ZWK is the abbreviation of Zone Working Key.
ZWK encrypts the PIN so that it can travel securely between different financial institutions (between the POS bank and the card-issuing bank).
What does “working key” mean?
In payment systems, keys are generally divided into two groups. Master keys are used to encrypt other keys and are not changed for a long time. Working keys, on the other hand, are used to encrypt data directly, for example the PIN, and are changed frequently. ZWK is a working key used between two institutions.
How is the ZWK distributed?
The ZWK is not sent in clear between two institutions. It is sent encrypted under the ZMK (Zone Master Key), which has previously been shared securely between the institutions. The other party decrypts the ZWK inside its own HSM and stores it encrypted under its own master key.
Why is it changed often?
The longer a working key is used, the more data is encrypted with that key. Changing the key regularly limits the number of transactions that could be affected if a key is compromised. For this reason, some institutions change the ZWK daily, or even more frequently.
Naming
In some systems, the ZWK is also called the ZPK. Both terms are used for the key used to encrypt PINs between institutions.
