EmvFAQ.docx

1、EmvFAQGeneral1. What is EMVCo, and what is its role? 2. Who are the members of EMVCo? 3. What are the roles of the International Payment Systems? 4. Who do I contact with queries regarding interpretation and application of the EMV specifications? 5. Is there an EMVCo help-line I can call? 6. What is

2、 the purpose of the mailing registration facility and how can I register? 7. How are the EMV standards maintained? 8. How do the EMV specifications fit in with other international standards? 9. What does the EMVCo approval activity cover? 10. Does EMVCo support chip card migration? 11. How does EMVC

3、o seek input from the user community? 12. How do I register a change in my Company Name with EMVCo? 13. What restrictions apply with respect to use of the EMV Trademark? 1. What is EMVCo, and what is its role? EMVCo, LLC, was formed in February 1999 by Europay International, MasterCard International

4、 and Visa International to manage, maintain and enhance the EMV Integrated Circuit Card Specifications for Payment Systems.EMVCos primary role is to manage, maintain and enhance the EMV Integrated Circuit Card Specifications with the objective of to ensure ensuring interoperability and acceptance of

5、 payment system integrated circuit cards on a worldwide basis.EMVCo is also responsible for type approval processes, which include terminal compliance testing, as well as Common Core Definitions (CCD) and Common Payment Application (CPA) card compliance testing. These testing processes ensure a sing

6、le terminal and card approval at a level that will allow cross payment system interoperability through compliance with the EMV specifications.2. Who are the members of EMVCo? The current members of EMVCo are American Express, JCB, MasterCard, and Visa. Each of these organizations owns an equal share

7、 of EMVCo and has representatives in the EMVCo organization at the management and working group levels.3. What are the roles of the International Payment Systems? Each payment system member participates in EMVCo activities on an equal basis. Each activity is assigned to working groups in which all t

8、he members have representatives. All decisions are made on a consensus basis among the member organizations.4. Who do I contact with queries regarding interpretation and application of the EMV specifications? All queries regarding interpretation and application of the EMV specifications should be di

9、rected through the Contact Us facility, which is available on the EMVCo website - .5. Is there an EMVCo help-line I can call? EMVCo neither operates a help-line facility nor provides direct contact information. All questions to EMVCo should be submitted using the Contact US facility available on the

10、 EMVCo website - 6. What is the purpose of the mailing registration facility and how can I register? The EMVCo Mailing List registration facility ensures that you receive automatic notices when any new information, such as Specification Updates or Whats New items are been posted on the website. To r

11、egister, enter your contact information via the Mail Registration facility, which is available on the EMVCo website - 7. How are the EMV standards maintained? Since the EMV 96 Version 3.1.1 release, EMVCo has published EMV 2000 Version 4.0 in December 2000 and, most recently, Version 4.1 in May 2004

12、. In addition to periodically publishing updated versions of the specifications, EMVCo issues clarifications, corrections and/or changes to the specifications and communicates these via bulletins, errata and application notes on the EMVCo website.8. How do the EMV specifications fit in with other in

13、ternational standards? The EMV Specifications are built upon the existing ISO 7816 series of standards for Integrated Circuit Cards with Contacts.The ISO 7816 standards were developed by an inter-industry group and contain various options applicable to multiple sectors. The EMVCo Specifications cont

14、ain a selection of options taken from the ISO 7816 standards that are relevant for the financial sector.Through payment systems representatives, EMVCo promotes and endeavors to harmonize the standardization work by actively contributing to the ISO standards drafting process in order to ensure ongoin

15、g compatibility between the ISO standards and the EMV specifications.9. What does the EMVCo approval activity cover? EMVCo has compiled and published a set test requirements and test cases for the terminal-to-chip card interface (level 1) and for the payment application (Level 2). Furthermore, EMVCo

16、 has accredited laboratories to provide testing services to terminal vendors and application providers. At the conclusion of the approval process EMVCo issues a Letter of Approval and lists approved products on the EMVCo website.10. Does EMVCo support chip card migration? EMVCo is not involved in pr

