Reference numbe
r
ISO 9564-1:2002(E)
©
ISO 2002
INTERNATIONAL
STANDARD
ISO
9564-1
Second edition
2002-04-15
Banking — Personal Identification Number
(PIN) management and security —
Part 1:
Basic principles and requirements for
online PIN handling in ATM and POS
systems
Banque — Gestion et sécurité du numéro personnel d'identification
(PIN) —
Partie 1: Principes et exigences de base pour la gestion du PIN en ligne
dans les systèmes ATM et POS
Copyright International Organization for Standardization
Provided by IHS under license with ISO
Not for Resale
No reproduction or networking permitted without license from IHS
--`,,,`-`-`,,`,,`,`,,`---
ISO 9564-1:2002(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not
be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this
file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this
area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters
were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event
that a problem relating to it is found, please inform the Central Secretariat at the address given below.
© ISO 2002
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic
or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body
in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.ch
Web www.iso.ch
Printed in Switzerland
ii
© ISO 2002 – All rights reserved
Copyright International Organization for Standardization
Provided by IHS under license with ISO
Not for Resale
No reproduction or networking permitted without license from IHS
--`,,,`-`-`,,`,,`,`,,`---
ISO 9564-1:2002(E)
© ISO 2002 – All rights reserved iii
Contents Page
Foreword.....................................................................................................................................................................iv
Introduction.................................................................................................................................................................v
1 Scope ..............................................................................................................................................................1
2 Normative references ....................................................................................................................................1
3 Terms and definitions ...................................................................................................................................2
4 Basic principles of PIN management ..........................................................................................................4
5 PIN entry devices...........................................................................................................................................5
5.1 Character set..................................................................................................................................................5
5.2 Character representation ..............................................................................................................................5
5.3 PIN entry .........................................................................................................................................................5
5.4 Packaging considerations ............................................................................................................................5
6 PIN security issues........................................................................................................................................6
6.1 PIN control requirements..............................................................................................................................6
6.2 PIN encipherment ..........................................................................................................................................7
6.3 Physical security ...........................................................................................................................................7
7 Techniques for management/protection of account-related PIN functions ............................................ 8
7.1 PIN length .......................................................................................................................................................8
7.2 PIN selection ..................................................................................................................................................8
7.3 PIN issuance and delivery ............................................................................................................................9
7.4 PIN change ...................................................................................................................................................10
7.5 Disposal of waste material and returned PIN mailers..............................................................................11
7.6 PIN activation ...............................................................................................................................................11
7.7 PIN storage ...................................................................................................................................................11
7.8 PIN deactivation...........................................................................................................................................12
8 Techniques for management/protection of transaction-related PIN functions.....................................12
8.1 PIN entry .......................................................................................................................................................12
8.2 Protection of PIN during transmission......................................................................................................12
8.3 Standard PIN block formats .......................................................................................................................12
8.4 Other PIN block formats..............................................................................................................................16
8.5 PIN verification.............................................................................................................................................16
8.6 Journalizing of transactions containing PIN data....................................................................................16
9 Approval procedure for encipherment algorithms ..................................................................................16
Annex A (informative) General principles of key management............................................................................17
Annex B (informative) PIN verification techniques................................................................................................ 20
Annex C (informative) PIN entry device for online PIN encipherment................................................................. 22
Annex D (informative) Example of pseudo-random PIN generation ....................................................................24
Annex E (informative) Additional guidelines for the design of a PIN entry device ............................................ 25
Annex F (informative) Guidance on clearing and destruction procedures for sensitive data ..........................28
Annex G (informative) Information for customers .................................................................................................30
Copyright International Organization for Standardization
Provided by IHS under license with ISO
Not for Resale
No reproduction or networking permitted without license from IHS
--`,,,`-`-`,,`,,`,`,,`---
ISO 9564-1:2002(E)
iv © ISO 2002 – All rights reserved
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO
member bodies). The work of preparing International Standards is normally carried out through ISO technical
committees. Each member body interested in a subject for which a technical committee has been established has
the right to be represented on that committee. International organizations, governmental and non-governmental, in
liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical
Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3.
