CVK (Card Verification Key) is the key information used in generating and verifying CVV/CVC values, and is therefore used to confirm the validity of CVV/CVC.
It is kept as a pair of keys: CVK A and CVK B.
On a shared network, CVK is encrypted under TMK or under ZMK; on a local network, it is encrypted under one of the LMK pairs.
The key storage hierarchy on local and shared networks is shown below:
Which values are generated using CVK?
CVK is used to generate not just one value, but several different verification values on the card:
- CVV1/CVC1: The value found on the magnetic stripe and verified during physical (card-present) transactions
- CVV2/CVC2: The value printed on the back of the card and used for online purchases
- iCVV: The value contained in the Track 2 equivalent data inside the chip
These values are calculated using the same algorithm but with different inputs. This means that knowing one value does not make it possible to guess the others.
Where is CVK used?
CVK is used in two stages. During card issuance, CVV values are generated in the card personalization system and printed on the card. During the transaction stage, the issuing bank recalculates the CVV value that comes with the transaction using the same key and compares it. In both stages, the calculation is performed inside the HSM.
Why two keys?
Using two keys, CVK A and CVK B, increases the security of the algorithm. In the calculation, encryption is performed with one key, and then additional operations are applied with the other key. These two keys are managed together as a key pair, and each is kept secret separately.
