SB nº SU-36 : EMVCo Payment System Public Key Policy (Spec Change)

Specification Update: Bulletin No. 36 April 2004 EMVCo Payment System Public Key Policy Please make the following changes to sections 10.2 and 10.3 of EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0, Book 2. Change the title of section 10.2 from Key Revocation Principles and Policies by Phase to Principles and Policies by Phase Modify the 3rd Bullet of section 10.2.2.2 as follows:

• In the event of announcement of an accelerated revocation by a member of EMVCo, the member may request convening an EMVCo, LLC, planning session to address the revocation, the key compromise, and its impacts. Modify the final sentence of the 1st Bullet of section 10.2.2.3 as follows: A member of EMVCo may request an emergency meeting for key review at any time. Modify the 7th Bullet of section 10.2.2.3 by adding an additional sentence as follows:
• Acquirers have a six month grace period starting from the planned expiration date (until June 30th of the following calendar year) to withdraw an expired key from all terminals. Enforcement of key withdrawal is not expected to occur until after the end of the grace period and may be deferred at payment system discretion. Modify the 9th Bullet of section 10.2.2.3 by adding an additional sentence as follows:
• Acquirers have a six month grace period (until June 30th of the following calendar year) to install any new keys in all terminals. Whenever possible the new keys will be distributed well in advance of December 31st thereby giving a longer period for key installation. Modify the 10th Bullet of section 10.2.2.3 as follows:
• Payment systems will not enable the new keys to be used for valid transactions until January 1st of the following year. Modify the 1st Bullet of section 10.2.5.2 as follows:
• Terminals that support offline static or dynamic data authentication or offline PIN encipherment shall provide support for six Certification Authority Public Keys per RID for member of EMVCo debit/credit applications based on this specification. Terminals shall support keys up to 1984 bits (248 bytes) in length, as specified in this specification. Modify the 1st Bullet of section 10.2.6.2 as follows:
• EMVCo, LLC, will provide a forum for members of EMVCo to share evaluation of cryptanalytic advances that might lead to potential compromise of the digital signature scheme specified in this specification. Modify the 2nd Bullet of Section 10.2.9.3 by appending the following sentence as follows:
• All Certification Authority Public Keys will have December 31st as their planned expiration date. Acquirers shall have a six month grace period (until June 30th of the following calendar year) to withdraw the revoked key. Enforcement of key withdrawal is not expected to occur until after the end of the grace period and may be deferred at payment system discretion. Replace the Sample Timeline of section 10.3.1 Key Introduction with the following and in the Sample Timeline of section 10.3.2 change the words “Enforcement Date” to “Enforcement Begins”: J FMAM J J A S OND Scheme Generates New CA Key & Distributes to Acquirers Acquirers Install Key in Terminals CA Signing of Issuer Certificates Cards Issued with New Certificates EMV Shared Policy Activities Payment System Policy Activities Legend