17、omotion of chip migration. Chip migration strategies are the responsibility of the individual card schemes.11. How does EMVCo seek input from the user community? EMVCo utilizes a comment facility on its website which is open to the public to submit suggestions for improvement to the specifications,

18、report any issues identified, or pose any questions.In addition, EMVCo holds semi-annual Advisors meetings, consisting of senior representatives from countries implementing chip card solutions, to solicit feedback, promote discussion, and share experiences.The goal of the Advisors is to provide a fo

19、rum to develop a common understanding for global acceptance of chip cards issued by the financial services industry. While advisory in capacity, it does provide an essential communication link to the EMV Specifications development process.Any country that is chip-active and promotes the EMV chip car

20、d specifications can request to be represented on the Advisors group.12. How do I register a change in my Company Name with EMVCo? If a company with existing EMVCo approved products changes its name, the name change will transfer all approvals issued under the old company name to the new one. The fo

21、llowing procedure is required to accommodate the change request:1. The contact person associated with the old company name is required to provide in writing the authorization of the transfer. This is to be a written letter on official company letterhead and sent to EMVCo at the address below. If the

22、 contact person is no longer employed at the company, then a new contact must be appointed. The information required is the following:o Old Company Name o Existing Registration Number (This will remain unchanged for the new company name) o Type Approval Level (1 or 2) o New Company Name (with Addres

23、s, Contact, Phone and Fax numbers) 2. A new contract must be completed under the new company name. See the forms section on the EMVCo website.13. What restrictions apply with respect to use of the EMV Trademark? Below is a brief overview of EMVCos policy as it relates to its two trademarks. These ma

24、rks consist of the EMV(tm) word mark and the EMVCo logo. Please review the entire EMVCo Mark Usage Guidelines before using either of the EMVCo trademarks.EMV(tm) WORD MARKThe trademark related to the EMV Integrated Circuit Card, Terminal, Application and Security Specifications for Payment Systems i

25、s the EMV(tm) word mark, which is used when reference is made to the EMV specifications.EMVCo LLC will monitor the use of this mark as part of an on-going process, and will take whatever steps are necessary to ensure that there are no improper or illegal uses of the EMV(tm) trademark. Note that any

26、use of the trademark also requires the user to properly attribute ownership, for example: EMV(tm) is a trademark owned by EMVCo LLC.Any time that a company or any other entity refers to EMV(tm), it must be formatted exactly as shown here, and not include parentheses, commas or any other modification

27、. The trademark denotation symbol TM should appear at least once in each piece of text page, typically after the first use of the mark on the first page of text.Where the EMV(tm) word mark is used by anybody other than EMVCo LLC, its use shall never imply authorization or endorsement by EMVCo LLC, n

28、or will it imply that the unauthorized user has obtained EMVCo approval for any of its products. Any claim that a particular product is approved by EMVCo, can be verified by requesting the EMVCo letter of approval associated with the product from the vendor and/or by checking the approved product li

29、st on the EMVCo website at .EMVCo LOGOThe EMVCo Logo is a design mark for exclusive use by EMVCo LLC and may not be used by anybody other than EMVCo in connection with the EMV(tm) specifications, supplementary specifications, a product or implementation supporting it, or for any reason whatsoever. W

30、here the EMVCo Logo is used by anybody other than EMVCo LLC, its use shall never imply authorization or endorsement by EMVCo LLC, nor will it imply that the unauthorized user has obtained EMVCo approval for any of its products.Security1. For how long are existing key lengths likely to be used? 2. Wh

31、at is the process for reviewing the lifespan of key lengths? 3. Does EMV use x.509 public key certificates? 4. What is the EMVCo position on elliptic curves or other alternative cryptography? 5. Where can I find other documentation that will help me understand the security issues relating to EMV?1.

32、For how long are existing key lengths likely to be used? At the end of each year EMVCo makes recommendations to the Payments Systems regarding expiry dates of Payment System public keys. These recommendations are published in EMVCo Notice Bulletins that are available from the Bulletins/Notices section of the EMVCo website.2. What is the process for reviewing the lifespan of key lengths? Every year EMVCo executes a review of the security of RSA. Based on that, a recommendatio