Document Comparison
PCI_PTS_HSM_Technical_FAQs_v4_May_2026.pdf
→
PCI_PTS_HSM_Technical_FAQs_v5_May_2026.pdf
62% similar
20 → 21
Pages
8401 → 7704
Words
54
Content Changes
Content Changes
54 content changes. 13 administrative changes (dates, page numbers) hidden.
Added
p. 11
Q 7 September 2015: The PCI Key Management Operations Security and Test Requirements stipulate that any cryptographic device used in connection with the acquisition of PIN data that is removed from service must have all keys stored within the device destroyed that have been used (or potentially could be) for any cryptographic purpose. If necessary to comply with the above, the device must be physically destroyed so that it cannot be placed into service again or allow the disclosure of any secret data or keys. Does this apply only to symmetric keys? A No. This applies to any secret or private key used by the device for PIN encipherment, firmware validation, display prompt control, or the protection of any of those same keys during loading to the device or storage within the device, including private keys used in connection with remote key distribution using asymmetric techniques. This requirement applies to …
Added
p. 14
Q 11 December (update) 2023: HSMs support Elliptic Curve Cryptography for various functions, including personalization, key conveyance, and transaction processing. Are there any specific implementations required? A In support of ECC used in the EMV® Contact and Contactless Specifications, HSMs used in personalization should support the Elliptic Curve Schnorr Digital Signature Algorithm (EC- SDSA). This will become mandatory in the next update of the HSM Security Requirements.
Q 1 September 2015: Is it acceptable for a PIN-encryption key to be used as a key-encrypting key, or for a key-encrypting key to be used as a PIN-encrypting key? A No. A key must be used for one purpose only, as mandated by ANSI X9.24 and ISO 11568-3.
Q 2 September 2015: Can a device use a key-encrypting key to encrypt or decrypt key-tag information along with a key? A Yes. Associated key-tag information, such as the algorithm, key expiration, usage, or key MAC, …
Q 1 September 2015: Is it acceptable for a PIN-encryption key to be used as a key-encrypting key, or for a key-encrypting key to be used as a PIN-encrypting key? A No. A key must be used for one purpose only, as mandated by ANSI X9.24 and ISO 11568-3.
Q 2 September 2015: Can a device use a key-encrypting key to encrypt or decrypt key-tag information along with a key? A Yes. Associated key-tag information, such as the algorithm, key expiration, usage, or key MAC, …
Modified
p. 1
Payment Card Industry (PCI) PTS HSM Security Requirements Technical FAQs for use with Version 4
Payment Card Industry (PCI) PTS HSM Security Requirements Technical FAQs for use with Version 5
Modified
p. 3
Q 2 June 2012: What part of the HSM lifecycle does the PCI HSM standard cover? A The PCI HSM standard covers the lifecycle of the HSM up to the point of its first delivery to the initial point of deployment facility. Subsequent stages of the HSM’s lifecycle continue to be of interest to PCI and are controlled by other PCI standards.
Q 2 June 2012: What part of the HSM life cycle does the PCI HSM standard cover? A The PCI HSM standard covers the life cycle of the HSM up to the point of its first delivery to the initial point of deployment facility. Subsequent stages of the HSM’s life cycle continue to be of interest to PCI and are controlled by other PCI standards.
Modified
p. 3
Q 3 December 2013: If a user has taken delivery of an HSM for which the hardware has been approved for PCI HSM, and all of the PCI HSM requirements relating to manufacturing and to delivery to the point of initial deployment have been met, but the shipped firmware/software has not been approved for PCI HSM, does the HSM become PCI HSM compliant when approved firmware/software is installed, or does the shipped firmware/software become approved at a later date? A …
Q 3 December 2013: If a user has taken delivery of an HSM for which the hardware has been approved for PCI HSM, and all of the PCI HSM requirements relating to manufacturing and to delivery to the point of initial deployment have been met, but the shipped firmware/software has not been approved for PCI HSM, does the HSM become PCI HSM compliant when approved firmware/software is installed, or does the shipped firmware/software become approved at a later date? A …
Modified
p. 4
Q 4 December 2013: Is it permissible to install firmware/software which is not PCI HSM approved on an HSM which is fully PCI HSM compliant, and for the PCI HSM compliance of the HSM to be restored at a later date by installing an approved version of firmware/software? A The PCI HSM compliance of the HSM ceases when the non-approved firmware/software is installed. The PCI HSM compliance of the HSM is restored if approved firmware/software is subsequently installed, subject to …
Q 4 December 2013: Is it permissible to install firmware/software that is not PCI HSM-approved on an HSM that is fully PCI HSM-compliant, and for the PCI HSM compliance of the HSM to be restored at a later date by installing an approved version of firmware/software? A The PCI HSM compliance of the HSM ceases when the non-approved firmware/software is installed. The PCI HSM compliance of the HSM is restored if approved firmware/software is subsequently installed, subject to the condition …
Modified
p. 4
Q 5 September 2015: Some attacks are technically simple in that they do not require an extensive identification, such as sniffing a communication on standard interfaces like USB/Ethernet between devices. How is the attack value calculation to be performed then? A For technically simple attacks that do not require an extensive identification, such as sniffing a communication on standard interfaces like USB/Ethernet between devices, all cost factors besides time and expertise should be disregarded. Also, attack time and expertise is …
