The initial terminal master key, or initial DUKPT key, is loaded using asymmetric techniques or manually via the keypad, IC cards or a key-loading device. Later loads may also encrypt the replacement under the current TMK or, for AES DUKPT, use a derived update key together with a new initial key ID. Keys are never loaded again into a device that has been compromised; such a device is taken out of use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.