P2PE

On this page:

Introduction

Point to Point Encryption (P2PE) enhances the security of account data by encrypting it between a Point of Interaction (POI) device and the decryption environment. Starting with version 2.02.021, Simplify can be implemented as part of an Elavon PCI-validated P2PE solution (not supported for Canada). This will allow Simplify customers to reduce the scope of their PCI audits.

The principal purpose of this section is to serve as a guide to inform users on the role of Simplify in Elavon’s PCI-validated P2PE solution. Customer requirements for PCI-validated P2PE can be summarized as follows:

• Ingenico Telium or Tetra PIN Pads using On-Guard encryption. See Versioning for more information.

• All general requirements for secure communications must be followed. Network security must be reviewed periodically.

• Any PCI-sensitive data received by the POS (encrypted or unencrypted) must be securely deleted when no longer needed.

• Printing must conform with PCI and TPP rules for masking.

• Informational Prompt messages (see Informational Prompting) must not be used to request PCI-sensitive data from the customer.

Encryption Types

Simplify supports two types of encryption (starting with version 2.02.021):

• The legacy Voltage encryption. Not eligible for PCI-validated P2PE.

• Ingenico’s On-Guard encryption. Eligible for PCI-validated P2PE.

The type of encryption used in an implementation can be displayed on the PIN Pad, as described under Versioning. This information is also sent in API field 5004, which has been modified as follows:

Encryption Provider ID (field 5004)

The Elavon API uses field 5004 to indicate the encryption type as follows:

• G2 = Voltage

• OG = On-Guard (version 2.02.021 and higher)

List-Based Transaction Processing

By default, Simplify sends transactions to Fusebox with PCI-sensitive data fields encrypted. Simplify uses two BIN lists to control and (if desired) modify this processing:

• Encrypt list – A non-configurable list containing BINs for PCI-protected PANs and any other BINs for which PCI-sensitive data fields can never be sent to Fusebox unencrypted. If this data cannot be encrypted, the transaction will not be sent to Fusebox and a bad card read response will be returned to the POS (no data).

• Return list – A merchant-configurable list containing BINs which will not be sent to Fusebox. These transactions will be returned to the POS unencrypted for use as determined by the merchant. Can only include BINs not in the Encrypt list.

If in neither list, the transaction will normally be sent to Fusebox encrypted (default processing). If there is an encryption failure not caused by system failure (e.g. data too long to encrypt), it will be sent unencrypted.

Sample Transaction with Return Unencrypted Response

The following sample is for a Sale transaction whose BIN is in the Return list. Simplify sends a Return Unencrypted response to the POS.

Request

Return Unencrypted Response

The following response sends account data to the POS in the clear (API 0003). The Response Message field (API 1010) contains *SLR WHITELIST, indicating a Return Unencrypted Response. Note that API 5004 (Encryption Provider ID) is not sent since the account data is not encrypted.