GB nº 43, EMVCo Common Contactless Terminal Roadmap

General Bulletin No. 43 First Edition November 2009 EMVCo Common Contactless Terminal Roadmap This General Bulletin presents EMVCo's roadmap on the development of a common contactless acceptance solution. Executive

Summary

This General Bulletin presents EMVCo's vision on the standardisation of contactless acceptance and the roadmap to advance EMV contactless acceptance. EMVCo envisions a phased project to achieve common contactless acceptance, first to address the immediate needs of the payment industry through licenses to EMVCo of the payment brands’ contactless kernels and then to introduce a plan and migration strategy to a common EMV contactless kernel that will include online-only requirements and advanced cryptography standards such as Elliptic Curve Cryptography (ECC). This General Bulletin describes EMVCo’s intentions as of the above date and is subject to change at any time.

Background

EMVCo's established mission has been to manage, maintain and enhance the EMV Integrated Circuit Card Specifications to facilitate interoperability and acceptance of payment system chip products on a worldwide basis. With the introduction of contactless technology, EMVCo has expanded its portfolio of specifications, which now includes the EMV Contactless Specifications for Payment Systems. The current EMV Contactless Specifications for Payment Systems (EMV Contactless Specifications) have three components, which are the Framework for Contactless Evolution, the EMV Contactless Communication Protocol Specification (Contactless Communication Protocol, CCP) and the Entry Point Specification (Entry Point). The Framework for Contactless Evolution document is an overarching description of EMVCo's vision on contactless payment. The Contactless Communication Protocol defines the communication (level one) characteristics between a contactless reader and a contactless IC card, while the Entry Point introduces the notion of a multi-kernel terminal approach. Collectively they form the foundation and key elements for a broader framework to achieve interoperability, backward compatibility and to allow for a progressive migration course toward a future EMV Common Contactless Kernel. EMVCo recognizes that promoting standardisation for contactless payments is a continuing effort which involves balancing market requirements and technical feasibility. This General Bulletin presents EMVCo's update on the current state of, and roadmap to advance, common contactless acceptance.

Description

The EMV Common Contactless roadmap consists of three phases (ref: Diagram 1) and each phase is described below. Past Accomplishments Oct 2009 2010 2011 2012 2013 Entry Point, Contactless Communication Protocol Phase One: Streamline existing licensing and approval Phase Two: Common Online Kernel Phase Three: Common On/Offline ECC Kernel Diagram 1: EMV Common Contactless Roadmap Phase One: Streamlining Existing Processes Each payment system has independently pursued different solutions to promote contactless payment. Significant investments have been made in deployment of these solutions which now enjoy a large installed base of cards and terminals. To broaden and accelerate the deployment of contactless payment, EMVCo can help further by standardising the existing contactless acceptance infrastructure and streamlining the contactless type approval processes. To achieve this, EMVCo and its members identified the following steps: 1. License existing Amex, JCB, MasterCard and Visa contactless terminal specifications and testing to EMVCo: EMVCo will create a "combined" set of terminal specifications from the existing four payment systems’ specifications and manage the testing and approval of the contactless kernels developed according to these specifications. The EMV "combined" terminal specification will be publicly available to vendors under a licensing agreement similar to other EMV Contact and Contactless specifications. Terminal vendors will have full access to the specifications for the purpose of terminal development and will enjoy an optimized solution for contactless terminal type approval. Terminal vendors will have EMVCo as the single point of contact, utilize a single EMVCo accredited lab for contactless type approval testing, and receive one Letter of Approval from EMVCo. This process will be applicable to any implementation of contactless terminal products conforming to the EMV Contactless Specifications and includes the contactless magstripe component

of the different kernels. This improves upon the current situation where a terminal vendor may have to independently contact multiple payment systems for type approval, use multiple laboratories for testing and receive multiple Letters of Approval with different expiry dates. EMVCo’s receipt from its members of licenses of their contactless kernel specifications will further the streamlining of terminal development and approval. Vendors who wish to use these specifications for the purpose of card application development will need to contact the individual payment systems to ensure all Intellectual Property rights are respected. 2. Enhance the existing EMV Contactless Specifications to establish a contactless framework for backward compatibility and future development: The EMV Contactless Specifications would be organized and structured in an approach similar to the contact EMV books.

