ISO 11568:2023
(Main)Financial services — Key management (retail)
Financial services — Key management (retail)
This document describes the management of symmetric and asymmetric cryptographic keys that can be used to protect sensitive information in financial services related to retail payments. The document covers all aspects of retail financial services, including connections between a card-accepting device and an Acquirer, between an Acquirer and a card Issuer, and between an ICC and a card-accepting device. It covers all phases of the key life cycle, including the generation, distribution, utilization, archiving, replacement and destruction of the keying material. This document covers manual and automated management of keying material, and any combination thereof, used for retail financial services. It includes guidance and requirements related to key separation, substitution prevention, identification, synchronization, integrity, confidentiality and compromise, as well as logging and auditing of key management events. Requirements associated with hardware used to manage keys have also been included in this document.
Services financiers — Gestion de clés (services aux particuliers)
General Information
Relations
Standards Content (Sample)
INTERNATIONAL ISO
STANDARD 11568
First edition
2023-02
Financial services — Key management
(retail)
Services financiers — Gestion de clés (services aux particuliers)
Reference number
ISO 11568:2023(E)
© ISO 2023
---------------------- Page: 1 ----------------------
ISO 11568:2023(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO 2023 – All rights reserved
---------------------- Page: 2 ----------------------
ISO 11568:2023(E)
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
1.1 General . 1
1.2 Scope exclusions . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Key management requirements .12
4.1 General .12
4.1.1 Key management strategy .12
4.1.2 Dual control and split knowledge of secret or private keys .12
4.1.3 Permissible key forms . 13
4.1.4 Logging. 14
4.1.5 Cryptographic strength .15
4.1.6 Key locations .15
4.1.7 Single-purpose key usage . 15
4.2 Secure cryptographic device . 17
4.2.1 General requirements . 17
4.2.2 Additional SCD requirements for devices used in SKDAT . 18
4.3 Additional CA requirements . 19
4.4 Additional RA requirements . 19
4.5 Key blocks . 20
4.5.1 Overview of key blocks .20
4.5.2 Key attributes. 21
4.5.3 Integrity of the key block . 21
4.5.4 Key and sensitive attributes field . 21
4.6 Key creation .22
4.6.1 Symmetric key creation . 22
4.6.2 Asymmetric key creation . 23
4.7 Key component and key share creation . 24
4.8 Check values . 24
4.8.1 Introduction . 24
4.8.2 Symmetric key check value calculation . 25
4.8.3 Asymmetric key check value calculation . 25
4.9 Key distribution . 25
4.9.1 Symmetric key distribution . 25
4.9.2 SKDAT asymmetric key distribution .29
4.10 Key loading . 30
4.10.1 General .30
4.10.2 Loading key components or shares . 31
4.11 Key utilization . 32
4.11.1 General key utilization requirements. 32
4.11.2 Additional key utilization requirements for SKDAT . 33
4.12 Key storage . 33
4.12.1 Cleartext key component and share storage . 33
4.12.2 Public key storage .34
4.13 Key replacement .34
4.14 Key destruction . 35
4.14.1 General . 35
4.14.2 Key destruction from an SCD .36
4.14.3 Destruction of a key in cryptogram form .36
4.14.4 Component and share destruction .36
4.15 Key backup .36
iii
© ISO 2023 – All rights reserved
---------------------- Page: 3 ----------------------
ISO 11568:2023(E)
4.16 Key archiving .36
4.17 Key compromise . 37
5 Transaction key management techniques .38
5.1 General .38
5.2 Method: master keys or transaction keys .38
5.3 Derived unique key per transaction . 39
5.3.1 General .39
5.3.2 DUKPT key management .39
5.3.3 Unique initial keys . 42
5.3.4 AES DUKPT . 43
5.3.5 KSN compatibility mode .46
5.3.6 Derived key OIDs . 47
5.3.7 Keys and key sizes . 47
5.3.8 Helper functions and definitions .48
5.3.9 Key derivation function algorithm .49
5.3.10 Derivation data . 50
5.3.11 “Create Derivation Data” (local subroutine) . 51
5.3.12 Security considerations . 52
5.3.13 Host security module algorithm .54
5.3.14 General .54
5.3.15 "Derive Initial Key" . . .54
5.3.16 "Host Derive Working Key" . 55
5.3.17 Intermediate derivation key derivation data examples .55
5.3.18 Working key derivation data examples .56
5.3.19 Transaction-originating device algorithm . 57
5.4 Host-to-host UKPT . . 62
Annex A (informative) Key and component check values .64
Annex B (normative) Split knowledge during transport .68
Annex C (informative) Trust models and key establishment .70
Annex D (informative) Symmetric key life cycle .78
Annex E (informative) Asymmetric key life cycle phases .80
Annex F (normative) Approved algorithms .83
Annex G (informative) AES DUKPT pseudocode notation .84
Annex H (informative) AES DUKPT test vectors .87
Annex I (informative) TDEA-derived unique key per transaction .88
Annex J (informative) Roles in payment environment . 109
Annex K (informative) Roles in symmetric key distribution using asymmetric techniques . 112
Bibliography . 115
iv
© ISO 2023 – All rights reserved
---------------------- Page: 4 ----------------------
ISO 11568:2023(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 2,
Financial services, security.
