PCI Watch

Tracking changes across the Payment Card Industry

Document Comparison

PCI_POS_PED_DTRs_v1-3.pdf → PCI_POS_PED_DTRs_v2-1.pdf
36% similar
59 → 64 Pages
21770 → 21338 Words
250 Content Changes

From Revision History

  • September 2006 2.x Draft published for comment

Content Changes

250 content changes. 88 administrative changes (dates, page numbers) hidden.

Added p. 1
Payment Card Industry (PCI) POS PIN Entry Device (PED) Derived Test Requirements Version 2.1

September 2006 2.x Draft published for comment

November 2006 2.x Formatting changes

April 2007 2.x A7, A11, B1, B4, B10, B11, D1, D4, Appendices B, C
Added p. 3
January 2009 2.1 Clarifications and errata Requirements A7, B10, B11, B12, B13 and B14 were formerly Online PIN only requirements and are now Core requirements applicable to all devices evaluated using these requirements.

In order to provide greater consistency with International Standards and to generalize the calculations, requirements that formerly were based on a dollar threshold for attacks have been converted to a point- based attack potential scheme.

Additional guidance notes have been added for emphasis. These guidance notes exist in the Technical FAQ for the current requirements. The Technical FAQ is available at www.pcisecuritystandardscouncil.org.
Added p. 7
Core Derived Test Requirements•Physical DTR A1.1 Tamper-Detection Mechanisms The PED uses tamper-detection and response mechanisms that cause the PED to become immediately inoperable and results in the automatic and immediate erasure of any secret information that may be stored in the PED, such that it becomes infeasible to recover the secret information. These mechanisms protect against physical penetration of the device by means of (but not limited to) drills, lasers, chemical solvents, opening covers, splitting the casing (seams), and using ventilation openings; and there is not any demonstrable way to disable or defeat the mechanisms and insert a PIN-disclosing bug or gain access to secret information without requiring an attack potential of at least 25 per PED, exclusive of the IC card reader for identification and initial exploitation as defined in Appendix B of PCI POS PED DTRs.

The objective of this section is to assess the PED’s ability to protect …
Added p. 10
“Immediate” is defined as fast enough to ensure erasure occurs before the tamper- detection mechanisms can be disabled using attack methods described in A1.1. Private or secret cryptographic keys that are never used to encrypt or decrypt data, or are not used for authentication, do not need to be considered sensitive data and therefore do not need to be erased, e.g., where the device uses a chip set that automatically generates keys at initialization but the keys are not subsequently used by the device.

TA2.4 The tester shall attempt to remove the access cover by disabling or defeating the tamper-detection mechanisms. To remove the cover the tester may open, pry, or otherwise disassemble the PED at the cover seams and remove other plates, connectors, etc. to gain access to the tamper-detection mechanisms. Removal shall not consist of drilling, milling, burning, melting, grinding, or dissolving the cover or enclosure. The tester may …
Added p. 14
TA5.3 The tester shall verify that any audible tones accompanying PIN entry are indistinguishable e.g., by listening to the tones while entering a PIN number or by otherwise analyzing or measuring the tone or tone generation circuitry.
Added p. 15
For A6 monitoring sound refers to other audible sounds apart from the beep generated by the PED when a key is pressed.

TA6.3 The tester shall visually inspect the PED to verify the assertions provided by the vendor in the PCI POS PED Evaluation Vendor Questionnaire relating to protections against the monitoring of sound, electro-magnetic emissions, power consumption or any other external characteristic available for monitoring. This could include verifying that any components that provide protection are as stated by the vendor.

TA6.5 The tester shall develop attack scenarios to defeat or circumvent the protection mechanisms against the monitoring of sound, electro-magnetic emissions, power consumption or any other external characteristic available for monitoring, using attack scenarios which require an attack potential of <25 per PED for identification and initial exploitation. The attack potential calculation shall be based on the scheme depicted in Appendix B.
Added p. 16
The vendor may need to supply specific test software to the evaluation laboratory to enable rigorous side channel attack analysis to be performed.

Keys resident in the PED or ICC reader means plain-text secret or private keys. If the encrypted keys are protected in accordance with the minimum key sizes and parameters for the key-encipherment algorithm(s) used as stipulated in B11 they do not need to be considered.

TA7.3 The tester shall attempt to develop attack scenarios to determine any PIN-security- related cryptographic key resident in the PED either by penetration or by monitoring emanations from the PED. The attack potential calculation shall be based on the scheme depicted in Appendix B. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity. If an attack scenario can be developed that requires an attack potential of <35 per PED for identification …
Added p. 17
Cryptographic keys that are never used to encrypt or decrypt data; or are not used for authentication, do not need to be considered secret data, and therefore do not need to be erased.

TA8.1.1 The tester shall examine the response to Section A8.1 of the PCI POS PED Evaluation Vendor Questionnaire, relating to user prompts, and alteration of prompts for consistency. The tester shall verify that mechanisms exist to ensure the authenticity and proper use of the prompts and modification of the prompts or improper use of the prompts is prevented.

TB8.1.4 The tester shall examine the vendor-supplied documentation to verify that the cryptographic controls to ensure the authenticity and the proper use of the prompts provide for unique accountability and utilize key sizes appropriate for the algorithm(s) in question. Examples of appropriate algorithms and minimum key sizes are:

Minimum key size in number of bits DES refers to non-parity bits. The RSA …
Added p. 24
Incorporation of the MSR within the casing of the PED that provides active tamper- response mechanisms should be sufficient to meet this requirement.

A11 applies to any attended POS PED with an integrated MSR.

TA11.4 The tester shall perform tests to verify that the protections of the device are such that the hardware and software cannot be tampered without requiring an attack potential of at least 14 for identification and initial exploitation. The attack potential calculation shall be based on the scheme depicted in Appendix B.

The device must perform an internal self-test automatically at least once every day, in addition to at power-up. It is acceptable to perform firmware integrity checks before each PIN transaction as opposed to performing them at least once every 24 hours. Self-tests after several minutes of inactivity may also be used, rather than once every 24 hours, in addition to power-up self-tests.

Software integrity tests may include SHA-1 …
Added p. 27
Firmware is considered to be any code within the PED that provides security protections needed to comply with PCI requirements. Other code that exists within the device that does not provide security, and cannot impact security, is not considered firmware under PCI requirements.
Added p. 28
Minimum key size in number of bits DES refers to non-parity bits. The RSA key size refers to the size of the modulus. The Elliptic Curve key size refers to the minimum order of the base point on the elliptic curve; this order should be slightly smaller than the field size. The DSA key sizes refer to the size of the modulus and the minimum size of a large subgroup.

Firmware is considered to be any code within the PED that provides security protections needed to comply with PCI requirements. Other code that exists within the device that does not provide security, and cannot impact security, is not considered firmware under PCI requirements.

TB4.5 The tester shall examine the vendor-supplied documentation to verify that the controls provide for unique accountability and utilize key sizes appropriate for the algorithm(s) in question. Examples of appropriate algorithms and minimum key sizes are:

AES may also be …
Added p. 36
a) When entering plain-text secret keys through the keypad, they must be entered as two or more components and require the use of at least two passwords/PINs. The passwords must be entered through the keypad or else conveyed encrypted into the device. These passwords/PINs must either be unique per device (and per custodian), except by chance, or if vendor default, they are pre-expired and force a change upon initial use. Passwords/PINs that are unique per device can be made optionally changeable by the acquirer, but this is not required. Passwords/PINs are at least five characters. Entry of key components without the use of at least two separate passwords/PINs results in the zeroization of pre-existing secret keys, i.e., the invoking of the key loading function/command causes the zeroization prior to the actual loading of the new key. For devices supporting multiple key hierarchies (e.g., multi-acquirer devices), only the hierarchy (specific TMK …
Added p. 39
TB11.9 The tester shall determine from vendor documentation how (e.g., active or passive erasure) each key is destroyed for all device states (power-on, power-off, sleep mode) and list the details in a key summary table.

c) Master/Session The PED must also support at least one of the following PIN Block Formats if supporting online PIN Entry:

c) ISO Format 3 For offline PIN:

a) The PIN that is submitted by the IC reader to the IC shall be contained in a PIN block conforming to ISO Format 2 PIN block. This applies whether the PIN is submitted in plain text or enciphered using an encipherment key of the IC.

b) Where the IC Card reader is not integrated into the PED, and PINs are enciphered only for transmission between the PIN entry device and the IC reader, the PED shall use one of the PIN block formats specified in ISO 9564. Where ISO Format …
Added p. 41
PIN-encryption keys shall only be used to encrypt PIN data. Key-encrypting keys shall only be used to encrypt keys. PIN keys shall never be used to encrypt keys. Key-encrypting keys shall never be used to encrypt PIN data.

The intent of the requirement is to help ensure that these keys are not intentionally used for multiple purposes. Thus the integrity check applies when the device is initially loaded with these keys. Session keys (working keys such as PIN, Data, and MAC keys) or key- encipherment keys subsequently downloaded during normal operations must be randomly generated, and there should only be collisions (duplication) by chance.

This is not intended to require that the device compare keys across different key hierarchies associated with different acquirers.

TB13.4 The tester shall verify by testing, that the PED enforces that data keys, key- encipherment keys and PIN-encryption keys have different values, e.g. by attempting to load keys of …
Added p. 44
The term “externally selected” means: selected by an interface function to the PED component that performs the PIN encryption. Both human interfaces and command interfaces are considered, and both direct and indirect.

External selection also includes interference with or manipulation of the data by which the PED selects the key to be used.

Keys may be selected through the PED keypad, or commands sent from another device such as an electronic cash register. Any commands sent from another device must be cryptographically authenticated to protect against man-in-the-middle and replay attacks, C1 is not applicable to devices that do not include commands for external key selection, or cannot hold multiple key hierarchies related to PIN encryption.

If an application can select keys from multiple key hierarchies, the PED must enforce authentication of commands used for external key selection. If the PED only allows an application to select keys from a single hierarchy, then command …
Added p. 49
ƒ Both D4.1 and D4.2 must be complied with for any non-integrated device supporting offline PIN entry.

It is not acceptable to answer “No” or “N/A” to any option under D4 that is supported by the PED. As part of this test procedure, the evaluator must verify that the vendor has answered “Yes” to all methods of PIN transmission between the PED and the ICC reader that are supported by the UPT. A plain-text PIN from the PED to the ICC reader is never permitted except when the PED and ICC reader are integrated into the same secure module. Both D4.1 and D4.2 must be complied with for any non-integrated device supporting offline PIN entry.

It is not acceptable to answer “No” or “N/A” to any option under D4 that is supported by the PED. As part of this test procedure, the evaluator must verify that the vendor has answered “Yes” to …
Added p. 56
c) Potential for the access to the POS PED; nts, IT hardware, software required for the d) Equipment required like instruments, compone analysis;

c) Potential for the access to the POS PED; nts, IT hardware, software required for the d) Equipment required like instruments, compone analysis;

2. Exploitation s levels of expe a) Attack time for the variou
Added p. 57
a) Experts are familiar with the underlying algorithms, protocols, hardware, structures, etc. implemented in the product or system type and the principles and concepts of security employe ient persons are knowledgeable in that they are familiar with the security behavior of the If pr enginee The e technolo ired for an attack. The use of Multiple Experts must concern fields that are strictly different, e.g. actu Multiple vel. his is follows: mation concerning the POS PED (e.g., as gained from vendor technical Care sh n here to distinguish between information required to identify the vulnerability and the info info Special with the information required for pers and lower th the greater the n ough the efforts of others, attack tools requiring little devices might be regularly purchased. Functional samples with working keys are fully functional devices, which might be used to verify an attack method or to actually perform an …
Added p. 59
Multiple Devices It is intended that the Identification phase of an attack calculation accounts for testing and development of an attack, such that the Exploitation phase of an attack is likely be successful. PCI does not intend multiple devices to be used during the attack phase to account for the probability of success. If multiple devices are included as part of an attack, strong justification must be provided. In all cases, the valid attack scenario(s) with the lowest attack potentials must be presented.
Added p. 60
Table 2: Attack Potential Factors Identification Exploitation < 1 hour 0 0 ≤ 1 day 1 2 ≤ 1 week 2 3 ≤ 1 month 3 4 Attack time > 1 month 5 7 Layman 0 0 Proficient 1 1 Expert 2 3 Multiple Expert 5 6 Public 0 0 Restricted 2 2 Knowledge of the POS PED Sensitive 3 4 Mechanical sample 1 1 Functional samples without working keys Access to the POS PED per unit required for the attack.

Note: If more than one unit is required, the values must be multiplied by the factors given above.
Added p. 61
4. The sensitive data is collected from the PED.

We assume that more than one sample of the device is needed for the identification phase but only the target device is required for the exploitation phase of the attack. The skill level required is Expert. The same standard equipment is used and required at identification and exploitation time. The following table consists of references to the attack phases.
Added p. 62
Table 4: Attack Potentials Example for DPA Analysis Aspect Identifying Value Exploiting Value Attack time > 1 month 5 < 1 month 3 Expertise Expert 2 Expert 3 Knowledge of the device Restricted 2 Public 0 Access to PED Functional sample with trial keys 2 Functional sample with working keys Equipment Bespoke 5 Specialized 4 Specific parts Standard 1 No further parts required Attack potential per phase 17 14 Total Attack Potential 31 As can be seen from the table, the attack potential is below the margin of 35 for the attack potential high level. If a key can be attacked which does not require the entry of a PIN at the keypad and the attack time is less than a day, the attack potential is even lower.
Added p. 63
A note on sts versions: Prior to version of 1.7, the Discrete Fourier Transform (Spectral) test was conducted using the incorrect peak height threshold value (called T in Section 2.6.4 of SP 800-22) and calculated the normalized difference (d) incorrectly. In order to use an older version of the sts tool, the corrections described in [Kim 2004] should be implemented for this test. In versions 1.7 and later, these corrections are already included.

The tester should request and obtain a sample of 230 bits from the vendor. The tester should exercise care to verify that the vendor supplied data is interpreted correctly by the sts tool (the sts tool assumes that binary data is in big-endian formatting on all platforms).

