Ensure the IDS monitors all traffic at the personalization network perimeter as well as at critical points inside the personalization network. Section 6: System Security Section 6 Requirement Card Vendor Self-Evaluation Assessor Compliance Evaluation Comply Comments Result Comment/Non-Compliance Assessment Section 6: System Security 6.1 General Requirements The vendor must: Ensure that any system used in the personalization process is only used to perform and control personalization activities. Change supplier provided default parameters prior to installation in the production environment. Encrypt non-console administrative access when it takes place from within the personalization network. Synchronize clocks on all systems associated with personalization with an external time source. Restrict and secure access to system at all times. Ensure that virtual systems do not span different network domains.
Annex A – Cryptographic Key Life Cycles – Examples Key Name * Algorithm Key Length (HEX) Purpose of Use Generation Distribution Storage HSMs Loading Destruction Update ZMK 2TDES 112 Encrypts keys during transmission between two entities. ZMK key types include: ZMK Bank encrypts keys (PEK, MDK, dCVV) between the issuer and vendor. ZMK vendor encrypts keys (KMC) used to lock the chip between pre-personaliser and personaliser The third party entity Bank or vendor Bank brings ZMK components on site. Vendor ZMK sent in three paper based components Inside HSM Affina PSG 3 Key Custodians 1 KM Head of CPC For ZMKBank 3 bank personnel also present Not planned PEK 2TDES 112 Encrypts PIN Block between Issuer and vendor Issuer Encrypted under ZMKBank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned MDK 2TDES 112 Issuer Master Application Keys, derivatives of which are for Authentication, Secure Messaging Integrity and Secure Messaging Confidentiality. Issuer Encrypted under ZMKBank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned dCVV 2TDES 112 Master Key, derivatives of which are used in contactless application to create a dynamic CVV Issuer Encrypted under ZMKBank Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned KMC 2TDES 112 Locks chips between card manufacturer and vendor Chip vendor Encrypted under ZMKGemalto Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC Not planned Not planned
ISK/IPK RSA 1152/ 1408 RSA Keys ISK is used to create ICC Certificate. IPK is placed on the card in Certificate format. vendor IPK sent to Visa in self signed format. Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC As per procedures. Depends on Scheme Key Expiry dates. ICCK RSA 1152 DDA keys. ICSK is personalised in chip. ICPK is placed on the card in Certificate format. If separate PIN encipherment key required – also generated. JCC Not distributed, coded on chip card Not stored Affina PSG Automated N/A N/A LMK 3DES 32 Local Master Key Used to encrypt keys in database. Generated on SafeNet PSG HSM. Not distributed. In memory of HSM and as 3 paper based components. SafeNet PSG Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Not Confirmed ZMK 3DES 32 Zone Master Key Shared between a third party and vendor. Generated on SafeNet PSG HSM or by third party. 3 paper-based components sent via different couriers In memory of HSM and as paper based components. SafeNet PSG Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Annually KEK/ KTK 3DES 32 Key Encryption Key / Key Transport Key Shared between internal cryptographic Generated on SafeNet PSG HSM by key custodian. 3 paper-based components used internally by the custodians. In memory of HSM and as paper based components. SafeNet PSG / Thales Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Not Confirmed
MPK 3DES 32 Master Personalisation Key Used by the card supplier to lock the chips Generated by the chip producer and distributed as a cryptogram. Distributed only as a cryptogram protected a zone master key. As cryptogram in protected memory of HSM SafeNet PSG Translated from under ZMK Deletion from the memory of the HSM Physical destruction in cross cut shredder Per batch of chips MDK 3DES 32 Master Derivation Key Used by the data system to generate the UDKs Generated by the issuer Ciphered with a ZMK As cryptogram in protected memory of HSM SafeNet PSG Translated from under ZMK Deletion from the memory of the HSM Physical destruction in cut shredder On request of issuer