TR-31 is the industry standard format for securely packaging cryptographic keys with their attributes (usage, algorithm, mode of use). It binds key metadata to the key cryptographically, preventing unauthorized attribute modification.
Inputs
Tab: Parse an existing TR-31 block or create a new one.
KBPK: Key Block Protection Key — the key used to encrypt and authenticate the key block.
Version: TR-31 key block version.
Key Usage: The purpose/usage of the wrapped key (e.g., K0=Key Encryption, P0=PIN Encryption, M0=MAC).
Algorithm: The algorithm of the wrapped key (A=AES, D=DEA/DES, T=Triple-DES).
Mode of Use: How the key can be used (N=No restrictions, E=Encrypt only, D=Decrypt only, B=Both).
Exportability: Whether the key can be exported (E=Exportable, N=Non-exportable, S=Sensitive).
Tips
Version D (AES) is recommended for new implementations.
Key Usage codes are defined in ASC X9 TR-31 Annex A.
Optional blocks can carry additional metadata like KCV hash (HM).
PCI requires TR-31 format for key exchange between payment system components.
Standards: ASC X9 TR-31:2018, ISO 20038, PCI PIN Security