All tests other than the Lempel-Ziv test should be run [0] (for later versions of sts, the Lempel-Ziv test is normally inaccessible).

The sts testing on the data shall be judged as a …
Removed p. 2
April 2004 1.0 New document based on alignment of Visa and MasterCard PIN Entry Device Security Requirements.

September 2004 1.1 Updated based on benchmark testing and industry comments.

September 2004 1.2 Minor adjustments to Requirement A3 based on additional industry comments. 9-10

February 2005 1.3 Minor adjustments to Requirements A1 and A3 based on additional industry comments and minor errata.
Removed p. 5
For example, the first DTR under A1.1.1 is:
Modified p. 5 → 6
DTR A1.1 Tamper-detection Mechanisms Each PCI requirement has been divided into its component parts. These parts are identified by the corresponding PCI requirement number and a number distinguishing it from other components of the same requirement.
DTR A1.1 Tamper-Detection Mechanisms When appropriate, each PCI requirement has been divided into component parts. These parts are identified by the corresponding PCI requirement number and a number distinguishing it from other components of the same requirement.
Modified p. 5 → 6
For example, the first component under the section for DTR A1.1 is:
For example, the first component under the section for DTR A.1.1 is:
Removed p. 6
A1.1.2 The tamper-detection mechanisms cause the PED to become immediately inoperable and results in the automatic and immediate erasure of any secret information, which may be stored in the PED.

• Attack scenarios should consider keypad removal or replacement associated with vending machines or such like.
Modified p. 6 → 7
TA1.1.1.2 The tester shall examine additional relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
TA1.1.2 The tester shall examine additional relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
Modified p. 6 → 7
• “Immediate” is defined as fast enough to ensure erasure occurs before the tamper- detection mechanisms can be disabled using attack methods described in A1.1. For those devices that do not contain secret information, device disablement may be used in lieu of “immediate erasure of all secret information”
Immediate is defined as fast enough to ensure erasure occurs before the tamper-detection mechanisms can be disabled using attack methods described in A1.1.
Modified p. 6 → 8
TA1.1.2.2 The tester shall examine the response to Section A1.1 of the PCI POS PED Evaluation Vendor Questionnaire relating to response of the PED to tamper detection, for consistency.
TA1.1.4 The tester shall examine the response to Section A1.1 of the PCI POS PED Evaluation Vendor Questionnaire relating to response of the PED to tamper detection, for consistency.
Modified p. 6 → 8
TA1.1.2.3 The tester shall examine vendor-supplied documentation to determine if the PED employs active or passive (i.e., removal of power) erasure. If the PED employs passive erasure, the tester shall verify that erasure occurs rapidly enough to prevent an attacker from opening the PED and stopping erasure before it is effective. The tester may create an attack scenario, which may be performed in its entirety or in part to verify the theory.
TA1.1.5 The tester shall examine vendor-supplied documentation to determine if the PED employs active or passive (i.e., removal of power) erasure. If the PED employs passive erasure, the tester shall verify that erasure occurs rapidly enough to prevent an attacker from opening the PED and stopping erasure before it is effective. The tester may create an attack scenario, which may be performed in its entirety or in part to verify the theory.
Modified p. 7 → 8
TA1.1.3.1 The tester shall develop attack scenario(s) to disable or defeat the tamper- detection mechanisms and insert a PIN-disclosing bug or gain access to secret information, which costs less than $25,000 per PED. The cost calculation shall be based on the scheme depicted in Appendix B. The tester may perform any test needed to validate the attack scenario. The tester will use his or her own judgment in determining the appropriate tests and whether the attack will be performed in …
TA1.1.6 The tester shall develop attack scenario(s) to disable or defeat the tamper-detection mechanisms and insert a PIN-disclosing bug or gain access to secret information, which requires an attack potential of <25 per PED, exclusive of the ICC reader, for identification and initial exploitation. The attack potential value shall be based on the scheme depicted in Appendix B. The tester may perform any test needed to validate the attack scenario. The tester will use his or her own judgment in …
Modified p. 7 → 9
In general, techniques may include any combination of tamper detection or tamper evidence. Security mechanisms must not rely on insecure services or characteristics provided by the PED such as (but not limited to) its power supply and unprotected wires. Tamper-evident labels and similar methods are not considered security mechanisms.
In general, techniques may include any combination of tamper detection or tamper evidence. Security mechanisms must not rely on insecure services or characteristics provided by the PED such as (but not limited to) its power supply and unprotected wires. Tamper-evident labels and similar methods involving tamper evidence are not considered security mechanisms.
Modified p. 7 → 9
TA1.2.1.1 The tester shall examine the response to Section A1.2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A1.2 of the PCI POS PED Security Requirements manual for consistency relevant to DTR.A1.2.1. The vendor responses should clearly indicate that the failure of a single security mechanism does not compromise PED security.
TA1.2.1 The tester shall examine the response to Section A1.2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A1.2 of the PCI POS PED Security Requirements manual for consistency relevant to DTR A1.2. The vendor responses should clearly indicate that the failure of a single security mechanism does not compromise PED security.
Modified p. 7 → 9
TA1.2.1.2 The tester shall examine any additional relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
TA1.2.2 The tester shall examine any additional relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
Modified p. 7 → 9
TA1.2.1.3 The tester shall verify that protection against a threat is based on a combination of at least two independent security mechanisms.
TA1.2.3 The tester shall verify that protection against a threat is based on a combination of at least two independent security mechanisms.
Removed p. 8
Guidance Objective of this section is to assess the PED’s ability to protect clear text PINs and other sensitive data. Attack scenarios must be in support of compromise of clear-text PINs and other sensitive data.

A2.1.2 The tamper-detection mechanisms cause the automatic and immediate erasure of all secret information contained in the PED.

Guidance “Immediate” is defined as fast enough to ensure erasure occurs before the tamper- detection mechanisms can be disabled using attack methods described in A1.1. Attack scenarios should consider keypad removal or replacement associated with vending machines or such like.

A2.1.3 There is no demonstrable way to disable the detection or the erasure mechanism without the expenditure of at least US $25,000 per PED.

TA2.1.3.2 The tester shall calculate the projected cost of disabling or defeating the tamper- detection mechanisms. The cost calculation shall be based on the scheme depicted in Appendix B.
Modified p. 8 → 10
TA2.1.1.2 The tester shall examine additional relevant documentation, such as schematics and assembly drawings submitted by the vendor to verify that it supports the vendor responses.
TA2.2 The tester shall examine any relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
Modified p. 8 → 10
TA2.1.2.1 The tester shall activate the PED tamper-detection mechanisms and then perform tests to support evidence that keys and secret data have been erased by the action. Tests that may be performed could include attempting a transaction to determine if the transaction fails, using a special function of the PED that allows a user to determine the status of secret data, or using special software to determine if secret data has been erased.
TA2.6 The tester shall open the PED to activate the tamper-detection mechanisms, and then perform tests to support evidence that keys and secret data have been erased. Tests that may be performed could include attempting a transaction to determine if the transaction fails, using a special function of the PED that allows a user to determine the status of secret data, or using special software to determine if secret data has been erased.
Modified p. 8 → 10
TA2.1.2.2 The tester shall examine the response to Section A2.1 of the PCI POS PED Evaluation Vendor Questionnaire relating to the response of the PED to tamper detection, for consistency.
TA2.1 The tester shall examine the response to Section A2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A2 of PCI POS PED Security Requirements for consistency relevant to A2.
Modified p. 8 → 19
TA2.1.1.1 The tester shall visually inspect the tamper-detect mechanisms to verify the assertions provided by the vendor in response to Section A2.1 PCI POS PED Evaluation Vendor Questionnaire.
TA8.2.1 The tester shall examine the assertions provided by the vendor in response to Section A8.2 of the PCI POS PED Evaluation Vendor Questionnaire relating to unauthorized alterations of prompts.
Modified p. 8 → 19
TA2.1.3.1 The tester shall develop a detailed attack scenario to disable or defeat the detection or erasure mechanism. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity.
TA8.2.3 The tester shall attempt to develop attack scenarios to alter the prompts for non-PIN data entry into the PIN entry keypad such that PINs are compromised. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity.
Removed p. 9
DTR A2.2 Tamper Evidence A2.2.1 The implementation of the PED is such that penetrating and then altering the PED to disclose future PINs (for example, inserting a PIN-disclosing bug or making PIN- disclosing functional modifications) damages the PED to the extent that either it becomes inoperative or it has a high probability of detection before the PED is placed (back) into operational use.
Removed p. 9
A2.2.2 The implementation of the PED is such that penetrating and then altering the PED to disclose future PINs (for example, inserting a PIN-disclosing bug or making PIN- disclosing functional modifications) damages the PED to the extent that either it becomes inoperative or it has a high probability of detection before the PED is placed (back) into operational use.

TA2.2.2.1 The tester shall attempt to develop attack scenarios to penetrate and alter the PED to disclose future PINs without damaging the PED to the extent that either it becomes inoperative or it has a high probability of detection before the PED is placed back into operational use. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity. If such an attack can be developed, this vendor assertion cannot be verified.
Modified p. 9 → 15
TA2.2.1.1 The tester shall visually inspect the PED to verify the assertions provided by the vendor in response to the PCI POS PED Evaluation Vendor Questionnaire, Section A2.2.
TA6.4 The tester shall perform a sample transaction to verify the assertions provided by the vendor relating to protections against monitoring.
Modified p. 9 → 16
TA2.2.1.2 The tester shall examine additional relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
TA7.2 The tester shall examine any relevant documentation, such as assembly drawings, test data, etc., submitted by the vendor to verify that it supports the vendor responses.
Removed p. 10
TA2.3.1.1 The tester shall visually inspect the PED to verify the assertions provided by the vendor in response to the PCI POS PED Evaluation Vendor Questionnaire, Section A2.3.

A2.3.2 The implementation of the PED is such that penetrating and then altering the PED to disclose future PINs (for example, inserting a PIN-disclosing bug or making PIN- disclosing functional modifications) requires that the PED be removed from its normal location for at least ten hours, so that there is a high probability that the absence or absence and re-appearance of the PED will be noted and reported before it is placed back into operational use.

TA2.3.2.1 The tester shall attempt to develop attack scenarios to penetrate and alter the PED to disclose future PINs without requiring the removal of the PED from its normal location for at least ten hours. The tester is not required to perform the attack but may perform all …
Modified p. 10 → 13
TA2.3.1.2 The tester shall examine additional relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
TA4.2 The tester shall examine any additional relevant documentation, such as assembly drawings and functional specifications submitted by the vendor to verify that it supports the vendor responses.
Removed p. 11
TA2.4.2.2 The tester shall calculate the projected cost of disabling or defeating the tamper- detection mechanisms. The cost calculation shall be based on the scheme depicted in Appendix B.

TA2.4.2.1 The tester shall attempt to develop attack scenarios to penetrate and alter the PED to disclose future PINs without damaging the PED to the extent that either it becomes inoperative or it has a high probability of detection before the PED is placed back into operational use. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity. If such an attack can be developed, this vendor assertion cannot be verified.

TA2.4.1.1 The tester shall visually inspect the PED to verify the assertions provided by the vendor in response to the PCI POS PED Evaluation Vendor Questionnaire, Section A2.4.
Removed p. 11
A2.4.2 The implementation of the PED is such that penetrating and then altering the PED to disclose future PINs (for example, inserting a PIN-disclosing bug or making PIN- disclosing functional modifications) requires a per-PED expenditure of at least US $25,000, which does not make the compromise cost-effective.

TA2.4.2.3 The tester shall examine the assertions provided by the vendor in response to Section A2.4 of the PCI POS PED Evaluation Vendor Questionnaire to determine if they are consistent with the findings in TA2.4.2.1 & TA2.4.2.2. If an attack scenario can be developed that yields a calculated cost of less than US $25,000 per PED, the vendor assertion cannot be verified.
Modified p. 11 → 15
TA2.4.1.2 The tester shall examine additional relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
TA6.2 The tester shall examine any relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses to the PCI POS PED Evaluation Vendor Questionnaire.
Removed p. 12
• Requiring that the PED or ICC reader be removed from its normal location for at least ten (10) hours, so that there is a high probability that the absence and/or re- appearance of the PED or ICC reader will be noted and reported before it is placed back into operational use or

• So damages the PED or ICC reader that either (1) it becomes inoperative or (2) the damage is so severe that it has a high probability of detection by the merchant and/or the cardholder before the PED or ICC reader is placed (back) into operational use.

Guidance If the ICC reader and the PED are physically separate devices, this procedure is to be performed and reported for each device. A verdict of “Verified” shall be assigned only if compliance can be verified for both devices. PCI has interpreted the “extended period of time” that a device may be …
Modified p. 12 → 14
TA3.1.1 The tester shall examine the vendor’s response to Section A3 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A3 of the PCI POS PED Security Requirements for consistency relevant to A3.
TA5.1 The tester shall examine the vendor’s response to Section A5 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A5 of the PCI POS PED Security Requirements for consistency relevant to A5.
Removed p. 13
• Requiring that the PED or ICC reader be removed from its normal location for at least ten (10) hours, so that there is a high probability that the absence and/or re- appearance of the PED or ICC reader will be noted and reported before it is placed back into operational use or

• So damages the PED or ICC reader that either (1) it becomes inoperative or (2) the damage is so severe that it has a high probability of detection by the merchant and/or the cardholder before the PED or ICC reader is placed (back) into operational use.
Removed p. 13
TA3.2.1 The tester shall perform tests to verify that the protections of the device are such that the hardware and software cannot be tampered without:

• Requiring specialized skills

• Requiring specialized equipment

• Requiring the PED or ICC reader to be absent from its normal location for at least ten (10) hours) so as to have a high probability of being detected or

• Damaging the PED or ICC reader so severely that it becomes inoperative or the damage has a high probability of being detected.

