TMK is an abbreviation for Terminal Master Key.
The TMK (Terminal Master Key) is a key-encrypting key that is distributed either manually or automatically under a previously established TMK. It is used to distribute data encryption keys to an ATM or POS terminal within a local (non-shared) network. (For example, KeyExchange.)
TMK is used in transfer operations to encrypt other TMKs or lower-level keys. In local storage, the TMK is encrypted under one of the LMK pairs.
You can see the key hierarchy of the TMK across the shared and local network below.
How is the TMK loaded onto a terminal?
The TMK is the top-level key that enables the other keys on a terminal to be distributed securely. For this reason, securely loading the initial TMK onto the terminal is a critical step. This is generally done using the following methods:
- Entering the key components separately, by authorized personnel, in a secure environment
- Loading the key using key-loading devices at the terminal manufacturer's secure facility
- Remote Key Loading (RKL) using public-key cryptography methods
Dual control and key components
In manual loading, the TMK is typically split into two or three components, and each component is entered by a different person. No single person knows the entire key. This method is called the principle of "dual control" and "split knowledge," and it is one of the fundamental rules of key management in payment systems.
Remote key loading
Since there are large numbers of terminals in the field, manually loading keys onto every terminal is costly and slow. Remote key loading methods make it possible to securely load the TMK without physically touching the terminal. These methods are widely used today, as the number of POS terminals continues to grow rapidly.
