This compliance documentation page provides the essential security and inspection guides required to ensure the physical integrity of DynaFlex II Go secure card readers before and after deployment.

Documents

This document addresses the proper use of the DynaFlex II Go family of secure card readers (SCR) in a secure manner. This includes information about key-management responsibilities, administrative responsibilities, device functionality, identification, and environmental requirements.

The use of this secure card reader in any method not described in this security policy will invalidate the PCI PTS POI v6.2 approval of the device.

Throughout this document:

• DynaFlex II Go products refers to all products in the DynaFlex II Go product family, including DynaFlex II Go models equipped with a barcode reader (BCR) and Bluetooth LE connectivity.

This document addresses the proper use of the DynaFlex II Go family of secure card readers (SCR) in a secure manner. This includes information about key-management responsibilities, administrative responsibilities, device functionality, identification, and environmental requirements.

Policy Document ToC

Initial Inspection

After receiving the device, the customer should visually inspect the product as follows:

• Inspect the label found on the bottom of the device (see section 2.3.1 Hardware Identification) and make sure the label is not missing, obscured, or modified.

• Check the PCI Hardware Identifier on the device label and make sure it matches the Hardware # listed for the device on the PCI web site for Approved Devices. Go to the PCI compliance web page and search for MagTek, and find the product name, DynaFlex II Go. Compare the Hardware ID and Firmware ID: https://www.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices

• Check the Device serial number (SN) and make sure it matches with labels on shipping materials and documentation.

• Visually inspect the device, per D998200593 DynaFlex II Go, Device Inspection Document, which is included in the package with each device. See section 4.1 Periodic Inspection for more information regarding visual inspection of the device.

• Follow the steps in section 2.3.2 to view the PCI firmware versions installed on the device. Make sure this matches one of the Firmware # values listed on the PCI web site for DynaFlex II Go. Note that in PCI listings, lowercase “x” is a wildcard meaning ‘any single character.’

Connect the device to a USB host for control and power (if battery power is not sufficient). DynaFlex II Go products are designed to provide flexible mounting options such as:

• External clip

• Embedded lanyard

The specified environmental conditions to operate and store the device are:

• Operating temperature range: 0°C to 35°C / 5% to 90% RH

• Storage temperature range: -20°C to 45°C / 5% to 90% RH

For safety, battery charging is disabled when the device is outside the recommended operating temperature range.

The security of the reader is not compromised by altering the environmental conditions outside the stated operating ranges above. Any temperature or operating voltage outside the values in the table below will trigger environmental security protections, resulting in a tamper condition. The device will need to be returned to the factory for inspection before this condition can be cleared.

DynaFlex II Go products support a USB interface using the USB-HID protocol, and a Bluetooth LE interface. Transactions, configuration, firmware updates, and key injection can all be performed using these interface types. Use of any method not listed in this security policy will invalidate the device’s PCI PTS approval.

The device requires Bluetooth LE hosts to use version 4.2 or higher and use LE Security Mode 1 Level 4 (Secure Connections) only. “Just Works” cannot be used at any time. The device does not support or allow for the use of insecure communication options such as, but not limited to, LE Security Mode 2, and levels 1, 2, and 3 of LE Security Mode 1 and the “Just Works” secure pairing option of Security Mode 1.

DynaFlex II Go products ship from the factory fully secure. The devices have no configuration settings that require modification by the user to meet PCI security requirements.