When necessary, this will include destructive testing of the device, formulation of attack scenarios and calculation of attack time.
Modified p. 13 → 15
TA4.1.1 The tester shall examine the vendor’s response to Section A4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A4 of the PCI POS PED Security Requirements for consistency relevant to A4.1 TA4.1.2 The tester shall examine any relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
TA6.1 The tester shall examine the vendor’s response to Section A6 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A6 of the PCI POS PED Security Requirements for consistency relevant to A6.
Removed p. 14
A4.2 If the PED or ICC reader permits access to internal areas (e.g., for service or maintenance), then it is not possible using this access area to insert a PIN-disclosing bug. Immediate access to sensitive information such as PIN or cryptographic data is either prevented by further means (e.g., by enclosing components with sensitive data into tamper-resistant/responsive enclosures), or it has a mechanism so that such access causes the immediate erasure of sensitive data TA4.2.1 The tester shall attempt to remove the access cover by disabling or defeating the tamper-detection mechanisms. To remove the cover the tester may open, pry, or otherwise disassemble the PED at the cover seams and remove other plates, connectors, etc. to gain access to the tamper-detection mechanisms. Removal shall not consist of drilling, milling, burning, melting, grinding, or dissolving the cover or enclosure. The tester may drill out visible fasteners (e.g., screws, rivets, press-fittings, etc.) …
Modified p. 14 → 10
TA4.2.2 The tester shall verify that attempts to remove the cover by removing fasteners, plates, connectors, etc. or by creating a gap between the covers or cover and housing does not allow access to probe critical security circuitry without triggering the tamper-detection mechanisms.
TA2.5 The tester shall verify that attempts to remove the cover by removing fasteners, plates, connectors, etc. or by creating a gap between the covers or cover and housing does not allow access to probe critical security circuitry without triggering the tamper-detection mechanisms.
Removed p. 15
A5.2 The security of the PED is not compromised by altering environmental conditions or operational conditions (for example subjecting the PED to temperatures or operating voltages outside the stated operating ranges) Guidance Objective is not to replicate the vendor testing, but instead is to account for shortcomings within the vendor’s implementation TA5.2.1 The tester shall develop attack scenarios to compromise the PED by altering environmental and or operational conditions.
Modified p. 15 → 12
Guidance The vendor must either provide substantive data to support the security of the product outside normal operating conditions, or show that the product uses sensors that will trigger a tamper response.
The vendor must either provide substantive data to support the security of the product outside normal operating conditions, or show that the product uses sensors that will trigger a tamper response.
Modified p. 15 → 12
TA5.1.1 The tester shall examine the response to Section A5 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A5 of the PCI POS PED Security Requirements manual for consistency relevant to Requirement A5. The vendor responses should clearly state that the security of the PED is not compromised by altering environmental conditions or operational conditions.
TA3.1 The tester shall examine the response to Section A3 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A3 of the PCI POS PED Security Requirements Manual for consistency relevant to Requirement A3. The vendor responses should clearly state that the security of the PED is not compromised by altering environmental conditions or operational conditions.
Modified p. 15 → 12
TA5.1.2 The tester shall examine any additional relevant documentation, such as schematics, data sheets, vendor test procedures and test reports, etc. submitted by the vendor to verify that it supports vendor responses. This may include data provided to support Requirement B2 under different environmental conditions.
TA3.2 The tester shall examine any additional relevant documentation, such as schematics, data sheets, vendor test procedures and test reports, etc. submitted by the vendor to verify that it supports vendor responses. This may include data provided to support Requirement B2 under different environmental conditions.
Modified p. 15 → 12
TA5.1.3 The tester shall verify that the vendor’s stated measures protect against the compromise of the PED by altering either environmental conditions or operational conditions, and assess the adequateness of the vendor test procedures and reports.
TA3.3 The tester shall verify that the vendor’s stated measures protect against the compromise of the PED by altering either environmental conditions or operational conditions, and assess the adequateness of the vendor test procedures and reports.
Removed p. 16
TA6.1.2 The tester shall examine any additional relevant documentation, such as assembly drawings and functional specifications submitted by the vendor to verify that it supports the vendor responses.

A6.2 Sensitive functions or information are only used in the protected area(s) of the PED. Sensitive information and functions dealing with sensitive information are protected from modification without the expenditure of at least US $25,000 per PED.
Modified p. 16 → 13
TA6.1.1 The tester shall examine the response to Section A6 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A6 of the PCI POS PED Security Requirements manual for consistency relevant to Requirement A6. The vendor responses should clearly indicate what sensitive information and functions exists; and that sensitive functions or information are only used in the protected area(s) of the PED; and that sensitive information and functions dealing with sensitive information are protected from modification.
TA4.1 The tester shall examine the response to Section A4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A4 of the PCI POS PED Security Requirements Manual for consistency relevant to requirement A4. The vendor responses should clearly indicate what sensitive information and functions exists; and that sensitive functions or information are only used in the protected area(s) of the PED; and that sensitive information and functions dealing with sensitive information are protected from modification.
Modified p. 16 → 13
TA6.1.3 Verify the completeness of the information regarding sensitive information and functions presented by the vendor.
TA4.3 Verify the completeness of the information regarding sensitive information and functions presented by the vendor.
Modified p. 16 → 13
TA6.2.1 The tester shall develop attack scenarios to defeat or circumvent the protection mechanisms dealing with sensitive information and functions, using attack scenarios, which costs less than $25,000 per PED. The cost calculation shall be based on the scheme depicted in Appendix B.
TA4.4 The tester shall develop attack scenarios to defeat or circumvent the protection mechanisms dealing with sensitive information and functions, using attack scenarios, with an attack potential of < 25 per PED. The attack potential calculation shall be based on the scheme depicted in Appendix B.
Removed p. 17
A7.1.2 All prompts for non-PIN data entry are under the control of the cryptographic unit of the PED and costs at least US $10,000 per PED to circumvent.

A7.1.3 Prompts cannot feasibly be altered without causing the erasure of the unit’s cryptographic keys.

A7.1.4 If prompts are stored outside the cryptographic unit, cryptographic mechanisms must exist to ensure the authenticity and the proper use of the prompts and that modification of the prompts or improper use of the prompts is prevented.

TA7.1.4.1 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information on how authentic user prompts are generated and administered to determine if it supports the assertions made by the vendor. TA7.1.4.2 The tester shall examine the response to Section A7.1 of the PCI POS PED Evaluation Vendor Questionnaire to verify that mechanisms exist to ensure the authenticity and proper use of the prompts and modification …
Modified p. 17 → 14
TA7.1.3.2 The tester shall examine any additional information (i.e., specifications, schematics, block diagrams, etc.) that contains information on data entry and erasure to determine if it supports the assertions made by the vendor.
TA5.2 The tester shall examine any additional information (i.e., specifications, schematics, block diagrams, etc.) that contains information on tone generation during PIN entry to determine if it supports the assertions made by the vendor.
Modified p. 17 → 16
TA7.1.3.1 The tester shall examine the response to Section A7.1 of the PCI POS PED Evaluation Vendor Questionnaire relating to alteration of user prompts, for consistency.
TA7.1 The tester shall examine the vendor’s response to Section A7 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A7 of the PCI POS PED Security Requirements for consistency relevant to A7.
Modified p. 17
TA7.1.1.2 The Tester shall examine all possible prompts to determine if any can be used in conjunction with numeric entry in the clear.
TA8.1.2 The Tester shall examine all possible prompts to determine if any can be used in conjunction with numeric entry in the clear.
Modified p. 17
TA7.1.1.3 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information on non-PIN data entry and prompts for non-PIN data entry to determine if it supports the assertions made by the vendor.
TA8.1.3 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information on non-PIN data entry and prompts for non-PIN data entry, and on data entry and erasure, and on how authentic user prompts are generated and administered to determine if it supports the assertions made by the vendor.
Modified p. 17 → 18
A7.1.2.1 The tester develop attack scenarios to compromise the PED by using attack scenarios which cost less than $10,000 per PED as detailed in Appendix B The tester may perform any test needed to validate the attack scenario. The tester will use his or her own judgment in determining the appropriate tests and whether the attack will be performed in its entirety or in part to verify the theory.
TA8.1.5 The tester shall develop attack scenarios to compromise the PED by using attack scenarios which have an attack potential of <16 per PED for identification and initial exploitation as defined in Appendix B The tester may perform any test needed to validate the attack scenario. The tester will use his or her own judgment in determining the appropriate tests and whether the attack will be performed in its entirety or in part to verify the theory.
Modified p. 17 → 20
TA7.1.1.1 The tester shall examine the response to Section A7.1 of the PCI POS PED Evaluation Vendor Questionnaire, relating to user prompts, for consistency.
TA8.3.1 The tester shall examine the response to Section A8.3 of the PCI POS PED Evaluation Vendor Questionnaire to determine the structure and nature of the controls implemented by the vendor.
Removed p. 18
TA7.2.1.1 The tester shall examine the assertions provided by the vendor in response to Section A7.2 of the PCI POS PED Evaluation Vendor Questionnaire relating to unauthorized alterations of prompts.

A7.2.2 The unauthorized alteration of prompts for non-PIN data entry into the PIN entry key pad such that PINs are compromised, i.e., by prompting for the PIN entry when the output is not encrypted, cannot occur without the expenditure of at least US $10,000 per PED.

TA7.2.2.1 The tester shall attempt to develop attack scenarios to alter the prompts for non- PIN data entry into the PIN entry key pad such that PINs are compromised. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity.

TA7.2.2.2 The tester shall calculate the projected cost of disabling or defeating the tamper- detection mechanisms. The cost calculation shall be based on the scheme depicted …
Modified p. 18 → 19
TA7.2.1.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information on how prompts are generated and administered to determine if it is possible to perform unauthorized alterations of prompts.
TA8.2.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information on how prompts are generated and administered to determine if it is possible to perform unauthorized alterations of prompts.
Removed p. 19
TA7.3.1.1 The tester shall examine the response to Section A7.3 of the PCI POS PED Evaluation Vendor Questionnaire to determine the structure and nature of the controls implemented by the vendor.

A7.3.2 The controls provide for unique accountability and utilize key sizes appropriate for the algorithm(s) in question.
Modified p. 19 → 20
The controls shall be implemented and enforced by the PED (see also the PED as defined by the PED Security Requirements manual). As an exception, an unattended PED vendor may decide to include into the to be approved PED scope not only the EPP, but also the device controller and the controls implemented to ensure a secure configuration, the PED display management, properties of the PED’s cabinet or procedural controls for the PED.
The controls shall be implemented and enforced by the PED (see also the PED as defined by the PED Security Requirements Manual). As an exception, an unattended PED vendor may decide to include into the to be approved PED scope not only the EPP, but also the device controller and the controls implemented to ensure a secure configuration, the PED display management, properties of the PED’s cabinet or procedural controls for the PED.
Modified p. 19 → 20
TA7.3.1.2 The tester shall examine the vendor-supplied documentation to determine the structure and nature of the controls implemented by the vendor to determine, whether it is conclusive and supports the assertions made by the vendor.
TA8.3.2 The tester shall examine the vendor-supplied documentation to determine the structure and nature of the controls implemented by the vendor to determine, whether it is conclusive and supports the assertions made by the vendor.
Modified p. 19 → 20
TA7.3.1.3 The tester shall examine the device to verify that the asserted protections exist and conform to the descriptions provided by the vendor in the documentation.
TA8.3.3 The tester shall examine the device to verify that the asserted protections exist and conform to the descriptions provided by the vendor in the documentation.
Modified p. 19 → 20
TA7.3.1.4 The tester shall perform tests to modify the display content and PED usage in order to verify that the controls are effective.
TA8.3.4 The tester shall perform tests to modify the display content and PED usage in order to verify that the controls are effective. The tests shall include performing an intended change/update of software and/or display messages and verifying that the result conforms to the specification of the vendor.
Modified p. 19 → 21
TA7.3.2.1 The tester shall examine the response to Section A7.3 of the PCI POS PED Evaluation Vendor Questionnaire to verify that the controls provide for unique accountability and utilize key sizes appropriate for the algorithm(s) in question. These controls must exist and must be suitable even when they are not provided solely by the EPP of the PED.
TA8.3.6 The tester shall examine the response to Section A8.3 of the PCI POS PED Evaluation Vendor Questionnaire and other vendor-supplied documentation (i.e., user guide, the installation and setup guide and the interface specification) to verify that the controls provide for unique accountability and utilize key sizes appropriate for the algorithm(s) in question. Examples of appropriate algorithms and minimum key sizes are:
Removed p. 20
TA7.3.2.3 The tester shall examine any additional documentation (i.e., user guide, the installation and setup guide and the interface specification) that contains information on the method for unique accountability, algorithms used and appropriate key sizes.

TA7.3.2.4 The tester shall examine the device to verify that the asserted protections exist and conform to the descriptions provided by the vendor in documentation.

TA7.3.2.5 The tester shall perform an intended change/update of software and/or display messages and verify that the result conforms to the specification of the vendor.

TA7.3.3.1 The tester shall examine the response to Section A7.3 of the PCI POS PED Evaluation Vendor Questionnaire to verify that key management techniques and other control mechanisms are defined and include appropriate application of the principles of dual control and split knowledge. These controls mechanisms must exist and must be suitable even when they are not provided solely by the PED.

TA7.3.3.2 The tester shall examine the vendor-supplied …
Modified p. 20 → 21
A7.3.3 Key management techniques and other control mechanisms are defined and include appropriate application of the principles of dual control and split knowledge.
TA8.3.7 The tester shall examine the response to Section A8.3 of the PCI POS PED Evaluation Vendor Questionnaire to verify that key-management techniques and other control mechanisms are defined and include appropriate application of the principles of dual control and split knowledge. These control mechanisms must exist and must be suitable even when they are not provided solely by the PED.
Modified p. 20 → 21
TA7.3.3.3 The tester shall examine any additional documentation (i.e., specifications, open standards, public documentation etc.) that contains information on the methods for key management techniques and other control mechanisms and the appropriate application of the principles of dual control and split knowledge.
TA8.3.9 The tester shall examine any additional documentation (i.e., specifications, open standards, public documentation etc.) that contains information on the methods for key-management techniques and other control mechanisms and the appropriate application of the principles of dual control and split knowledge.
Modified p. 20 → 21
TA7.3.3.4 The tester shall examine logging documentation provided by the vendor of the actual performance of the techniques and control mechanisms specified by the vendor.
TA8.3.10 The tester shall examine logging documentation provided by the vendor of the actual performance of the techniques and control mechanisms specified by the vendor.
Removed p. 21
TA8.1.2 The tester shall examine any additional information (i.e., specifications, schematics, block diagrams, etc.) that contains information on tone generation during PIN entry to determine if it supports the assertions made by the vendor.

