ISO 9564

ISO 9564 is an international standard for personal identification number (PIN) management and security in retail banking.

The PIN is used to verify the identity of a customer (the user of a bank card) within an electronic funds transfer system, and (typically) to authorize the transfer of funds. Therefore, it is important to protect such PINs against unauthorized disclosure or misuse. Modern banking systems require interoperability between different card issuers, acquiring banks and retailers – including transmission of PINs between those entities – so a common set of rules for handling and securing PINs is required, both to ensure technical compatibility and a mutually agreed level of security. ISO 9564 provides principles and techniques to meet these requirements.

ISO 9564 comprises four parts, under the general title of Financial services — Personal Identification Number (PIN) management and security.^{[Note 1]}

Part 1: Basic principles and requirements for online PIN handling in ATM and POS systems

ISO 9564-1:2002^[1] specifies the basic principles and techniques of secure PIN management. It includes both general principles and specific requirements.

(ISO 9564-1:2002 has been superseded by ISO 9564-1:2011 Basic principles and requirements for PINs in card-based systems.^[2])

Basic principles

The basic principles of PIN management include:

PIN management functions shall be implemented in software and hardware in such a way that the functionality cannot be modified without detection, and that the data cannot be obtained or misused.

The PIN must always be stored encrypted or physically secured.

Encrypting the same PIN with the same key but for a different bank account shall not predictably give the same cipher text.

Security of the PIN encryption shall depend on secrecy of the key, not secrecy of the algorithm.

Only the customer (i.e. the user of a card) and/or authorized card issuer staff shall be involved with PIN selection or issuing. Where card issuer staff are involved, appropriate strictly enforced procedures shall be used.

A stored encrypted PIN shall be protected from substitution.

A PIN shall be revoked if it is compromised, or suspected to be.

The card issuer shall be responsible for PIN verification, but may delegate that responsibility to another institution.

The customer shall be advised of the importance of keeping the PIN secret.

PIN entry devices

The standard specifies some characteristics required (or recommended) of PIN entry devices (also known as PIN pads), i.e. the device into which the customer enters the PIN, including:

All PIN entry devices shall allow entry of the digits zero to nine. Numeric keys may also have letters printed on them, e.g. as per E.161. These letters are only for the customers' convenience; internally, the PIN entry device only handles digits. (E.g. the standard does not support multi-tap or similar.) The standard also recommends that customers should be warned that not all devices may have letters.

The PIN shall not be displayed or disclosed by audible feedback.

The PIN entry device shall be physically secured so that it is not feasible to modify its operation or extract PINs or encryption keys from it.

The PIN entry device shall be designed or installed so as to prevent other people from observing the PIN as it is entered.

The keyboard layout should be standardized, with consistent and unambiguous labels for function keys, such as "enter", "clear" (this entry) and "cancel" (the transaction). The standard also recommends specific colours for function keys: green for "enter", yellow for "clear", red for "cancel".

Other specific PIN control requirements

Other specific requirements include:

All hardware and software used for PIN management functions shall be implemented such that:
- Their correct functioning can be assured.
- They cannot be modified or accessed without detection.
- The data cannot be inappropriately accessed, modified or misused.
- The PIN cannot be determined by a brute-force search.

The PIN shall not be communicated verbally. In particular bank personnel shall never ask the customer to disclose the PIN, nor recommend a PIN value.

PIN encryption keys shall not be used for any other purpose.

PIN length

The standard specifies that PINs shall be from four to twelve digits long, noting that longer PINs are more secure but harder to use. It also notes that not all systems support entry of PINs longer than six digits.

PIN selection

There are three methods of selecting or generating a PIN:

assigned derived PIN: The card issuer generates the PIN by applying some cryptographic function to the account number or other value associated with the customer. In this case the issuer need not - and should not - keep a record of the PIN, because it can be derived again when it needs to be verified.

assigned random PIN: The card issuer generates a PIN value using a random number generator.

customer-selected PIN: The customer selects the PIN value.

PIN issuance and delivery

The standard includes requirements for keeping the PIN secret while transmitting it, after generation, from the issuer to the customer. These include:

The PIN shall be only be mailed in a PIN mailer, an envelope designed so that it can be printed without the PIN being visible (even at printing time) until the envelope is opened. A PIN mailer must also be constructed so that any prior opening will be obvious to the customer, who will then be aware that the PIN may have been disclosed.

The PIN shall never appear where it can be associated with a customer's account. For example the PIN mailer must not include the account number, but only sufficient information for its physical delivery (e.g. name and address). The PIN and the associated card shall not be mailed together, nor at the same time.

PIN encryption

To protect the PIN during transmission from the PIN entry device to the verifier, the standard requires that the PIN be encrypted, and specifies several formats that may be used. In each case, the PIN is encoded into a 64-bit PIN block, which is then encrypted by an "approved algorithm" (currently TDEA, according to part 2 of the standard).

The PIN block formats are:

Format 0

The PIN block is constructed by XOR-ing two 64-bit fields: the plain text PIN field and the account number field, both of which comprise 16 four-bit nibbles.

The plain text PIN field is:

one nibble with the value of 0, which identifies this as a format 0 block
one nibble encoding the length N of the PIN
N nibbles, each encoding one PIN digit
14−N nibbles, each holding the "fill" value 15 (i.e. 1111₂)

The account number field is:

four nibbles with the value of zero
12 nibbles containing the right-most 12 digits of the primary account number (PAN), excluding the check digit

Format 1

This format should be used where no PAN is available. The PIN block is constructed by concatenating the PIN with a transaction number thus:

1 nibble with the value of 1, which identifies this as a format 1 block
1 nibble encoding the length N of the PIN
N nibbles, each encoding one PIN digit
14−N nibbles encoding a unique value, which may be a transaction sequence number, time stamp or random number

Format 2

Format 2 is for local use with off-line systems only (e.g. smart cards). It is specified in part 3 of the standard.

