ISO8583Studio
Pro Download Studio
9 tools · key blocks · KCVs · X.509

Key Management Tools

Generate, validate, wrap, share, and verify cryptographic keys used across payment systems — from raw 3DES key generation and parity enforcement to TR-31 / Thales key blocks, vendor HSM-specific calculators, keyshare splitting, and X.509 certificate workflows.

Download StudioBrowse the tools
ISO8583StudioProfessional Payment Testing
Tool Categories
Payment Simulators9 tools
EMV & Card Tools12 tools
Cryptographic Tools7 tools
Key Management10 tools
Payment Utilities21 tools
Data Converters6 tools
Card Validation4 tools
DUKPT Tools6 tools
MAC Tools5 tools
Key Management Tools
Generate, wrap, share and verify payment keys
Search key tools…
9 tools
012 tools
Build & share
DEA keys · shares · parity
025 tools
Key blocks & HSMs
TR-31 · Thales · Atalla · Safenet
032 tools
Certificates & DER
X.509 · CSR · DER
All tools
Build, wrap, distribute, check
hex-driven · audit log
DEA Keys (DES / 3DES Utility)01
A multi-tab tool focused on raw 3DES key material.
Keyshare Generator01
Splits a single key into n shares such that all n are required to reconstruct the key (XOR-based component scheme).
TR-31 Key Block02
ASC X9.143 (formerly TR-31) defines a key block format that binds a key to its allowable usage, algorithm, mode, and exportability.
Thales Key Block02
The Thales-specific key block format used by PayShield HSMs.
Thales Key Calculator02
Vendor-aware calculations matching Thales PayShield host commands.
Atalla Key Calculator02
Atalla / Utimaco AKB-style key block helpers, including AKB header construction and KCV verification.
Safenet Key Calculator02
Safenet / Thales Luna key calculations for legacy and modern formats.
RSA DER Public Key Tool03
Wrap a modulus and exponent into DER, with the sign-byte case handled.
SSL / X.509 Certificate Tool03
An end-to-end certificate workflow tool for terminal-host TLS.
›Opening TR-31 Key Block · ASC X9.143 (formerly TR-31) defines a key block format that binds a key to its allowable usage, algorithm, mode, and exportability.
Activity log
A KCV beside every key that leaves the screen.
On this page
key-tools · Key Management hub — above

Introduction

Key Management Tools cluster around four jobs:

Build keysGenerate and combine raw key material.
Wrap keysBind a key to its usage / algorithm via TR-31 or Thales key blocks.
Distribute keysSplit into shares for multi-custodian loading and validate the resulting halves.
Compute key check valuesFor vendor HSMs and operational sign-off.

SSL / X.509 certificate handling is also grouped here for projects that need terminal or host-to-host TLS.

All tools

Every tool in this category — each card links to the detailed reference below.

01 · Build & shareDEA Keys (DES / 3DES Utility)A multi-tab tool focused on raw 3DES key material.View details
01 · Build & shareKeyshare GeneratorSplits a single key into n shares such that all n are required to reconstruct the key (XOR-based component scheme).View details
02 · Key blocks & HSMsTR-31 Key BlockASC X9.143 (formerly TR-31) defines a key block format that binds a key to its allowable usage, algorithm, mode, and exportability.View details
02 · Key blocks & HSMsThales Key BlockThe Thales-specific key block format used by PayShield HSMs.View details
02 · Key blocks & HSMsThales Key CalculatorVendor-aware calculations matching Thales PayShield host commands.View details
02 · Key blocks & HSMsAtalla Key CalculatorAtalla / Utimaco AKB-style key block helpers, including AKB header construction and KCV verification.View details
02 · Key blocks & HSMsSafenet Key CalculatorSafenet / Thales Luna key calculations for legacy and modern formats.View details
03 · Certificates & DERRSA DER Public Key ToolWrap a modulus and exponent into DER, with the sign-byte case handled.View details
03 · Certificates & DERSSL / X.509 Certificate ToolAn end-to-end certificate workflow tool for terminal-host TLS.View details
01 · Build & share

DEA Keys (DES / 3DES Utility)

A multi-tab tool focused on raw 3DES key material.

key-tools · DEA Keys Calculator — DEA Keys Calculator on the Key Generator tab with keys-to-generate, 128-bit key length and odd key parity, beside the activity log

Tabs

  • Key Generator — Generate cryptographically random DES, 2-key 3DES, or 3-key 3DES keys.
  • Key Combination — XOR multiple key components together to reconstruct a key from shares.
  • Parity Enforcement — Adjust the LSB of each byte so each byte has odd parity (DES requirement).
  • Key Validation — Check parity, detect weak keys, and compute KCV (Key Check Value) using 00 00 00 00 00 00 00 00.

