What is a Key Check Value?
A Key Check Value (KCV) is a short cryptographic digest of a key — typically the first 3 or 6 bytes of the result of encrypting a fixed all-zeros block under the key. Its purpose is exclusively verification: two parties can compare KCVs to confirm they hold the same key without ever revealing the key itself, since the KCV is a one-way function of the key.
KCVs are computed during every key ceremony, after every key injection, and on every key import. They appear in HSM command responses (e.g., the payShield A0 command returns the KCV of the generated key), in TR-31 key-block headers, and in audit logs as the canonical way to identify which key was used without compromising its confidentiality.
How KCVs Are Computed
The standard KCV for a 3DES key is the first 3 bytes (6 HEX characters) of: 3DES-Encrypt(Key, 0000000000000000). For AES keys, it is typically the first 3-6 bytes of: AES-Encrypt(Key, 0000000000000000_0000000000000000). Some HSM vendors and standards (notably TR-31) use slightly different conventions (e.g., a CMAC-based KCV for AES keys), so always check which KCV convention is in use before comparing.
A 3-byte (24-bit) KCV has a 1-in-16 million chance of collision with a random key, which is generally considered sufficient for operational identity. For higher-stakes ceremonies, a 6-byte KCV reduces collision probability to 1-in-281-trillion.