Overview
ISO 9564-2:2014 defines the approved algorithms for the encipherment of Personal Identification Numbers (PINs) used in financial services. This part of the ISO 9564 series focuses exclusively on the cryptographic methods authorized for PIN protection and references related ISO/IEC standards for algorithm definitions and modes of operation.
Approved algorithms listed in the standard:
- Triple Data Encryption Algorithm (TDEA)
- RSA encryption algorithm (RSA)
- Advanced Encryption Standard (AES)
The document is published by ISO/TC 68 (Financial services), SC 2 (Financial services security) and forms Part 2 of the ISO 9564 family addressing PIN management and security.
Key Topics
Applications
ISO 9564-2:2014 provides practical guidance for organizations that implement PIN encipherment in card-based and offline payment contexts. Key applications and benefits include:
- Secure PIN transmission and storage: By prescribing approved algorithms and modes, the standard supports secure handling of PIN blocks within payment systems.
- Interoperability and compliance: Implementers can rely on the listed algorithms to meet industry expectations for PIN protection and to align with related ISO requirements.
- Clear scope for offline and card-present scenarios: RSA is explicitly approved for offline PIN submission to ICCs, while block-cipher algorithms (TDEA, AES) are tied to specific PIN block formats.
Related Standards
- ISO 9564-1 - Basic principles and requirements for PINs in card-based systems (normative reference).
- ISO/IEC 10116 - Modes of operation for block ciphers (normative reference for ECB mode usage).
- ISO/IEC 18033-2 - Definitions for asymmetric ciphers (RSA)
- ISO/IEC 18033-3 - Definitions for block ciphers (TDEA, AES)
- ISO 9564-4 - Requirements for PIN handling in eCommerce (related part of the series)
Adopting ISO 9564-2:2014 helps security architects and payment system operators select approved cryptographic algorithms and modes for protecting PIN data in compliance with internationally recognized practices.
Open preview (PDF)Financial services — Personal Identification Number (PIN) management and security — Part 2: Approved algorithms for PIN encipherment