Issuer PIN Security Guidelines - Visa

• Transported clear text key components should be in pre-serialised, separate,
tamper-evident, packaging or in a SCD .
• If a key loading device is used to transport key components:
– The device (or the part of it which contains the key component) should
be a SCD
– The device should only be operated by issuer authorised personnel .
• Key loading procedures should ensure that:
– All participating devices and connections are inspected for monitoring
or tampering
– key loading is performed using dual control
– key components are only combined within a secure cryptographic
device, e .g, a HSM
• Keys should be replaced in accordance with the existing issuer key
management policy3 .
• Keys used in a production environment should not be the same as keys used
in a non-production environment (for example testing or development) .
• Keys should exist in the minimum number of locations needed for correct
operation of the system in accordance with issuer security policy .
• Issuer security policy should identify suspicious circumstances that indicate
a key compromise (consistent with their own fraud detection systems and
threat analysis) .
• In the event of a suspected key compromise:
– The key and its derivatives should be replaced immediately
– Replacement keys should not be derived from the compromised key
– The compromised key, and its components should be destroyed
– All keys protected by or derived from the compromised key should be
destroyed
– Users of compromised keys should be informed of the compromise and
change in key, even if the key is no longer in use
– The decommissioning of compromised keys should be logged
– The amount of time in which a compromised key remains active should
be consistent with the risk to affected parties
• PIN encryption keys should be used only for PIN encryption and not for any
other purpose .
• Reference PINs should be protected using a different key to that used to
protect transaction PINs, both for storage and transmission .
• Encryption keys should be unique to each pair of communicating nodes . .
• The strength of encryption mechanisms should be sufficient to minimise
the risk of security breaches through exhaustive key search or through
cryptanalysis .
3 Key change intervals should be consistent with the corresponding PCI DSS requirements for key change intervals .
Issuer PIN Security Guidelines 3 3
Visa Public © 2010 Visa. All Rights Reserved.