Q 5 September 2015: Some attacks are technically simple in that they do not require an extensive identification, such as sniffing a communication on standard interfaces like USB/Ethernet between devices. How is the attack value calculation to be performed then? A For technically simple attacks that do not require an extensive identification, such as sniffing a communication on standard interfaces like USB/Ethernet between devices, all cost factors besides time and expertise should be disregarded. Also, attack time and expertise are …
Modified
p. 4
Q 7 September 2015: Can a device meet the PTS HSM requirements without having an active tamper response mechanism to zeroize secret and private keys during a penetration attack? A No. Regardless of which modules of the PTS HSM standard the device is designed to comply with, penetration of the device must cause the automatic and immediate erasure of any secret and private keys such that it becomes infeasible to recover the keying material. Secret or private cryptographic keys that …
Q 7 September 2015: Can a device meet the PTS HSM requirements without having an active tamper-response mechanism to zeroize secret and private keys during a penetration attack? A No. Regardless of which modules of the PTS HSM standard the device is designed to comply with, penetration of the device must cause the automatic and immediate erasure of any secret and private keys such that it becomes infeasible to recover the keying material. Secret or private cryptographic keys that are …
Modified
p. 5
Q 9 June 2016: Some HSMs exist as standalone cards/components which are meant to be installed into a larger chassis/compound enclosure. Are there any special requirements which must be met for HSMs with this form factor? A Yes. If an HSM is meant to be installed into a chassis/compound enclosure, a mechanism must be provided to validate the hardware and firmware version of the HSM. If this mechanism requires performing a procedure to retrieve this information⎯i.e., via a software library …
Q 9 June 2016: Some HSMs exist as standalone cards/components that are meant to be installed into a larger chassis/compound enclosure. Are there any special requirements that must be met for HSMs with this form factor? A Yes. If an HSM is meant to be installed into a chassis/compound enclosure, a mechanism must be provided to validate the hardware and firmware version of the HSM. If this mechanism requires performing a procedure to retrieve this information⎯i.e., via a software library …
Modified
p. 5
Q 10 November (update) 2018: Several requirements stipulate that if the device is restricted to deployment in Controlled Environments as defined in ISO 13491, then specific restrictions apply in the attack techniques that can be used. If the restrictions preclude any viable attacks for a specific requirement, how must that be presented in the evaluation report? A The report must present attack scenarios as stipulated in the derived test requirements. These must be presented without the restrictions of the Controlled …
Q 10 November (update) 2018: Several requirements stipulate that if the device is restricted to deployment in Controlled Environments as defined in ISO 13491, then specific restrictions apply in the attack techniques that can be used. If the restrictions preclude any viable attacks for a specific requirement, how must that be presented in the evaluation report? A The report must present attack scenarios as stipulated in the derived test requirements. These must be presented without the restrictions of the Controlled …
Removed
p. 6
Q 14 June 2025: Devices may support Post-Quantum Cryptography (PQC), also known as Quantum Resistant, in addition to classic cryptography. Specifically, cryptographic algorithms that are currently thought - e.g., as published by NIST - to be secure against a cryptanalytic attack by a quantum computer. Is there an option for this to be noted as part of the PCI approval? Yes. Where the lab validates the support of PQC algorithms in the API and/or processing of the device and includes that notation in the test report submitted to PCI, then it will be listed as Additional Information for the device. The details of the PQC must be stated in the security policy. The specifics for all cryptography and associated critical security parameters (CSPs) must be included in the relevant tables in the Security Policy. Encapsulation and signature algorithms must be implemented and be available through functional calls.
This notation in Additional …
This notation in Additional …
Modified
p. 6
Q 12 June 2022: Where a requirement specifies a need for the use of “cryptographic methods,” or the application of cryptography, to provide security. What is the intent of such requirements? A The intent of any requirement that references the need for cryptographic controls or the application of cryptography, is to ensure that the security of that system is based on the security of the underlying cryptographic protocol and key. It is not sufficient in such cases to rely solely …
Q 12 June 2022: Where a requirement specifies a need for the use of “cryptographic methods,” or the application of cryptography, to provide security. What is the intent of such requirements? A The intent of any requirement that references the need for cryptographic controls or the application of cryptography is to ensure that the security of that system is based on the security of the underlying cryptographic protocol and key. It is not sufficient in such cases to rely solely …
Modified
p. 6
• Other functionality impacting security requirements The submission must include a description of the services provided by the remote administration solution in the HSM Security Policy posted on the Approved PTS Devices website. This includes, where applicable, notation the solution must be used with a PCI PTS approved Key Loading Device if clear-text keying material is to be remotely loaded in conjunction with the use of the remote solution.
