KL Bulletin No.27: EMVCo Annual RSA Key Lengths Assessment

Notice Bulletin No. 27 July 2023 EMV SWG NM83r2 EMVCo Annual RSA Key Lengths Assessment EMVCo, LLC (“EMVCo”) has completed its annual review of the Certification Authority Public Key lengths and expiry dates and makes the following recommendations to EMV®-based payment systems:

• 1408-bit keys are recommended to have an expiry date of 31 December 2024. Special portfolios that use a 1408-bit key should only continue to do so until 31 December 2025. Public keys that support these portfolios will need to remain in terminals until this date.
• 1984-bit keys are recommended to have an anticipated lifetime to at least 31 December 2033. EMVCo does not project beyond a 10-year horizon.
• No certificate should be issued that expires later than the expiry date of the CA key. Payment systems will decide individually whether to adopt the recommendations made in this Bulletin and will notify their members of their final decision. © 1994-2023 EMVCo, LLC. All rights reserved. Any and all uses of the EMV Specifications shall be permitted only pursuant to the terms and conditions of the license agreement between the user and EMVCo found at www.emvco.com