Key management is the set of processes and controls for generating, distributing, storing, using, rotating and destroying the cryptographic keys that protect data, since strong algorithms are only as safe as their keys. NIST SP 800-57 is the usual reference for that lifecycle. Most systems use a hierarchy in which a master key, kept in a hardware security module validated to FIPS 140-2 or 140-3 Level 3, protects key-encrypting keys that protect data-encrypting keys, with dual control so no single employee holds a whole master key. Card payments follow ANSI X9.24, using zone master keys between processors and DUKPT at terminals. PCI DSS Requirements 3.6 and 3.7 demand documented custodians and cryptoperiods.
What is key management in security
In security terms, key management covers the full lifecycle of each key and who can touch it at each stage. NIST SP 800-57 is the reference most organisations follow. It groups the work into:
- Generation: keys created from a certified random source, usually inside a hardware module.
- Distribution: keys moved between systems only in encrypted form, wrapped by another key.
- Storage and use: keys kept in tamper-resistant hardware, used there, and never exported in clear.
- Rotation: keys replaced after a set cryptoperiod or after suspected compromise.
- Revocation and destruction: retired keys wiped so old ciphertext cannot be reopened.
How does cryptographic key management work
Most systems use a key hierarchy. A master key protects key-encrypting keys, which in turn protect the data-encrypting keys that do the actual work. Only the top of the chain needs the strongest protection; rotating a data key means re-encrypting one layer, not the whole estate.
The top of that chain normally lives in a hardware security module validated to FIPS 140-2 or 140-3 Level 3, or in a cloud key management service backed by such hardware. Access follows split knowledge and dual control: no single employee holds a complete master key, and loading one requires two or three custodians each entering a component.
Payment encryption key management
Card payments run on symmetric key hierarchies defined by ANSI X9.24. Between processors, a zone master key protects the working keys used to encrypt PINs and verify MACs in each message. At the terminal, DUKPT (Derived Unique Key Per Transaction) derives a fresh key for every transaction from a base derivation key held only by the processor. If a terminal is stolen and its current key extracted, earlier transactions stay protected.
Keys exchanged between parties are sent in key blocks (the TR-31 format is common), which bind each key to its permitted use so a PIN key cannot be misused to decrypt data.
What auditors and buyers check
PCI DSS Requirements 3.6 and 3.7 require documented procedures for keys that protect stored card data, including custodians, cryptoperiods and replacement of weakened keys. PCI PIN Security adds stricter rules for anyone handling PIN keys.
In due diligence on a processor or payment gateway, the practical questions are who the key custodians are, whether any of them are leaving with the sale, when master keys were last rotated, and whether keys held with a third-party HSM provider can be migrated. A processor that cannot reissue its zone keys without its founder present has a real operational dependency.