• Other functionality impacting security requirements The submission must include a description of the services provided by the remote administration solution in the HSM Security Policy posted on the Approved PTS Devices website. This includes, where applicable, notation that the solution must be used with a PCI PTS-approved Key Loading Device if cleartext keying material is to be remotely loaded in conjunction with the use of the remote solution.
Modified
p. 7
Q 15 September 2015: In the event of tamper, the device must become immediately inoperable and result in the automatic and immediate erasure of any secret information that may be stored in the device, such that it becomes infeasible to recover the secret information. Guidance notes provide that secret or private keys do not need to be zeroized if either or both of the following conditions exist:
• If any of these keys is not zeroized, other mechanisms must exist to …
• If any of these keys is not zeroized, other mechanisms must exist to …
Q 1 September 2015: In the event of tampering, the device must become immediately inoperable and result in the automatic and immediate erasure of any secret information that may be stored in the device, such that it becomes infeasible to recover the secret information. Guidance notes provide that secret or private keys do not need to be zeroized if either or both of the following conditions exist:
• If any of these keys is not zeroized, other mechanisms must exist to …
• If any of these keys is not zeroized, other mechanisms must exist to …
Modified
p. 7
Q 16 September 2015: A device uses a key that is randomly generated internally in the secure processor to protect other keys. This key is stored in the clear and protected within a register in the same secure processor. The secure processor resides within a secure area of the device. This key is used to encrypt other keys, which are stored encrypted outside the secure processor•e.g., in flash memory that also resides within the secure area of the device. Upon …
Q 2 September 2015: A device uses a key that is randomly generated internally in the secure processor to protect other keys. This key is stored in the clear and protected within a register in the same secure processor. The secure processor resides within a secure area of the device. This key is used to encrypt other keys, which are stored encrypted outside the secure processor•e.g., in flash memory that also resides within the secure area of the device. Upon …
Modified
p. 7
Q 17 September 2015: What standards and methods are used for measuring “electro-magnetic emissions”? A Vendors should take into account that EM emissions can be a risk to PIN data and should design to address this risk. There are many methods for shielding and minimizing EM emissions. The vendor must describe to the laboratory in writing how EM emissions are addressed by the device design. The laboratory will examine evidence provided by the vendor to determine if the evidence supports …
Q 1 September 2015: What standards and methods are used for measuring “electro-magnetic emissions”? A Vendors should take into account that EM emissions can be a risk to PIN data and should design to address this risk. There are many methods for shielding and minimizing EM emissions. The vendor must describe to the laboratory in writing how EM emissions are addressed by the device design. The laboratory will examine evidence provided by the vendor to determine if the evidence supports …
Modified
p. 8
Q 18 Does the device need to have an electronic audit record for pre-operational self-tests? A Yes. The device must include an audit record showing the self-test execution and record the result.
Q 1 Does the device need to have an electronic audit record for pre-operational self-tests? A Yes. The device must include an audit record showing the self-test execution and record the result.
Modified
p. 8
Q 19 May 2023: Error logs cannot be accessed without assuming an authenticated role supported by the cryptographic module. Does this apply in all circumstances? A In the case that the error log does not contain any sensitive module information, an operator can assume an authorized (any defined role) role that does not require authentication in order to gain access to the module’s error log. CSPs cannot be present in the error log. The access also must not allow the …
Q 2 May 2023: Error logs cannot be accessed without assuming an authenticated role supported by the cryptographic module. Does this apply in all circumstances? A In the case that the error log does not contain any sensitive module information, an operator can assume an authorized (any defined role) role that does not require authentication in order to gain access to the module’s error log. CSPs cannot be present in the error log. The access also must not allow the …
Modified
p. 8
Q 20 September 2015: What parties may possess keys used for the cryptographic authentication of firmware updates? A The firmware is the responsibility of the device vendor, and as such the cryptographic keys that authenticate it within the device must be held solely by the vendor or their designated agent.
Q 1 September 2015: What parties may possess keys used for the cryptographic authentication of firmware updates? A The firmware is the responsibility of the device vendor, and as such, the cryptographic keys that authenticate it within the device must be held solely by the vendor or their designated agent.