The main task of technical committees is to prepare International Standards. Draft International Standards adopted
by the technical committees are circulated to the member bodies for voting. Publication as an International
Standard requires approval by at least 75 % of the member bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this part of ISO 9564 may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO 9564-1 was prepared by Technical Committee ISO/TC 68, Banking, securities and other financial services,
Subcommittee SC 6, Retail financial services.
This second edition cancels and replaces the first edition (ISO 9564-1:1991), which has been technically revised.
ISO 9564 consists of the following parts, under the general title Banking — Personal Identification Number (PIN)
management and security:
— Part 1: Basic principles and requirements for online PIN handling in ATM and POS systems
— Part 2: Approved algorithm(s) for PIN encipherment
— Part 3: PIN protection requirements for offline PIN handling in ATM and POS systems
Annexes A to G of this part of ISO 9564 are for information only.
Copyright International Organization for Standardization
Provided by IHS under license with ISO
Not for Resale
No reproduction or networking permitted without license from IHS
--`,,,`-`-`,,`,,`,`,,`---
ISO 9564-1:2002(E)
© ISO 2002 – All rights reserved v
Introduction
The Personal Identification Number (PIN) is a means of verifying the identity of a customer within an electronic
funds transfer (EFT) system.
The objective of PIN management is to protect the PIN against unauthorized disclosure, compromise and misuse
throughout its life cycle and, in so doing, to minimize the risk of fraud occurring within EFT systems. The secrecy of
the PIN needs to be assured at all times during its life cycle which consists of its selection, issuance, activation,
storage, entry, transmission, validation, deactivation and any other use made of it.
PIN security also depends upon sound key management. Maintaining the secrecy of cryptographic keys is of
the utmost importance because the compromise of any key allows the compromise of any PIN ever enciphered
under it.
Wherever possible, this part of ISO 9564 specifies requirements in absolute terms. In some instances, a level of
subjectivity cannot be practically avoided especially when discussing the degree or level of security desired or to be
achieved.
The level of security to be achieved needs to be related to a number of factors, including the sensitivity of the data
concerned and the likelihood that the data will be intercepted, the practicality of any envisaged encipherment
process and the cost of providing, and breaking, a particular means of security. It is, therefore, necessary for each
card acceptor, acquirer and issuer to agree on the extent and detail of security and PIN management procedures.
As absolute security is not practically achievable, PIN management procedures should implement preventive
measures to reduce the opportunity for a breach in security and aim for a “high” probability of detection of any illicit
access or change to PIN material should these preventive measures fail. This applies at all stages of the
generation, exchange and use of a PIN, including those processes that occur in cryptographic equipment and
those related to the communication of PINs.
This part of ISO 9564 is designed so that issuers can uniformly make certain, to whatever degree is practical, that a
PIN, while under the control of other institutions, is properly managed. Techniques are given for protecting the PIN-
based customer authentication process by safeguarding the PIN against unauthorized disclosure during the PIN's
life cycle. The publication of additional parts is planned and these will cover PIN protection principles and
techniques, electronic commerce and other environments identified at the time of writing.
In ISO 9564-2, approved encipherment algorithms to be used in the protection of the PIN are specified. Application
of the requirements of this part of ISO 9564 requires bilateral agreements to be made, including the choice of
algorithms specified in ISO 9564-2.
This part of ISO 9564 is one of a series that describes requirements for security in the retail banking environment,
as follows:
ISO 9564-2:1991, Banking — Personal Identification Number (PIN) management and security — Part 2: Approved
algorithm(s) for PIN encipherment
ISO 9564-3:—
1)
, Banking — Personal Identification Number (PIN) management and security — Part 3: PIN
protection requirements for offline PIN handling in ATM and POS systems
ISO 10202 (all parts), Financial transaction cards — Security architecture of financial transaction systems using
integrated circuit cards
ISO 11568 (all parts), Banking — Key management (retail)
1) To be published.
Copyright International Organization for Standardization
Provided by IHS under license with ISO
Not for Resale
No reproduction or networking permitted without license from IHS
--`,,,`-`-`,,`,,`,`,,`---
