TAK is an abbreviation for the term Terminal Authentication Key.
TAK (Terminal Authentication Key) is a data encryption key used to generate and verify a Message Authentication Code (MAC) for data communication between a terminal and the terminal's bank (acquirer) within a local network.
TAK is encrypted under TMK or ZMK during transmission; in local storage it is encrypted under one of the LMK pairs.
You can see the key hierarchy of TAK across the shared and local network below.
How is the MAC calculated with TAK?
The terminal processes certain fields of the message it will send to the bank with TAK to produce a MAC (Message Authentication Code) value, and appends this value to the end of the message. The bank performs the same calculation on the message using the same TAK. If the two values match, it confirms that the message came from the terminal and was not altered along the way.
What attacks does it protect against?
The MAC calculated with TAK provides protection especially against the following types of attacks:
- Alteration of the transaction amount or card number during transmission
- Sending a message to the bank from a fraudulent device
- Replaying a previously sent message after it has been altered
Difference from TPK
TPK ensures the confidentiality of the PIN. TAK, on the other hand, verifies the integrity and origin of the message. Both keys are present on a terminal and are used for different purposes. Under the principle of key separation, one key is never used in place of the other.
Key exchange
TAK is encrypted under TMK and loaded onto the terminal, and it is changed at regular intervals. The key exchange is usually performed automatically during the key exchange process when the terminal connects to the bank.