TA8.1.3 The tester shall verify that any audible tones accompanying PIN entry are indistinguishable by listening to the tones while entering a PIN number.
Modified p. 21 → 22
TA8.1.1 The tester shall examine the vendor’s response to Section A8 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A8 of the PCI POS PED Security Requirements for consistency relevant to A8.1.
TA9.1 The tester shall examine the vendor’s response to Section A9 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A9 of the PCI POS PED Security Requirements for consistency relevant to A9.
Removed p. 22
Guidance For A9 monitoring sound refers to other audible sounds apart from the beep generated by the PED when a key is pressed.

TA9.1.3 The tester shall visually inspect the PED to verify the assertions provided by the vendor in the PCI POS PED Evaluation Vendor Questionnaire relating to protections against the monitoring of sound, electro-magnetic emissions, power consumption or any other external characteristic available for monitoring. This could include verifying that any components that provide protection are as stated by the vendor. .

TA9.1.4 The tester shall perform a sample transaction to verify the assertions provided by the vendor relating to protections against monitoring.

A9.2 There is no feasible way to determine any entered PIN digit by monitoring sound, electro-magnetic emissions, power consumption or any other external characteristic available for monitoring, even with the cooperation of the terminal operator or sales clerk without the expenditure of at least US $25,000 per PED …
Modified p. 22 → 23
TA9.1.1 The tester shall examine the vendor’s response to Section A9 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A9 of the PCI POS PED Security Requirements for consistency relevant to A9.1.
TA10.1 The tester shall examine the vendor’s response to Section A10 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A10 of the PCI POS PED Security Requirements for consistency relevant to A10.
Modified p. 22 → 24
TA9.1.2 The tester shall examine any relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses to the PCI POS PED Evaluation Vendor Questionnaire.
TA11.2 The tester shall examine any relevant documentation, such as schematics and assembly drawings, submitted by the vendor to verify that it supports the vendor responses TA11.3 The tester shall examine the device to verify that the asserted protections exist and conform to the descriptions provided by the vendor in documentation. This will include disassembly of the test unit when necessary.
Removed p. 23
DTR A11 Unique Enclosure A11.1 The design of the PED or ICC reader is such that it is not practical to construct a duplicate PED or ICC reader from commercially available components. For example, the casing used to house the device's electronic components is not commonly available.

TA11.1.1 The tester shall examine the vendor’s response to Section A11 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A11 of the PCI POS PED Security Requirements for consistency relevant to A11.1 TA11.1.2 The tester shall examine any relevant documentation submitted by the vendor to verify that it supports the vendor responses. This could be documentation such as parts lists that indicate that PED and ICC reader are housed in a custom or semi-custom enclosure (or enclosures if the devices are separate).
Modified p. 23 → 22
TA10.1.2 The tester shall examine the means to deter the visual observation of PIN values provided by the PED, and/or as described in the PED documentation, to verify the assertions of the vendor.
TA9.2 The tester shall examine the means to deter the visual observation of PIN values provided by the PED, and/or as described in the PED documentation, to verify the assertions of the vendor.
Modified p. 23 → 22
TA10.1.3 The tester will verify the physical properties of the privacy screen. The privacy screen of an attended device shall provide protection as described in Appendix A, section A.1 of this document. Alternatively, the vendor may use less restrictive privacy shield criteria provided that the vendor supplies rules and guidance as to how the visual observation is to be deterred by the environment in which the PED is installed. These rules shall be binding for the organization placing the PED …
TA9.3 The tester will verify the physical properties of the privacy screen. The privacy screen of an attended device shall provide protection as described in Appendix A, section A.1 of this document. Alternatively, the vendor may use less restrictive privacy shield criteria provided that the vendor supplies rules and guidance as to how the visual observation is to be deterred by the environment in which the PED is installed. These rules shall be binding for the organization placing the PED …
Modified p. 23 → 22
TA10.1.4 If the PED is a module to be integrated into an unattended device, and the means to deter visual observation are not an integral part of the PED, the vendor shall specify by appropriate means (e.g., drawings and description) how the visual observation is deterred by the machine housing the PED. These specifications shall be binding for the vendor. The tester shall examine this specification to deter the visual observation of PIN values provided by the PED to verify …
TA9.4 If the PED is a module to be integrated into an unattended device, and the means to deter visual observation are not an integral part of the PED, the vendor shall specify by appropriate means (e.g., drawings and description) how the visual observation is deterred by the machine housing the PED. These specifications shall be binding for the vendor. The tester shall examine this specification to deter the visual observation of PIN values provided by the PED to verify …
Modified p. 23 → 24
TA10.1.1 The tester shall examine the vendor’s response to Section A10 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A10 of the PCI POS PED Security Requirements for consistency relevant to A10.1.
TA11.1 The tester shall examine the vendor’s response to Section A11 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement A11 of the PCI POS PED Security Requirements for consistency relevant to A11.
Modified p. 24 → 25
TB1.1.1 The tester shall examine the vendor’s response to Section B1 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B1 of the PCI POS PED Security Requirements to verify that the PED performs a self- test upon start up and at least once per day to check firmware and security mechanisms for signs of tampering, and whether the PED is in a compromised state.
TB1.1 The tester shall examine the vendor’s response to Section B1 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B1 of the PCI POS PED Security Requirements to verify that the PED performs a self-test upon start-up and at least once per day to check firmware and security mechanisms for signs of tampering, and whether the PED is in a compromised state.
Modified p. 24 → 25
TB1.1.2 The tester shall examine any relevant documentation, such as the user guide or the software specification, submitted by the vendor to verify that it supports the vendor responses.
TB1.2 The tester shall examine any relevant documentation, such as the user guide or the software specification, submitted by the vendor to verify that it supports the vendor responses.
Modified p. 24 → 25
TB1.1.3 The tester will verify that the PED performs self-tests upon start upon and on a periodic basis at least once per day to check firmware and security mechanisms for signs of tampering, and whether the PED is in a compromised state. The tester will activate the self-test(s) and look for the result of the self-test(s) as shown by the PED.
TB1.3 The tester will verify that the PED performs self-tests upon start-up and on a periodic basis at least once per day to check firmware and security mechanisms for signs of tampering, and whether the PED is in a compromised state. The tester will activate the self-test(s) and look for the result of the self-test(s) as shown by the PED.
Modified p. 24 → 25
TB1.1.4 The tester will verify that the PED self-tests are able to detect failures and in doing so, fail in a secure manner. The vendor shall provide evidence of testing that confirms the PED fails securely in the event of self-test failure.
TB1.4 The tester will verify that the PED self-tests are able to detect failures and in doing so, fail in a secure manner. The vendor shall provide evidence of testing that confirms the PED fails securely in the event of self-test failure.
Removed p. 25
B2.2 The PED’s functionality shall not be influenced by logical anomalies such as (but not limited to) unexpected command sequences, unknown commands, commands in a wrong device mode and supplying wrong parameters or data which could result in the PED outputting the clear text PIN or other sensitive information.
Modified p. 25 → 26
Guidance Functionality shall be considered as any functionality, via any internal or external interface, that could impact the security of the PED. Vendors should provide software design rules and specifications to support answers.
Guidance Functionality shall be considered as any functionality, via any internal or external interface, that could impact the security of the PED.
Modified p. 25 → 26
TB2.1.1 The tester shall examine the vendor’s response to Section B2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B2 of the PCI POS PED Security Requirements to verify that the PED’s functionality shall not be influenced by logical anomalies such as (but not limited to) unexpected command sequences, unknown commands, commands in a wrong device mode and supplying wrong parameters or data.
TB2.1 The tester shall examine the vendor’s response to Section B2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B2 of the PCI POS PED Security Requirements to verify that the PED’s functionality shall not be influenced by logical anomalies such as (but not limited to) unexpected command sequences, unknown commands, commands in a wrong device mode and supplying wrong parameters or data.
Modified p. 25 → 26
TB2.1.2 The tester shall examine any relevant documentation, such as a user guide, the specification of the PEDs logical structure, the PED interface specification, the software design rules and specifications, or the software implementation submitted by the vendor to verify that it supports the vendor responses.
TB2.2 The tester shall examine any relevant documentation, such as a user guide, the specification of the PED’s logical structure, the PED interface specification, the software design rules and specifications, or the software implementation submitted by the vendor to verify that it supports the vendor responses.
Modified p. 25 → 26
TB2.1.3 The tester shall analyze the vendor’s measures that ensure, that the PED’s functionality is not influenced by logical anomalies such as (but not limited to) unexpected command sequences, unknown commands, commands in a wrong device mode and supplying wrong parameters or data.
TB2.3 The tester shall analyze the vendor’s measures that ensure that the PED’s functionality is not influenced by logical anomalies such as (but not limited to) unexpected command sequences, unknown commands, commands in a wrong device mode, and supplying wrong parameters or data.
Modified p. 25 → 26
TB2.2.1 The tester may perform tests needed to validate the device’s property. The evaluator should use his or her own judgment in determining appropriate tests. Test support shall be provided by the vendor as needed to access and use the interfaces under test.
TB2.4 The tester may perform tests needed to validate the device’s property. The evaluator should use his or her own judgment in determining appropriate tests. Test support shall be provided by the vendor as needed to access and use the interfaces under test.
Modified p. 26 → 27
The PED must display or otherwise make available the revision number.
TB3.4 The tester will verify that the device displays or otherwise makes available the revision number.
Modified p. 26 → 27
TB3.1.1 The tester shall examine the response to Section B3 of the PCI POS PED Evaluation Vendor Questionnaire relating to the firmware documentation and certification process, for consistency.
TB3.1 The tester shall examine the response to Section B3 of the PCI POS PED Evaluation Vendor Questionnaire relating to the firmware documentation and certification process, for consistency.
Modified p. 26 → 27
TB3.1.2 The tester shall examine the support documentation submitted by the PED vendor. The documents should be representative of a Configuration Control process that can be audited. The documentation could include firmware revision lists with updates documented, current source code check-in, checkout, and control procedures; authorized access lists, and other materials that show clear evidence that the firmware is under an auditable Configuration Control procedure.
TB3.2 The tester shall examine the support documentation submitted by the PED vendor. The documents should be representative of a Configuration Control process that can be audited. The documentation could include firmware revision lists with updates documented, current source code check-in, checkout, and control procedures; authorized access lists, and other materials that show clear evidence that the firmware is under an auditable Configuration Control procedure.
Modified p. 26 → 27
TB3.1.3 The tester shall examine details provided by the vendor that the documented process explicitly addresses how testing/ auditing has been carried out to check for unauthorized and undocumented functions DTR B4 Remote Firmware Updates B4.1 If the PED implements remote firmware updates, the software integrity is cryptographically authenticated by the device. If the authenticity of a firmware update is not confirmed, either the software update is rejected or all secret cryptographic keys are erased.
TB3.3 The tester shall examine details provided by the vendor that the documented process explicitly addresses how testing/ auditing has been carried out to check for unauthorized and undocumented functions.
Modified p. 26 → 28
TB4.1.1 The tester shall examine the response to Section B4 of the PCI POS PED Evaluation Vendor Questionnaire relating to the authentication procedures for remote firmware updates, for consistency.
TB4.1 The tester shall examine the response to Section B4 of the PCI POS PED Evaluation Vendor Questionnaire relating to the authentication procedures for firmware updates, for consistency.
Modified p. 26 → 28
TB4.1.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information that relates to remote firmware updates to determine if it supports the assertions made by the vendor.
TB4.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information that relates to firmware updates to determine if it supports the assertions made by the vendor.
Modified p. 26 → 28
TB4.1.3 The tester shall verify that the PED cryptographically authenticates the software integrity. This will be accomplished for example by performing a simulated firmware update.
TB4.3 The tester shall verify that the PED cryptographically authenticates the firmware integrity. This will be accomplished, for example, by performing a simulated firmware update.
Modified p. 26 → 28
TB4.1.4 The tester shall verify that the PED rejects unauthorized Firmware. This will be accomplished for example by performing a simulated firmware update with inadequate or modified authentication information.
TB4.4 The tester shall verify that the PED rejects unauthorized firmware. This will be accomplished, for example, by performing a simulated firmware update with inadequate or modified authentication information.
Removed p. 27
B5.2 The PED never displays the entered PIN digits. Any displayed character related to PIN entry is a non-significant symbol, i.e., asterisk TB5.2.1 The tester shall perform a transaction in which a PIN number is entered to verify that the PED does not display any digits of the PIN value. The tester shall note and report any characters that are displayed.

DTR B6 Transaction Controls B6.1 When the PED is an attended device, the entry of the transaction amount must be separate from the PIN entry process, avoiding the accidental display of a cardholder PIN on the PED display. If the amount and PIN are entered on the same keypad, then the amount entry and the PIN entry shall be clearly separate operations.