Modified
p. 8
Q 21 September 2015: Firmware updates must be cryptographically authenticated, and if the authentication fails, the update is rejected and deleted. Are there any circumstances where firmware can be updated without authentication? A Some chipsets are not designed for firmware updates, but only to support firmware replacement. The deletion of the existing firmware and cryptographic keys during the replacement does not allow for the authentication of the new firmware to occur.
Q 2 September 2015: Firmware updates must be cryptographically authenticated, and if the authentication fails, the update is rejected and deleted. Are there any circumstances where firmware can be updated without authentication? A Some chipsets are not designed for firmware updates, but only to support firmware replacement. The deletion of the existing firmware and cryptographic keys during the replacement does not allow for the authentication of the new firmware to occur.
Modified
p. 8
Q 22 September 2015: If a device supports firmware updates, the device must cryptographically authenticate the firmware, and if the firmware is not confirmed, the firmware update must be rejected and deleted. Can a device completely load new firmware before checking its authenticity and overwrite its primary copy of existing authenticated code if it retains a secure backup copy of the existing authenticated code? A Yes, provided the following is true:
Q 3 September 2015: If a device supports firmware updates, the device must cryptographically authenticate the firmware, and if the firmware is not confirmed, the firmware update must be rejected and deleted. Can a device completely load new firmware before checking its authenticity and overwrite its primary copy of existing authenticated code if it retains a secure backup copy of the existing authenticated code? A Yes, provided the following is true:
Modified
p. 8
• If the new code fails authentication, the backup copy of code is cryptographically authenticated, and if the backup copy is successfully authenticated, the device boots from the backup copy and the backup is then used to overwrite the new code that failed authentication.
• If the new code fails authentication, the backup copy of code is cryptographically authenticated; and if the backup copy is successfully authenticated, the device boots from the backup copy, and the backup is then used to overwrite the new code that failed authentication.
Modified
p. 9
Q 23 September 2015: Is it acceptable to XOR key components during key loading to satisfy the authentication requirements of B6? A The XOR of key components alone is not enough to constitute authentication. Some type of authentication of the users that use the key loading function, or authentication of the key-loading command is required.
Q 1 September 2015: Is it acceptable to XOR key components during key loading to satisfy the authentication requirements of B6? A The XOR of key components alone is not enough to constitute authentication. Some type of authentication of the users who use the key-loading function, or authentication of the key-loading command, is required.
Modified
p. 9
Q 24 September 2015: For devices that require the use of authentication data to access sensitive functions, and the authentication data are static, can the authentication data be sent with the device? A The authentication data can be sent with the device only when the authentication data is in tamper-evident packaging, such as the use of PIN mailers. Otherwise, separate communication channels must be used with pre-designated recipients.
Q 2 September 2015: For devices that require the use of authentication data to access sensitive functions, and the authentication data is static, can the authentication data be sent with the device? A The authentication data can be sent with the device only when the authentication data is in tamper-evident packaging, such as the use of PIN mailers. Otherwise, separate communication channels must be used with pre-designated recipients.
Modified
p. 9
Q 25 September 2015: Plain-text secret or private keys and their components may be injected into a HSM using a key loader (which has to be some type of secure cryptographic device). Are there any restrictions on loading keys via this methodology? A Yes. The loading of plain-text secret or private keys and their components using a key-loader device is restricted to a controlled environment.
Q 3 September 2015: Plaintext secret or private keys and their components may be injected into an HSM using a key loader (which has to be some type of secure cryptographic device). Are there any restrictions on loading keys via this methodology? A Yes. The loading of plaintext secret or private keys and their components using a key-loader device is restricted to a controlled environment.
Modified
p. 9
Q 26 September 2015: Devices may have functions for zeroizing secret and private keys in the device. Are these functions considered sensitive services that require authentication? A Yes. The intentional zeroization of secret or private keys in a non-tamper event is the execution of functions that are not available during normal use. This requires authentication consistent with the implementations of other sensitive services, such as the use of PINs/passphrases. If implemented, the device must force the authentication values to be …
Q 4 September 2015: Devices may have functions for zeroizing secret and private keys in the device. Are these functions considered sensitive services that require authentication? A Yes. The intentional zeroization of secret or private keys in a non-tamper event is the execution of functions that are not available during normal use. This requires authentication consistent with the implementations of other sensitive services, such as the use of PINs/passphrases. If implemented, the device must force the authentication values to be …
Modified
p. 10
Q 27 June 2022: Is it acceptable to generate security related cryptographic keys solely from known or low-entropy data, such as passwords or serial numbers? A No. Any process used to generate cryptographic keys must ensure that there is sufficient entropy provided for the output key, and that the key-generation process includes consideration for dual control and split knowledge requirements. Sufficient entropy is considered to be an entropy that is at least equal to the bit strength of the output …
Q 1 June 2022: Is it acceptable to generate security-related cryptographic keys solely from known or low-entropy data, such as passwords or serial numbers? A No. Any process used to generate cryptographic keys must ensure that there is sufficient entropy provided for the output key, and that the key-generation process includes consideration for dual control and split knowledge requirements. Sufficient entropy is considered to be an entropy that is at least equal to the bit strength of the output key. …
Modified
p. 10
Q 28 Are HSMs allowed to have keys that are not unique per device? A Yes, but only for load balancing and disaster recovery purposes.
