PCI PIN Security Requirements provide guidelines on protecting PIN during offline and online transactions in ATM’s and POS terminals. This standard has serious overlaps with PCI DSS, POS Management and HSM utilization in a secure card environment.

1. PCI PIN, PCI
CRYPTOGRAPHY &
KEY MANAGEMENT

2. Webinar
Objectives
Introduction to PCI PIN
Scope and Applicability of PCI PIN
Basics of cryptography
Best practices in Key Management
PCI PIN certification process.
QnA

3. FREE COMPLIANCE CONTENT
Subscribe to our YouTube channel:
https://www.youtube.com/c/vistainfosecofficial
View up-to-date informative videos free on
-PCI DSS
-HIPAA
-GDPR
-SOC 1/2
-Ethical Hacking

4. •It is not the answer that enlightens,
but the question.
Decouvertes

5. ABOUT M E
Mr.Sahoo carries over 25 years of experience in the IT industry, out of which the last 15 years
has been dedicated to VISTA InfoSec. His professional qualifications include PCI QSA, CISA,
CISSP, CRISC, ISO 27001 Lead Assessor. Starting off as an assembly language programmer,
with the advent of networking and the Internet in India, he moved on into networking and IT
management of which InfoSec was a natural progression.
A very well versed professional with proficiency in globally recognized standards such as
ISO27001, PCI DSS, ITIL/ISO 20000, COBIT and many international regulations such as
HIPAA, CSV, SOX, SSAE16, SOC, etc., Mr.Sahoo has conducted IT consulting and assessments
for large Banks, Software development organizations, Banks, Research & Development
companies and BPOs in India and overseas. Well versed with strategy development and an
astute Technical background, he has audited, designed and strategized for a wide variety of
Information security and networking technologies. He has provided consulting services for
premier organizations such as Tata Group, Shell Oil, Cipla, numerous payment processing
organisations and a host of banks including the Reserve Bank of India and the Indian armed
forces.
He has recently been awarded the “Crest of Honor” by the Indian Navy for his contributions. He
was inducted into the CSI – Hall of Fame for his significant contributions to the fraternity.
Sectors: Worked in all vertical ranging from Government/PSU, BFSI, Pharma, Manufacturing,
ITES etc.
NARENDRA SAHOO
Designation Director
Certifications PCI QPA,
PCI QSA, CISSP, CISA,
CRISC, ISO27001 LA
Experience 25 Years

10. Ending Survey pls…
Please do complete our brief survey at the end and leave your
comments

11. PCI SSC STANDARDS

12. PCI SSC - The Standards
PC I PED PC I PA-DS S PC I DS S
PCI PED addresses device
characteristics impacting
security of PIN Entry Device
(PED) during financ ial
transactions
PA- DSS applies to software vendors and others
who develop payment applications that store,
process, or transmit cardholder data as part of
authorization or settlement, where those
applications are sold, distributed, or licensed to
third parties.
PCI DSS applies to any entity that stores,
proc es s es, and/ or trans mits c ardholder
data, and specifically to those system
components included in or connected to
the cardholder data environment (the part
of the network with cardholder data)
PEDs Integrated with
payment applications
(POS , ATM)
Stand
Alone PED
Device
PCI PED
applies - PED
device only
PA DSS may
apply*
PCI DSS applies –
systems &
networks
Payment
A pplic ations (e.g.
Shopping cart,
POS)
Payment
Applications in
merchants/ service
providers
environment**
Merchants’ and
Service Providers’
cardholder data
environment

13. Standards Overview

14. PCI
Standards Framework

15. Objective
of PCI PIN
Identifies minimum security requirements for PIN-
based interchange transactions.
Outlines the minimum acceptable requirements for
securing PINs and encryption keys.
Assists all retail electronic payment system
participants in establishing assurances that
cardholder PINs will not be compromised.

16. Applicability
of PCI PIN
Secure management, processing, and transmission
of personal identification number (PIN) data during
online and offline payment card transaction
processing at ATMs and attended and unattended
point- of- sale (POS) terminals.

