GB/T 21078.1-2023Financial services - Personal Identification Number(PIN) management and security - Part 1: Basic principles and requirements for PINs in card-based systems (English PDF)

1 Scope

Basic principles and techniques of security measures: These measures apply to agencies responsible for implementing PIN management and protection technologies, including PIN creation,

Publish, use and deactivate, etc:

This document applies to the management of cardholder PINs used to authenticate cardholders in retail banking systems, especially in automated teller machines kiosks and PIN selection/change systems: This document also applies to card issuers and switching systems:

The terms of this document do not cover the following:

--- PIN management and security where there is no persistent cryptographic relationship between the transaction originating device and the acquirer, e:g:, using a browser conduct online shopping (see ISO 9564-4 for this environment);

---Prevent customers from losing or intentionally using wrong PIN;

---Confidentiality of non-PIN transaction data;

---Protect transaction information from being altered or replaced;

---Prevent replaying of PINs or transactions;

---Specific key management technology;

--- Offline PIN verification used in contactless devices;

--- Special PIN management requirements involving integrated circuit card (IC card) multi-application functions:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references

For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document:

GB/T 21078:4-2023 Financial Services Personal Identification Number Management and Security Part 4: Approved PIN Encryption Algorithm (ISO 9564-2:2014, MOD)

Note: GB/T 27909 (all parts) Banking key management (retail) [ISO 11568 (all parts)]

ISO 13491-1 Secure cryptographic devices for financial services (retail) Part 1: Concepts, requirements and evaluation methods [Financial ods]

Note: GB/T 21079:1-2022 Financial Services Security Encryption Equipment (Retail) Part 1: Concepts, Requirements and Assessment Methods (ISO 13491-1:

2016, MOD)

ISO 13491-2:2017 Security encryption equipment for financial services (retail) Part 2: Equipment security compliance inspection for financial transactions

JR/T 0197 | JR/T 0154 | GB/T 19584 | GB/T 21078.4 | GB/T 21079.2 | GB/T 21079.1 | […]