PCI Preparedness

• January 2025 deadline
• Avoid your ATMs going 'dark'!

Hyosung ATMs have been updated to support a more secure method of storing and securing encryption keys. The new standard TR-31 (“key blocks”) will be mandated by PCI (Payment Card Industry) for the transfer of keys to ATMs starting January 1, 2025. To transfer the master key from the host processor to the ATM in TR-31 format (Remote Key Loading), also requires implementation of another standard TR-34. TR-34 is also required by PCI (Payment Card Industry) when RKL is used.

Are all ATMs required to support this mandate?

All ATMs will be mandated to support the required EPP version and related ATM software for the TR-31 key block standard. The EPP-8000 can support TR-31 with appropriate Firmware updates for manual key loading. Additionally, Hyosung released EPP version X1 in 2020 which also meets the TR-31 standard, though you will need to ensure the correct SW is running on your ATMs. Hyosung EPP X1 supports TR-31 and TR-34 for Remote Key loading. All new ATMs purchased from Hyosung beginning in May of 2021 come installed with EPP-X1 hardware.

Are all ATMs required to support TR-31 Compliance?

All ATMs must support the TR-31 Keypad & related software

What about Remote Key Loading?

TR-34 is the new Remote Key Loading (RKL) 'Process' required for RKL of TR-31 Keys. Hyosung EPP X1 (PCI 5.0) began shipping exclusively with new ATMs purchased since May of 2021 and support TR-31 and TR-34. Note: TR-34 Requires Blueverse XTM v2.2.

EPP-8000 PCI 3.0 SHA1/SHA2 does not support TR-34. TR-31 support only via manual key loading.

When is that deadline again?

PCI is requiring that ATM support will end by January 1, 2025, your ATM's host processor will address the actual date when the non TR-31 key transfer method will no longer be available. Please connect with your host processor to determine end of non TR-31 key transfer methods.

Will my ATM actually 'go dark'?

The answer is 'Yes'. If your ATM or ATM EPP and SW has not been upgraded to support the TR-31 key block requirements, your host processor can stop accepting transactions from those non-compliant ATMs.

How can I get ahead of this potential issue?

You can upgrade your ATMs 'now'! Hyosung EPP X1 has been supported since January 2020 and the TR-31 software updates for EPP 8000 were available January 1, 2023. Hyosung encourages you to plan and forecast your upgrade plans now versus waiting until a likely rush closer to the January 2025 date.

Are certain ATMs already TR-31 compliant?

Hyosung X1 (5.0) & 8000R (3.0) Keypads are TR-31 Compliant

Frequently Asked Questions

• What EPP(s) support TR-34?
  • The current EPP X1 PCI 5.0 and newer with Blueverse XTM v2.2
  • EPP-8000 PCI 3.0 SHA1/SHA2 does not support TR-34 (RKL process)
  • Please contact your processor to ensure they support Remote Key Loading

• Does the EPP-8000 PCI 3.0 SHA1/SHA2 support TR-31?
  • Yes, EPP-8000 is fully PCI 3.0 Compliant
  • Minimum EP version 10.01.03.00
  • Minimum SP Version 04.22.08
  • Minimum FI MoniAct version 01.00.51.15
  • Minimum Retail MoniAct version 01.00.51.08
  • BlueVerse Retail Release 01.01.00
  • Blueverse XTM v2.2

• Will the EPP-8000 PCI 3.0 SHA1/SHA2 be PCI compliant with TR-31 even though it expired in April of 2021?
  • Yes, EPP-8000 is fully PCI 3.0 Compliant
  • Any like for like replacement of the EPP-8000 PCI 3.0 SHA1 would require a Manual Key Load

• Is TR-31 support for MP2S Global Customers?
  • Yes – MP2S Global is supported for TR-31, manual key loading.
  • Please check with your processor for support of TR-34 and Remote Key Loading support.

• What is the difference between TR-31 and TR-34?
  • In addition to being the new RKL process for TR-31 keys, one of the key differences between TR-31 and TR-34 key block formats is that TR-34 doesn't require a symmetric key to be exchanged between the Key Distribution Host (KDH) and the Key Receiving Device (KRD).
  • TR-34 is used to exchange a TR-31 Key block protection key using asymmetric (RSA) encryption. A TR-34 key block includes a TR-31 compatible key block header. This header contains the usage and exportability information about the key. It is not encrypted and can also contain optional key header blocks as allowed by TR-31. You can find more information on TR-31 and TR-34 key blocks at https://www.pcisecuritystandards.org/document_library/

TetraLink and our partners stock ATM parts and products. Please reach out to us if you have further questions or need to understand how to obtain keypads. We can be reached at 855-593-6227 or by email at sales@tetralink.com