17. S tandard
layout
Transaction Processing Operations
- 7 Control Objectives
Normative Annex A – Symmetric Key Distribution using
Asymmetric Keys
Ac quiring entities involved in the implementation of s ymmetric
key distribution using asymmetric keys (remote key
dis tribution) or thos e entities involved in the operation of
Certification Authorities for such purposes
- A1 – 6 C ontrol Objec tives. Remote Key Dis tribution Us ing
Asymmetric Techniques Operations
- A2 – 7 C ontrol Objec tives. C ertific ation and Regis tration
Authority Operations
Normative Annex B – Key- Injection Facilities
- Entities that operate key- injection facilities for the
injec tion of keys ⎯ key-enc ipherment keys (KEKs ), PIN-
encipherment keys (PEKs), etc. ⎯that are used for the
acquisition of PIN data
- 7 Control Objectives
Normative Annex C – Minimum and Equivalent Key Sizes and
Strengths for Approved Algorithms

18. Requirements
layout

19. Transaction
Processing Operations
Control Objective 1: PINs used in transactions governed by these requirements are processed
using equipment and methodologies that ensure they are kept secure.
Control Objective 2: Cryptographic keys used for PIN encryption/decryption and related key
management are created using processes that ensure that it is not possible to predict any
key or determine that certain keys are more probable than other keys.
Control Objective 3: Keys are conveyed or transmitted in a secure manner
Control Objective 4: Key-loading to HSMs and POI PIN-acceptance devices is handled in a
secure manner.
Control Objective 5: Keys are used in a manner that prevents or detects their unauthorized
usage.
Control Objective 6: Keys are administered in a secure manner.
Control Objective 7: Equipment used to process PINs and keys is managed in a secure
manner

20. Normative Annex A – Symmetric Key Distribution
using Asymmetric Techniques
A1 – Remote Key Distribution Using Asymmetric Techniques Operations Control
Objective 1: PINs used in transactions governed by these requirements are processed
using equipment and methodologies that ensure they are kept secure.
Control Objective 2: Cryptographic keys used for PIN encryption/decryption and related
key management are created using processes that ensure that it is not possible to
predict any key or determine that certain keys are more probable than other keys.
Control Objective 3: Keys are conveyed or transmitted in a secure manner
Control Objective 4: Key-loading to HSMs and POI PIN-acceptance devices is handled in
a secure manner.
Control Objective 5: Keys are used in a manner that prevents or detects their
unauthorized usage
Control Objective 6: Keys are administered in a secure manner

21. Normative Annex A – Symmetric Key Distribution
using Asymmetric Techniques
A2 – Certification and Registration Authority Operations
Control Objective 3: Keys are conveyed or transmitted in a secure manner
Control Objective 4: Key-loading to HSMs and POI PIN-acceptance devices is handled in
a secure manner.
Control Objective 5: Keys are used in a manner that prevents or detects their
unauthorized usage.
Control Objective 6: Keys are administered in a secure manner.
Control Objective 7: Equipment used to process PINs and keys is managed in a secure
manner

22. Normative Annex B –
Key Injection Facilities
Control Objective 1: PINs used in transactions governed by these requirements are
processed using equipment and methodologies that ensure they are kept secure.
Control Objective 2: Cryptographic keys used for PIN encryption/decryption and related
key management are created using processes that ensure that it is not possible to
predict any key or determine that certain keys are more probable than other keys.
Control Objective 3: Keys are conveyed or transmitted in a secure manner
Control Objective 4: Key-loading to HSMs and POI PIN-acceptance devices is handled in
a secure manner.
Control Objective 5: Keys are used in a manner that prevents or detects their
unauthorized usage.
Control Objective 6: Keys are administered in a secure manner.
Control Objective 7: Equipment used to process PINs and keys is managed in a secure
manner

23. Minimum and Equivalent Key Sizes and Strengths for Approved Algorithms
The following are the minimum key sizes and parameters for the algorithm(s) in question
that must be used in connection with key transport, exchange, or establishment and for
key or data protection:
Normative Annex C

24. Basics of
Cryptography

25. I ndex
Introduction
What is Cryptography?
Purpose Of cryptography
Architecture of cryptography
Types of Cryptography
Process of cryptography
Types Of cryptography Algorithms Attacks
of cryptography
Conclusion
References

26. I NTRODUCTI ON
The Internet is a global connection of computer network with its various addresses
administered by the IANA (Internet address and Naming Authority).
There are many aspects to internet security which involves a range of applications,
including secure commerce and payments to private communications and protecting
passwords.
Cryptography is one critical aspect for secure communications.

27. What is
Cryptography?
Cryptography is a term derived from a Greek word
called “Krypto” which means “Hidden Secrets”.
Cryptography is a technique of hiding information.
The method involves securing of
communication/data by encrypting readable data
into a coded format, using special characters in
replacement of simple letters.
This process or technique facilitates Confidentiality,
Integrity, and Accuracy.