Copyright © 2006 - 2024 MagTek, Inc.MagTek® is a registered trademark of MagTek, Inc.MagnePrint® is a registered trademark of MagTek, Inc.MagneSafe® is a registered trademark of MagTek, Inc.Magensa™ is a trademark of MagTek, Inc.AAMVA™ is a trademark of AAMVA.American Express® and EXPRESSPAY FROM AMERICAN EXPRESS® are registered trademarks of American Express Marketing & Development Corp.Apple Pay® is a registered trademark to Apple Inc.D-PAYMENT APPLICATION SPECIFICATION® is a registered trademark to Discover Financial Services CORPORATIONMasterCard® is a registered trademark and PayPass™ and Tap & Go™ are trademarks of MasterCard International Incorporated.Visa® and Visa payWave® are registered trademarks of Visa International Service Association.ANSI®, the ANSI logo, and numerous other identifiers containing "ANSI" are registered trademarks, service marks, and accreditation marks of the American National Standards Institute (ANSI).ISO® is a registered trademark of the International Organization for Standardization.PCI Security Standards Council® is a registered trademark of the PCI Security Standards Council, LLC.EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC. The Contactless Indicator mark, consisting of four graduating arcs, is a trademark owned by and used with permission of EMVCo, LLC.UL™ and the UL logo are trademarks of UL LLC.All other system names and product names are the property of their respective owners.

DynaFlex II Go is a secure card reader authenticator in a small form factor that is ready to accept tap, swipe, and dip payments in a wide variety of retail environments. The small form factor is ready for countertop and mobile devices with USB or Bluetooth® LE connection. Start accepting mobile wallets including Samsung® Pay, Google® Pay and Apple® Pay via NFC Contactless or accept card payments via EMV® Contactless, EMV Contact Chip, and magnetic stripe.

Check the overall form factor for signs of attempted entry or tampering. The form factor is a smooth shell. The seam between the top and bottom shells are molded together. There are no additional electronics or wires. Any breaks in the plastic, scuffs, or damage could be signs of physical tampering and should be reported. Look for any added components, size, or weight: Dimensions: 2.76 in.x2.57 in.x0.79 in. (70.10mm x 65.3mm x20.1mm) DynaFlex II Go (w/BCR and Bluetooth LE): 92 grams, DynaFlex II Go (with Bluetooth LE): 90 grams.

Top of Device: This is the location of the EMV Chip Card insert position and magstripe swipe card reader slot.

Payment Methods: Directional icons for magstripe, EMV chip insert, and contactless tap landing pad are printed on the device front.

The device always encrypts account data from all three reader types using 112-bit TDEA, 128-bit AES, or 256-bit AES algorithms with X9.24 DUKPT key management. This device does not support any mechanisms such as whitelists or SRED disable that would allow the data to be sent out unencrypted.

The device includes the following cryptographic algorithms:

• AES

• TDEA

The following documents may be used to provide additional details about the device and this security policy:

• DynaFlex II Go Installation and Operation Manual

• DynaFlex II Go Programmer’s Manual (COMMANDS)

• DynaFlex II Go Device Inspection Document

• DynaFlex II Go Package Inspection Document

• NIST SP 800-57-1 Recommendation for Key Management

• ANS X9.24 Part 3:2017, Retail Financial Services Symmetric Key Management, Part 3: Derived Unique Key Per Transaction Using Symmetric Techniques

• X9 TR-31:2010, Interoperable Secure Key Exchange Key Block Specification for Symmetric Algorithms

DynaFlex II Go products are PCI PTS v6.x SCR, certified. The packaging is designed to be tamper evident and the closure uses security tape. Any attempt to open the package shows signs of tampering. This document explains how to detect tampering.

Overall Form Factor

The basic form factor of the package is a folded white cardboard box with a cardboard insert where the device is nestled into Korrvu plastic wrap packaging. There are no rips or added materials on the package other than product and Lot labels. The package only has one color ink printed on the package: black. The box is made with corrugated white cardboard.

Back of Package

Certification Compliance Logos: Industry certification logos showing compliance are printed on the back of the package as shown. Manufacturer address is shown.

Front Cover of Package

The front cover of the package lists the product name, MagneSafe Security information, PCI revision information, product read capability icons, QR Codes, and description.

Left Side of Package

On the left side of the package is printed a list of the package contents and the product label is adhered.

The right side of the package shows the storage requirements and CAUTION content.

The front of the package lists the product name, category, PCI certification, and Security Tape.

Security tape wraps onto the bottom of the package from the front flap of the package.

Adhered

Here security tape is applied and secured. Wrapping front to bottom of package.

