EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key...
Transcript of EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key...
![Page 1: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/1.jpg)
Datacard Confidential
EMV Key Management
Why Should You Care?
Guy Berg Global Industry Consultant Advanced Payment Technologies Datacard Group 651.354.6808 [email protected]
![Page 2: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/2.jpg)
Datacard Confidential 2
What Do these Operations have in Common?
Dynamic Cryptogram
Dynamic Data Authentication
Digital Signatures
Tokenization
On-line Authentication
Off-line Authentication
Cryptography
Data Security
Key Management
![Page 3: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/3.jpg)
Datacard Confidential 3
• Key Management System Core Functions – Generating Keys – Importing Keys – Exporting keys – Distributing keys – Protecting keys
What is Key Management?
![Page 4: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/4.jpg)
Datacard Confidential 4
On-line Authentication Key
Payment Brand
Acquirer
Dynamic Cryptogram
Dynamic Cryptogram ARQC
Issuer
Shared Key
![Page 5: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/5.jpg)
Datacard Confidential 5
On-line Authentication Keys
Payment Brand
Acquirer
Dynamic Cryptogram
Product 1 Key 1 Product 2 Key 2 Product 3 Key 3 Product 4 Key 4 Product 5 Key 5 Product 6 Key 6 Product….. Key …… Issuer
![Page 6: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/6.jpg)
Datacard Confidential 6
Off-line Authentication Keys and Certificates
Payment Brand
Acquirer
JCB MC V D AM
Certificate Authority
Private Public
Issuer Public Key Certificate
Issuer
Public
Private
JCB MC V D AM
Cert
![Page 7: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/7.jpg)
Datacard Confidential 7
• Updating EMV data on already issued cards • EMV Scripts
EMV Post Issuance Keys
Payment Brand
Acquirer
MDK Encryption Key
MDK MAC Key
MDK AC Key
![Page 8: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/8.jpg)
Datacard Confidential 8
• Updating EMV data on already issued cards • EMV Card Update Scripts
EMV Post Issuance Keys
Payment Brand
Acquirer
MDK Encryption Key
MDK MAC Key
MDK AC Key
Product 1 Key set 1 Product 2 Key set 2 Product 3 Key set 3 Product 4 Key set 4 Product 5 Key set 5 Product 6 Key set 6 Product….. Key ……
![Page 9: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/9.jpg)
Datacard Confidential 9
Smart Card Inventory Security Transport Keys
![Page 10: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/10.jpg)
Datacard Confidential 10
Why is Key Management Important?
Keys are the Heart of EMV Protection
Maximizing key security is vital to EMV
![Page 11: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/11.jpg)
Datacard Confidential 11
• Payment Brand • Issuers • Issuer Authorization Processors • Issuer Card Personalization Bureaus • Acquirers
Who Has to Manage EMV Keys
![Page 12: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/12.jpg)
Datacard Confidential
Key Distribution
Key type Auth System
EMV Script Generator
CMS Data Prep
Perso / Bureau
Service Provider / VISA NET
PVK/ Key ü ü ü MDKac ü ü ü ü MDKenc ü ü MDKmac ü ü MDKidn ü ü ü MDKicvv ü ü ü KEK ü ü ZMK ü ü ü
![Page 13: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/13.jpg)
Datacard Confidential 13
Key Transportation Key Ceremony
![Page 14: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/14.jpg)
Datacard Confidential 14
Keys Transport using KEKs
Shared Key Encrypting Key
Shared Key Encrypting Key
Shared Key
![Page 15: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/15.jpg)
Datacard Confidential 15
EMV Key Exchanges
Issuer
Issuer service bureau
Authorization processor
Product 1
Product 2
Product 3
Product 4
Product 5
Product …..
Product 1
Product 1
Product 1
Product 1
Product 1
Product 1
Product …
![Page 16: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/16.jpg)
Datacard Confidential 16
Key Management Evolution
• Only used for EMV cards and PINs
• Key requirements were not well understood
• Tools were in an embryonic state
• Few people had key management knowledge
Step 1: PIN Key Management Step 2: PCI Data Security Compliance Step 3: EMV Key Management
![Page 17: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/17.jpg)
Datacard Confidential 17
Key Management Evolution Continues…..
SE
SE
SE
TSM
Issuer 1
Issuer 1
Issuer 1
Issuer 1
Issuer 1
Issuer 1
TSM
TSM
![Page 18: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/18.jpg)
Datacard Confidential 18
Continue to Evolve
Issuer 1
Issuer 1
Issuer 1
Issuer 1
Issuer 1
Issuer 1
Virtual Cards or Wallets
![Page 19: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/19.jpg)
Datacard Confidential 19
Key Management Evolution
![Page 20: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/20.jpg)
Datacard Confidential 20
• Tactical EMV Migration Questions – Where will keys be generated? – How often will keys be changed over time? – What will be the process for rolling over keys? – How will you transport keys to each location?
• One at a time in components? • Encrypted under a KEK (Key Encrypting Key)
– How will you assure the key security through the complete issuance process?
• What are your future plans for Key Management
Key Management Considerations
![Page 21: EMV Key Management - securetechalliance.org · 2015-10-07 · Datacard Confidential EMV Key Management Why Should You Care? Guy Berg Global Industry Consultant Advanced Payment Technologies](https://reader030.fdocuments.in/reader030/viewer/2022040600/5e8c0f717d64153c552ce2cf/html5/thumbnails/21.jpg)
Datacard Confidential
EMV Key Management
Why Should You Care?
Guy R. Berg Global Industry Consultant
Datacard Group 651.354.6808