User Manual
V1.3 - 202301
Page 33 of 43
Signing
The Apollo will only run applications that provide a signature created using a certificate that has
been issued by the Payter Root certificate.
Applications are signed using RSA 4096 for signature verification and SHA256 calculating data
integrity hashes.
During signing a file is generated that contains the SHA256 hash of all the files in the application.
This file is then signed using RSA 4096 and a file containing the signature using the Cryptographic
Message Syntax is generated. Both the file containing hashes as the signature file are packed into
the application, these are verified by Apollo upon starting the application, see [2] for more details.
The signing process must be performed offline and under dual control using split knowledge.
Account-data Protection
The device supports DUKPT 2009 (TDES) and DUKPT 2017 (TDES and AES) for account data
protection, the device supports pass-through of clear-text account data for authenticated
applications. The device does not support turning off the SRED functionality.
Algorithms Supported
The device supports the following cryptographic algorithms
•
TDES (112 bits and 168 bits)
•
AES (128 bits)
•
RSA (Signature Verification and Key Exchange 4096 bits)
•
HMAC SHA256
•
CMAC AES 128
Key Management
The device supports DUKPT as its key management technique, the technique uses a unique key
per transactions as specified in [3] and [4].
The use of the POI with different key management systems will invalidate any PCI approval of this
POI.
Key Loading
Key loading cannot be performed directly on the device, all key loading activities are performed
over the air via an online key loading facility that is cryptographically bound to the terminal.
Key Table
Key Name
Designator
Type
Size
(Bits)
Form Factor
Loaded / Stored
to Device
Num Slots
Payter Root
PK
ROOT
ROOT
RSA
Public
4096
Loaded: x509
Stored: x509
1
Terminal
Intermediate
PK
TERMINAL-INT
ROOT
RSA
Public
4096
Loaded: x509
Stored: x509
1
Terminal Certificate
Key Pair
KP
TERMINAL
TERMINAL-INT
RSA Key
Pair
4096
Loaded : NA
Stored : OPTEE
Key Object
1
Application
Intermediate
PK
APP-INT
ROOT
RSA
Public
4096
Loaded: x509
Stored: x509
1
Application Signing
Key
PK
APP
APP-INT
RSA
Public
4096
Loaded: x509
Stored: x509
1 per
application
Crypto Domain - DUKPT
