Key Diversification Visualizer
Educational visualizer for AES-CMAC-based key diversification (NXP AN10922 / AV2). Demonstrates the SHAPE of the derivation — a unique per-card key from a master key plus the card UID — without producing a production-equivalent value.
How to use this tool
What it does
Demonstrates how a per-card key is derived from a master key and card data, the pattern behind large card fleets.
When to use it
Use it to understand or teach why one leaked card key does not compromise a whole deployment.
Worked example
Diversify a master key with a sample UID to see a unique card key derived from it.
Input
Derived (educational)
Why diversification
Diversification keeps the master key in the SAM and ships only a per-card derivative onto each card. Compromising one card reveals only that card. Production diversification uses AES-CMAC inside an HSM/SAM; this tool uses a SHA-256 stand-in so users grasp the shape without producing a usable key. Never paste real keys into a webpage.
Spec
NXP AN10922 / AV2 application note.
Companion
Frequently asked questions
What is key diversification?
Deriving a unique per-card key from one master key and card-specific input such as the UID. Every card holds a different key, so extracting one compromises that card alone rather than the estate.
Which scheme does this illustrate?
AES-CMAC diversification in the shape described by NXP AN10922 / AV2, where a padded diversification input is run through CMAC under the master key.
Is this safe to use for production key derivation?
No, and it is labelled educational for that reason. It shows the structure of the derivation; real key material must be derived inside an HSM or SAM under proper key custody.
Why diversify rather than use one key everywhere?
Because a single shared key makes every card in the scheme only as strong as the least protected reader. Diversification bounds the blast radius of one extraction to one card.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.