Encryption
Connection Encryption
All connections to the Terminal Switch Server ISO8583 are to be encrypted via TLS (v1.2 or later). Non-encrypted (plain) connections are not supported.
Message Field Data Encryption
The majority of message fields within the packager specification are not to be populated with encrypted data. These fields are to be protected by the TLS encryption that protects the entire message.
Specific message fields (or subfields of composite fields) are explicitly defined as containing encrypted data only. Encrypted fields should only be used when using P2PE / DUKPT or other encryption schemes. (See F-60 Security Data, subfield Encryption Mode for identification of the encryption scheme used.)
DUKPT Keys
When DUKPT is used to protect specific message field data, three separate DUKPT keys are to be used to encrypt the data, as follows:
DUKPT Key | Description |
PIN | Used to protect Payment Card PIN data only. |
P2PE | Used to protect transaction data (excluding Payment Card PIN data) requiring DUKPT encryption. |
DATA | Used to protect the MAC field only. See also F-64 / F-128 Message Authentication Code |
On this page
- Encryption