- January 2025 deadline
- Avoid your ATMs going ‘dark’!
Hyosung retail ATMs have been updated to support a more secure method of transferring encryption keys from the host processor to the ATM as required by PCI (Payment Card Industry). The new standard TR-31 (“key blocks”) will be mandated by PCI for the transfer of keys to ATMs starting January 1, 2025
Are all ATM required to support this mandate?
All ATMs will be mandated to support the required EPP version and related ATM software for the TR-31 key block standard. Hyosung released EPP version X1 in 2020 to meet this requirement…New ATMs purchased from Hyosung since May of 2021 came with the required EPP hardware to meet the TR-31 standard, though you will need to ensure the correct SW is running on your ATMs. EPP-8000 can also support TR-31 with appropriate Firmware updates.
Which retail Hyosung ATMs can be upgraded to support TR-31?
Hyosung ATM models running WINCE version 6.03.02 or higher can support the TR-31 required EPP hardware upgrade. Hyosung ATMs running older WINCE versions cannot support the TR-31 required upgrades. Please refer to the matrix below for additional details.
When is that deadline again?
PCI is requiring that ATM support will end by January 1, 2025, your ATM’s host processor will address the actual date when the non TR-31 key transfer method will no longer be available. Please connect with your host processor to determine end of non TR-31 key transfer methods.
Will my ATM actually ‘go dark’?
The answer is ‘Yes’. If your ATM or ATM EPP and SW has not be upgraded to support the TR-31 key block requirements, then your host processor will stop accepting transactions from those non-compliant ATMs.
How can I get ahead of this potential issue?
You can upgrade your ATMs ‘now’! Hyosung EPP X1 has been supported since January 2020 and the TR-31 software updates for EPP 8000 were available January 1, 2023. Hyosung encourages you to plan and forecast your upgrade plans now versus waiting until a likely rush closer to the January 2025 date.
What does my ATM upgrade require?
To achieve PCI TR-31 compliance, all your ATMs will need an existing EPP-8000 or newer Hyosung X1 keypad (EPP), operating WinCE 6.03.02 or higher and TR-31 support from your network.
Are there any additional benefits to upgrading my ATMs now versus waiting until just before January 1, 2025?
In addition to avoiding fears of your ATMs going dark or not meeting the January 2025 deadline, upgrading your ATMs to the latest WinCE version of can provide additional security protections including protection against jackpotting attacks. (Refer to Technical Service Bulletin No.08155 “CDU Binding Feature”– on Hyosung’s Web Ordering System (https://www.nhatm.com/front/home.do/Support).
Upgrade Planning Matrix:
Please refer to the table below to determine the readiness of your ATMs to support the TR-31 Key Block standard.
| ATM Model | Keypad version | ATM Core | Replace ATM? | Replace EPP Keypad? | Software Version Required |
| MBxxxx NH1500 NH1800 NH2100T | Firmware | Yes | |||
| NH1800 | Firmware | Yes | |||
| NH2100T | Firmware | Yes | |||
| NH1800CE NH5000CE NH5300CE | WinCE 5.0 | Yes | |||
| NH1500SE NH1800SE NH2600SE MX2600SE NH2700 NH2700T MX4000W MX5000SE MX5200SE MX5300SE | EPP-6000K (or older) | WinCE 6.0 | No | Yes – EPP-X1 | MoniPlusCE2 – V06.03.02 |
| NH1500SE NH1800SE NH2600SE MX2600SE NH2700 NH2700T MX2800SE MX2800T MX4000W MX5000SE MX5200SE MX5300SE | EPP-8000R EPP-X1 | WinCE 6.0 | No | No | MoniPlusCE2 – V06.03.02 |
| MX2600SE MX2800SE MX2800T MX5200SE MX5400SE | EPP-X1 | WinCE 7.0 | No | No | MoniPlusCE2 – V06.03.02 |
| MX5000XP MX5100 MX5100T* MX5300XP* MX5600 MX5600T MX7000D | 852 945 G41 | Yes | |||
| MX5100T MX5300XP MX5300A/S MX5600 MX5600T | EPP-6000K (or older) | H81 Q87 Q170 | No | Yes – EPP-X1 | MP2S Retail – v1.1.0 |
| MX5100T MX5200† MX5300XP MX5400 MX5600 MX5600T | EPP-8000R EPP-X1 | SBC210 H81 Q87 Q170 | No | No | MP2S Retail – v1.1.0 |
Frequently Asked Questions
- Does the EPP-8000 PCI 3.0 SHA1/SHA2 support TR-31?
- Yes, EPP-8000 is fully PCI 3.0 Compliant
- Minimum EP version 10.01.03.00
- Minimum SP Version 04.22.08
- Minimum MoniAct version 01.00.51.07
- BlueVerse Retail Release 01.01.00
- Will the EPP-8000 PCI 3.0 SHA1/SHA2 be PCI compliant with TR-31 even though it expired in April of 2021?
- Yes, EPP-8000 is fully PCI 3.0 Compliant
- Any like for like replacement of the EPP-8000 PCI 3.0 SHA1 would require a Manual Key Load
- What EPP(s) support TR-34?
- The current EPP X1 PCI 5.0 and newer
- EPP-8000 PCI 3.0 SHA1/SHA2 does not support TR-34
References:
PCI Security Standards – https://www.pcisecuritystandards.org/
Interoperable Secure Key Exchange Block Specification – https://webstore.ansi.org/Standards/ASCX9/ascx9tr312018
