RKL is the process of distributing a TMK (Terminal Master Key) to each terminal from a central point. RKL can be used to remotely load keys onto POS and ATM devices.
TMKs sent to ATMs via RKL are loaded onto the ATM's keypad. TMKs sent to a POS are put into use by the POS once it loads the relevant keys.
On ATMs and POS terminals, this method improves operational efficiency, raises the security level, and also reduces fraud risk.
What are the types of RKL?
There are 2 types of RKL: Signature-based and Certificate-based.
Signature-based RKL: Structurally, this resembles a digital signature. The data structure is simpler. It contains a code key that encrypts the digital key. The digital key is then sent to the PIN pad in encrypted form. The PIN pad decrypts the key and performs security checks to prevent fraud.
Certificate-based RKL:
In certificate-based structures, certificates are carried instead of a key. Certificates hold more information than signature-based protocols, and more information is transmitted as well.
How is RKL performed?
Keys used in the RKL process
LMK (Local Master Key) : All keys produced by the HSM are generated under the LMK. It is known and used only by the HSM. No one knows the clear form of the LMK. It actually contains a DES or TripleDES key set. When an LMK is generated on the HSM, these keys are stored on physical smart cards.
TMK (Terminal Master Key) :
- Used to encrypt keys. It is loaded onto the terminal manually or automatically and is stored on the terminal encrypted under the LMK.
- It is a TDES/AES key.
- There is 1 per terminal.
- It secures the other keys on the terminal.
- It is stored as 3 components.
TPK (Terminal Pin Key) : On an ATM, the PIN entered on the pinpad is encrypted under the TPK before being sent on for verification. The TPK is the key used to carry the PIN between a terminal - encrypted under the TMK - and the acquiring bank.
ZMK (Zone Master Key) :
- Key information used to carry a key between environments.
- When exchanging a ZPK, the clear ZPK is never carried in the open. This key is carried under a key such as the ZMK, and an extra process is run for key security.
- It is stored encrypted under the LMK.
- It is a TDES/AES key.
- There is one ZMK for each zone with which keys are shared.
- It ensures the secure transport of keys.
- It is stored as 3 components.