Key Share Generator
Split cryptographic keys into XOR components for dual-control key ceremonies and recombine them with KCV verification
Enter or generate a hex key (16, 32, or 48 characters). Whitespace is ignored.
KCV (Key Check Value): Calculated by encrypting 8 zero bytes using 3DES-ECB with the key. The first 3 bytes of the ciphertext form the KCV — a fingerprint to verify the key was loaded correctly.
Security Note: In production, key splitting should happen inside a tamper-resistant HSM during a formal key ceremony with witnesses. This tool is for testing and educational purposes.
Related Tools
What is the Key Share Generator?
The Key Share Generator is a free, browser-based tool that splits cryptographic keys into multiple XOR components and recombines them. It is designed for payment engineers who need to simulate key ceremonies, verify key components, or test dual-control procedures required by PCI DSS and PCI PIN Security standards.
- Enter a hexadecimal cryptographic key or click one of the "Generate" buttons to create a random key of 16, 32, or 48 characters.
- Select the number of components to split into — either 2 or 3.
- Click "Split Key" to generate the XOR components and their Key Check Values (KCVs).
- To reconstruct a key, enter all components in the "Combine Components" section and click "Combine Components."
- The KCV of the combined key allows you to verify the reconstruction is correct without comparing the full key value.
What is XOR key splitting used for?
XOR key splitting enforces the "split knowledge" and "dual control" principles mandated by PCI DSS. No single person holds the complete cryptographic key, reducing the risk of insider compromise. Each key custodian receives one component during a formal key ceremony.
How do I verify that key components are correct?
Each component and the combined key has a Key Check Value (KCV). The KCV is computed by encrypting 8 zero bytes with 3DES-ECB and taking the first 3 bytes. If the KCV matches the expected value, the component was entered correctly.
Is this tool safe to use with real production keys?
This tool runs 100% client-side — no data is sent to any server. However, for production key ceremonies, always use a certified Hardware Security Module (HSM) inside a secure environment with proper witnesses and audit logging, as required by PCI PIN Security.