ISK/IPK RSA 1152/ RSA Keys Vendor IPK sent to Visa in Inside HSM Affina PSG 1 Key Custodian As per Depends on self-signed format. procedures. Scheme Key 1408 1 KM ISK is used to create Expiry dates. ICC Certificate. Head of CPC IPK is placed on the card in Certificate format. RSA 1152 Vendor Not distributed, Not stored Affina PSG Automated N/A N/A ICCK DDA keys. coded on chip card ICSK is personalised in chip. ICPK is placed on the card in Certificate format. If separate PIN encipherment key required also – generated. LMK 3DES 32 Master Key Generated Not distributed. In memory of SafeNet PSG Loaded by 3 Key Deletion from Not Confirmed on SafeNet HSM and as 3 Custodians. the memory of Used to encrypt keys in PSG HSM. paper based the HSM database. components. Physical destruction in cross cut shredder ZMK 3DES 32 Zone Master Key Generated 3 paper-based In memory of SafeNet PSG Loaded by 3 Key Deletion from Annually on SafeNet components sent HSM and as Custodians. the memory of Shared between a third PSG HSM or via different paper based the HSM party and vendor. by third couriers components. Physical party. destruction in cross cut shredder KEK/ 3DES 32 Key Encryption Key / Generated 3 paper-based In memory of SafeNet PSG Loaded by 3 Key Deletion from Not Confirmed Key Transport Key KTK on SafeNet components used HSM and as / Thales Custodians. the memory of PSG HSM by internally by the paper based the HSM Shared between key custodians. components. Physical internal cryptographic custodian. destruction in zones. cross cut shredder
ISK/IPK RSA 1152/ 1408 RSA Keys ISK is used to create ICC Certificate. IPK is placed on the card in Certificate format. Vendor IPK sent to Visa in self-signed format. Inside HSM Affina PSG 1 Key Custodian 1 KM Head of CPC As per procedures. Depends on Scheme Key Expiry dates. ICCK RSA 1152 DDA keys. ICSK is personalised in chip. ICPK is placed on the card in Certificate format. If separate PIN encipherment key required – also generated. Vendor Not distributed, coded on chip card Not stored Affina PSG Automated N/A N/A LMK 3DES 32 Master Key Used to encrypt keys in database. Generated on SafeNet PSG HSM. Not distributed. In memory of HSM and as 3 paper based components. SafeNet PSG Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Not Confirmed ZMK 3DES 32 Zone Master Key Shared between a third party and vendor. Generated on SafeNet PSG HSM or by third party. 3 paper-based components sent via different couriers In memory of HSM and as paper based components. SafeNet PSG Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Annually KEK/ KTK 3DES 32 Key Encryption Key / Key Transport Key Shared between internal cryptographic zones. Generated on SafeNet PSG HSM by key custodian. 3 paper-based components used internally by the custodians. In memory of HSM and as paper based components. SafeNet PSG / Thales Loaded by 3 Key Custodians. Deletion from the memory of the HSM Physical destruction in cross cut shredder Not Confirmed
PCI_CP_v1_1_ROC_Reporting_Template_Logical_form_a.docx