There's a family of standards that aim to protect
cardholder PINs wherever they are processed.
The first member of the family, PTS POI, or Point of Interaction, is
concerned with the manufacture and cryptographic key management of
Points of Interaction, so that's any device that reads a card where
the customer can enter their PIN.
It also, confusingly now, also applies to Points of Interaction
where the cardholder doesn't enter a PIN,
such as a contactless‑only reader.
But the standard has been out there for such a long time
that it's not going to change its name.
So this standard applies to physical hardware,
the POI, the Point of Interaction, and the firmware in it.
It is usually the manufacturer of the device that gets
their hardware tested against the standard,
which covers things like tamper resistance,
how the encryption keys that protect the PIN are secured internally,
how they are inserted into the device, and how the devices
looked after from manufacturer to user.
Making sure these devices are secure from the moment they are manufactured
to when they are installed in a merchant is actually a real problem.
Criminals have in the past compromised manufacturing facilities and the
supply chain, so when the devices were used,
they kept a record of the customer's card data and PINs,
which the criminals then downloaded from the device and used themselves.
The second standard, PCI PIN,
is concerned with how organizations look after cryptographic keys
used for PIN encryption and PIN decryption.
That's mainly going to be very large merchants,
acquirers, and other payment processes.
So this standard is a bit like DSS, in that it applies to an
organization and it contains a number of logical and physical controls
that apply to how the organization manages security.
The final PIN standard is one that you don't often come across and is
concerned with the security of Hardware Security Modules, or HSMs.
Hardware Security Modules are typically used to manage and secure the
cryptographic keys which are used to encrypt and decrypt PINs in banks and
payment service providers, and like PTS POI, this is a standard that
applies to physical hardware, the HSM and the firmware in it.
So that's the three members of the PIN family, Point of
Interaction, PIN, and HSM. Let's see where they apply.
The retail environment will contain devices where people enter their PIN.
So these devices could be tested against PTS POI.
And remember, this isn't the merchant's responsibility.
It's the manufacturer of a device that gets their hardware tested against
the standard. All the merchant has to do is to buy compliant devices, and
whether a merchant has to use a compliant device or not is usually a
condition that's put on the merchant by their acquirer. To see where PTS
PIN may apply, let's see how a PIN moves between the entities and the
payment system.
And I'm really simplifying the process here, just for clarity. So
the cardholder enters a PIN on the PIN entry device, or the POI
device, in the merchant's coffee shop.
The POI contains an encryption key placed there by the merchant's acquirer,
which is used to encrypt the PIN.
The encrypted PIN is sent to the acquirer, where it is decrypted and then
it's re‑encrypted using the card scheme's encryption key.
The PIN is then sent to a scheme, where it's once again decrypted and
then re‑encrypted with the issuer's encryption key.
The scheme then sends the encrypted ping to the issuer, where
it's decrypted, and then checked against the PIN that the
issuer has on file for the cardholder.
And in this way, the merchant's Point of Interaction doesn't have to have
the encryption keys for every single issuer in the world.
So, just as we saw in the first module how a payment card transaction moves
from the merchant through to the acquirer to the card scheme or brand and
then to the issuer, the PIN does exactly the same thing, actually, is part
of the same authorization request.
But because the PIN has to travel encrypted,
it has to be encrypted and decrypted at each stage in the
process so the issuer can eventually decrypt it.
So, it's obviously really important that the PIN and the keys
used to encrypt and decrypt it, protect it, and that's the
whole purpose of the PTS standards.
So as we know, PTS POI is concerned with the design,
manufacturer, distribution,
and management of the end user devices used in the merchants. PIN describes
the physical and logical controls for all the entities that do encryption
and decryption of PINs, so that acquirers, payment processes, and it may
apply to also some larger merchants.
And finally, PTS HSM is a security standard for the Hardware Security Modules
that may be used to generate, store, encrypt, and decrypt PINs and PIN keys in
acquirers, in schemes or brands, and issuers.
Now, learning the intricacies of PTS and the 3 PIN standards would be a whole
Pluralsight course in itself, and there's probably only about,
I don't know, 50 people in the world who would be interested in it.
So there's one simplification I made on the previous slide that I actually
do need to expand on a little. When a PIN is encrypted,
it's not just a 4‑digit or 32‑bit PIN that's encrypted using the
encryption key to produce a 4‑character ciphertext. This would be
too weak, and it would be easily broken.
What happens is that the PIN is mathematically combined with some other
data, and actually, that's based on the primary account number, and then an
XOR operation to generate a 64‑bit PIN block.
And it's this PIN block that's encrypted using the PIN encryption key, and
that's sufficiently long enough and much harder to break.