AS 2805.3.2-2008

Table of Contents

<toc>
<bookmarktable>
<bookmark index=&apos;0&apos;>
<pageno>1</pageno>
<text>AS 2805.3.2-2008 ELECTRONIC FUNDS TRANSFER-REQUIREMENTS FOR INTERFACES - PIN MANAGEMENT AND SECURITY-OFFLINE</text>
<bookmark index=&apos;1&apos;>
<pageno>4</pageno>
<text>PREFACE</text>
</bookmark>
<bookmark index=&apos;2&apos;>
<pageno>6</pageno>
<text>CONTENTS</text>
</bookmark>
<bookmark index=&apos;3&apos;>
<pageno>7</pageno>
<text>FOREWORD</text>
</bookmark>
<bookmark index=&apos;4&apos;>
<pageno>8</pageno>
<text>1 SCOPE</text>
</bookmark>
<bookmark index=&apos;5&apos;>
<pageno>8</pageno>
<text>2 APPLICATION</text>
</bookmark>
<bookmark index=&apos;6&apos;>
<pageno>9</pageno>
<text>3 REFERENCED DOCUMENTS</text>
</bookmark>
<bookmark index=&apos;7&apos;>
<pageno>9</pageno>
<text>4 DEFINITIONS</text>
<bookmark index=&apos;8&apos;>
<pageno>9</pageno>
<text>4.1 Acquirer</text>
</bookmark>
<bookmark index=&apos;9&apos;>
<pageno>9</pageno>
<text>4.2 Cipher text</text>
</bookmark>
<bookmark index=&apos;10&apos;>
<pageno>9</pageno>
<text>4.3 Encipherment</text>
</bookmark>
<bookmark index=&apos;11&apos;>
<pageno>9</pageno>
<text>4.4 Encryption algorithm</text>
</bookmark>
<bookmark index=&apos;12&apos;>
<pageno>9</pageno>
<text>4.5 Integrated Circuit Card (ICC)</text>
</bookmark>
<bookmark index=&apos;13&apos;>
<pageno>9</pageno>
<text>4.6 Personal identification number (PIN)</text>
</bookmark>
<bookmark index=&apos;14&apos;>
<pageno>9</pageno>
<text>4.7 PIN block</text>
</bookmark>
<bookmark index=&apos;15&apos;>
<pageno>9</pageno>
<text>4.8 Plain text</text>
</bookmark>
</bookmark>
<bookmark index=&apos;16&apos;>
<pageno>10</pageno>
<text>5 BASIC PRINCIPLES OF PIN MANAGEMENT</text>
</bookmark>
<bookmark index=&apos;17&apos;>
<pageno>10</pageno>
<text>6 PIN PROTECTION DURING TRANSMISSION BETWEEN PED AND ICC READER</text>
</bookmark>
<bookmark index=&apos;18&apos;>
<pageno>11</pageno>
<text>7 SECURITY REQUIREMENTS</text>
</bookmark>
<bookmark index=&apos;19&apos;>
<pageno>12</pageno>
<text>8 PIN BLOCK FORMAT</text>
<bookmark index=&apos;20&apos;>
<pageno>12</pageno>
<text>8.1 General</text>
</bookmark>
<bookmark index=&apos;21&apos;>
<pageno>12</pageno>
<text>8.2 Format 2 PIN block</text>
</bookmark>
</bookmark>
<bookmark index=&apos;22&apos;>
<pageno>12</pageno>
<text>9 PHYSICAL SECURITY</text>
<bookmark index=&apos;23&apos;>
<pageno>12</pageno>
<text>9.1 Physical security for PIN entry devices</text>
</bookmark>
<bookmark index=&apos;24&apos;>
<pageno>12</pageno>
<text>9.2 Physically secure device</text>
</bookmark>
<bookmark index=&apos;25&apos;>
<pageno>13</pageno>
<text>9.3 Physically secure environment</text>
</bookmark>
<bookmark index=&apos;26&apos;>
<pageno>13</pageno>
<text>9.4 PIN entry device requirements</text>
</bookmark>
</bookmark>
</bookmark>
</bookmarktable>
</toc>

Abstract

Specifies requirements for addressing offline PIN management using IC cards.

Scope

This Standard specifies the minimum security measures required for PIN management in an off-line environment.
It is applicable to financial transaction card originated transactions requiring offline PIN verification by an IC card and to those institutions responsible for implementing techniques for the management and protection of the PIN at Automated Teller Machines (ATM) and Point-of-Sale (POS) terminals.
The provisions of this part of AS 2805.3 are not intended to cover:
(a) PIN management and security in the online PIN environment, which is covered in AS 2805.3.1.
(b) The protection of the PIN against loss or intentional misuse by the customer or authorized employees of the issuer or their agents.
(c) Privacy of non-PIN transaction data.
(d) Protection of transaction messages against alteration or substitution, e.g. an online authorisation response.
(e) Protection against replay of the PIN or transaction.
(f) Specific key management techniques.
(g) The decision as to whether the IC card is to receive the PIN enciphered.
(h) Contactless IC cards.
Requirements associated with multi-application IC cards are considered to be the responsibility of the issuer and are not included in this Standard. This Standard is described in terms applicable to IC card technology, however this language is not meant to restrict the applicability of this part to IC card technology.

General Product Information

Published
Document Type	Standard
Status	Current
Publisher	Standards Australia
Pages
ISBN
Committee	IT-005
Supersedes	AS 2805.3-2000 DR 05484