Online vs. offline PIN verification
In the United States, and a number of European countries, card transactions need to be verified and authorized in real-time with an online PIN. Elsewhere, PIN verification and authentication take place between the terminal and the card, which is known as offline PIN verification.
In countries with online PIN verification, payment terminals need to be injected with special keys to enable them to encrypt the PIN and create an Enciphered PIN Block. Injecting these special cryptographic keys without RKI means this process has to take place in a key injection facility (KIF), which is a highly secure environment subject to PCI PIN, TR-39 standards, and other standards or audits.
Manual key injection vs. remote key injection
BSCG’s RKI eliminates the need for an off-site secure KIF and the associated cost, inventory complexities, and distribution delays by utilizing a secure channel to remotely inject payment devices. This enables PIN debit and other data encryption keys, such as those used for point-to-point encryption (P2PE), to be safely and securely injected, no matter where the payment device is located.
PCI PIN and TR-39 compliance
BSCG technology has been audited and assessed to comply with the American National Standards Institute (ANSI) TR-39 and PCI PIN.
- RKI eliminates dependencies of a KIF as an unlimited number of payment devices can be injected instantly no matter their location
- RKI eliminates shipment cost, downtime, and disruptions as there is no need to ship payment devices to and from a KIF
- RKI eliminates administrative costs and overhead associated with the key management process