Key Combination

key-tools · DEA Keys Calculator — Key Combination form with a TDES double-length key type and eight component fields, each with its own KCV box alongside

Components XOR together into the key. Pick the Key Type / Length — e.g. TDES — Double length (16B / 32H) — and the fields resize to match.

There is room for eight components, and each carries its own KCV box beside it, with one more for the combined result. That is what makes a bad component obvious: check each custodian’s KCV against their envelope before you trust the total.

Parity Enforcement

key-tools · DEA Keys Calculator — Parity Enforcement form with a hex key field and an odd or even key parity selector above the Enforce Parity button

DES ignores the low bit of each byte, so specs use it as a parity bit. Paste a Key (Hex), choose Odd or Even, and Enforce Parity adjusts each byte to match — the key value is unchanged as far as the cipher is concerned.

Key Validation

key-tools · DEA Keys Calculator — Key Lookup form with a hex key, a Check KCV checkbox, an optional KCV field and Any / Odd / Even parity radios above the Lookup Key button

The validation tab is a Key Lookup: give it a key and it reports what the key actually is.

  • Key (Hex)
  • Check KCV? — When ticked, the KCV (Optional) field is compared against the computed value instead of just reporting it.
  • Parity — Any, Odd or Even; the check fails if the key does not match the parity you assert.

Button: Lookup Key.

01 · Build & share

Keyshare Generator

Splits a single key into n shares such that all n are required to reconstruct the key (XOR-based component scheme). Useful for multi-custodian key loading.

key-tools · Keyshare Generator — Keyshare Generator with global parity and key type options above a 2 Parts / 3 Parts tab pair, showing part fields with a combined key and its KCV

Inputs

  • Global Options — Parity (Ignore by default) and Key Type (DES/TDES), applied to the whole operation.
  • 2 Parts / 3 Parts — A tab pair rather than a count field; each tab shows exactly that many part fields.
  • Part 1, Part 2 (and Part 3) — Leave them empty to have the tool generate them.

Button: Generate 2 Parts (or 3). The Combined Key and its KCV appear together at the bottom, so the reconstructed value can be checked before it leaves the screen.

Output

  • Random components for shares 1 to n−1.
  • Final component computed so XOR of all components = the master key.
  • KCV of each share for safe transport verification.
Custody
Components must be transported and stored separately under the control of different custodians. Recombining shares brings them under the control of a single trustee, so do this only inside the HSM during loading.
02 · Key blocks & HSMs

TR-31 Key Block

ASC X9.143 (formerly TR-31) defines a key block format that binds a key to its allowable usage, algorithm, mode, and exportability. A TR-31 block is opaque to anything outside the issuing HSM but lets two HSMs exchange keys without losing metadata.

key-tools · TR-31 Key Block — TR-31 Key block on the Wrap tab with KBPK, clear key, version id, key usage, algorithm, mode of use, key version and exportability fields, beside the activity log

Tabs

  • Wrap — Build a key block from a clear key under a Key Block Protection Key (KBPK).
  • Unwrap — Decode a key block, validate its MAC, and reveal the contents.

Inputs (Wrap)

FieldDescription
KBPK32 / 48 hex chars (3DES) or 64 hex (AES).
Clear KeyKey to wrap.
Key UsageTwo-character code (e.g. P0 = PIN encryption, M0 = MAC, K0 = Key Encryption Key).
AlgorithmD = DES, T = TDES, A = AES, etc.
Mode of UseE = encrypt, D = decrypt, B = both, N = no restriction.
Key Version NumberTwo characters.
ExportabilityE = exportable, S = sensitive (no clear export), N = no export.

Output

An ASCII key block string starting with the version (A, B, C, D) plus encrypted key, MAC, and optional blocks.

A0072P0TE00E0000ABC...   (D variant TR-31 block)
02 · Key blocks & HSMs

Thales Key Block

The Thales-specific key block format used by PayShield HSMs. Similar in concept to TR-31 but with Thales’ own header and key usage codes.

key-tools · Thales Key Block — Thales Key Block on the Encode tab with a 3DES / AES KBPK version selector, key block protection key with KCV, clear key, and the key block header attributes

Workflow

  1. Pick a Thales Key Type — ZMK, ZPK, TMK, BDK, ZEK, etc.
  2. Provide the LMK Variant applicable to that key type.
  3. Provide the clear key material.
  4. The tool returns the encrypted key under LMK along with its KCV.
Tip
Use this when you have a clear key and want to import it under the HSM Simulator’s LMK without typing it through the console.
02 · Key blocks & HSMs

