Issuer Ecosystem Key Type Descriptions

ZCMK - Zone Control Master Key

Name	Description
Also known as	Transport Key
Type	Shared Key
Used to	Encrypt other shared keys
Required for	New third party integration requiring use of keys (Card Manufacturer, 3DS providers or Networks)
Who generates	CLOWD9
Comments	This key is not BIN specific CLOWD9 only need to exchange it once with each third party The components need to be the standard 32 bits Allows generation and encryption of TR-31 Key Blocks (or other encapsulation method)

MDKac/MDKauth - Master Derivation Keys

Name	Description
Also known as	MDK1, MDKac or MDKauth
Type	Shared Key
Used to	Used to perform a chip authenticity check during the authorisation stage, this is known as ARPC/ARQC handshake. AC = Application Cryptogram.
Required for	New BIN with existing card manufacturer New BIN with new card manufacturer Existing BIN with new card manufacturer
Who generates	CLOWD9
Comments	BIN Specific

MDKsmi/MDKmac - Master Derivation Keys

Name	Description
Also known as	MDK2, MDKsmi or MDKmac
Type	Shared Key
Used to	MDKsmi / MDKenc: pin unblock issuer script
Required for	New BIN with existing card manufacturer New BIN with new card manufacturer Existing BIN with new card manufacturer
Who generates	CLOWD9
Comments	BIN Specific

MDKsmc/MDKenc - Master Derivation Keys

Name	Description
Also known as	MDK3, MDKsms or MDKenc
Type	Shared Key
Used to	MDKsmc / MDKmac: pin change issuer script
Required for	New BIN with existing card manufacturer New BIN with new card manufacturer Existing BIN with new card manufacturer
Who generates	CLOWD9
Comments	BIN Specific

CVK - Card Verification Value / Code keys

Name	Description
Also known as	CVV Key, CVC Key, CVK1, CVK2, CVKA, CVKB
Type	Shared Key
Used to	Generate Value of CVV1 (magstripe), CVV2 (embossed), CVV3 (contactless), iCVV (Chip CVV)
Required for	New BIN with existing card manufacturer New BIN with new card manufacturer Existing BIN with new card manufacturer
Who generates	CLOWD9
Comments	BIN Specific CVK generically refers to different keys, such as CVK1 and CVK2. A CVK is combined with card data such as PAN and expiry date to compute the Verification Value. I.e CVK1 used to get CVV1, CVK2 used to get CVV2, etc. Using during PAN creation to generate CVVs for authorisations

AAVK - Accountholder Authentic Value Key

Name	Description
Also known as	CAKA, CAKB, AAV, CAVV
Type	Shared Key
Used to	Validate 3D Secure Authentication
Required for	3D Secure set up
Who generates	3D secure provider (CLOWD9 to generate it if agreed by Network and 3D secure provider )
Comments	BIN Specific This key is used to validate that the 3D Secure authentication has been performed by the genuine 3D Secure provider

PVK - PIN Validation Key

Name	Description
Also known as	PVKA, PVKB
Type	Shared Key
Used to	Generate & Validate on-line PIN
Required for	On-behalf PIN validation by the Network - (Stand-In)
Who generates	CLOWD9
Comments	BIN Specific

PBK - PIN Block Key

Name	Description
Also known as	Manufacturer PIN Encryption Key (MPEK), PINKey, ZPK
Type	Shared Key
Used to	Encrypt PIN in transit from CLOWD9 to Card Manufacturer (in the Card Data File)
Required for	New Card Manufacturer Integration
Who generates	CLOWD9
Comments	Card Manufacturer Specific Only required once Used for all files send to the same Card Manufacturer Used during PAN creation to generate PIN Block for Card Manufacturer

PEK - PIN Encryption Key

Name	Description
Also known as	MPinKey, MCPinKey, Network Key (Nk), Issuer Working Key (IWK), IWK1 or IWK2
Type	Shared Key
Used to	Encrypt PIN in transit from the Network to CLOWD9 (in the authorisation request)
Required for	New network integration
Who generates	CLOWD9
Comments	Network specific This is used during PAN creation to generate PIN Block for authorisations.

IPK - Issuer Processing Key

Name	Description
Also known as	Public key Infrastructure, Issuer Public Key
Type	Private-Public key pair
Used to	Authenticate that the chip is genuinely issued by an authorised Network member. Between terminal and Chip
Required for	EMV personalisation
Who generates	Issuer (or Card Manufacturer) to exchange with Network
Comments	Issuer specific The key is not used in the transaction processing. The issuer has to sign a letter of delegation for the Card Manufacturer to exchange IPK/ certificate with Visa or Mastercard

UDK - Unique Derivation Key

Name	Description
Also known as	Card Master Key
Type	Derived Key
Used to	EMV authentication (ARQC/ARPC)
Required for	EMV personalisation
Who generates	Card Manufacturer
Comments	Card specific Unique card keys for cryptogram generation and Issuer scripts They are derived from the varios MDKs: i.e UDKac = MKac +PAN + PAN sequence number CLOWD9 must set correct algorithm to be used for these keys: Mastercard ARPC Key: Master Key or Session Key Session Derivation Key Method: Mastercard SDK or EMV CSK ARPCV Key: Master Key or Session Key `` Visa Not possible to set Cryptogram Version Number (CVN) - CLOWD9 Support CVN 10 and 18

PGP - Pretty Good Privacy

Name	Description
Also known as	Public key, Private key, Certificate
Type	Private-Public key pair software
Used to	Authenticate key exchanges
Who generates	Third party (card manufacturer, clients) or CLOWD9 The key generation is subject to the third party’s role. Who does what in the context Always check the approach with the CLOWD9 Infrastructure team
Comments	PGP is a proprietary suite of software that can generate key pairs and encrypt/decrypt data

RSA - Rivest-Shamir-Adleman cryptosystem

Name	Description
Also known as	Public key, Private key, Certificate
Type	Private-Public key pair
Used to	Authenticate sFTP client and server.
Required For	New third party integration requiring sFTP access
Who generates	Third party (card manufacturer, clients, issuer) or CLOWD9 The key generation is subject to the third party’s role. Who does what in the context Always check the approach with the CLOWD9 Infrastructure team
Comments	2048 bit RSA key is needed to authenticate connection to CLOWD9 sFTP service

Updated about 1 month ago