28. PURPOSE OF
CRYPTOGRAPHY
Authentication: Proves one's identity. (The primary forms
of host-to-host authentication on the Internet today are
name-based or address-based, both of which are
notoriously weak.)
Privacy/confidentiality: Ensures confidentiality of data, for
the text is encrypted and can only be read by the intended
person.
Integrity: It assure the data received by the receiver is not
compromised or altered in any way from the original.
Non-repudiation: A mechanism to prove that the
data/message was originally sent by sender himself.

29. Architecture of cryptography
Public
Key Crypto
Hash
Function
Secret
Key Crypto
Public
Key Crypto
Alice's
Private Key
Alice's
Message
Random
Session Key
Bob's
Public Key
Digital
Signature
Digital
Envelope
Encrypted
Message
Encrypted
Session Key
Sent to
Bob

30. Types of
Cryptography Both the sender and receiver needs to
be aware of the key.
Assuming we live in a hostile
environment (otherwise - why the need
for cryptography?), it may be hard to
share a secret key.
Secret Key Cryptography
Single key used to encrypt and decrypt
data.

31. Public Key
Cryptography
One of the keys allocated to each
person is called the "public key",
It is published in an open directory
where it is visible/accessible to
everyone. ( example by email address)
Each entity has 2 keys:
- Private Key (a secret)
- Public key (well known).

32. Using Keys
Private keys are used for decrypting.
Public keys are used for encrypting.

33. Process of
cryptography

34. TYPES OF CRYPTOGRAPHIC
ALGORITHMS

35. PUBLIC/PRIVATE KEY
CRYPTOGRAPHY
Asymmetric key cryptography which involves using of different encryption and
decryption key pair helps overcome key management problem.
Knowing just a single key, say the encryption key, is not sufficient to determine the
other decryption key.
The mathematical relationship between the public/private key pair has a standard
rule.
The rule suggests that any message encrypted with one key of the pair can only be
decrypted with its counterpart key.

36. Hash
Functions It is a one-way function, fundamental to most parts of
cryptography.
A one way function simply means it is easy to calculate, but hard to
invert.
Calculation of the input to the function maybe difficult, given its
output.
Meanings of "easy" and "hard" can be precisely defined
mathematically.
With rare exceptions, almost the entire field of public key
cryptography rests on the existence of one-way functions.

37. Attacks of
cryptography
Cipher text only attack
- The only data available is a target cipher text
Known plaintext attack
- A target cipher text
- Pairs of other cipher text and plaintext (say, previously broken or
guessing)

38. Attacks of
cryptography
Chosen plaintext attacks
- A target cipher text
- I t can obtain the matching cipher text by feeding on encryption
algorithm using plaintexts.
Chosen cipher text attack
- A target cipher text
- I t can obtain the matching plaintext and matching cipher text by
feeding on decryption algorithm.

39. Certification Process

40. Basics of
key management

41. Key M anag ement
in Cryptography
What is Key Management?
Why is Key Management a topic of disc ussion?
Different Key Management Techniques
About Key Management Life Cycle

42. Key M anag ement
in Cryptography
Definition: Key Management is a set of technique and
procedure that supports the establishment and
maintenance of keying relationships between
authorized parties.
A keying relationship is a process wherein two
entities who share a common data (Keying material)
enable the technique of cryptography.
The data shared between both the parties may
include public or sec ret keys, initialization values,
and additional non- secret parameters.

43. Key M anag ement
in Cryptography
( cont.) ?
Key Management techniques and procedures support:
Initialization of systems users within a domain;
Generation, dis tribution, and ins tallation of keying
material;
Controlling the use of keying material;
U pdate, revocation, and des truction of keying material;
S torag e, backup/recovery, and archival of keying
material.

44. WHY IS KEY MANAGEMENT
A TOPIC OF DICUSSION ?
Most attacks are aimed at Key Management level rather than
Cryptographic Algorithm itself.
Key Management objectives, threats, and policy.
Objectives of Key Management-
Maintain keying relationships and keying material in a manner that counters relevant threats.
Practically in conformance to relevant Security Policy

45. WHY IS KEY MANAGEMENT
A TOPIC OF DICUSSION ?
Threats
Compromise the confidentiality of secret keys.
Compromise the authenticity of secret or public keys.
Unauthorized use of public or secret keys.

46. WHY IS KEY MANAGEMENT
A TOPIC OF DICUSSION ?
Security policy
Explicitly or implicitly defines the potential threat a system is intended to
address.
Possibly affect the stringency of cryptographic requirements, depending
on the susceptibility of the environment in questions to various types of
attack.

