PHPackages                             evgeniyvb/dukpt-php - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. evgeniyvb/dukpt-php

ActiveLibrary[Security](/categories/security)

evgeniyvb/dukpt-php
===================

DUKPT implementation in PHP

07PHP

Since Jan 20Pushed 3y agoCompare

[ Source](https://github.com/evgeniyVB/dukpt-php)[ Packagist](https://packagist.org/packages/evgeniyvb/dukpt-php)[ RSS](/packages/evgeniyvb-dukpt-php/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependenciesVersions (1)Used By (0)

camcima/dukpt-php
=================

[](#camcimadukpt-php)

[![Scrutinizer Continuous Inspections](https://camo.githubusercontent.com/31d6612f672801278028cb40732060bfaa82c67f21ecd3bdb63cb59a15c6d179/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f63616d63696d612f64756b70742d7068702f6261646765732f67656e6572616c2e706e673f733d66303938323736323565323235616261376665653037653435396332303662393135313130626636)](https://scrutinizer-ci.com/g/camcima/dukpt-php/)[![Scrutinizer Quality Score](https://camo.githubusercontent.com/89b4eec99235a43069016fa9d2bfd84b6bb7f07f6b786d4dbcdf4ca276555e7b/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f63616d63696d612f64756b70742d7068702f6261646765732f7175616c6974792d73636f72652e706e673f733d66303766613733336466663534653732663135653435316262316664613938613066633261323761)](https://scrutinizer-ci.com/g/camcima/dukpt-php/)[![Code Coverage](https://camo.githubusercontent.com/b8f9718db4ed4162cc7d90b2810d36685f540fcfc31da57e2e63e2f9dfdaff52/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f63616d63696d612f64756b70742d7068702f6261646765732f636f7665726167652e706e673f733d66636638393331313733373938653361333861376137383764656238623933363461396566333663)](https://scrutinizer-ci.com/g/camcima/dukpt-php/)

A library to handle [DUKPT](http://en.wikipedia.org/wiki/Derived_unique_key_per_transaction "DUKPT") decryption.

DUKPT Reference
---------------

[](#dukpt-reference)

DUKPT is defined in [ANSI X9.24-1:2009](http://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-1%3A2009 "ANSI X9.24-1:2009") standard.

Glossary
--------

[](#glossary)

- **3DES** - Triple DES (see DES);
- **AES** - Advanced Encryption Standard;
- **BDK** - Base Derivation Key;
- **DES** - Data Encryption Standard;
- **DUKPT** - Derived Unique Key Per Transaction;
- **KSN** - Key Serial Number;
- **IPEK** - Initial Pin Encryption Key;
- **MAC** - Message Authentication Code

Brief Explanation
-----------------

[](#brief-explanation)

DUKPT is a standard that deals with encryption key management for credit card readers. It was invented by Visa in the 80's.

Using DUPKT, the card reader encrypts each transaction with a unique key. This key is derived from a base derivation key (BDK) using a complicated algorithm implemented in this library.

The derived key is calculated from the BDK and the KSN, a serial number formed by the device identifier (unique) and a serial number starting at 1. This serial counter has 21 bits. This would allow more the 2 million uses, but the standard states that only binary numbers that have less than or equal to 10 "one" bits can be used, because the algorithm is very CPU intensive and each "one" bit requires additional calculations.

Based on the BDK and the KSN, the algorithm calculates the IPEK, which is the base for calculating the future keys.

Note that for each BDK/KSN pair, different keys are generated for different uses:

- PIN Encryption Key
- MAC Request Key
- MAC Response Key
- Data Request Key
- Data Response Key

The device I had used the `Data Request Key` to encrypt the credit card data.

Installation
------------

[](#installation)

- Include the library in your `composer.json`;

```
"require": {
...
"camcima/dukpt-php": "dev-master"
}

```

- Run `composer update`;

Usage
-----

[](#usage)

To calculate the decryption key you must have the KSN and BDK.

```