KEK (Key Encryption Key) is an encryption key used to encrypt the DEK (Data Encryption Key) and to decrypt the encrypted DEK.
The relationship between KEK and DEK
In encryption systems, keys are managed in a layered structure. The DEK (Data Encryption Key) is the key that directly encrypts the data. The KEK protects the DEK by encrypting it. This way, the DEK is never present in plaintext during transmission or storage.
Equivalents in payment systems
In payment systems, the keys that serve the role of a KEK are as follows:
- TMK: Encrypts the working keys sent to the terminal.
- ZMK: Encrypts the working keys shared between institutions.
- LMK: Encrypts all keys stored outside the HSM.
What these keys have in common is that they encrypt keys, not data.
Why a layered structure?
Encrypting all data with a single key would expose all of the data if that key were ever compromised. In a layered structure, working keys can be changed frequently, and with each change only the new key is sent, encrypted under the KEK. The KEK itself is used less often and is protected more strictly, so the risk of it being compromised is lower.
Key wrapping
Encrypting one key with another key is called "key wrapping." Today, payment systems use formats such as TR-31, which also preserve the intended usage of the wrapped key.