Q 1 Are HSMs allowed to have keys that are not unique per device? A Yes, but only for load balancing and disaster recovery purposes.
Modified
p. 10
Q 29 September 2015: Is it acceptable for a device to have the ability to use Master Keys as both key-encryption keys for session key and as fixed keys•i.e., the Master Key could be used to encrypt PIN blocks and to decrypt session keys? A No. A key must be used for one purpose only as mandated in ANSI X9.24 and ISO 11568.
Q 2 September 2015: Is it acceptable for a device to have the ability to use Master Keys as both key-encryption keys for session key and as fixed keys•i.e., the Master Key could be used to encrypt PIN blocks and to decrypt session keys? A No. A key must be used for one purpose only, as mandated in ANSI X9.24 and ISO 11568.
Modified
p. 10
Q 30 September 2015: Is it acceptable to use the same authentication technique for loading both cryptographic keys and firmware? A The technique may be the same, but the secrets used for authentication must be different. Example: If RSA signatures are used, the RSA private key used to sign cryptographic keys for loading must be different from the private key used to sign firmware.
Q 3 September 2015: Is it acceptable to use the same authentication technique for loading both cryptographic keys and firmware? A The technique may be the same, but the secrets used for authentication must be different. Example: If RSA signatures are used, the RSA private key used to sign cryptographic keys for loading must be different from the private key used to sign firmware.
Modified
p. 10
Q 31 September 2015: Is it acceptable to use TDES ECB mode encryption for session keys when using the Master Key/session key technique? A Yes. TDES ECB mode can be used to encrypt session keys.
Q 4 September 2015: Is it acceptable to use TDES ECB mode encryption for session keys when using the Master Key/session key technique? A Yes. TDES ECB mode can be used to encrypt session keys.
Modified
p. 10 → 11
Q 32 September 2015: Is it acceptable to load double-length 128-bit TDES key components into a device in smaller bit-values⎯e.g., two 64-bit parts held by key custodian 1 and two 64-bit parts held by key custodian 2? A Yes, provided the 128-bit cryptographic TDES keys (and key components) are generated and managed as full double-length 128-bit TDES keys during their entire life cycle in accordance with ANSI X9.24 and ISO 11568.
Q 5 September 2015: Is it acceptable to load double-length 128-bit TDES key components into a device in smaller bit-values⎯e.g., two 64-bit parts held by key custodian 1 and two 64-bit parts held by key custodian 2? A Yes, provided the 128-bit cryptographic TDES keys (and key components) are generated and managed as full double-length 128-bit TDES keys during their entire life cycle in accordance with ANSI X9.24 and ISO 11568.
Modified
p. 10 → 11
It would not be acceptable to generate 64-bit keys or key components separately, and then concatenate them for use as a double length key after generation.
It would not be acceptable to generate 64-bit keys or key components separately, and then concatenate them for use as a double-length key after generation.
Modified
p. 10 → 11
If key-check values are used to ensure key integrity, they must be calculated over the entire 128- bit key component or the resultant 128-bit key, but never on a portion of the key or key
If key-check values are used to ensure key integrity, they must be calculated over the entire 128- bit key component or the resultant 128-bit key, but never on a portion of the key or key component. In addition, the resultant key inside the device must be recombined in accordance with PCI requirements and ANSI/ISO standards. Similarly, for triple-length keys, the entire 192- bit key component or the resultant 192-bit key must be used to calculate the key-check values.
Removed
p. 11
Q 34 November (update) 2022: ANSI X9.143 defines three keys. A key block protection key (KBPK), a key block encryption key (KBEK), and a key block MAC key (KBMK). The KBPK is used to calculate the KBEK and the KBMK. Can the KBPK be used for any other purpose? A No. In order to meet the requirement that a key is used only for a single purpose as defined in ANSI X9.24, the key block protection key is only used to calculate the KBEK and the KBMK, and is not used for any other purpose. Only the KBPK is used to generate the KBEK and the KBMK key; no other key is used for this purpose.
