Smart Card Key Diversification Calculator
Derive card-specific keys from a master key and diversification data (PAN, PAN sequence). Supports EMV CSK Option A & B, Visa SD, Mastercard CAP, and MIFARE SAM derivation patterns. All cryptographic operations run in-browser via Web Crypto API — keys never leave your device.
Input Parameters
Derived Card Key
How to Use This Calculator
Key diversification is the process of deriving a unique per-card key from a master key. This is the cornerstone of smart card security — instead of storing the same key on every card (which would compromise all cards if one is broken), each card gets a unique key derived from the master key + card-specific data (typically the PAN).
EMV Option A: Most common. Uses 16-byte master key. PAN + PAN Seq → 3DES encrypt → card key.
EMV Option B: Uses 24-byte (double-length) 3DES key. Stronger but less common.
Visa SD: Specific to Visa Smart Debit/Credit. PAN (right-justified) → 3DES encrypt.
MIFARE SAM: AES-128 based, used in NXP MIFARE SAM AV2/AV3 secure access modules.
Related Tools
GP Session Key Calculator — SCP02/SCP03 session key derivation | MIFARE Access Bits Calculator — Sector trailer permissions | APDU Command Builder — Build APDUs for key operations
EMV Key Diversification
EMV key diversification derives unique card keys from an issuer master key (IMK) using the card's PAN and PSN. This ensures each card has a different set of keys, so compromising one card does not affect others. The diversification process is defined in EMV Book 2.
Derivation Process
For the Application Cryptogram Key (MK_AC): the card-specific key is derived as MK_AC = 3DES(IMK, PAN[0:8] || PSN || PAN[8:]). The PAN is zero-padded to 16 bytes if needed. The result is split into two halves: the left half is used directly, and the right half has its bits inverted (XOR with 0xFF) to form the complete 128-bit key. For VISA/Mastercard, the PAN used is the full PAN truncated to the significant digits. The PSN (PAN Sequence Number) distinguishes cards with the same PAN.
Key Types
EMV uses several diversified keys: MK_AC (Application Cryptogram) for ARQC/TC/AAC generation. MK_SMC (Secure Messaging for Confidentiality) for encrypting data sent to the card. MK_SMI (Secure Messaging for Integrity) for MAC computation on commands. MK_DN (Data Authentication) for dynamic data authentication signatures in DDA/CDA. Each key is derived using the same diversification method but with different padding constants. Use our Session Key Tool for SCP session key derivation and EMV Cryptogram Visualizer for ARQC computation.