Format 3

Format 3 is the same as format 0, except that the "fill" digits are random values from 10 to 15, and the first nibble (which identifies the block format) has the value 3.

Part 2: Approved algorithms for PIN encipherment

ISO 9564-2^[3] specifies which encryption algorithms may be used for encrypting PINs. The approved algorithms are:

Part 3: Requirements for offline PIN handling in ATM and POS systems

ISO 9564-3^[4] specifies the requirements for handling and verifying PINs that are verified by a smart card itself, rather than being sent to the bank for verification.

PIN protection between entry device and smart card

The PIN entry device and the smart card reader that will verify the PIN may be integrated into a single physically secure unit, but they do not need to be. If they are not both part of an integrated secure unit, then the PIN shall be encrypted while it is transmitted from the PIN entry device to the card reader.

Independently of whether the PIN is encrypted from the entry device to the card reader, the PIN may be encrypted for transmission from the card reader to the card.

Physical security

Generally, the PIN entry device used for offline PIN handling should meet the same requirements as for online PIN handling, described in part 1. Additionally, the card reader should be constructed to prevent someone monitoring the communications to the card by inserting a monitoring device into the card slot.

PIN blocks

If the PIN is encrypted for transmission from the entry device to the card reader, it shall be encrypted using one of the PIN block formats specified in part 1 (i.e. format 0, 1 or 3).

The card reader shall always submit the PIN to the card encoded as a format 2 PIN block, whether or not it is encrypted. If it is encrypted, a unique key shall be used for each transaction.

Format 2 PIN block

The format 2 PIN block is constructed thus:

1 nibble with the value of 2, which identifies this as a format 2 block
1 nibble encoding the length N of the PIN
N nibbles, each encoding one PIN digit
14-N nibbles, each holding the "fill" value 15

Part 4: Guidelines for PIN handling in open networks

ISO 9564-4^[5] provides guidelines for PIN handling in open networks, i.e. in environments where issuers and acquirers have no direct control, or where no relationship exists between the PIN entry device and the acquirer prior to the transaction.

Notes

↑ The exact wording of this title varies between parts. This is the wording of the most recently published part.

References

ISO standards by standard number

List of ISO standards / ISO romanizations / IEC standards

1–9999	1 2 3 4 5 6 7 9 16 31 -0 -1 -2 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 128 216 217 226 228 233 259 269 302 306 428 518 519 639 -1 -2 -3 -5 -6 646 690 732 764 843 898 965 1000 1004 1007 1073-1 1413 1538 1745 1989 2014 2015 2022 2047 2108 2145 2146 2240 2281 2709 2711 2788 2852 3029 3103 3166 -1 -2 -3 3297 3307 3602 3864 3901 3977 4031 4157 4217 4909 5218 5428 5775 5776 5800 5964 6166 6344 6346 6385 6425 6429 6438 6523 6709 7001 7002 7098 7185 7200 7498 7736 7810 7811 7812 7813 7816 8000 8178 8217 8571 8583 8601 8632 8652 8691 8807 8820-5 8859 -1 -2 -3 -4 -5 -6 -7 -8 -8-I -9 -10 -11 -12 -13 -14 -15 -16 8879 9000/9001 9075 9126 9293 9241 9362 9407 9506 9529 9564 9594 9660 9897 9945 9984 9985 9995

10000–19999	10006 10116 10118-3 10160 10161 10165 10179 10206 10218 10303 -11 -21 -22 -28 -238 10383 10487 10585 10589 10646 10664 10746 10861 10957 10962 10967 11073 11170 11179 11404 11544 11783 11784 11785 11801 11898 11940 (-2) 11941 11941 (TR) 11992 12006 12182 12207 12234-2 13211 -1 -2 13216 13250 13399 13406-2 13407 13450 13485 13490 13567 13568 13584 13616 14000 14031 14224 14289 14396 14443 14496 -2 -3 -6 -10 -11 -12 -14 -17 -20 14644 -1 -2 -3 -4 -5 -6 -7 -8 -9 14649 14651 14698 -2 14750 14764 14882 14971 15022 15189 15288 15291 15292 15398 15408 15444 -3 15445 15438 15504 15511 15686 15693 15706 -2 15707 15897 15919 15924 15926 15926 WIP 15930 16023 16262 16612-2 16750 16949 (TS) 17024 17025 17203 17369 17799 18000 18004 18014 18245 18629 18916 19005 19011 19092 (-1 -2) 19114 19115 19125 19136 19439 19500 19501 19502 19503 19505 19506 19507 19508 19509 19510 19600 19752 19757 19770 19775-1 19794-5 19831

20000+	20000 20022 20121 21000 21047 21500 21827:2002 22000 23270 23271 23360 24517 24613 24617 24707 25178 25964 26000 26300 26324 27000 series 27000 27001:2005 27001:2013 27002 27003 27004 27005 27006 27007 27729 27799 28000 29110 29148 29199-2 29500 30170 31000 32000 38500 40500 42010 80000 -1 -2 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 -14

Categories	ISO standards ISO 639 ISO 3166 ISO / IEC standards OSI protocols

All articles with prefix "ISO"

This article is issued from Wikipedia - version of the Friday, June 19, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.