B6.2 When the PED is an attended device, the entry of the transaction amount must be separate from the PIN entry process, avoiding the accidental display of a cardholder …
Modified p. 27 → 29
TB5.1.2 The tester shall examine any relevant documentation, such as an API user guide, submitted by the vendor to verify that supports the vendor responses.
TB5.2 The tester shall examine any relevant documentation, such as an API user guide, submitted by the vendor to verify that supports the vendor responses.
Modified p. 27 → 29
TB5.2.2 If the PED does not directly control the display, it must supply a suitable signal to indicate, that a numeric key has been pressed and the value is stored inside the PED. The tester shall examine the response to Section B5 of the PCI POS PED Evaluation Vendor Questionnaire to determine the kind of signaling and to verify that the signal information is not related to the digit entered.
TB5.4 If the PED does not directly control the display, it must supply a suitable signal to indicate that a numeric key has been pressed and the value is stored inside the PED. The tester shall examine the response to Section B5 of the PCI POS PED Evaluation Vendor Questionnaire to determine the kind of signaling and to verify that the signal information is not related to the digit entered.
Modified p. 27 → 31
TB5.1.1 The tester shall examine the vendor’s response to Section B5 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B5 of the PCI POS PED Security Requirements for consistency relevant to B5.1.
TB7.1 The tester shall examine the vendor’s response to Section B7 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B7 of the PCI POS PED Security Requirements for consistency relevant to B7.
Modified p. 27 → 32
TB6.1.1 The tester shall examine the vendor’s response to Section B6 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B6 of the PCI POS PED Security Requirements for consistency relevant to B6.1.
TB8.1 The tester shall examine the vendor’s response to Section B8 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B8 of the PCI POS PED Security Requirements for consistency relevant to B8.
Modified p. 27 → 43
TB6.1.2 The tester shall examine any relevant documentation to verify that the prompt for and entry of the PIN is distantly separate from all other operations.
TB15.2 The tester shall examine any relevant documentation to verify that the prompt for and entry of the PIN are distinctly separate from all other operations.
Modified p. 27 → 43
TB6.2.1 The tester shall perform a simulated transaction to verify that the prompt for PIN entry is distinctly separate from all other operations such as the display of the transaction amount. When prompting for PIN entry, the device must not accept any other data inputs. Control inputs such as “Yes,” “OK,” “Cancel,” or “No” are acceptable.
TB15.3 The tester shall perform a simulated transaction to verify that the prompt for PIN entry is distinctly separate from all other operations such as the display of the transaction amount. When prompting for PIN entry, the device must not accept any other data inputs. Control inputs such as “Yes,” “OK,” “Cancel,” or “No” are acceptable.
Modified p. 28 → 30
Guidance Vendor shall provide documentation of test results for inspections of internal buffers.
The vendor shall provide documentation of test results for inspections of internal buffers.
Modified p. 28 → 30
TB7.1.1 The tester shall examine the vendor’s response to Section B7 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B7 of the PCI POS PED Security Requirements to verify that sensitive information shall not be present any longer or used more often than strictly necessary.
TB6.1 The tester shall examine the vendor’s response to Section B6 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B6 of the PCI POS PED Security Requirements to verify:
Modified p. 28 → 30
TB7.1.2 The tester shall examine any relevant documentation, including vendor test results for inspections of internal buffers submitted by the vendor to verify that it supports the vendor responses.
TB6.2 The tester shall examine any relevant documentation, including vendor test results for inspections of internal buffers, the user guide, the software specification, or the software implementation submitted by the vendor to verify that it supports the vendor responses.
Modified p. 28 → 30
TB7.1.3 The tester will verify that the vendor has identified all data that is automatically cleared when the transaction is completed and that all sensitive data is included. Passwords, plaintext cryptographic keys outside of the crypto-processor and PIN values are considered sensitive data.
TB6.3 The tester will verify that the vendor has identified all data that is automatically cleared when the transaction is completed and that all sensitive data is included. Passwords, plain-text cryptographic keys outside of the crypto-processor, and PIN values are considered sensitive data.
Modified p. 28 → 30
B7.2 The PED must automatically clear its internal buffers when either the transaction is completed or the PED has timed-out waiting for the response from the cardholder or merchant.
ƒ The transaction is completed, or ƒ The PED has timed out waiting for the response from the cardholder or merchant.
Modified p. 28 → 30
TB7.2.3 The tester will verify that all data that is automatically cleared when either the transaction is completed or the PED has timed-out waiting for the response from the cardholder or merchant. The tester will determine the appropriate test actions to be taken. For instance, by performing a partial simulated transaction to verify the behavior at time-out.
TB6.4 The tester will verify that all data is automatically cleared when either the transaction is completed or the PED has timed out waiting for the response from the cardholder or merchant. The tester will determine the appropriate test actions to be taken. For instance, by performing a partial simulated transaction to verify the behavior at time- out.
Modified p. 28 → 32
TB7.2.2 The tester shall examine any relevant documentation, such as the user guide, the software specification, or the software implementation submitted by the vendor to verify that it supports the vendor responses.
TB8.2 The tester shall examine any relevant documentation, such as the user guide or the software specification, submitted by the vendor to verify that it supports the vendor responses.
Modified p. 28 → 33
TB7.2.1 The tester shall examine the vendor’s response to Section B7 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B7 of the PCI POS PED Security Requirements to verify that the PED automatically clears its internal buffers when either the transaction is completed or the PED has timed-out waiting for the response from the cardholder or merchant.
TB9.1 The tester shall examine the vendor’s response to Section B9 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B9 of the PCI POS PED Security Requirements for consistency relevant to B9.
Removed p. 29
TB8.1.3 The tester shall verify from vendor documentation that the vendor has identified all sensitive services, data and secure modes. Sensitive functions are those functions that process sensitive data such as Cryptographic Keys, Pins and Passwords.

B8.2 Access to sensitive services requires authentication. Sensitive services provide access to the underlying sensitive functions. Sensitive functions are those functions that process sensitive data such as Cryptographic Keys, Pins and Passwords. Entering or exiting sensitive services shall not reveal or otherwise affect sensitive information.
Modified p. 29
TB8.2.1 The tester shall examine the vendor’s response to Section B8 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B8 of the PCI POS PED Security Requirements for consistency relevant to B8.2.
TB5.1 The tester shall examine the vendor’s response to Section B5 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B5 of the PCI POS PED Security Requirements for consistency relevant to B5.1.
Modified p. 29 → 31
Guidance Authentication shall be considered as dual control techniques when entering sensitive information through a secure user interface, or cryptographic techniques when entering electronic data. The use of other techniques to access sensitive services results in the device being unable to use previously existing keying material.
Authentication shall be considered as dual control techniques when entering sensitive information through a secure user interface, or cryptographic techniques when entering electronic data. The use of other techniques to access sensitive services results in the device being unable to use previously existing keying material.
Modified p. 29 → 31
TB8.1.2 The tester shall examine any relevant documentation (such as an API user guide) submitted by the vendor to verify that it supports the vendor assertions with regard to the control of sensitive services.
TB7.2 The tester shall examine any relevant documentation (such as an API user guide) submitted by the vendor to verify that it supports the vendor assertions with regard to the control of sensitive services.
Modified p. 29 → 31
TB8.1.4 The tester shall verify from vendor documentation and from functional testing that sensitive services require authentication.
TB7.4 The tester shall verify from vendor documentation and from functional testing that sensitive services require authentication.
Modified p. 29 → 31
TB8.1.5 The tester shall verify from vendor documentation and from functional testing that entering and exiting sensitive services does not reveal or otherwise affect sensitive information.
TB7.5 The tester shall verify from vendor documentation and from functional testing that entering and exiting sensitive services does not reveal or otherwise affect sensitive information.
Modified p. 29 → 31
TB8.2.3 The tester shall verify from vendor documentation that sensitive services are entered, used, and exited securely and that mode transitions (e.g., from operational to maintenance) do not reveal or otherwise affect sensitive information.
TB7.6 The tester shall verify from vendor documentation that sensitive services are entered, used, and exited securely and that mode transitions (e.g., from operational to maintenance) do not reveal or otherwise affect sensitive information.
Modified p. 29 → 35
TB8.2.2 The tester shall examine any relevant documentation (such as an API user guide) submitted by the vendor to verify that it supports the vendor assertions with regard to the control of sensitive services.
TB11.2 The tester shall examine any relevant documentation such as a user guide, submitted by the vendor to verify that it supports vendor responses.
Modified p. 29 → 45
TB8.1.1 The tester shall examine the vendor’s response to Section B8 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B8 of the PCI POS PED Security Requirements for consistency relevant to B8.1.
TD1.1 The tester shall examine the vendor’s response to Section D1 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D1 of the PCI POS PED Security Requirements for consistency relevant to D1.
Removed p. 30
• Data inputs cannot be discerned from any displayed characters.

• Data inputs cannot be discerned by monitoring audible or electro- magnetic emissions.

• Sensitive data is cleared from internal buffers upon exiting the sensitive mode.

• Entering data while accessing sensitive services.

TB8.2.5 If mode transitions require input by a separate interface device, such as a key loader, the tester will verify that the physical and logical security level of the device is equal to or greater than that of the PED. The testing shall include:

• Entering data while accessing sensitive services,

• Document review, and

• Physical examination of the interface device.
Removed p. 31
B9.2 To minimize the risks from unauthorized use of sensitive services, limits on the number of actions that can be performed and a time limit shall be imposed, after which the PED is forced to return to its normal mode TB9.2.1 The tester shall verify the limits placed on the number of actions by causing the PED to access sensitive services and attempting to exceed the limit. Once the limit is exceeded the tester will verify that the PED has returned to its normal mode.
Modified p. 31 → 32
TB9.1.3 The tester shall examine the rationale provided by the vendor in Section B9 of the PCI POS PED Evaluation Vendor Questionnaire to verify the following:
TB8.3 The tester shall examine the rationale provided by the vendor in Section B8 of the PCI POS PED Evaluation Vendor Questionnaire to verify the following:
Modified p. 31 → 32
• The vendor has provided a rationale for the value chosen as a limit on the number of actions and the time limits imposed.
ƒ The vendor has provided a rationale for the value chosen as a limit on the number of actions and the time limits imposed.
Modified p. 31 → 32
• The vendor has provided a rationale as to how the limits minimize the risks from unauthorized use of sensitive services.
ƒ The vendor has provided a rationale as to how the limits minimize the risks from unauthorized use of sensitive services.
Modified p. 31 → 32
TB9.2.2 The tester shall verify that a time limit is imposed such that after one minute of inactivity while accessing sensitive services, the PED returns to its normal state. This will be accomplished by attempting to use sensitive functions after the time limit has been exceeded.
TB8.5 The tester shall verify that a time limit is imposed such that after one minute of inactivity while accessing sensitive services, the PED returns to its normal state. This will be accomplished by attempting to use sensitive functions after the time limit has been exceeded.
Modified p. 31 → 32
TB9.2.3 The tester shall verify that a time limit is imposed such that fifteen (15) minutes after accessing sensitive services, the PED returns to its normal mode. This will be accomplished by attempting to use sensitive functions after the time limit has been exceeded. To prevent the PED from reaching a limit of inactivity, sensitive functions will be used throughout the fifteen minutes.
TB8.6 The tester shall verify that a time limit is imposed such that fifteen (15) minutes after accessing sensitive services, the PED returns to its normal mode. This will be accomplished by attempting to use sensitive functions after the time limit has been exceeded. To prevent the PED from reaching a limit of inactivity, sensitive functions will be used throughout the fifteen minutes.
Modified p. 31 → 43
TB9.1.1 The tester shall examine the vendor’s response to Section B9 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B9 of the PCI POS PED Security Requirements for consistency relevant to B9.1.
TB15.1 The tester shall examine the response to Section B15 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B15 of the PCI POS PED Security Requirements for consistency relevant to B15.
Modified p. 31 → 45
TB9.1.2 The tester shall examine any relevant documentation, such as the user guide or the software specification, submitted by the vendor to verify that it supports the vendor responses.
TD1.2 The tester shall examine any relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.
Removed p. 32
Applicable whenever random numbers are generated by the PED in connection with security over sensitive data.
Modified p. 32 → 33
TB10.1.2 The tester shall compare the vendor supplied, such as the specification of the random number generator and test documentation, submitted by the vendor to verify that it supports vendor responses.
TB9.2 The tester shall compare the vendor supplied documentation, such as the specification of the random number generator and test documentation, submitted by the vendor to verify that it supports vendor responses.
Modified p. 32 → 33
TB10.1.3 The tester shall verify test information provided by the vendor to assess whether the random numbers are sufficiently unpredictable. The tester shall use a suitable test method (for example, those listed in NIST PUB 800-22). See Appendix C.
TB9.3 The tester shall verify test information provided by the vendor to assess whether the random numbers are sufficiently unpredictable. The tester shall use a suitable test method (for example, those listed in NIST PUB 800-22). See Appendix C.
Modified p. 32 → 46
TB10.1.1 The tester shall examine the vendor’s response to Section B10 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement B10 of the PCI POS PED Security Requirements for consistency relevant to B10.1.
TD2.1.1 The tester shall examine the vendor’s response to Section D2.1 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D2.1 of the PCI POS PED Security Requirements for consistency relevant to D2.1.
Removed p. 33
Guidance The vendor may need to supply specific test software to the evaluation laboratory to enable rigorous DPA analysis to be performed.

C1.2 The cost of determining any PIN-security-related cryptographic key resident in the PED, either by penetration of the PED or by monitoring emanations from the PED (including power fluctuations) exceeds US $35,000.

TC1.2.1 The tester shall attempt to develop attack scenarios to determine any PIN- security-related cryptographic key resident in the PED either by penetration or by monitoring emanations from the PED. The tester is not required to perform the attack but may perform all or part of the attack to verify its validity.

TC1.2.2 The tester shall calculate the projected cost of determining any PIN-security- related cryptographic key resident in the PED by either by penetration or by monitoring emanations. The cost calculation shall be based on the scheme depicted in Appendix B.

TC1.2.3 The tester shall examine the assertions provided …
Modified p. 33 → 35
TC1.1.1 The tester shall examine the vendor’s response to Section C1 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement C1 of the PCI POS PED Security Requirements for consistency relevant to C1.1.
TB11.1 The tester shall examine the response to Section B11 of the PCI POS PED Evaluation Vendor Questionnaire relating to the method of key management in use in the PED, for consistency.
Modified p. 33 → 41
TC1.1.2 The tester shall examine any relevant documentation, such as assembly drawings, test data, etc., submitted by the vendor to verify that it supports the vendor responses.
TB13.2 The tester shall examine any additional documentation such as the API Programmer’s guide, submitted by the vendor to verify that it supports vendor responses.
Removed p. 34
TC2.1.2 The tester shall examine any additional documentation (i.e., the interface specification, the functional specification, the software specification, the software implementation, etc.) that contains information on the PIN encryption to determine if it supports the assertions made by the vendor.