Q 35 November (update) 2022: The Guidance for DTR B10 states, “A device may include more than one compliant key-exchange and storage scheme. This does not imply that the device must enforce ANSI X9.143 or …
Q 35 November (update) 2022: The Guidance for DTR B10 states, “A device may include more than one compliant key-exchange and storage scheme. This does not imply that the device must enforce ANSI X9.143 or …
Modified
p. 11
Q 33 September 2015: Under what conditions is it acceptable for a device to allow single component plain-text cryptographic keys to be loaded via a keypad? A None. A device must not accept entry of single component plain-text cryptographic keys via a keypad. Full-length key components and encrypted keys may be loaded via a keypad if the requirements for sensitive functions are met.
Q 6 September 2015: Under what conditions is it acceptable for a device to allow single- component plaintext cryptographic keys to be loaded via a keypad? A None. A device must not accept entry of single-component plaintext cryptographic keys via a keypad. Full-length key components and encrypted keys may be loaded via a keypad if the requirements for sensitive functions are met.
Removed
p. 12
Q 37 May (update) 2018: Can secret keys or their components be used for other purposes, such as passwords/authentication codes, to enable the use of sensitive services? A No. The use of secret keys or their components for other purposes violates the requirement that keys be used for their sole intended purpose⎯e.g., key encipherment or PIN encipherment, etc.
Q 38 September 2015: The PCI PIN Security Requirements stipulate that any cryptographic device used in connection with the acquisition of PIN data that is removed from service must have all keys stored within the device destroyed that have been used (or potentially could be) for any cryptographic purpose. If necessary to comply with the above, the device must be physically destroyed so that it cannot be placed into service again or allow the disclosure of any secret data or keys. Does this apply only to symmetric keys? A No. This applies to …
Q 38 September 2015: The PCI PIN Security Requirements stipulate that any cryptographic device used in connection with the acquisition of PIN data that is removed from service must have all keys stored within the device destroyed that have been used (or potentially could be) for any cryptographic purpose. If necessary to comply with the above, the device must be physically destroyed so that it cannot be placed into service again or allow the disclosure of any secret data or keys. Does this apply only to symmetric keys? A No. This applies to …
Modified
p. 12 → 11
• Specific menu commands to zeroize stored keys
• Specific menu commands to zeroize stored keys.
Modified
p. 12 → 11
• Inducement of a tamper event to zeroize those keys
• Inducement of a tamper event to zeroize those keys.
Modified
p. 13 → 12
a) It must prevent the loading of PIN, MAC, and/or Data keys - or any keys used to manage these within the key hierarchy - from being used for another purpose. IPEK, KEKs, and derivation keys must be uniquely identified where supported. b) It must prevent the determination of key length for variable length keys. c) It must ensure that the key can only be used for a specific algorithm (such as TDES or AES, but not both). d) It …
Q 8 November (update) 2022: Are there any restrictions on how the master key is loaded into the device? A The initial master key (MK) must be loaded to the device using either asymmetric key-loading techniques or manual techniques•e.g., a keypad, IC cards, key-loading device, etc. It may also be internally generated and exported to hardware-management devices. Subsequent loading of the master key may use asymmetric techniques, manual techniques, self-generation, etc. Keys are not allowed to be reloaded by any …
Modified
p. 13
Q 39 November (update) 2022: Devices must support the ANSI X9.143 key-derivation methodology for TDES keys, and for AES keys must support either the ANSI X9.143 methodology or the ISO 20038 methodology. In either case, equivalent methods can be used where subject to an independent expert review and said review is publicly available as described. What characteristics enforced in ANSI X9.143 and ISO 20038 must be considered in determining equivalence? A “Equivalency” must be demonstrated in the context of security …
Q 10 November (update) 2022: Devices must support the ANSI X9.143 key-derivation methodology for TDES keys, and for AES keys must support either the ANSI X9.143 methodology or the ISO 20038 methodology. In either case, equivalent methods can be used where subject to an independent expert review and said review is publicly available as described. What characteristics enforced in ANSI X9.143 and ISO 20038 must be considered in determining equivalence? A “Equivalency” must be demonstrated in the context of security …
Removed
p. 14
Q 41 November (update) 2022: Devices must support the ANSI X9.143 key-derivation methodology for TDES keys, and for AES keys must support either the ANSI X9.143 methodology or the ISO 20038 methodology. In either case, equivalent methods can be used where subject to an independent expert review and said review is publicly available for peer review. What constitutes publicly available? A “Publicly available" means posted in a forum or otherwise published such that it is available for peer review for the time frame for which the solution is relied upon.
Q 42 December 2022: For Key Blocks, is the same MAC key allowed to be used across different MAC algorithms, or is a key unique to each algorithm implemented required? A A key unique to each implemented MAC algorithm must be used as specified in ANSI X9.143.
Q 43 March (update) 2024: Can an HSM support other key distribution using asymmetric techniques …
Q 42 December 2022: For Key Blocks, is the same MAC key allowed to be used across different MAC algorithms, or is a key unique to each algorithm implemented required? A A key unique to each implemented MAC algorithm must be used as specified in ANSI X9.143.
