ISO 9564-2:2014

Financial services - Personal Identification Number (PIN) management and security - Part 2: Approved algorithms for PIN encipherment

ISO 9564-2:2014 specifies approved algorithms for the encipherment of Personal Identification Numbers (PINs).

Services financiers — Gestion et sécurité du numéro personnel d'identification (PIN) — Partie 2: Algorithmes approuvés pour le chiffrement du PIN

General Information

• Status: Published
• Publication Date: 21-Jul-2014
• ICS: 35.240.40 - IT applications in banking
• Technical Committee: ISO/TC 68/SC 2 - Financial Services, security
• Drafting Committee: ISO/TC 68/SC 2/WG 13 - Security in retail banking
• Current Stage: 9599 - Withdrawal of International Standard
• Start Date: 19-Aug-2025
• Completion Date: 13-Dec-2025

Relations

• Revised: ISO 9564-2:2025 - Financial services - Personal Identification Number (PIN) management and security - Part 2: Approved algorithms for PIN encipherment
• Effective Date: 12-Aug-2023
• Revises: ISO 9564-2:2005 - Banking - Personal Identification Number management and security - Part 2: Approved algorithms for PIN encipherment
• Effective Date: 04-Feb-2012

Overview

ISO 9564-2:2014 defines the approved algorithms for the encipherment of Personal Identification Numbers (PINs) used in financial services. This part of the ISO 9564 series focuses exclusively on the cryptographic methods authorized for PIN protection and references related ISO/IEC standards for algorithm definitions and modes of operation.

Approved algorithms listed in the standard:

• Triple Data Encryption Algorithm (TDEA)
• RSA encryption algorithm (RSA)
• Advanced Encryption Standard (AES)

The document is published by ISO/TC 68 (Financial services), SC 2 (Financial services security) and forms Part 2 of the ISO 9564 family addressing PIN management and security.

Key Topics

• Algorithm definitions and references: ISO 9564-2 relies on ISO/IEC documents (ISO/IEC 18033-2, ISO/IEC 18033-3) for formal algorithm definitions and ISO/IEC 10116 for modes of operation.

• TDEA (Triple DES):

  • Definition as per ISO/IEC 18033-3.
  • Approved encipherment mode: Electronic Code Book (ECB) with block size n = 64.
  • Approved for use with PIN block formats 0, 1, and 3.

• RSA:

  • Definition as per ISO/IEC 18033-2.
  • Approved use limited to encipherment of offline PINs submitted to integrated circuit cards (ICCs) and is applicable only to PIN block format 2.

• AES:

  • Definition as per ISO/IEC 18033-3.
  • Approved encipherment mode: Electronic Code Book (ECB) with block size n = 128.
  • Approved for use with PIN block format 4.

Applications

ISO 9564-2:2014 provides practical guidance for organizations that implement PIN encipherment in card-based and offline payment contexts. Key applications and benefits include:

• Secure PIN transmission and storage: By prescribing approved algorithms and modes, the standard supports secure handling of PIN blocks within payment systems.
• Interoperability and compliance: Implementers can rely on the listed algorithms to meet industry expectations for PIN protection and to align with related ISO requirements.
• Clear scope for offline and card-present scenarios: RSA is explicitly approved for offline PIN submission to ICCs, while block-cipher algorithms (TDEA, AES) are tied to specific PIN block formats.

Related Standards

• ISO 9564-1 - Basic principles and requirements for PINs in card-based systems (normative reference).
• ISO/IEC 10116 - Modes of operation for block ciphers (normative reference for ECB mode usage).
• ISO/IEC 18033-2 - Definitions for asymmetric ciphers (RSA)
• ISO/IEC 18033-3 - Definitions for block ciphers (TDEA, AES)
• ISO 9564-4 - Requirements for PIN handling in eCommerce (related part of the series)

Adopting ISO 9564-2:2014 helps security architects and payment system operators select approved cryptographic algorithms and modes for protecting PIN data in compliance with internationally recognized practices.

Standards Content (Sample)

INTERNATIONAL ISO
STANDARD 9564-2
Third edition
2014-08-01
Financial services — Personal
Identification Number (PIN)
management and security —
Part 2:
Approved algorithms for PIN
encipherment
Services financiers — Gestion et sécurité du numéro personnel
d’identification (PIN) —
Partie 2: Algorithmes approuvés pour le chiffrement du PIN
Reference number
©
ISO 2014
© ISO 2014
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland
ii © ISO 2014 – All rights reserved

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Triple Data Encryption Algorithm (TDEA) . 1
3.1 Definition of the TDEA algorithm . 1
3.2 Use of the TDEA algorithm . 1
4 RSA encryption algorithm. 1
4.1 Definition of the RSA algorithm . . 1
4.2 Use of the RSA algorithm . 2
5 AES encryption algorithm . 2
5.1 Definition of the AES algorithm . 2
5.2 Use of the AES algorithm . 2
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
ed
...