This document cancels and replaces the former ISO 11568 series, which has been technically revised.
The main changes are as follows:
— all parts of the series combined into a single document;
— fixed key no longer included in the permissible methods of transaction key management;
— required key replacement policy (see 4.13) added;
— cleartext key injection removed;
— AES DUKPT introduced as a key management method.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
v
© ISO 2023 – All rights reserved
---------------------- Page: 5 ----------------------
ISO 11568:2023(E)
Introduction
Retail financial transactions are often transmitted over potentially non-secure channels, which,
if exploited, can result in fraud. The vast range in value and volume of such transactions exposes
participants to severe risks, which can be uninsurable. To protect against these risks, many institutions
are employing encryption. The encryption algorithms used are in the public domain. The security and
reliability of any process based on these algorithms is directly dependent on the protection afforded to
secrets called cryptographic keys.
This document describes requirements and provides guidance for the secure management of
cryptographic keys used to protect sensitive information in a retail financial services environment, for
example in messages between a card acceptor and an Acquirer. Typical services in the retail financial
services domain include point-of-sale (POS) debit and credit authorizations and automated teller
machine (ATM) transactions. While it is designed with these environments in mind, it may also be used
in unrelated applications. For example, such keys could be used for:
— encrypting Personal Identification Numbers (PIN) (see ISO 9564-1);
— authenticating messages;
— encrypting other data;
— encrypting or deriving cryptographic keys;
— automated symmetric key distribution using asymmetric techniques.
vi
© ISO 2023 – All rights reserved
---------------------- Page: 6 ----------------------
INTERNATIONAL STANDARD ISO 11568:2023(E)
Financial services — Key management (retail)
1 Scope
1.1 General
This document describes the management of symmetric and asymmetric cryptographic keys that can
be used to protect sensitive information in financial services related to retail payments. The document
covers all aspects of retail financial services, including connections between a card-accepting device
and an Acquirer, between an Acquirer and a card Issuer, and between an ICC and a card-accepting device.
It covers all phases of the key life cycle, including the generation, distribution, utilization, archiving,
replacement and destruction of the keying material. This document covers manual and automated
management of keying material, and any combination thereof, used for retail financial services. It
includes guidance and requirements related to key separation, substitution prevention, identification,
synchronization, integrity, confidentiality and compromise, as well as logging and auditing of key
management events.
Requirements associated with hardware used to manage keys have also been included in this document.
1.2 Scope exclusions
This document does not specifically address internet banking services offered by an Issuer to their own
customers through that financial institution's website or applications.
This document does not address using asymmetric keys to encrypt the Personal Identification Number
(PIN) or any other data and does not address asymmetric keys managed with asymmetric keys.
This document is not intended to apply to the management of the keys installed in an ICC during
manufacturing or the initial key established in an ICC during card personalization.
This document is not intended to address post-quantum encryption considerations. Key management
using quantum technologies is out of scope of this document.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 9797 (all parts), Information technology — Security techniques — Message Authentication Codes
(MACs)
ISO/IEC 11770 (all parts), Information security — Key management
ISO 13491 (all parts), Financial services — Secure cryptographic devices (retail)
ISO 16609, Financial services — Requirements for message authentication using symmetric techniques
ISO/IEC 18031, Information technology — Security techniques — Random bit generation
ISO/IEC 18032, Information security — Prime number generation
ISO/IEC 18033 (all parts), Information security — Encryption algorithms
ISO/IEC 19592-2, Information technology — Security techniques — Secret sharing — Part 2: Fundamental
mechanisms
1
© ISO 2023 – All rights reserved
---------------------- Page: 7 ----------------------
ISO 11568:2023(E)
ISO/IEC 19772, Information security — Authenticated encryption
ISO 20038, Banking and related financial services — Key wrap using AES
ISO 21188:2018, Public key infrastructure for financial services — Practices and policy framework
ANSI X9.63, Public Key Cryptography for the Financial Services Industry — Key Agreement and Key
Management Using Elliptic Curve-Based Cryptography
ANSI X9.143, Retail Financial Services — Interoperable Secure Key Block Specification
RFC 3647, Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework,
Internet Request for Comments 3647, S. Chokhani, W. Ford, R. Sabett, C. Merrill, S. Wu, November 2003
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
Acquirer
institution (or its agent) which acquires from the card acceptor the data relating to the transaction
(3.84) and initiates the data into an Interchange (3.47) system
[SOURCE: ISO/IEC 7812-1:2017, 3.1]
3.2
Advanced Encryption Standard
AES
16-byte block cipher (3.3)
Note 1 to entry: This is defined in ISO/IEC 18033-3.