Q 43 March (update) 2024: Can an HSM support other key distribution using asymmetric techniques …
Modified
p. 14 → 19
Q 40 November (update) 2022: HSMs are required to support key blocks using the ANSI X9.143 key-derivation methodology for TDES keys, and for AES keys must support either the ANSI X9.143 methodology and/or the ISO 20038 methodology. ANSI X9.143 and ISO 20038 are methods to package keys (the key blocks) for conveyance or storage, but they use symmetric mechanisms for that and for key conveyance require a symmetric key- exchange key that is pre-shared for use as the key block …
Q 1 November (update) 2022: HSMs are required to support key blocks using the ANSI X9.143 key-derivation methodology for TDES keys, and for AES keys, must support either the ANSI X9.143 methodology and/or the ISO 20038 methodology. ANSI X9.143 and ISO 20038 are methods to package keys (the key blocks) for conveyance or storage, but they use symmetric mechanisms for that, and for key conveyance require a symmetric key- exchange key that is pre-shared for use as the key block …
Modified
p. 14 → 19
• The Key Block Header (KBH) which contains attribute information about the Key and the Key Block
• The Key Block Header (KBH), which contains attribute information about the Key and the Key Block
Modified
p. 14 → 19
• The Key Block Binding Method However, TR-34 uses asymmetric methods for the Key Block Binding Method, instead of the symmetric methods used in ANSI X9.143 or ISO 20038 which require that a symmetric key was previously exchanged between the POI device and the KDH.
• The Key Block Binding Method However, TR-34 uses asymmetric methods for the Key Block Binding Method, instead of the symmetric methods used in ANSI X9.143 or ISO 20038, which require that a symmetric key has been previously exchanged between the POI device and the KDH.
Removed
p. 15
Q 45 March 2024: Preventing the determination of the key length for variable length symmetric keys is required for proprietary key blocks. Does this apply to ISO 20038 or ANSI X9.143 key blocks? A ISO 20038 and X9.143 specify that TDEA and AES keys should use key length obfuscation to hide the true key length. Where padding is used:
• TDEA keys less than 192 bits shall be padded to 192 bits
• AES keys less than 256 bits shall be padded to 256 bits.
Padding will become mandatory in the next update of the HSM Security Requirements.
• TDEA keys less than 192 bits shall be padded to 192 bits
• AES keys less than 256 bits shall be padded to 256 bits.
Padding will become mandatory in the next update of the HSM Security Requirements.
Modified
p. 15 → 20
Q 46 May 2026: Are hybrid or post-quantum cryptographic key-transport mechanisms permitted for HSMs? A Yes. Hybrid and pure post-quantum cryptographic (PQC) key-transport mechanisms are permitted, provided that:
Q 2 May 2026: Are hybrid or post-quantum cryptographic key-transport mechanisms permitted for HSMs? A Yes. Hybrid and pure post-quantum cryptographic (PQC) key-transport mechanisms are permitted, provided that:
Removed
p. 16
Q 48 September 2015: Is it acceptable for a PIN-encryption key to be used as a key-encrypting key, or for a key-encrypting key to be used as a PIN-encrypting key? A No. A key must be used for one purpose only as mandated by ANSI X9.24 and ISO 11568-3.
Q 49 September 2015: Can a device use a key-encrypting key to encrypt or decrypt key-tag information along with a key? A Yes. Associated key-tag information such as the algorithm, key expiration, usage, or key MAC may be encrypted or decrypted along with the key using a key-encrypting key. The key and its tag are bound together using a chaining mode of encipherment as defined in IS0 10116.
Q 49 September 2015: Can a device use a key-encrypting key to encrypt or decrypt key-tag information along with a key? A Yes. Associated key-tag information such as the algorithm, key expiration, usage, or key MAC may be encrypted or decrypted along with the key using a key-encrypting key. The key and its tag are bound together using a chaining mode of encipherment as defined in IS0 10116.
Modified
p. 16 → 21
Q 47 May 2026: What are examples of hybrid and PQC Key-Transport Mechanisms? A Examples include, but are not limited to:
Q 3 May 2026: What are examples of hybrid and PQC Key-Transport Mechanisms? A Examples include, but are not limited to:
Removed
p. 17
Q 50 May 2022: If a PIN block translating HSM does not enforce a unique key per transaction encryption for the resulting PIN block, what restrictions apply to prevent the misuse of card issuance-related functions? A The following restrictions apply:
• Standard PIN block formats⎯i.e., ISO format 0, 1, 2, 3 and 4⎯shall not be translated into non-standard PIN block formats and translations between these PIN block formats shall be restricted as specified in the table in DTR B14.
