Approval Number

Approval numbers are assigned by PCI SSC at the time of approval and remain the same for the life of the device's approval.

Additional Information

This field may be used to place any additional pertinent information. For example, when a vendor has changed the status of a device to end-of-life (EOL), as delineated in 5.4, “Approval-Listing Fee,” and thus the device is no longer available for purchase except for maintenance purposes. Devices with EOL status are no longer supported by the vendor and no deltas are processed for those devices. The date and month of the EOL will be listed on the Website

• EOL

This will also be used for v2, v3 and v4 HSMs to delineate whether they are approved for restricted or unrestricted usage as delineated in the HSM Security Requirements:

• Restricted - Approval is valid only when deployed in Controlled Environments or more robust-e.g., Secure Environments-as defined in ISO 13491-2 and in the device’s PCI HSM Security Policy.
• Unrestricted - Approval is valid in any environment.

Devices supporting ISO PIN Block Format 4 (AES) will be noted here. For additional information on whether the MK/SK, DUKPT or Fixed Key methodologies are supported for AES PIN Blocks, see the Key Management section. POI v5 and higher devices supporting online PIN and HSM v4 and higher devices supporting PIN processing are required to support ISO PIN Block Format 4.

• Supports ISO Format 4 (AES) PIN Blocks

This field will also be used for notation for POI v6 and higher devices supporting Bluetooth and/or Wi-Fi that have been architected and evaluated to support unauthenticated wireless communications using those technologies.

• Interface Isolation - Bluetooth
• Interface Isolation - Wi-Fi

In addition, v4 HSMs that meet additional criteria to support remote-e.g., non-console-administration for configuration and cryptographic key loading, will be noted here as “Remote-managed HSM.” Requirements for Remote-managed HSMs are a subset of those for Multi-tenant HSMs.

• Remote Managed HSM

Devices must support key blocks using the ANSI X9.143 key-derivation methodology for TDES keys, and for AES keys, must support either the X9.143 methodology or the ISO 20038 methodology. In either case, equivalent methods can be used where subject to an independent expert review and where that review is publicly available. The link provided here is where a vendor who implements a proprietary method has had that method validated in accordance with PCI-prescribed criteria as equivalent.

Approval Class

The Approval Class is used by PCI to ensure that its payment security device approvals accurately describe today's ever-evolving designs, architectures, and implementations. All POIs and HSMs approved by PCI SSC in the framework of the PCI PTS Device Security Evaluation Program, regardless of the designated Approval Class, carry PCI's full approval status. Financial institutions, or their designated agents (e.g., merchants or processors), should make sure that they understand the different classes, as they represent how the payment security device has met the PCI PTS Device Security Requirements. Detailed Approval Class Descriptions can be found in the Device Approval & Testing Guide.

Approved Components

(PED, RAP, UPT)

"Approved components" contains, when relevant, the list of approved components that are part of the approved device, and which have successfully undergone a distinct evaluation. Each component is listed with its approval number.

The use of a device with components e.g., EPPs, card readers that are different than that listed as an approved component for that device invalidates that device’s approval.

RAP devices may be listed as an approved component of one or more associated HSMs. For v4 and higher HSMs, the HSM must be validated to the Remote-Managed HSM requirements.

Version

Version refers to the version of the security requirements the device has been evaluated against. Each approval class may follow its own version release schedule.

PIN Support

(EPP, PED, SCR, SCRP, UPT)

"PIN Support"denotes the type of PIN entry verification that can be supported by the POI.
"Online" represents that the POI has the capability to support online PIN verification by the payment card's issuer or its designated processor. To pass testing, POIs that support online PIN entry must support the use of TDES or AES to protect the PIN. Additionally, if the PIN needs to be protected during transport in nonintegrated offline POIs, then the POI must support the use of TDES or AES for that channel. "Offline" means that the POI has the capability to support offline PIN verification by the payment card's integrated chip.

Unless otherwise noted, the "Offline" designation, without any suffix, in the PCI PTS Device Approval List represents that the POI has the capability to support both plaintext and enciphered offline PIN verification. The "Offline (p)" designation with the "(p)" as a suffix represents that the offline POI has the capability of performing only plaintext offline PIN verification.

However, under current testing, all newly evaluated offline POI devices must support both plaintext and enciphered PIN verification. SCRs or other POI devices that include an ICCR or hybrid reader must have an "Offline" designation in order to be used for offline PIN acceptance.

Note:
All newly approved offline PIN verification POIs must support both plaintext and enciphered PIN verification.

PIN Encryption Key Management

(EPP, PED, SCRP, UPT, SCR)

"PIN encryption key management" denotes whether the Laboratory has successfully evaluated the payment security device to support the use of Triple DES (TDES) or AES for PIN encryption for online PIN. TDES requires use of at least a double-length key.

A MK/SK (master key, session key), DUKPT, and/or Fixed designation denote that the device has been evaluated successfully to support the implementation of TDES for that particular key-management method(s).

Where AES is used, that will be explicitly noted in conjunction with the MK/SK, DUKPT and/or Fixed Key methodologies.

Note: DUKPT is the only unique key per transaction (UKPT) algorithm (ANSI X9.24) that PCI SSC recognizes and approves; all other forms of UKPT tested by the Laboratory will not be depicted in the approval letter or on "Approved PTS Devices" on the Website.

Note: POI v5 and v6 devices used for online PIN must support ISO PIN Block Format 4 (AES).

Note: Fixed Key is not allowed for POI v6 and higher devices.

This is for POI devices supporting the entry of online PINs, and in general, this will be N/A for devices in the Non-PED or SCR approval classes and will be N/A for offline PIN-only devices. SCRPs can indirectly support online PIN in connection with mobile-based solutions via PIN translation.

PIN Encryption Key Management is only applicable for SCRs where the SCR does PIN translation in connection with sending the PIN online to a host.

SRED Key Management

(EPP, PED, SCR, SCRP, UPT)

"SRED key management" denotes whether the Laboratory has successfully evaluated the payment security device to support the use of Triple DES (TDES) or AES for Account Data encryption. TDES requires use of at least a triple-length key or DUKPT for account data encryption.

A MK/SK (master key, session key), DUKPT and/or Fixed designation denote that the device has been evaluated successfully to support the implementation of TDES for that particular key-management method(s).

Where AES is used, that will be explicitly noted in conjunction with the MK/SK, DUKPT and/or Fixed Key methodologies.

Note: Fixed Key is not allowed for POI v6 and higher devices.

Format-preserving encryption (FPE) shall be denoted where one of the ANSI, ISO or NIST approved algorithms are used.

Note: The FPE notation is only presented for POI v6 and higher devices.

Prompt Control

(PED, EPP, UPT)

Vendor-controlled: The end-user, acquirer, or reseller cannot modify the POI's firmware or POI's payment application to make changes to the device's prompts or PIN-entry controls. Only the POI's original equipment manufacturer has the capability to modify the prompts and controls for PIN entry.

Acquirer-controlled: The original equipment manufacturer has shipped the POI with mechanisms for controlling the POI display and its use in place. These mechanisms can be employed to unlock the POI for updates of the prompts by the acquirer, using proper cryptographically controlled processes as defined in the applicable POI security requirement. The reseller or end-user, if authorized by the acquirer, can also make updates using proper cryptographically controlled processes.

Not applicable for devices without a display.

Devices must be deployed locked. In any case, the acquiring customer is always responsible to ensure that appropriate processes and documented procedures are in place to control the POI display and usage.