ISO 9564-5:2025

Overview

ISO 9564-5:2025 - Financial services - Personal identification number (PIN) management and security - Part 5 specifies cryptographic methods for PIN generation, PIN change and transaction PIN verification. The standard defines approved techniques using encryption, CMAC (block-cipher MAC) and HMAC (hash-based MAC), and references approved ciphers and hash algorithms (see the standard’s Table 1). It builds on the basic PIN principles in ISO 9564-1 and is intended to ensure secure, interoperable PIN management in card-based and payment systems.

Key topics and requirements

• PIN generation methods
  • Random PIN generation and deterministic PIN generation (including PIN offset methods).
  • Use of a PIN generation key (PGK) and clear rules for decimalization and base conversion.
• PIN change and management
  • Authentication requirements for PIN change.
  • Handling forgotten PINs and issuer-side update processes.
  • HSMs must provide an atomic PIN change function to safely update reference PINs, PVVs or offsets.
• Transaction PIN verification
  • PIN Verification Value (PVV) method (a 16‑byte block-cipher calculated PVV in this standard, distinct from legacy TDEA PVVs).
  • Offset method and stored encrypted reference PIN approaches.
• Cryptographic building blocks
  • Approved encryption algorithms and block ciphers (e.g., AES family as referenced).
  • CMAC and HMAC mechanisms conforming to ISO/IEC 9797 and approved hash algorithms.
• Key management
  • Keys must be managed per ISO 11568 (retail key management).
  • Guidance on key rotation policies for PVV/PIN generation keys to allow for card life and reissuance.

Applications

ISO 9564-5:2025 is directly applicable to:

• Banks, card issuers and payment processors implementing secure PIN issuance, generation and verification workflows.
• HSM and security appliance vendors building PIN management functions, PVV calculation, CMAC/HMAC support and atomic update APIs.
• Security architects and compliance teams designing PIN lifecycle controls, cryptographic key rotation, and interoperability between issuer systems.
• Payment scheme operators and integrators ensuring consistent PIN verification across channels (ATM, POS, online wallet back-ends).

Practical benefits include improved security for PIN lifecycle operations, standardized PVV/offset techniques, and interoperability across issuer and acquirer systems.

Related standards

• ISO 9564-1 (Basic principles and requirements for PINs)
• ISO/IEC 9797-1 and 9797-2 (MAC algorithms - block-cipher and hash-based)
• ISO 11568 (Financial services - Key management)
• ISO/IEC 18031 and ISO/IEC 18033-3 (random generation and cipher references)

Keywords: ISO 9564-5:2025, PIN management, PIN generation, PVV, PIN verification, CMAC, HMAC, AES, HSM, financial services security.