PVK (Pin Verification Key) is a key held on the HSM that is used in PIN generation and verification processes, and is therefore used to confirm that a PIN is correct.
On a shared network, the PVK is encrypted under TMK or under ZMK; on a local network, it is encrypted under one of the LMK pairs.
The key storage hierarchy on local and shared networks is shown below:
How is a PIN verified with PVK?
PVK is a key that allows a PIN to be verified without storing the PIN itself. During card issuance, a verification value (PVV) is calculated using the card number and PIN together with the PVK. During the transaction, the same calculation is repeated using the PIN entered by the cardholder. If the two values match, the PIN is accepted as correct.
Different PIN verification methods
Banks can use different methods for PIN verification:
- PVV method: A method defined by Visa in which a 4-digit verification value is calculated.
- IBM 3624 method: A method in which the difference (offset) between the PIN and a value derived from the card number is stored.
In both methods, the PIN itself is not stored, and verification is performed inside the HSM.
What happens if the PVK is changed?
When the PVK is changed, PVV values calculated with the old key can no longer be verified with the new key. For this reason, when banks change the PVK, they use the PVKI (PIN Verification Key Index) value to distinguish which card is to be verified with which key.