DTR C3 Exhaustive PIN Determination C3.1 The PED has characteristics that prevent or significantly deter the use of a stolen device for exhaustive PIN determination (for example, using electromechanical solenoids to depress the keys, so as to try all possible PINs until the ciphertext produced equals the ciphertext recorded when the PED was in operational use). The following are examples of such characteristics:
Modified p. 34
Use of a unique key per transaction technique. (Prevents the attack.)  Preventing the entry of the PIN through other than the keypad, and limiting the rate at which the PED will encrypt PINs to the average (for example, over 120 transactions) of one per 30 seconds. (Deters the attack.) TC3.1.1 The tester shall examine the response to Section C3 of the PCI POS PED Evaluation Vendor Questionnaire relating to characteristics that prevent or significantly deter the use of …
ƒ Use of a unique key per transaction technique. (Prevents the attack.); ƒ Preventing the entry of the PIN through other than the keypad, and limiting the rate at which the PED will encrypt PINs to the average (for example, over 120 transactions) of one per 30 seconds. (Deters the attack.) ƒ The device is exclusively used for offline PIN and the ICC reader is integrated into the PED.
Modified p. 34
TC3.1.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information that relates to characteristics that prevent or significantly deter exhaustive PIN determination to determine if it supports the assertions made by the vendor.
TB10.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information that relates to characteristics that prevent or significantly deter exhaustive PIN determination to determine if it supports the assertions made by the vendor.
Modified p. 34
TC3.1.3 The tester shall perform functional testing to verify the PED characteristics regarding C3.
TB10.3 The tester shall perform functional testing to verify the PED characteristics regarding B10.
Modified p. 34 → 41
TC2.1.1 The tester shall examine the response to Section C2 of the PCI POS PED Evaluation Vendor Questionnaire relating to the immediate encryption of PIN data, for consistency.
TB13.1 The tester shall examine the response to Section B13 of the PCI POS PED Evaluation Vendor Questionnaire relating to encryption and decryption of arbitrary data, for consistency.
Removed p. 35
• Master/Session C4.2 The PIN encryption technique implemented in the PED is a technique included in ISO 9564.
Modified p. 35 → 40
TC4.1.1 The tester shall examine the response to Section C4 of the PCI POS PED Evaluation Vendor Questionnaire relating to the TDES PIN encryption implementation in the PED, for consistency and compliance with ISO 9564.
TB12.1 The tester shall examine the response to Section B12 of the PCI POS PED Evaluation Vendor Questionnaire relating to the TDES PIN-encryption implementation in the PED, for consistency and compliance with ISO 9564.
Modified p. 35 → 40
TC4.1.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information that relates to the PIN encryption technique implemented in the PED.
TB12.2 The tester shall examine any additional documentation (i.e., specifications, schematics, block diagrams, etc.) that contains information that relates to the PIN- encryption technique implemented in the PED.
Modified p. 35 → 40
Note: The PED must support at least one of the following key management techniques using TDES as described in ANSI X9.24 and ANSI X9.52:
Note: The PED must support at least one of the following key-management techniques using TDES as described in ANSI X9.24 and ANSI X9.52:
Modified p. 35 → 40
TC4.2.1 The tester shall perform a transaction with a known encryption key. The tester shall use this key to create an encrypted PIN block with a test system, using the Primary Account Number, and PIN with the format (the format must be either ISO format 0, 1 or 3) specified by the vendor. The corresponding encrypted PIN block shall be generated by the PED with a simulated transaction. If both encrypted PIN blocks are identical, the PED is using the …
TB12.3 The tester shall perform a transaction with a known encryption key. The tester shall use this key to create an encrypted PIN block with a test system, using the Primary Account Number, and PIN with the format (the format must be either ISO format 0, 1 or 3, specified by the vendor. The corresponding encrypted PIN block shall be generated by the PED with a simulated transaction. If both encrypted PIN blocks are identical, the PED is using the …
Removed p. 36
TC5.1.4 The tester shall verify that the PED will not allow the entry of a single component plaintext key. If possible attempt to load a plaintext single component key either manually or electronically (does not include initial keys for DUKPT). The vendor may alternately provide user documentation detailing the management of cryptographic keys following the principles of dual control and split knowledge and implementing the use of a secure cryptographic device for management of these keys. That is, the process exists upstream of the PED.
Modified p. 36 → 35
TC5.1.3 The tester shall determine from vendor documentation the key management technique used for Firmware and Application updates. Symmetric key techniques must include the use of Unique Key per Device.
TB11.3 The tester shall determine from vendor documentation the key-management technique used for firmware and application updates. Symmetric key techniques must include the use of Unique Key(s) per Device.
Modified p. 36 → 37
• Use public and private key lengths that are deemed acceptable for the algorithm in question (e.g., 1024-bits minimum for RSA, see also DTR A7.3).
a) Use public and private key lengths that are deemed acceptable for the algorithm in question (e.g., 1024-bits minimum for RSA, see also DTR A7.3).
Modified p. 36 → 37
• Use key-generation techniques that meet the current ANSI and ISO standards for the algorithm in question.
b) Use key-generation techniques that meet the current ANSI and ISO standards for the algorithm in question.
Modified p. 36 → 44
TC5.1.1 The tester shall examine the response to Section C5 of the PCI POS PED Evaluation Vendor Questionnaire relating to the method of key management in use in the PED, for consistency.
TC1.1 The tester shall examine the response to Section C1 of the PCI POS PED Evaluation Vendor Questionnaire relating to multiple keys and unauthorized key replacement and key misuse, for consistency.
Modified p. 36 → 44
TC5.1.2 The tester shall examine any relevant documentation such as a user Guide, submitted by the vendor to verify that it supports vendor responses.
TC1.2 The tester shall examine any additional documentation such as a user’s manual or the API Programmer’s guide submitted by the vendor to verify that it supports vendor responses.
Removed p. 37
Guidance PIN encryption keys shall only be used to encrypt PIN data. Key-encrypting keys shall only be used to encrypt keys. PIN keys shall never be used to encrypt keys. Key- encrypting keys shall never be used to encrypt PIN data.

TC6.1.1 The tester shall examine the response to Section C6 of the PCI POS PED Evaluation Vendor Questionnaire relating to encryption and decryption of arbitrary data, for consistency.

TC6.1.2 The tester shall examine any additional documentation such as the API Programmer’s guide, submitted by the vendor to verify that it supports vendor responses.

DTR C7 Key Substitution C7.1 If the PED can hold multiple encryption keys and the key to be used to encrypt the PIN can be externally selected, then the PED prohibits unauthorized key replacement and key misuse.

TC7.1.1 The tester shall examine the response to Section C7 of the PCI POS PED Evaluation Vendor Questionnaire relating to multiple keys and …
Modified p. 37 → 41
TC6.1.3 The tester shall verify the following:
TB13.3 The tester shall verify the following:
Modified p. 37 → 41
• PIN encryption keys are only used to encrypt PIN data.
a) PIN-encryption keys are only used to encrypt PIN data.
Modified p. 37 → 41
• Key-encrypting keys are only used to encrypt keys.
b) Key-encrypting keys are only used to encrypt keys.
Modified p. 37 → 41
• PIN keys shall never be used to encrypt keys.
c) PIN keys are never used to encrypt keys.
Modified p. 37 → 41
• Key-encrypting keys shall never be used to encrypt PIN data.
d) Key-encrypting keys are never used to encrypt PIN data.
Removed p. 38
TC8.1.1 The tester shall examine the response to Section C8 of the PCI POS PED Evaluation Vendor Questionnaire relating to the output of clear-text keys, for consistency.

C8.2 There is no mechanism in the PED that would allow the encryption of a key or PIN under a key that might itself be disclosed.

TC8.2.2 The tester shall examine any additional documentation (i.e., API Programmer’s guide, specifications, block diagrams, etc.) that contains information that relates to encryption of a key or PIN to determine if it supports the assertions made by the vendor.

C8.3 There is no mechanism in the PED that would allow the transfer of a clear-text key from a component of high security into a component of lesser security.

TC8.3.2 The tester shall examine any additional documentation (i.e., API Programmer’s guide, specifications, block diagrams, etc.) that contains information that relates to the transfer of keys from one component to another to determine …
Modified p. 38 → 42
TC8.1.2 The tester shall examine any additional documentation (i.e., API Programmer’s guide, specifications, block diagrams, etc.) that contains information that relates to the outputting of clear-text keys to determine if it supports the assertions made by the vendor.
TB14.4 The tester shall examine any additional documentation (i.e., API Programmer’s guide, specifications, block diagrams, etc.) that contains information that relates to any of the aforementioned to determine if it supports the assertions made by the vendor.
Modified p. 38 → 42
TC8.2.1 The tester shall examine the response to Section C8 of the PCI POS PED Evaluation Vendor Questionnaire relating to encryption of a key or PIN under a key that might itself be disclosed, for consistency.
TB14.2 The tester shall examine the response to Section B14 of the PCI POS PED Evaluation Vendor Questionnaire relating to encryption of a key or PIN under a key that might itself be disclosed, for consistency.
Modified p. 38 → 42
TC8.3.1 The tester shall examine the response to Section C8 of the PCI POS PED Evaluation Vendor Questionnaire relating to the transfer of a key from a high security component to a lower-security component, for consistency.
TB14.3 The tester shall examine the response to Section B14 of the PCI POS PED Evaluation Vendor Questionnaire relating to the transfer of a key from a high- security component to a lower-security component, for consistency.
Removed p. 39
“Tamper-evident Characteristic: A characteristic that provides evidence that an attack has been attempted.”

PCI has indicated that properly implemented tamper-responsive characteristics (tamper detection and response) can be considered a stronger protection than tamper evidence, and therefore, may be substituted to meet this requirement.

TD1.1.1 The tester shall examine the vendor’s response to Section D1 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D1 of the PCI POS PED Security Requirements for consistency relevant to D1.1 TD1.1.2 The tester shall examine any relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.

TD1.1.3 The tester shall examine the device to verify that the PED and ICC reader are integrated and that the tamper-evident protections asserted by the vendor are present and as defined in PCI PED requirements document.

TD1.1.4 The tester shall examine the device to verify that the integrated PED and …
Removed p. 40
TD1.3.1.2 The tester shall examine any relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.

TD1.4.1.2 The tester shall examine any relevant documentation, such as assembly drawings, submitted by the vendor to verify that it supports the vendor responses.

TD1.3.1.3 The tester shall examine the devices to verify that the PED and ICC reader are two separate devices and that the tamper-responsive protections asserted by the vendor are present and as defined in PCI PED requirements document. This will be accomplished by disassembling the device and examining the mechanism.

D1.3.2 The PED and the ICC reader exist as two separate tamper-responsive attended devices.

TD1.3.2.1 The tester shall attempt to penetrate or modify the device to verify that the design of the device does not allow access to probe critical security circuitry without triggering the tamper-detection mechanisms. These tests are typically performed as part of testing …
Removed p. 41
TD1.4.2.2 The tester shall activate the tamper-detection mechanisms by penetration, modification or removal and then perform tests to support evidence that keys and secret data have been erased. Tests that may be performed could include attempting a transaction to determine if the transaction fails, using a special function of the PED that allows a user to determine the status of secret data, or using special software to determine if secret data has been erased.

TD1.4.2.3 If the design allows removal after authorization, such authorized removal shall be performed to verify that the authorization is adequate and provides means for accountability and traceability.

TD1.4.2.4 The vendor may claim for tamper-resistance characteristics instead of tamper- responsive characteristics for all or part of the protection mechanisms. For these aspects the tester shall examine the vendor’s responses, the relevant documentation, and the device in order to assess it with respect to the statements for Penetration and …
Modified p. 42 → 46
Guidance The cost and level of the evaluation shall be commensurate with that of A1 and A3, i.e., cost should not exceed $25,000.
The attack potential of the evaluation shall be commensurate with that of A1, i.e., the attack potential shall not be less than 25.
Modified p. 42 → 46
D2.3 The slot of the ICC reader into which the ICC is inserted cannot feasibly be enlarged to provide space for a PIN-disclosing “bug.” TD2.3.1 The tester will develop an attack scenario to enlarge the slot. The tester will use his or her experience to determine what type of testing is necessary to determine the attack feasibility.
TD2.1.4 The tester shall develop an attack scenario to enlarge the slot. The tester will use his or her experience to determine what type of testing is necessary to determine the attack feasibility.
Modified p. 42 → 46
D2.4 It is not possible for both an ICC and any other foreign object to reside within the card insertion slot.
c) It is not possible for both an ICC and any other foreign object to reside within the card-insertion slot. For instance, it will be verified that the slot is not large enough to hold more than one card.
Modified p. 42 → 47
TD2.4.1 The tester shall examine the vendor’s response to Section D2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D2 of the PCI POS PED Security Requirements for consistency relevant to D2.3.
TD2.2.1 The tester shall examine the vendor’s response to Section D2.2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D2.2 of the PCI POS PED Security Requirements for consistency relevant to D2.2.
Modified p. 42 → 48
D2.2 The slot of the ICC reader into which the ICC is inserted cannot feasibly be enlarged to provide space for a PIN-disclosing “bug.” TD2.2.1 The tester shall examine the vendor’s response to Section D2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D2 of the PCI POS PED Security Requirements for consistency relevant to D2.2.
TD3.1 The tester shall examine the vendor’s response to Section D3 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D3 of the PCI POS PED Security Requirements for consistency relevant to D3.
Removed p. 43
TD2.4.3 The tester shall examine the ICC reader slot to verify that the slot is as described in documentation and supports vendor assertions that it is not possible for both an ICC and any other foreign object to reside within the card insertion slot. For instance, it will be verified that the slot is not large enough to hold more than one card. This will include disassembly of the test unit when necessary.

D2.5 It is not possible for both an ICC and any other foreign object to reside within the card insertion slot.