3.3
algorithm
specified mathematical process for computation or set of rules which, if followed, will give a prescribed
result
[SOURCE: ISO 16609:2022, 3.1]
3.4
archived key
inactive cryptographic key (3.28) that is being stored in a secure manner for a non-operational purpose
3.5
asymmetric algorithm
cryptographic algorithm (3.27) that uses two related keys, a public key (3.71) and a private key (3.69),
where the two keys have the property that, given the public key, it is computationally infeasible (3.25) to
derive the private key
3.6
asymmetric cryptosystem
cryptosystem using asymmetric algorithms (3.5)
2
© ISO 2023 – All rights reserved
---------------------- Page: 8 ----------------------
ISO 11568:2023(E)
3.7
authentication
provision of assurance that a claimed characteristic of an entity is correct
[SOURCE: ISO/IEC 27000:2018, 3.5]
3.8
authentication element
message element that is to be protected by authentication (3.7)
[SOURCE: ISO 16609:2022, 3.12, modified — Term revised.]
3.9
Base Derivation Key
BDK
key used in derivation (3.32) to generate initial DUKPT keys (3.45) for installation into transaction
originating secure cryptographic devices (3.75) and for transaction processing
3.10
BDK ID
32-bit value that identifies the Base Derivation Key (3.9)
Note 1 to entry: This was formerly known as the Key Set Identifier (KSI) (3.57) in the TDEA DUKPT specification.
3.11
card acceptor
party accepting the card for the purpose of presenting transaction data to an Acquirer (3.1) or
intermediary facilitating the transaction flow
[SOURCE: ISO/IEC 7812-1:2017, 3.3]
3.12
certificate
digitally signed statement that binds the value of a public key to the identity of the person, device or
service that holds the corresponding private key
[SOURCE: ISO 20415:2019, 3.15, modified — Term revised.]
3.13
certificate authority
CA
entity that vouches for the binding between a device’s identity, its public key and associated keying
material
[SOURCE: ISO/IEC/IEEE 8802-11:2022, definition modified.]
3.14
certificate authority system
CA system
infrastructure required to manage, maintain and secure the key pairs and certificates of the certificate
authority (3.13)
Note 1 to entry: A CA system will typically include one or more Hardware Security Modules (3.42), firmware,
computer equipment, operating systems and software
3.15
certificate policy
CP
named set of rules that indicates the applicability of a certificate to a particular community and/or
class of application with common security requirements
[SOURCE: ISO 21188:2018, 3.13]
3
© ISO 2023 – All rights reserved
---------------------- Page: 9 ----------------------
ISO 11568:2023(E)
3.16
certificate practice statement
CPS
statement of the practices which a certificate authority (3.13) employs in issuing certificates (3.12)
and which defines the equipment, policies and procedures the certificate authority uses to satisfy the
requirements specified in the certificate policies (3.15) that are supported by it
3.17
certificate subject
entity identified in a certificate (3.12)
EXAMPLE Secure cryptographic device (3.75).
3.18
chain of custody
demonstrable possession, movement, handling and location of material from one point in time until
another
[SOURCE: ISO/IEC 27050-1:2019, 3.1]
3.19
check value
key check value
KCV
component check value
CCV
non-secret value that is cryptographically related to the key (or component) and is used to verify that
the underlying value is as expected
Note 1 to entry: It is possible for different keys or components to have the same check value.
3.20
cipher
method for the transformation of data in order to hide its information content, prevent its undetected
modification and/or prevent its unauthorized use
3.21
ciphertext
data which has been transformed to hide its information content
[SOURCE: ISO/IEC 18033-1:2021, 3.7]
3.22
cleartext
plaintext
unencrypte
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.