Security functions and key management

Review PCI-POI security functions, key storage, key loading, and security-related extensions.

VOS3 provides PCI-POI security features, protected key storage, and remote key loading support.

Use this page to review supported security functions and operational key handling.

Security functions

The following table summarizes PCI-POI relevant security functions.

Security Function	Support
PIN Support	Online PIN blocks: ISO 9564 Format 0. ISO 9564 Format 1. ISO 9564 Format 3. ISO 9564 Format 4 (AES only). AS 2805 6.2 (based on ISO Format 1, but with a second encryption using a value derived from card data) Offline PIN blocks: ISO 9564 Format 2. The entered PIN length must be between 4 and 12 digits.
Key Management - Online PIN Encryption	TDEA - DUKPT TDEA - MK/SK AES - DUKPT AES - MK/SK Other acquirer-specific schemes via Verifone Customizable Cryptographic Interface (VCCI)
Offline PIN	Plaintext offline PIN for EMV contact Enciphered offline PIN for EMV contact and contactless
Key Management - Account Data Encryption	TDEA - DUKPT TDEA - MK/SK (3TDEA only) AES - DUKPT AES - MK/SK Format-preserving encryption FF2.1
Key Loading	Remote loading of keys using Verishield Remote Key Loading (VRK)
Key Types	TDEA: 112, 168 AES: 128, 192, 256 RSA-2048
PIN Entry Technology	Physical keypad: P630 Touch: Ux700, V640m, V660p
Prompt Control	Acquirer-controlled
SRED	ADE VSP and VCL
Other Functions Provided	OP on the application processor side Secure pairing for PIN transfer

Key storage

VOS3 does not rely on a fixed small slot model for keys.

Keys are stored in a database and encrypted with the secure processor internal key.

Each key uses a unique name across all loaded keys, including warrantied keys.

The key name is provided in the VRK payload.

The key database is invalidated on tamper.

Key loading

VOS3 supports remote key loading using the Verifone Remote Key (VRK) loading method.

Warrantied keys

Verifone devices arrive from the factory with device-individual production warrantied keys pre-installed.

Application Development (APP-DEV) units have simulation warrantied keys installed instead. These are not for production use and are identical across all APP-DEV devices. They enable loading of test VRK packages with test customer key payloads.

To check installed warrantied keys, go to Control Panel → Security → Keys → Warrantied Key Status.

Under normal circumstances warrantied keys do not need to be reloaded. For APP-DEV devices that have been tampered, simulation warrantied keys can be reloaded from a KLD simulation tool via Control Panel → Security → Keys → Load Warrantied Keys. Contact Verifone for details on this process if needed.

Customer keys

Customer keys are loaded using VRK JSON files, typically generated by an HSM. Each file contains the encrypted key payload and a key block header with metadata. The payload is encrypted using the pre-installed VRK warrantied key on the device.

VRK files can be delivered to the device:

• remotely via Verifone VHQ or a custom terminal management system
• locally from a USB stick connected directly to the device

Load customer keys from a USB stick

1. Connect a USB stick to your host PC and copy the VRK JSON files to the root or a subdirectory.
2. Safely eject the stick before unplugging.
3. Plug the USB stick into the Verifone device. If the USB port is not in Host mode, go to Control Panel → Communication → More → Configuration → Device Settings and set it to Host.
4. From the MAC desktop, open Control Panel → Security → Keys → Load Payment Keys.
5. Use the file browser to select the VRK JSON file and confirm to install.

Use a USB stick with a maximum capacity of 32 GB formatted as FAT32.

To check installed customer keys, go to Control Panel → Security → Keys → Payment Key Status.

Customizations

VOS3 supports extensions through system plug-ins for custom key derivation and related security behavior.

Verifone works with application teams on these customizations.