TD2.5.1 The tester shall perform a simulated transaction whilst inserting 2 cards into the slot. If it is possible to insert two cards and perform the transaction then the device does not comply with this requirement D2.6 The opening for the insertion of the ICC is in full view of the cardholder so that any untoward obstructions or …
Modified p. 43 → 47
TD2.6.2 The tester shall examine a test unit to verify vendor assertions that the ICC reader’s slot is in full view of the cardholder so that any untoward obstructions or suspicious objects at the opening are detectable. The construction of the device should be such that the entire slot opening is in full view of the cardholder prior to card insertion.
TD2.2.2 The tester shall examine a test unit to verify vendor assertions that the ICC reader’s slot is in full view of the cardholder so that any untoward obstructions or suspicious objects at the opening are detectable. The construction of the device should be such that the entire slot opening is in full view of the cardholder prior to card insertion.
Modified p. 43 → 48
TD3.1.2 The tester shall examine a test unit to verify vendor assertions that the ICC reader is constructed so that wires running out of the slot can be observed by the cardholder. The reader enclosure shall not have any seams or channels around the slot that would allow the concealment of wires.
TD3.2 The tester shall examine a test unit to verify vendor assertions that the ICC reader is constructed so that wires running out of the slot can be observed by the cardholder. The reader enclosure shall not have any seams or channels around the slot that would allow the concealment of wires.
Modified p. 43 → 49
TD3.1.1 The tester shall examine the vendor’s response to Section D3 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D3 of the PCI POS PED Security Requirements for consistency relevant to D3.1.
TD4.1.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D4 of the PCI POS PED Security Requirements for consistency relevant to D4.1.
Modified p. 43 → 50
TD2.6.1 The tester shall examine the vendor’s response to Section D2 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D2 of the PCI POS PED Security Requirements for consistency relevant to D2.4.
TD4.2.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D4 of the PCI POS PED Security Requirements for consistency relevant to D4.2.
Removed p. 44
D4.1.1 If the PED and the ICC reader are not integrated and the cardholder verification method (i.e., the ICC requires) is determined to be an enciphered PIN, then the PIN block shall be enciphered between the PED and the ICC reader using either an authenticated encipherment key of the ICC, or in accordance with ISO 9564-1.

D4.1.2 If the PED and the ICC reader are not integrated and the cardholder verification method (i.e., the ICC requires) is determined to be an enciphered PIN, then the PIN block shall be enciphered between the PED and the ICC reader using either an authenticated encipherment key of the ICC, or in accordance with ISO 9564-1.

TD4.1.1.2 The tester shall verify that all “No” and “N/A” responses to Requirement D4 in the PCI POS PED Security Requirements are appropriate. A “Yes” response is required for all methods of PIN transmission between the PED and chip reader …
Modified p. 44 → 49
It is not acceptable to answer “No” or “N/A” to any option under D4 that is supported by the PED. As part of this test procedure, the evaluator must verify that the vendor has answered “Yes” to all methods of PIN transmission between PED and chip reader that are supported by the PED.
It is not acceptable to answer “No” or “N/A” to any option under D4 that is supported by the PED. As part of this test procedure, the evaluator must verify that the vendor has answered “Yes” to all methods of PIN transmission between the PED and the ICC reader that are supported by the PED.
Modified p. 44 → 49
D4 requires that the following be met: • A plaintext PIN from the PED to the ICC reader is never permitted except when the PED and ICC reader are integrated into a single tamper-evident device.
D4 requires that the following be met: ƒ A plain-text PIN from the PED to the ICC reader is never permitted except when the PED and ICC reader are integrated into the same secure module.
Modified p. 44 → 49
• When the cardholder verification method is determined to be an enciphered PIN, the encipherment must occur within the PED itself or a secure component of the terminal. The PIN must be enciphered in accordance with ISO 9564-1 for secure transport between the PED and the secure component.
ƒ When the cardholder verification method is determined to be an enciphered PIN, the encipherment must occur within the PED itself or a secure component of the terminal. The PIN must be enciphered in accordance with ISO 9564 for secure transport between the PED and the secure component.
Modified p. 44 → 49
TD4.1.2.1 The tester shall test the device to determine that the PIN is enciphered between the PED and the ICC reader using one of the following:
TD4.1.2 The tester shall test the device to determine that the PIN is enciphered between the PED and the ICC reader using one of the following:
Modified p. 44 → 49
• An authenticated encipherment key of the ICC
a) An authenticated encipherment key of the ICC
Modified p. 44 → 49
• Triple-DES Tests that may be performed include: performing a simulated transaction so that PIN data can be captured and analyzed, using a special function of the PED that allows a user to determine the methods of encryption used, or using test tools (such as ICC emulators) and software to determine the method of encipherment. The device will also be physically examined for compliance to Section 6.3 of ISO 9564-1 as necessary. Also see Requirement D1.
b) Triple-DES Tests that may be performed include: performing a simulated transaction so that PIN data can be captured and analyzed, using a special function of the PED that allows a user to determine the methods of encryption used, or using test tools (such as ICC emulators) and software to determine the method of encipherment. The tester may require the vendor to supply special hardware and software to facilitate this test, or they can use their own hardware and test …
Modified p. 44 → 51
TD4.1.1.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D4 of the PCI POS PED Security Requirements for consistency relevant to D4.1.
TD4.4.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D4 of the PCI POS PED Security Requirements for consistency relevant to D4.4.
Removed p. 45
TD4.2.1.2 The tester shall verify that all “No” and “N/A” responses to Requirement D1 in the PCI POS PED Security Requirements are appropriate. A “Yes” response is required for all methods of PIN transmission between PED and chip reader that are supported by the PED.

D4.2.2 If the PED and the ICC reader are not integrated and the cardholder verification method is determined to be a plaintext PIN, then the PIN block shall be enciphered from the PED to the ICC reader (the ICC reader will then decipher the PIN for transmission in plaintext to the ICC) in accordance with ISO 9564-1.

TD4.3.1.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D1 of the PCI POS PED Security Requirements for consistency relevant to D4.3 TD4.3.1.2 The tester shall verify that all “No” and “N/A” responses to Requirement …
Modified p. 45 → 50
TD4.2.1.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D4 of the PCI POS PED Security Requirements for consistency relevant to D4.2.
TD4.3.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D1 of the PCI POS PED Security Requirements for consistency relevant to D4.3 TD4.3.2 The tester shall perform a transaction and capture the encrypted PIN block between the PED and card reader. The tester may require the vendor to supply special hardware and software to facilitate this test, or they can use their own hardware and …
Modified p. 45 → 50
TD4.2.2.1 The tester shall test the device to determine that the PIN is enciphered between the PED and the ICC reader using Triple DES.
TD4.2.2 The tester shall test the device to determine that the PIN is enciphered between the PED and the ICC reader in accordance with ISO 9564.
Modified p. 45 → 50
Tests that may be performed include: performing a simulated transaction so that PIN data can be captured and analyzed, using a special function of the PED that allows a user to determine the methods of encryption used, or using test tools (such as ICC reader emulators) and software to determine the method of encipherment. The device will also be physically examined for compliance to Section 6.3 of ISO 9564-1 as necessary. Also see Requirement D1.
Tests that may be performed include: performing a simulated transaction so that PIN data can be captured and analyzed, using a special function of the PED that allows a user to determine the methods of encryption used, or using test tools (such as ICC reader emulators) and software to determine the method of encipherment. The tester may require the vendor to supply special hardware and software to facilitate this test, or they can use their own hardware and test tools.
Modified p. 45 → 50
D4.3.1 If the PED and ICC reader are integrated and the cardholder verification method is determined to be an enciphered PIN, then the PIN shall be enciphered using an authenticated encipherment key of the ICC.
D4.3. If the PED and ICC reader are integrated into the same secure module, and the cardholder verification method is determined to be an enciphered PIN, then the PIN shall be enciphered using an authenticated encipherment key of the ICC.
Removed p. 46
TD4.4.1.1 The tester shall examine the vendor’s response to Section D4 of the PCI POS PED Evaluation Vendor Questionnaire and the response to Requirement D4 of the PCI POS PED Security Requirements for consistency relevant to D4.4 TD4.4.1.2 The tester shall verify that all “No” and “N/A” responses to Requirement D1 in the PCI POS PED Security Requirements are appropriate. A “Yes” response is required for all methods of PIN transmission between the PED and chip reader that are supported by the PED.

D4.4.2 If the PED and ICC reader are integrated and the cardholder verification method is determined to be a plaintext PIN, then encipherment is not required if the PIN block is transmitted wholly through a protected environment (as defined in ISO 9564.1 Section 6.3). If the plaintext PIN is transmitted to the ICC reader through an unprotected environment, then the PIN block shall be enciphered in accordance with …
Removed p. 47
Horizontal observation range ! = 270° Privacy Screen 5 " = 270° C O: Observer C: PED user (cardholder) Keypad length Figure A1: Sample PED with privacy screen range, bird's eye view PED height ! !

Privacy screen Horizontal plane Vertical protection angle !
Modified p. 49 → 54
2. A handheld device must by weight, size, and shape encourage its handheld operation. The criteria
2. A handheld device must by weight, size, and shape encourage its handheld operation. The criteria are:
Modified p. 49 → 54
a) Weight should be 500 gram or less,
a) Weight should be 500 grams or less,
Modified p. 49 → 54
90° ≤ ≤ 270°: The protection angle shall be at least 40°. The display side of the privacy screen may be lowered as the PED is tilted against the horizontal plane.
90° ≤ ≤ 270°: The protection angle shall be at least 40°. The display side of the privacy screen may be lowered as the PED is tilted against the horizontal plane.
Modified p. 49 → 54
4. If the device is to be placed vertically or tilted by 45° and more, the requirements under step 3 will apply accordingly, using the vertical plane instead of the horizontal plane as the reference for the angle α.
4. If the device is to be placed vertically or tilted by 45° and more, the requirements under Step 3 will apply accordingly, using the vertical plane instead of the horizontal plane as the reference for the angle α.
Removed p. 50
− Visual shields designed into the check-stand. The shields may be solely for shielding purposes, or may be part of the general check-stand design, e.g., used as selling area.
Modified p. 50 → 55
Note: This option does not preclude the use of privacy mechanisms as defined in A1, but allows less restrictive physical mechanisms, e.g., ≥ 20°.
Note: This option does not preclude the use of privacy mechanisms as defined in A1, but allows less restrictive physical mechanisms, e.g., α ≥ 20°.
Modified p. 50 → 55
Positioning of terminal on the check-stand in such way as to make visual observation of the PIN-entry process infeasible. Examples include:
Positioning of terminal on the check-stand in such way as to make visual observation of the PIN-entry process infeasible. Examples include: a) Visual shields designed into the check-stand. The shields may be solely for shielding purposes, or may be part of the general check-stand design, e.g., used as selling area.
Modified p. 50 → 55
− Position the PED so that it is angled in such a way to make PIN spying difficult.
b) Position the PED so that it is angled in such a way to make PIN spying difficult.
Modified p. 50 → 55
Installing PED on an adjustable stand that allows consumers to swivel the terminal sideways and/or tilt it forwards/backwards to a position that makes visual observation of the PIN-entry process difficult.
c) Installing PED on an adjustable stand that allows consumers to swivel the terminal sideways and/or tilt it forwards/backwards to a position that makes visual observation of the PIN-entry process difficult.
Modified p. 50 → 55
Positioning of in-store security cameras such that the PIN-entry keypad is not visible.
d) Positioning of in-store security cameras such that the PIN-entry keypad is not visible.
Modified p. 50 → 55
Instructing the cardholder regarding safe PIN-entry. This can be done with a combination of − Signage on the PED − Prompts on the display, possibly with a "click-through" screen − Potentially literature at the point of sale − A logo for safe PIN-entry process Other methods are possible as well. The above are examples of some of the methods a vendor can propose to protect PINs during PIN entry. The vendor must provide adequate techniques in the PED documentation …
e) Instructing the cardholder regarding safe PIN-entry. This can be done with a combination of ƒ Signage on the PED ƒ Prompts on the display, possibly with a "click-through" screen ƒ Potentially literature at the point of sale ƒ A logo for safe PIN-entry process Other methods are possible as well. The above are examples of some of the methods a vendor can propose to protect PINs during PIN entry. The vendor must provide adequate techniques in the PED documentation …
Modified p. 50 → 55
Table A1: Sample Matrix of Observation Corridors and PIN Protection Methods Observation Corridors Customers in Queue Customers Elsewhere On-Site Cameras Remote Cameras PED Stand A M H L L L PED Stand B H H H L M Check-Stand A L M M L H Check-Stand B H H M H H Customer Instruction H* H* H* H* H* * Customer Instruction methods are less repeatable and therefore should be used in combination with other methods.
Table A1: Sample Matrix of Observation Corridors and PIN Protection Methods Observation Corridors On-Site Cameras Remote Cameras PED Stand A M H L L L PED Stand B H H H L M Check-Stand A L M M L H Check-Stand B H H M H H Customer Instruction H* H* H* H* H* * Customer Instruction methods are less repeatable and therefore should be used in combination with other methods. L = low, M = medium, H = high.
Removed p. 51
Identification and exploitation For an attacker wanting to exploit a vulnerability the vulnerability must first be identified. This may appear to be a trivial separation, but it is an important one. To illustrate this, first consider a vulnerability that is uncovered following months of analysis by an expert and a simple attack method published on the Internet. Compare this to a vulnerability that is well known but requires enormous expenditure of time and resources to exploit. Of course factors such as time need to be treated differently in these cases.