Thales Key Calculator

Vendor-aware calculations matching Thales PayShield host commands.

key-tools · Thales Key Calculator — Thales Keys Encryption / Decoding with a hex key, key scheme, double or triple LMK size, an LMK pair selector and a variant, above Encrypt and Decrypt buttons

Operations

  • Key Generation — Equivalent to A0 (Generate a Key) host command.
  • Key Translation — Equivalent to A6 (Translate a Key from One ZMK to Another).
  • KCV Computation — Match Thales-style 6-digit KCVs for operational sign-off.
  • Variant Application — Apply LMK and ZMK variants used during key wrapping.
02 · Key blocks & HSMs

Atalla Key Calculator

Atalla / Utimaco AKB-style key block helpers, in both directions: build a key block from a clear key, or take one apart.

key-tools · Atalla Keys Calculator — Atalla Keys Calculator on the Key Encryption tab with hex key, AKB header and MFK key fields above the Encrypt Key button

Key Encryption

  • Key (Hex) — The clear key to wrap.
  • AKB Header (Hex) — The attribute header that travels inside the block.
  • MFK Key (Hex) — The Master File Key the block is encrypted under.

Button: Encrypt Key.

AKB Decode

key-tools · Atalla Keys Calculator — AKB Decode form with an Atalla Key Block field, a Check KCV checkbox, an optional KCV, a parity selector and an MFK key, above the Decode AKB button

  • AKB (Atalla Key Block) — The block to open.
  • Check KCV? and KCV (S) — Verify the recovered key against a known check value rather than trusting the decode.
  • Parity — None by default.
  • MFK Key (Hex)

Button: Decode AKB.

02 · Key blocks & HSMs

Safenet Key Calculator

Safenet / Thales Luna key calculations for legacy and modern formats.

key-tools · Safenet Keys Calculator — Safenet Keys Calculator with a hex key, a key format of single length DES, a DPK variant, hexadecimal key input format and a KM key, above Encrypt and Decrypt buttons

03 · Certificates & DER

SSL / X.509 Certificate Tool

An end-to-end certificate workflow tool for terminal-host TLS.

key-tools · SSL Certificate (X.509) Utility — SSL Certificate (X.509) Utility on the Keys tab with an RSA key type, 2048-bit length and public and private key fields, beside the activity log

Tabs

  • Keys — Generate RSA key pairs (2048 / 3072 / 4096-bit) or read existing keys.
  • CSRs — Build a Certificate Signing Request from a key and DN parameters (CN, OU, O, L, S, C).
  • Read CSR — Parse and display the contents of an existing CSR.
  • Self-Signed — Issue a self-signed certificate from a key + DN, with configurable validity.
  • Read Certificate — Parse and display an X.509 certificate, including extensions.

Inputs

  • Common Name (CN)
  • Organisation (O), Org. Unit (OU)
  • Locality (L), State (S), Country (C)
  • Validity (Days)
  • Key Size — 2048 / 3072 / 4096.

Outputs are displayed as PEM and as parsed fields side-by-side, with a copy button per artifact.

03 · Certificates & DER

RSA DER Public Key Tool

An RSA public key is a modulus and an exponent, but what a host expects on the wire is those two numbers wrapped in DER. This encoder does that wrapping, and is the tool to reach for when a certificate library rejects a key you know is correct.

key-tools · DER Public Key Encoder — DER Public Key Encoder with modulus and exponent fields, their own encoding selectors and a toggle modulus negative checkbox above the Encode Key button

Inputs

  • Modulus — with its own Modulus Encoding selector.
  • Exponent — with an Exponent Encoding selector — commonly 03 or 010001.
  • Toggle Modulus Negative — DER reads the leading bit as a sign, so a modulus starting above 0x7F needs a leading zero byte. This is the switch for that case.

Button: Encode Key.

Tips

  1. Always verify the KCV after combining shares or unwrapping a key block. A wrong KCV almost always means a typo in one share.
  2. For TR-31, watch out for case sensitivity in the header — the key usage and mode codes are uppercase.
  3. If your HSM rejects an imported key, compare the version byte (A vs B vs C vs D) — older HSMs may only accept specific versions.
  4. For SSL, generate the key first, then the CSR, then the cert — the tool will pre-fill DN parameters from a previous CSR if you stay on the same session.

Try it on your own keys

Free and open source. Download the studio and run these calculators on your desk in minutes.

Download StudioInstallation guide
✦ Pro

Testing with a team, or certifying with a scheme? Pro raises the CPS ceiling, unlocks the full algorithm set and deep simulator tweaks, plus hosted endpoints and priority support.

Register for Pro