PEK is the abbreviation for Pin Encryption Key.
The role of PEK is to encrypt PINs.
There are two types of PEK:
- TPK (Terminal Pin Key)
- ZWK (Zone Working Key)
TPK (Terminal Pin Key): Used to encrypt PINs on the terminal (ATM, POS) side of the transaction.
ZWK (Zone Working Key): Encrypts the PIN so that it can travel securely between different financial institutions (between the POS bank and the card bank).
Key naming conventions
Keys used for the same purpose in payment systems may be referred to by different names by different manufacturers and institutions. For example, the zone key used to encrypt PINs is called ZPK in some sources, ZWK in others, and PEK in others. For this reason, rather than focusing on the key names, it is necessary to look at the purpose for which the key is used and between which parties.
Basic characteristics of PEK
- PEK is a data encryption key, meaning it directly encrypts PIN blocks rather than other keys.
- PEKs are distributed encrypted under a higher-level key encryption key (TMK or ZMK).
- PEKs are changed more frequently than master keys. This way, if a key is compromised, the number of affected transactions remains limited.
The principle of key separation
For security purposes, each key must be used for only one purpose. A key used to encrypt PINs should not be used to calculate a MAC or to encrypt data. HSMs enforce this principle based on key types and do not allow a key to be used for a purpose other than the one it was defined for.