Factors to be considered The following cost factors should be considered for the analysis of the attack costs required to exploit a vulnerability:

3. Cost for the access to the POS PED;

3. Cost for the access to the POS PED;

4. Equipment costs like instruments, components, IT hardware, software required for the analysis;

4. Equipment costs like instruments, components, IT hardware, software required for …
Modified p. 51 → 56
1. Attack time labor costs for the various levels of expertise;
a) Attack time for the variou
Modified p. 51 → 56
2. Costs to acquire the required knowledge of the POS PED design and operation;
b) Potential to acquire the required knowledge of the POS PED’s de
Modified p. 51 → 56
2. Costs to acquire the required knowledge of the POS PED design and operation;
b) Potential to acquire the required knowledge of the POS PED’s de
Modified p. 51 → 56
5. Costs of POS PED specific spare components.
e) POS PED specific spare components.
Modified p. 51 → 56
5. Costs of POS PED specific spare components.
e) POS PED specific spare components.
Modified p. 51 → 56
In many cases these factors don’t depend on each other but might be substituted for each other in varying degrees. For example expertise or hardware/software can be a substitute for time. A discussion of these factors follows.
In many cases these factors don’t depend on ea varying degrees. For example, expertise or hard of these factors follows.
Removed p. 52
a) Experts are familiar with the underlying algorithms, protocols, hardware, structures, etc. implemented in the product or system type and the principles and concepts of security employed.

b) Proficient persons are knowledgeable in that they are familiar with the security behavior of the product.

If proficient expertise on various areas of technology is required for an attack, e.g., on electrical engineering and cryptography, an expert level of expertise can be assumed.

Knowledge of the POS PED costs refers to obtaining specific expertise in relation to the POS PED. This is different from generic expertise but not unrelated to it. Identified levels are as follows:

a) No information about the POS PED, other than its general purpose;

b) Public information concerning the POS PED (e.g., as gained from user guides);

c) Sensitive information about the POS PED (e.g., knowledge of internal design, which may have to be obtained by ‘social engineering’ or exhaustive reverse engineering).

Care should be …
Modified p. 53 → 58
a) Standard equipment is equipment that is readily available to the attacker, either for the identification of a vulnerability or for an attack. This equipment can be readily obtained, e.g., at a nearby store or downloaded from the Internet. The Equipment might consist of simple attack scripts, personal computers, card readers, pattern generators, simple optical microscopes, power supplies or simple mechanical tools.
a) Standard equipment i dily avail he attacker, either for the identification of vulnerability or for an attack. This equipment can be readily obtained•e.g., at a nearby store or downloaded from the Internet. The equipment might consist of simple attack scripts, personal computers, card readers, pattern gener ple optical microscopes, power supplies, or simple mechanical t .
Modified p. 53 → 58
b) Specialized equipment isn’t readily available to the attacker, but could be acquired without undue effort. This could include purchase of moderate amounts of equipment (e.g., dedicated electronic cards, specialized test bench, protocol analyzers, oscilloscopes, microprobe workstation, chemical workbench, precise milling machines, etc.) or development of more extensive attack scripts or programs.
b) Specialized equipment isn’t readily available to the attacker, but could be acquired without undue effort. This could include pu se of moderate amounts of equipment (e.g., dedicated electronic cards, specialized test bench, protocol analyze oscilloscopes, microprobe workstation, chemical workbench, precise milling machines, etc.) or development of more veloped during the identification phase is considered as s equipment that is rea able to t ators, sim ools extensive attack scripts or programs.
Modified p. 53 → 58
c) Bespoke equipment is not readily available to the public as it might need to be specially produced (e.g., very sophisticated software) or because the equipment is so specialized that its distribution is controlled, possibly even restricted. Alternatively the equipment may be very expensive (e.g., Focused Ion Beam, Scanning Electron Microscope, and Abrasive Laser Equipment). Bespoke Equipment, which can be rented, might have to be treated as specialized equipment.
c) Bespoke equipment is not readily available to the public as it might need to be specially produced (e.g., very sophisticated software) or because the equipment is so specialized that its distribution is controlled, possibly even restricted. Alternatively, the equipment may be very expensive (e.g., Focused Ion Beam, Scanning Electron Microscope, and Abrasive Laser Equipment). Bespoke equipment, which can be rented, might have to be treated as specialized equipment. Software that has been de bespoke equipment; it must not additionally …
Modified p. 53 → 59
Spare part costs refer to components required to hide the signs of an attack or to otherwise replace components that have been broken during an attack, like a case part, a display or a printer.
Parts refer to components required to hide the signs of an attack; to otherwise replace components that have been broken during an attack, like a case part, a display or a printer; to created data-monitoring or communicating bug; or otherwise are needed to perform the attack. If the same part may be used for identification and exploitation, it must only be accounted for once.
Modified p. 53 → 59
a) Standard parts are readily available to the attacker, either by purchasing it from a supply store or by re-using parts from a mechanical sample of the same device.
a) Standard parts are readily available to the attacker, either by purchasing them from a supply store or by re-using parts from a mechanical sample of the same device.
Removed p. 55
First attack cost example.

4. The sensitive data is collected from the PED We assume that more than one sample of the device is needed for the identification phase and the exploitation phase of the attack. The skill required is proficient skill. The same equipment is used and required at identification and exploitation time. The following table is references to the attack phases.
Modified p. 55 → 61
The attack aims to insert a PIN-disclosing bug into a PED. The bug is placed at a position in the device, where the PIN is handled in clear, for instance at the keypad or at the ICC reader interface. It is assumed that such an attack is possible. A generic attack consists of the following steps:
First Attack Example The attack aims to insert a PIN-disclosing bug into a PED. The bug is placed at a position in the device where the PIN is handled in clear, for instance at the keypad or at the ICC reader interface. It is assumed that such an attack is possible. A generic attack consists of the following steps:
Modified p. 55 → 61
1. Reverse-engineer the device and develop the attack models. This step requires professional knowledge of electronic engineering and the capability to perform the mechanical and electronic test required. The modules will break during that phase. It is assumed, that the device is protected by tamper-response circuits, which prevent undetected opening of the device, but the point of interest are not covered by a tamper-responsive envelope.
1. Reverse-engineer the device and develop the attack models. This step requires professional knowledge of electronic engineering and the capability to perform the mechanical and electronic test required. The modules will break during that phase. It is assumed that the device is protected by tamper-response circuits, which prevent undetected opening of the device, but the points of interest are not covered by a tamper-responsive envelope.
Modified p. 55 → 61
3. A PIN-disclosing bug is to be developed and tested (Identification phase) or placed into the PED (Exploitation Phase).
3. A PIN-disclosing bug is placed into the PED (Exploitation Phase).
Removed p. 56
Table 2: Attack Costs for Inserting a PIN-Disclosing Bug Identifying Exploiting 1a Reverse-engineering 40 hours / proficient skill at the identification phase. Cost factor Elapsed time * Expertise 1b Access to target, 1 mechanical sample and 1 functional sample 2 Modifying PED Elapsed time, 80 hours at identifying time, 8 hours at exploitation time / Proficient skill Cost factor Elapsed time * Expertise 2 Access to target, functional sample with working key 2 Sensitive knowledge of the PED, since reverse engineering is assumed to be required. During exploitation time, no further knowledge is required 2 / 3 Specialized equipment 3000 4000 3 Development/attachment of PIN-disclosing bug, 40 hours at identification time, 8 hours at exploitation time, proficient skill Cost factor Elapsed time * Expertise 3 Camouflage of the modification using spare parts from a mechanical sample 4 Collecting the sensitive data from the PED. 4 hours at identification and exploitation …
Modified p. 56 → 62
The attack aims at the determination of a DES key used for encryption at the device using differential power analysis (DPA). It is assumed, that  A function of the PED is used which requires a PIN to be entered for every execution of the cryptographic action with the key under attack,  The data used for DPA can be acquired at an external interface of the PED, e.g., the PED has not further to be physically attacked to get …
ƒ A function of the PED is used which requires a PIN to be entered for every execution of the cryptographic action with the key under attack; ƒ The data used for DPA can be acquired at an external interface of the PED, e.g., the PED needs not be further physically attacked to get the required test data; and that ƒ The PED does not have effective countermeasures against DPA.
Removed p. 57
Table 3: Attack Costs Example for DPA Analysis Identifying Exploiting 1 Reverse-engineering of the PED operation mode 40 hours/ Proficient skill 2 Develop Attack set-up, 160 hours/ Proficient skill 4800 0 3 Perform measurement, 166/3 hours identifying, 166/3 hours exploitation 3 Access to target, functional sample at identification time, functional sample with working keys at exploitation time 2 and 3 Sensitive knowledge of target at exploitation time, public knowledge at identification time 2 Bespoke equipment at identification time, which is re-used in step 3 3 Specialized equipment at exploitation time 0 4000 4 Analysis of the data, 160 hours at exploitation time, 40 hours at identification time Attack Costs per Phase 25500 10900 Total Attack Costs 36400 As can be seen from the table, the attack costs are close to the margin of US $35,000 for the attack model. If the PIN is:

a) Entered manually in the attack, or b) …
Modified p. 57 → 62
2. Develop the attack set-up including the control to run the PED in a automated way. Since a large number of PIN entries is required, which can hardly be performed manually, a special mechanics has to be developed which performs the PIN entries. This is bespoke equipment, developed specially for this attack, which will be reused at Identification time.
2. Develop the attack set-up including the control to run the PED in an automated way. Since a large number of PIN entries are required, which can hardly be performed manually, special mechanics must be developed to perform the PIN entries. This is bespoke equipment, developed specially for this attack, which will be reused at Identification time.
Modified p. 57 → 62
3. Get an PED and perform the measurement. We expect, that at least 20,000 PIN entry steps and the following encryption have to be observed. In the identification phase, this may have to be repeated several times. Due to the exhaustive PIN search countermeasure, 20,000 PIN entries need at least 7 days. Since such an amount of transactions cannot be performed in a real live environment, it must be possible to run the device off-line with an simulated host.
3. Get a PED and perform the measurement. We expect that at least 20,000 PIN entry steps and the following encryption have to be observed. In the identification phase, this may have to be repeated several times. Due to the exhaustive PIN search countermeasure, 20,000 PIN entries need at least 7 days. Since such an amount of transactions cannot be performed in a real live environment, it must be possible to run the device off-line with a simulated host.
Modified p. 57 → 62
The attack costs are estimated by the following table:
The attack potentials are estimated within the following table:
Removed p. 58
In order to support these settings, the tester should request and obtain an initial sample of 230 bits from the vendor.

The Lempel-Ziv test should not be run. [0] The SP800-22 document (section 4.2) requires that the results be interpreted as a "pass" if it passes all of the executed tests using both the "Proportion of Sequences Passing a Test" and the "Uniform Distribution of P-Values" interpretation approaches. The SP800-22 document further requires that if the results are inconclusive (e.g., if a small number of the tests fail, but only marginally) the tester should acquire additional data from the vendor and continue testing in order to determine if the original failure was the result of a statistical anomaly.
Removed p. 59
[2] The number of bit sequences (sample size) must be 1,000 or greater in order for the "Proportion of Sequences Passing a Test" result to be meaningful. (See SP800-22 section 4.2.1 and 4.3 f). This value will be 1,073 for the first test, but if further testing is required, this parameter will be larger.
Modified p. 59 → 64
[1] n must be selected to be consistent with the requirements all of the tests to be run. The Overlapping Template Matching Test, Linear Complexity Test, Random Excursions Test, and Random Excursions Variant Test all require n to be greater than or equal to 106 in order to produce meaningful results. The Non-Overlapping Template Matching Test and the Lempel-Ziv Compression test require n to equal 106. (See SP800-22 sections 2.7.7, 2.8.7, 2.10.7, 2.11.7, 2.15.7, and 2.16.7) The Lempel-Ziv code in …
[1] n must be selected to be consistent with the requirements all of the tests to be run. The Overlapping Templates, Linear Complexity, Random Excursions, and Random Excursions Variant tests all require n to be greater than or equal to 106 in order to produce meaningful results. The Non-Overlapping Templates test requires n to equal 106. (See SP800-22 Sections 2.7.7, 2.8.7, 2.10.7, 2.11.7, 2.15.7, and 2.16.7) [2] The number of bit sequences (sample size) must be 1,000 or greater in …
Modified p. 59 → 64
[3] For the Frequency Test within a Block, if n=106, the test block size should be set between 104 and 106. (See SP800-22 section 2.2.7) [4] The two template tests (Non-Overlapping Template Test and Overlapping Template Test) both require selection of a template length of 9 or 10 in order to produce meaningful results. (See SP800- 22 section 2.7.7 and 2.8.7) [5] Maurer's Universal Statistical Test block length (L) and initialization steps (Q) must be consistent with the table in …
[3] For the Block Frequency Test, if n=106, the test block size should be set between 104 and 106. (See SP800-22 Section 2.2.7.) [4] The two template tests (Non-Overlapping and Overlapping tests) both require selection of a template length of 9 or 10 in order to produce meaningful results. (See SP800-22 Sections 2.7.7 and 2.8.7.) [5] The Universal test block length (L) and initialization steps (Q) must be consistent with the table in SP800-22 Section 2.9.7. For n=106, the only …
Modified p. 59 → 64
[6] SP800-22 section 2.13.7 requires the block length to be less than 2 log 2 n ! " # $ % , however the sts tool warns if the block size is greater than 2 log 5 n ! " # $ % (which is consistent with the information in section 4.3 f). Other analysis ([Hill 2004]) has shown that for n=1,000,000 setting the block length to 8 is more reasonable, as it is large enough to be meaningful while …
[6] For the Approximate Entropy (ApEn) test, SP800-22 Section 2.13.7 requires the block length to be less than , however the sts tool warns if the block size is greater than 2 log 2 n − ⎢ ⎥ ⎣ ⎦ 2 log 5 n − ⎢ ⎥ ⎣ ⎦ (which is consistent with the information in Section 4.3 f). Other analysis [Hill 2004] has shown that for n=1,000,000 values block lengths greater than 8 can cause failures more often than …
Modified p. 59 → 64
(See SP800-22 section 2.12.7) [8] The Linear Complexity block length is required to be set to between 500 and 5,000, inclusive. (See SP800-22 section 2.11.7) References [Rukhin 2001] Rukhin, Andrew, et al., "A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications", NIST SP800-22, revisions dated May 15, 2001.
[7] The Serial Test block length is also set based on n. If n=106, the block length must be less than 17. (See SP800-22 Section 2.12.7) [8] The Linear Complexity Test block length is required to be set to between 500 and 5,000 (inclusive), and requires that 200 ≥ M n . (See SP800-22 Section 2.11.7.) References [Rukhin 2001] Rukhin, Andrew, et al., "A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications", NIST SP800-22, revisions dated …