PCI Watch

Tracking changes across the Payment Card Industry

SB nº SU-38 : Terminal Key Management (Spec Change)

v1.0 Specification Bulletins

Specification Update Bulletin No. 38 Second Edition June 2005 Terminal Key Management This bulletin updates Book 4 to allow integrity checking of Certification Authority Public Keys on a batch basis

Applicability

This Draft Specification Update Bulletin applies to:

  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 4

Related Documents

This Draft Specification Update Bulletin should be read in conjunction with:

  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 2

Description

Section 11 of EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 2 requires that, when a new Certification Authority Public Key is introduced into a terminal, that the terminal be able to verify that it has received the key and its related data error-free from the acquirer. Book 2 further defines a data field called the Certification Authority Public Key Check Sum which may be used by the terminal when fulfilling this requirement, but also states that other techniques may be used to fulfil the requirement. Section 10 of EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 4 currently mandates that the Check Sum method be used. This Specification Update Bulletin modifies Book 4 in order to align with Book 2 and to thereby permit terminals to implement a more flexible approach to ensuring the integrity of the Certification Authority Public Key and its related data. Proposed Specification Change Notice In Section 10.2 of EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 4 insert the following Note before the final paragraph: Note: alternative integrity verification techniques may be used. The integrity of the stored Certification Authority Public Keys should be verified periodically. © 1994-2005 EMVCo, LLC (“EMVCo”). All rights reserved. Any and all uses of the EMV Specifications (“Materials”) shall be permitted only pursuant to the terms and conditions of the license agreement between the user and EMVCo found at http://www.emvco.com/specifications.cfm.