• PIN block translations where the real PAN or PAN Token changes⎯i.e., PAN translation⎯shall not be permitted, except in any of the following circumstances:
For card issuance, where i) the translation is between PIN blocks using real PANs, ii) the introduction of a new PAN is required to support account number changes, and iii) it is not performed in interchange processing systems; or For translation between a tokenized PAN and a “real” …
• Standard PIN block formats⎯i.e., ISO format 0, 1, 2, 3 and 4⎯shall not be translated into non-standard PIN block formats and translations between these PIN block formats shall be restricted as specified in the table in DTR B14.
• PIN block translations where the real PAN or PAN Token changes⎯i.e., PAN translation⎯shall not be permitted, except in any of the following circumstances:
For card issuance, where i) the translation is between PIN blocks using real PANs, ii) the introduction of a new PAN is required to support account number changes, and iii) it is not performed in interchange processing systems; or For translation between a tokenized PAN and a “real” …
Removed
p. 18
Q 52 September 2015: The operating system of the device must contain only necessary components and must be configured securely and run with least privilege. What is considered an “operating system” for PCI purposes? A In the scope of PCI PTS, any underlying software providing services for code running in the device is considered part of the operating system. Examples of such services include: system initialization and boot, hardware abstraction layers, memory management, multitasking, synchronization primitives, file systems, device drivers, and networking stacks. In addition, services that provide security or may impact security are considered firmware. Operating systems may range from hardware abstraction layer libraries and embedded micro- kernels to complex multi-user operating systems.
Q 53 February 2020: Can an HSM operating in PCI-mode support known weak cryptographic algorithms/key sizes not otherwise allowable when used for EMV card personalization? A Yes. When used for EMV card personalization an HSM when operating …
Q 53 February 2020: Can an HSM operating in PCI-mode support known weak cryptographic algorithms/key sizes not otherwise allowable when used for EMV card personalization? A Yes. When used for EMV card personalization an HSM when operating …
Removed
p. 19
• Translation of PIN block formats that include the PAN, to PIN block formats that do not include the PAN, shall not be supported. In particular, ISO PIN-block formats 0, 3, and 4 are not translated into any PIN-block formats other than 0, 3, or 4
• PIN-block translations from ISO format 0, 3, or 4 to any of ISO format 0, 3, or 4 do not support a change in PAN. This translation restriction is not applicable to surrogate PANs used in tokenization implementations.
• If ISO format 1 is translated to ISO format 0, 3, or 4, it is not translated back to ISO format 1.
Q 56 May (update) 2018: Is the device allowed to share PCI relevant keys and passwords/authentication codes between PCI approved mode of operation and non-PCI approved mode of operation? A No. The device must either enforce separation of all PCI relevant keys and passwords/authentication codes …
• PIN-block translations from ISO format 0, 3, or 4 to any of ISO format 0, 3, or 4 do not support a change in PAN. This translation restriction is not applicable to surrogate PANs used in tokenization implementations.
• If ISO format 1 is translated to ISO format 0, 3, or 4, it is not translated back to ISO format 1.
Q 56 May (update) 2018: Is the device allowed to share PCI relevant keys and passwords/authentication codes between PCI approved mode of operation and non-PCI approved mode of operation? A No. The device must either enforce separation of all PCI relevant keys and passwords/authentication codes …
Removed
p. 20
Q 59 August 2022: Vendors can have various options for both hardware and firmware that may be either security- or non-security-relevant. For non-security-relevant options, vendors are allowed to designate in their hardware/firmware identifiers a lower case “x” in the relevant position. Security-relevant options must have specific numbers and/or letters assigned and listed as part of the approval. The Program Guide specifies that options, both security- and non-security-relevant must be clearly defined and documented as to the options available and their function in the device’s Security Policy. Through oversight, some Security Policies do not have this information. Does this information need to be included? A Yes. All report submittals, whether “New” or “Delta” must ensure that the device’s Security Policy required for the PCI website includes this information. This includes necessary updates to existing Security Policies.
Q 60 April 2023: HSM virtualization systems that are not implemented within a physical system that …
Q 60 April 2023: HSM virtualization systems that are not implemented within a physical system that …
Modified
p. 20 → 21
Q 61 September 2015: Many devices are designed so that third parties can create and load applications. Vendors often support this by providing third parties the tools needed to create and load applications. How can a vendor ensure that the application will not need to be controlled by the vendor? A If applications are not considered firmware, they do not need to be controlled by the vendor. The device design must prevent applications from impacting functions and features governed by …
Q 1 September 2015: Many devices are designed so that third parties can create and load applications. Vendors often support this by providing third parties the tools needed to create and load applications. How can a vendor ensure that the application will not need to be controlled by the vendor? A If applications are not considered firmware, they do not need to be controlled by the vendor. The device design must prevent applications from impacting functions and features governed by …