Tape

Tape is removed VOID and OPENED appear on tape.

Package

Security tape wraps onto the bottom of the package from the front flap of the package.

Bottom

Security Tape: The Security Tape wraps from the front flap to the bottom of the package. Make certain there are no signs of tampering.

Lot Label: The lot label is placed on the bottom of the box. Make certain there are no false labels added or tampering.

Inside

DynaFlex II Go products are nestled inside the package with Korrvu packaging that uses cling wrap to hold the device securely in place for transit. The cling wrap is attached to an insert that has thumb-hole cuts on either side to make it easier to remove from the outer packaging. The package includes the device, cable(s), device inspection document, and quick installation guide.

To check for PCI Validation check the Hardware and Firmware ID. Hardware ID is printed on the label. The Firmware ID is accessible via the device. Go to the PCI compliance web page and search for MagTek, and find the product name, DynaFlex II Go. Compare the Hardware ID and Firmware ID: https://

As part of your inspection, include the following for your device inspection audit:

• Be certain to have a list of the devices and include the details listed on the product label.

• It may be helpful to take photos of the front, back, and sides of each device.

Be certain to check device part numbers, serial numbers, and IDs and check physical connections. Use the chart below as a checklist to inspect the device for signs of tampering.

The merchant or acquirer should daily check the appearance of secure card reader:

• Inspect the appearance of secure card reader to make sure it is the right product.

• Inspect whether the Swipe Path has an additional card reader or other inserted bugs, See Figure 4‑1, below.

Product Name and Appearance

The front view of all DynaFlex II Go models (with and without BCR), are shown in Figure 2‑1 below. The back view of all DynaFlex II Go devices are identical, as seen in Figure 2‑2.

Figure 2 1 - DynaFlex II Go and DynaFlex II Go with BCR Front View

Figure 2 2 – Back View of all DynaFlex II Go Models

Product Type

All DynaFlex II Go products include USB communications, a magnetic stripe reader (MSR), a contact chip card reader (ICCR), a contactless card reader (CTLS), and may also be purchased with an embedded barcode reader (BCR) and Bluetooth LE connectivity.

DynaFlex II Go models can be used as desktop or handheld devices. They are approved as a secure card reader (SCR) under PCI PTS POI v6.2 requirements.

Usage in any other environment will invalidate the approval.

Identification

Hardware Identification

To find important product identification, look on the printed product label on the back face of the device as shown in Figure 2‑3 below.

Figure 2 3 - DynaFlex II Go Device Label Location

The product label includes the following elements of device identification information, indicated by the numbered callouts in Figure 2‑4 and Figure 2‑5.

1. Product Name

2. PCI Hardware Identifier (“HW”)

Figure 2 4 - DynaFlex II Go Device Label

Figure 2 5 DynaFlex II Go with Bluetooth LE Device Label

The label also contains other supporting information about the device.

All DynaFlex II Go product family hardware configurations are listed in Table 2‑1 below. The device utilizes two interface types, USB and Bluetooth LE. Use of any interface other than USB or Bluetooth LE will invalidate PCI approval.

The most recent firmware versions for DynaFlex II Go products are 1000009446-AB0-PCI for the secure bootloader (Boot1 FW), 1000009421-AC0-PCI and 1000009714-AC0-PCI for the core firmware (Main FW), and 1000009327-AB0-PCI for the Bluetooth LE Firmware Version. The X in firmware versions indicates minor non-security related changes. The secure bootloader firmware version also covers the initial bootloader (Boot0) permanently programmed into the device. Any changes to either Boot0 or Boot1 will result in a change to the Boot1 FW version that is visible to the user, reported by the device, and listed on the PCI Approved Devices website.

All device identification information, including firmware versions and PCI Hardware ID, is accessible by connecting DynaFlex II Go to a host device via USB or Bluetooth LE, using the latest software provided by MagTek, as seen in Figure 2‑6 - Device Information Screen.

The host user can also can retrieve device information at any time using Command 0xD101 Get Property as described in DynaFlex II Go Programmer’s Manual (COMMANDS).