ISO 11568:2023 defines management of symmetric and asymmetric cryptographic keys in retail finance. Creation, distribution, storage, use, replacement and retirement form a controlled lifecycle, helping protect transaction security through controlled handling of payment keys.
TL;DR:
- ISO 11568:2023 covers retail financial-services key management.
- It addresses symmetric and asymmetric keys throughout their lifecycle.
- Manual and automated processes are both within scope.
Summary
Retail-payment key management
ISO 11568:2023 addresses management of symmetric and asymmetric cryptographic keys used to protect sensitive retail financial-services information. The public abstract includes links between card-accepting devices, acquirers, issuers and integrated-circuit cards.
Lifecycle coverage
Its scope spans generation, distribution, use, archiving, replacement and destruction of keying material. Both manual and automated management, including combinations of the two, are covered.
Control objectives
The catalogue identifies key separation, substitution prevention, identification, synchronisation, integrity, confidentiality and compromise handling, together with logging and auditing of key-management events.
Edition and evidence
ISO lists the first consolidated edition as published in February 2023. The public catalogue establishes scope and lifecycle identity; the licensed text is needed for clause-level implementation. A provider’s use of cryptographic keys alone does not establish conformance to this edition.
Keywords
- Cryptographic Keys
- Retail Security
- Key Generation
- Key Distribution
- Key Separation
- Key Archiving
- Key Destruction
- Compromise Handling
- Audit Logging
- Asymmetric Keys