5 - Security
DynaGlass| Payment Terminal | PCI PTS POI Security Policy
Page 20 of 22 (
D998200455-10
)
5.5
Key Loading
The device does not support manual cryptographic key entry. Only a specialized Key Loading Device,
compliant with key management requirements and cryptographic methods, specifically
TR-31
, can be
used for key loading. Use of any other methods will invalidate PCI approval.
5.6
Key Replacement
Keys should be replaced with new keys whenever the original key is known or suspected to have been
compromised, and whenever the time deemed feasible to determine the key by exhaustive attack has
elapsed, as defined in
NIST SP 800-57-1
. If a tamper event has occurred, the device must be returned to
MagTek for security inspection and secure re-injection of new keys.
5.7
Key Removal
After keys are successfully injected into the device, there are two ways to remove them:
Passively erasing keys, performed by firmware or hardware, such as when a tamper event occurs.
Actively erasing keys, performed by an authorized user with a dedicated software tool, for example
during manufacturer repair or decommissioning.
5.8
Signature
The device uses asymmetric cryptographic algorithms for software signature verification:
SHA256 and RSA 2048 are used for Application Processor (AP) firmware signature verification.
SHA256 and ECDSA-P256 are used for Secure Processor (SP) firmware signature verification.
SHA256 and ECDSA-P384 are used for Application Processor (AP) application signature
verification.
The signing keys are controlled only by MagTek. Software authentication is performed within the device
by signature verification using the corresponding public key.
5.9
Open Protocols
The following describes the communication methods and protocols available in the device:
Communication
Interface
Protocols
802.11 Wireless LAN
(WLAN)
TLS, IP, TCP, UDP, ARP, DHCP, ICMP
Bluetooth
SMP, GATT, ATT, L2CAP, HCI, LL
Data transferred between the device and remote hosts via the 802.11 Wireless LAN (WLAN) connection
is encrypted with security protocol
TLS1.2
. Application developers can use TLS by calling a library
available on the device. During the TLS connection phase, the private key of the device is needed. The
private key is pre-embedded in the Application Processor’s firmware.
The device also supports Bluetooth 4.2 protocol for Bluetooth secure communication. In Bluetooth Low
Energy mode, the device uses low energy security mode 1 level 4. The Bluetooth “Just Works” pairing
mode is disabled.
Support version: openssl-1.0.2g TLSv1.2
SSL has inherent vulnerabilities. DynaGlass does not support SSL.
