> For the complete documentation index, see [llms.txt](https://docs.verifone.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.verifone.com/adk-os-platform/readme/security-and-system-protection/security-functions-and-key-management.md).

# Security functions and key management

Review PCI-POI security functions, key storage, key loading, and security-related extensions.

VOS3 provides PCI-POI security features, protected key storage, and remote key loading support.

Use this page to review supported security functions and operational key handling.

## Security functions

The following table summarizes PCI-POI relevant security functions.

| **Security Function**                    | **Support**                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| PIN Support                              | <ul><li><p>Online PIN blocks:</p><ul><li>ISO 9564 Format 0.</li><li>ISO 9564 Format 1.</li><li>ISO 9564 Format 3.</li><li>ISO 9564 Format 4 (AES only).</li><li>AS 2805 6.2 (based on ISO Format 1, but with a second encryption using a value derived from card data)</li></ul></li><li><p>Offline PIN blocks:</p><ul><li>ISO 9564 Format 2.</li></ul></li><li>The entered PIN length must be between 4 and 12 digits.</li></ul> |
| Key Management - Online PIN Encryption   | <ul><li>TDEA - DUKPT</li><li>TDEA - MK/SK</li><li>AES - DUKPT</li><li>AES - MK/SK</li><li>Other acquirer-specific schemes via Verifone Customizable Cryptographic Interface (VCCI)</li></ul>                                                                                                                                                                                                                                      |
| Offline PIN                              | <ul><li>Plaintext offline PIN for EMV contact</li><li>Enciphered offline PIN for EMV contact and contactless</li></ul>                                                                                                                                                                                                                                                                                                            |
| Key Management - Account Data Encryption | <ul><li>TDEA - DUKPT</li><li>TDEA - MK/SK (3TDEA only)</li><li>AES - DUKPT</li><li>AES - MK/SK</li><li>Format-preserving encryption FF2.1</li></ul>                                                                                                                                                                                                                                                                               |
| Key Loading                              | <ul><li>Remote loading of keys using Verishield Remote Key Loading (VRK)</li></ul>                                                                                                                                                                                                                                                                                                                                                |
| Key Types                                | <ul><li>TDEA: 112, 168</li><li>AES: 128, 192, 256</li><li>RSA-2048</li></ul>                                                                                                                                                                                                                                                                                                                                                      |
| PIN Entry Technology                     | <ul><li>Physical keypad: P630</li><li>Touch: Ux700, V640m, V660p</li></ul>                                                                                                                                                                                                                                                                                                                                                        |
| Prompt Control                           | <ul><li>Acquirer-controlled</li></ul>                                                                                                                                                                                                                                                                                                                                                                                             |
| SRED                                     | <ul><li>ADE</li><li>VSP and VCL</li></ul>                                                                                                                                                                                                                                                                                                                                                                                         |
| Other Functions Provided                 | <ul><li>OP on the application processor side</li><li>Secure pairing for PIN transfer</li></ul>                                                                                                                                                                                                                                                                                                                                    |

## Key storage

VOS3 does not rely on a fixed small slot model for keys.

Keys are stored in a database and encrypted with the secure processor internal key.

Each key uses a unique name across all loaded keys, including warrantied keys.

The key name is provided in the VRK payload.

The key database is invalidated on tamper.

## Key loading

VOS3 supports remote key loading using the Verifone Remote Key (VRK) loading method.

### Warrantied keys

Verifone devices arrive from the factory with device-individual production warrantied keys pre-installed.

{% hint style="info" %}
Application Development (APP-DEV) units have simulation warrantied keys installed instead. These are not for production use and are identical across all APP-DEV devices. They enable loading of test VRK packages with test customer key payloads.
{% endhint %}

To check installed warrantied keys, go to **Control Panel → Security → Keys → Warrantied Key Status**.

Under normal circumstances warrantied keys do not need to be reloaded. For APP-DEV devices that have been tampered, simulation warrantied keys can be reloaded from a KLD simulation tool via **Control Panel → Security → Keys → Load Warrantied Keys**. Contact Verifone for details on this process if needed.

### Customer keys

Customer keys are loaded using VRK JSON files, typically generated by an HSM. Each file contains the encrypted key payload and a key block header with metadata. The payload is encrypted using the pre-installed VRK warrantied key on the device.

VRK files can be delivered to the device:

* remotely via Verifone VHQ or a custom terminal management system
* locally from a USB stick connected directly to the device

**Load customer keys from a USB stick**

1. Connect a USB stick to your host PC and copy the VRK JSON files to the root or a subdirectory.
2. Safely eject the stick before unplugging.
3. Plug the USB stick into the Verifone device. If the USB port is not in Host mode, go to **Control Panel → Communication → More → Configuration → Device Settings** and set it to **Host**.
4. From the MAC desktop, open **Control Panel → Security → Keys → Load Payment Keys**.
5. Use the file browser to select the VRK JSON file and confirm to install.

{% hint style="info" %}
Use a USB stick with a maximum capacity of 32 GB formatted as FAT32.
{% endhint %}

To check installed customer keys, go to **Control Panel → Security → Keys → Payment Key Status**.

## Customizations

VOS3 supports extensions through system plug-ins for custom key derivation and related security behavior.

Verifone works with application teams on these customizations.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.verifone.com/adk-os-platform/readme/security-and-system-protection/security-functions-and-key-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.