Security

Account Data Protection

The device always encrypts account data from the MSR using 112-bit TDEA, 128-bit AES, or 256-bit AES algorithms with X9.24 DUKPT key management. This device does not support any mechanisms such as whitelists or SRED disable that would allow the data to be sent out unencrypted. The programmers need to follow the guidance provided in [3]. Use of the device with key-management systems not described in this policy will invalidate the PCI PTS POI v6.2 approval of the device.

Algorithms Supported

The device includes the following cryptographic algorithms:

• AES-128/256

• TDEA-128

• ECDSA (P256 and P521)

• RSA2048

• SHA-256

Key Management

The device implements the original AES/TDEA DUKPT as its only key management method. Use of any other method will invalidate PCI approval. DUKPT derives a new unique key for every transaction. For more details, see [5] and [6].

Table 5-1 - iDynamo 5 Gen III Product Keys

Key Name	Size	Algorithm	Purpose
Transport Keys: · Master Transport Key · Device Transport Key · Financial Transport Key · Production Transport Key · Manufacturing Transport Key · MagTek KIF Financial Transport Key	32 bytes	AES X9.143 KBPKs	Key Injection
Account Data Key · DKPTM7-FK	16 bytes for TDEA and AES- 128 32 bytes for AES-256	AES and TDEA DUKPT (ANS X9.24-3)	Encrypt and MAC Account Data
Firmware Protection Key · Firmware Signing Key (FSK)	256 bytes	RSA2048 and SHA-256	Checks integrity and authenticity of firmware

Key Loading

The device does not support manual or plaintext cryptographic key entry. Only specialized tools, compliant with key management requirements and cryptographic methods, specifically [6] and [7]. On the production line, the ANSI X9.143 format can be used for key loading by an HSM after mutual authentication. Use of any other methods will invalidate PCI approval.

Key Replacement

Keys should be replaced with new keys whenever the original key is known or suspected to have been compromised, and whenever the time deemed feasible to determine the key by exhaustive attack has elapsed, as defined in [4].