key for one transaction is compromised, other transactions are not affected. When DUKPT is used, the key information is sent in a different field.