47. WHY IS KEY MANAGEMENT
A TOPIC OF DICUSSION ?
Security Policies specify:
Practices and procedures to be followed while carrying out technical and
administrative aspects of Key Management, both automated and manual;
The responsibilities and accountability of each party involved;
The types of records to be kept, support subsequent reports or review
security-related events.

48. PUBLIC/PRIVATE KEY
CRYPTOGRAPHY
O N E - O N -
O N E
M E E T I N G
P r e s e n t a t i o n s a r e
c o m m u n i c a t i o n
t o o l s t h a t c a n b e
u s e d a s l e c t u r e s .
T E A M
B U I L D I N G
E X E R C I S E S
P r e s e n t a t i o n s a r e
c o m m u n i c a t i o n
t o o l s t h a t c a n b e
u s e d a s l e c t u r e s .
F I R S T
W E E K
C H E C K L I S T
P r e s e n t a t i o n s a r e
c o m m u n i c a t i o n
t o o l s t h a t c a n b e
u s e d a s l e c t u r e s .
I N T E R
D E P A R T
M E N T A L
P r e s e n t a t i o n s a r e
c o m m u n i c a t i o n
t o o l s t h a t c a n b e
u s e d a s l e c t u r e s .

49. Public-Key vs. Symmetric-Key Techniques
Primary advantage of Public-Key (vs. symmetric-key) techniques for applications
related to key management include:
Key Management
Techniques
Simplified
Key
Management
Online
Trusted Serve
Not Required
Enhanced
Functionality.

50. Key management
a) Symmetric-key encryption
Key Management
Techniques

51. b) Public-key encryption
Key Management
Techniques

52. Techniques for distributing confidential keys
Key layering and symmetric-key certificates
Key layering:
Master keys at the highest level in the hierarchy.
Key-encrypting keys are symmetric keys or encryption public keys used for key
transport or storage of other keys.
Data keys are provides cryptographic operations on user data.
Key Management
Techniques

53. Key Management Life Cycle
Key Management is simplest when all cryptographic keys are fixed for all time.
Cryptoperiods necessitate the update of keys.
It further necessitates additional procedures and protocols which include
communications with third parties in public-key systems.
The sequence of states in which keying material progresses through over its
lifetime is called the key management life cycle.
Key Management Life
Cycle

54. Life Cycle Stages may include-
User registration
User initialization
Key generation
Key installation
Key registration
Normal use
Key backup
Key update
Archival
Key de-registration and destruction
Key recovery
Key revocation
Key Management Life
Cycle

55. Thank You
Please do complete our brief survey at the end and leave your
comments

56. Past Webinars
PCI DSS - Managing your outsourced vendor.
Log Management and reporting for the PCI environment.
Best practices in Ecommerce security.
PCI DSS and the Cloud – Top risks and Mitigations
Wireless in the PCI environment – Top risks and Mitigations
PCI DSS in the virtualized environment – Top risks and Mitigations
Targeted attacks: Spear Phishing and Social Engineering.
PCI DSS Scoping and Segmentation.
Managing Data Leakage in your PCI environment.
Strategies for migration from early TLS and SSL.
Using PCI DSS for GDPR Compliance
Using ISO27001 for PCI DSS
SOC2 and YOU
GDPR – Are you ready
SOC2 – Beyond the myth
GDPR – Steps to a successful DPIA
Blockchain – A crash course – What is it, potential uses and pitfalls

57. Past Webinars
Tackling Security in the Cloud:
CASB to the rescue
HIPAA – Basics and Beyond…
Using SOC2 for HIPAA Compliance
Developing a Cyber Security
framework using NIST
SOC for CyberSecurity
Rights of Data Subjects – GDPR and
PDPA
SOC2 Compliance and the Cloud
Debunking Top 10 myths of PCI DSS
Achieving PCI DSS in 90 days
FDA CFR Part 11 - Whats the hype all about
Achieving SOC2 Compliance in 90
days – Is it possible?
Step by step approach to PDPA
compliance
steps for Compliance with NIST
800-171 compliance
PCI DSS - 5 Simple Techniques to
reduce scope
SOC2 and CCM
Intalks with Nitin Bhatnagar (PCI
Council) - Meeting Payment Security Needs Now and for the Future

58. Past Webinars
Covid 19 and Business Continuity
PA DSS and PCI SSF – How they match up and how they map
PCI PIN, PCI Cryptography & Key
Management

59. YouTube:

60. Facebook:

61. Linkedin: