MEK is short for Message Encryption Key.
A message encryption key (MEK) is a key, either randomly generated or static, used to encrypt message content and ensure that the message is transmitted securely.
- First, an MEK value is generated along with the transaction.
- The message to be transmitted is encrypted using the generated MEK value.
- The encrypted content is then encrypted again with the recipient's public key to create a secure message, which is sent to the recipient.
- The recipient checks the message's "Security Option".
- Once it determines that the message is encrypted, the recipient extracts the incoming security package and decrypts the MEK using its private key.
- It then decrypts the encrypted message using the decrypted MEK code.
- This way, the unencrypted message is obtained.
In a transaction carried out through a POS terminal, the transaction can be sent encrypted with the MEK defined on that terminal. The same MEK key can be used for all POS terminals, or a different MEK key can be used for each POS terminal.
Below, you can see a visual representation of the MEK's role in the message flow.
The logic of hybrid encryption
The message is generally encrypted with a symmetric key because this method is fast. The symmetric key is then sent encrypted with the recipient's public key, because public-key encryption is slow but makes key distribution secure.
Combining the two methods provides both speed and security. The recipient decrypts the MEK with its own private key and reads the message.
Generating a new MEK for every message ensures that even if one key is compromised, the other messages remain protected.