• The Level 1 - Contactless Communication Protocol is expected to remain unchanged as of the latest 2.01 release.
• The Entry Point Specification is expected to undergo some enhancements and other minor functional changes in support of the new licensed specifications
• The Level 2 - Terminal Kernel Specifications will contain multiple independent, separate books, with each detailing an EMVCo member's contactless kernel specification.
• Other common requirements on a contactless reader may also be consolidated, and if they are, this would result in a separate book EMVCo intends for the EMV contactless framework to remain open, such that other contactless terminal kernels may co-exist with the EMV Kernels and function under the Entry Point framework. Phase one is ongoing as of November 2009 and EMVCo plans to publish the draft EMV Contactless Specifications in June 2010 with final specifications in September 2010. EMVCo terminal type approval based on these specifications is anticipated to start in January 2011. The diagrams (ref: Diagram 2 to 4) show a possible evolution in a contactless terminal architecture with the completion of phase one activities. Please note that the diagrams below (ref: Diagram 2 to 6) are intended as an example of a possible implementation; any combination of the EMV Kernels (i.e., from Kernel 1 to Kernel 4) may be implemented on the same contactless terminal under Entry Point. Terminals Brand A Kernel Brand A L2 Type Approval Physically different terminals or proprietary solutions Brand B Kernel Brand B L2 Type Approval EMVCo L1 Type Approval Diagram 2: Without Entry Point, independent contactless kernels are available within the same terminal; type approval for each contactless kernel is done independently. Terminal Brand A Kernel EMVCo “Entry Point” App. Physically the same terminals Brand B Kernel Brand A L2 Type Approval EMVCo Type Approval TA will be coordinated Brand B L2 Type Approval EMVCo L1 Type Approval Diagram 3: With Entry Point, one contactless terminal may support multiple contactless kernels, but type approval for each contactless kernel is done independently. Terminal EMV Kernel 1 EMVCo “Entry Point” App. Physically the same terminals EMV Kernel 2 Diagram 4: After phase one, contactless terminal type approval is simplified and streamlined EMVCo Type Approval EMVCo L1 Type Approval Phase Two: Common Online Kernel In phase one, EMVCo focuses on streamlining existing contactless type approval, addresses the immediate acceptance infrastructure needs, and provides a framework to base future development on. In phase two, the EMV Contactless roadmap foresees a common contactless kernel for online only markets. This effort will result in a common contactless online-only kernel. The initial focus on an online-only kernel is because it can be implemented prior to the EMVCo scheduled migration to Elliptic Curve Cryptography (ECC)1 or the availability of the Secure Hash Algorithm 3 (SHA-3) cryptography standard2. Additionally, requirements for an online-only solution are relatively straightforward compared to the requirements for an offline solution, resulting in a simpler implementation. These factors should shorten the development cycle and have a favorable influence towards a shorter time to market. Other positive considerations would be on the migration planning. The Common Online Kernel would be designed to be forward compatible with the future EMV Common Contactless Kernel. This approach reduces the costs associated with multiple potential migration cycles introducing an EMV common contactless kernel and should result in simpler planning and implementation for acquirers and issuers. The start of this phase is projected to be April 2010. Following the feasibility and requirements study for a single, secure online-only solution, EMVCo will develop a Common Online Kernel specification; a draft is scheduled for publication in Q4 2010 with a final specification in Q1 2011. EMVCo type approval for the Common Online Kernel will follow in Q4 2011. The diagram below (ref: Diagram 5) illustrates a possible contactless terminal architecture implementing the phase two solution. Terminal EMVCo “Entry Point” App. Physically the same terminals EMV Kernel 1 Common Online Kernel EMV Kernel 2 EMVCo Type Approval EMVCo L1 Type Approval Diagram 5: After phase two, the Common Online Kernel could function independently or alongside existing contactless kernels of phase one under Entry Point. Phase Three: Common Contactless Kernel In phase two, EMVCo continues to build on the foundation from phase one, and begins the work on a common contactless kernel targeting the online only market initially. The 1 A reader may find additional information on ECC migration at the following link: http://www.emvco.com/specifications.aspx?id=160 2 The SHA-3 cryptography standard would be used for secure hashing and is not yet available; the proposed standard would be available no sooner than Q4 2012. For more information on SHA-3, please visit: http://csrc.nist.gov/groups/ST/hash/index.html focus of phase three development will address the offline capable markets and will therefore integrate the ECC and SHA-3 cryptography standards for security. The outline of this phase is such that, EMVCo will:
• Design a Common Contactless Kernel based on ECC and SHA-3 for offline transactions
• Base the security protocol and data structures on existing EMVCo work in EMV book 2 by implementing ECC enhanced with the new SHA-3 cryptography standard once available
• While the initial focus is on contactless, the architecture of the Common Contactless Kernel will be forward looking and incorporate design elements applicable to contact EMV
• Coordinate with the future contact EMV migration to ECC Phase three is expected to start in early 2011, with draft spec in early 2012 and final spec in late 2012. This time frame may be influenced by the availability of the SHA-3 cryptography standard expected to be available in Q4 2012. Type approval development will follow and continue until late 2013. The diagram below (ref: Diagram 6) illustrates a possible contactless terminal architecture implementing the phase three solution. Terminal EMVCo “Entry Point” App. Physically the same terminals EMV Kernel 1 Common Contactless Kernel w/ECC EMV Kernel 2 EMVCo Type Approval EMVCo L1 Type Approval Diagram 6: After phase three, the Common Contactless Kernel could function independently or alongside the existing contactless kernels of phase one under Entry Point; optionally the phase three Common Contactless Kernel could replace the phase two Common Online Kernel. Optionally the phase one kernels may be phased out of service at this stage. Phase one of this project is in active development and EMVCo will announce future news and updates on the EMVCo website: www.emvco.com.