ZPK, also known as the PIN Protection Key, is a data encryption key that is distributed automatically and used to encrypt PINs.
It is also referred to as the 'Working Key'. This key allows PIN information to be carried securely across the network.
Due to security protocols, the HSM on which this key is generated never exposes the ZPK in clear form. However, it can be exported using the ZMK key.
When PIN information needs to be transferred between zones, the PIN is first sent under the ZPK. The ZPK itself is sent encrypted under the ZMK.
For example, in the PIN verification for a transaction performed at another bank's ATM with a card, the PIN information is sent in field F52, encrypted under the ZPK.
The concept of a zone
In payment systems, a "zone" refers to the security domain between two institutions that share keys. For example, there is one zone between the merchant's acquiring bank and the card scheme, and another zone between the card scheme and the issuing bank. A separate ZPK is used between the institutions in each zone.
PIN translation
A PIN may pass through multiple zones on its way from the terminal to the issuing bank. At each hop, the PIN is translated from one key to another:
- At the terminal, the PIN is encrypted with the TPK.
- The merchant's acquiring bank decrypts the PIN from the TPK and re-encrypts it with the ZPK it shares with the card scheme.
- The card scheme decrypts the PIN from this ZPK and encrypts it with the ZPK it shares with the issuing bank.
These translation operations are performed inside the HSM, and the PIN never appears in clear form at any stage.
ZPK exchange
ZPKs are changed at regular intervals for security reasons. The new ZPK is sent encrypted under a ZMK previously shared between the two institutions. This exchange is generally performed automatically through network management messages.
