Square Contactless and Chip Reader Manuel utilisateur

Contactless and Chip Reader

PCI Compliance Policy and Procedures

Version 1.00

Table of Contents

01 Introduction

05 Square Reader Authentication and Use

07 Square Reader Security

10 Version History

Introduction

Square’s Contactless and Chip Reader enables acceptance of EMV and NFC based

transactions. It meets the most stringent security requirements published by the Payment

Card Industry (PCI) Security Standards Council (SSC), PIN Transaction Security (PTS) version

4.1.

The purpose of this document is to address the security requirements as listed in the PCI PTS

Point of Interaction (POI) version 4.1 Derived Test Requirements (DTRs) B20. As required by

PCI SSC this document can be placed in the public domain.

Environment description

The Square Contactless and Chip Reader (“Reader”) is a secure payment device that is

designed for use by merchants in many industries for accepting card-present payment

transactions. The Reader only works with the Square Register application and a compatible

mobile device1running in a Square Stand (https://squareup.com/stand). There is no

conﬁguration required other than to verify that the Reader is fully powered and connected via

a USB po to the Square Stand.

Installation and inspection

Sellers can order a Reader on the Square website (https://squareup.com) or purchase one at a

number of retail outlets (https://squareup.com/retail). Upon receipt of the Reader, the Seller

should inspect that the hardware version (S8) and serial number are visible on the underside

of the Reader.

Bottom view:

1https://squareup.com/help/en-us/aicle/3887-devices-compatible-with-square-register

Introduction

Isometric top-down view:

Front view:

Introduction

Side view:

Back view:

Introduction

Square Reader Authentication and Use

Authentication of the Square Reader

Upon receipt, the operator can connect the Square Reader to the USB hub of the Square

Stand. The Square Reader is cryptographically authenticated to both the Register application

and Square back-end servers. If the Square Reader is valid, it will register as such with the

Square Register application. If the operator has received an unauthorized reader, the Square

does not have conﬁgurable application or Reader settings for the authentication function.

Using the Square reader

How to obtain a Square Reader

The Square Reader may be obtained either via the Square website or via an approved retail

location. The Square Reader is ready for use upon receipt. (The Seller should verify that

Square offers payment processing in their country.) To use, simply remove the Square Reader

from the packaging and connect to a USB po of the Square Stand. The Square Reader

should authenticate itself to the Square Register application and operation can continue.

Attributes of a Square Reader

The Square Reader has the following approval classes: Secure Card Reader (SCR), Secure

Read and Exchange of Data (SRED), Integrated Chip Card Reader (ICCR). The Square Reader

is intended for use in environments with attended payments; it is not intended for use as an

unattended payment terminal (UPT).

How to store a Square Reader

To store the Square Reader simply remove it from the Square Stand USB po and store for

next use. In the event the Seller will not use the Square Reader for more than twelve (12)

months at a time, be sure to charge the Square Reader prior to storage and periodically to

preserve its readiness.

Procedures for using a Square Reader

It is impoant that each day or before use the Seller check the Reader to make sure it has not

been tampered with between uses. This can be easily done by looking at the chip card slot to

verify there are no foreign objects such as capture devices, card skimmers, extra wires/cables

or other materials.

The Square Register application will convey operational messages from the Reader including

when the device is ready for payment and when a payment data capture is complete. The

Square Reader has no user-conﬁgurable security options.

Security Self-Tests

In addition to the continual tamper detection and response, the Square Reader authenticates

the ﬁrmware and terminal conﬁgurations using RSA 3072/SHA-256 every time it is powered

Square Reader Authentication and Use

on. The Square Reader also implements a forced reboot every 23.5 hours which initiates the

same self-tests as when the device is powered on.

How to decommission a Square Reader

To decommission the Square Reader please ship the device to the following address for

decommissioning:

Square, Inc.℅

: Reader Decommissioning

1455 Market St, Suite 600

San Francisco, CA 942103

USA

How to review the hardware and ﬁrmware version

A Square Seller can conﬁrm the hardware version by physical inspection as described above.

In addition, the Seller can conﬁrm the hardware and ﬁrmware version via the

Suppo>Readers screen of the Square Register application.

The PCI approved ﬁrmware version is 2.2 which is displayed as “202xxx”.

Square Reader Security

Privacy shielding

The Square Reader is not a PIN-entry device and, in accordance with PCI POS PED Security

Requirements and EPP Security Requirements technical FAQs version 2.0, does not require a

privacy screen.

Firmware and software update

Square will update the ﬁrmware associated with the Square Reader automatically and as

needed. This will occur in the background without user interaction required. In the event of a

critical update, the Square Register software will notify the user of the critical nature of the

update and advise a course of action for applying the update. Based on the criticality of the

update, Square may disable transaction processing until a ﬁrmware update is successfully

applied.

Infrequent or seasonal use

The Square Reader has a primary battery and backup battery. The primary battery is used for

operation of the Square Reader. The backup battery is used to maintain the tamper-detection

features of the Square Reader. If the primary battery is entirely discharged the backup battery

will maintain tamper-detection of the device for one year. If the Square Reader is not fully

charged annually it will enter into a tampered state and become inoperable.

Common use and recharging of the primary battery will prevent the Square Reader from

entering a tampered state. For infrequent or seasonal users of the Square Reader we

recommend charging the Square Reader fully at least once each year.

Tamper Detection and Response

External Inspection of Square Reader

Under normal operation, Square Reader employs internal active tamper-response

mechanisms as described below. These mechanisms are enforced automatically and do not

require any initial conﬁguration by the user.

Prior to accepting payments with Square Reader, the user must inspect the Reader for

evidence of external tampering. Procedures should include, at minimum, examination to

identify:

•Evidence of inses, wires, overlays or any unknown component connected to the Reader

or inside the card slot

•Evidence of modiﬁcation or disassembly of the Reader

Square Reader Security

•Visible or tactile changes to the cable connections or card slot

Please contact Square Suppo at https://squareup.com/square-suppo if you discover any

evidence of external tampering.

Automatic Tamper Response

The Square Reader may identify ceain events as attempts to tamper with its operation and

alter its inner workings. If the Square Reader identiﬁes a tamper event it will erase the

encryption key material it contains and become inoperable.

The Square Reader is rated for normal operation and any of the below scenarios may tamper

the device and cause it to become inoperable:

•Temperatures outside of the range of 0 and 40 degrees Celsius

•Voltage outside of the range of 1.6 and 3.9 volts

•Any attempt to open/disassemble/take apa the Square Reader or access pas inside

The Square Reader is intended to be fully charged once a year. If the Square Reader’s primary

battery is fully discharged and left for more a year without a recharge it may become

inoperable.

The Seller can detect if a tamper event has occurred by connecting the Square Reader to an

approved mobile device with the Register application installed. Opening the Register

application will notify the Seller if the device has reached a tamper event.

If the Square Reader experiences one of the above tamper events, Square will reach out to the

Seller and communicate as appropriate how to return the Square Reader to Square for secure

disposal and replacement.

Software development guidance

The Square Reader is designed for use with Square products and applications, and does not

work with other applications. All code is developed, written, and managed by Square.

Square developers must refer to the Software Engineering and Vulnerability Management

Procedures when developing new software for Square Readers.

Encryption and key management

The Square Reader is only intended for use with other Square applications and services.

Square peorms all key management, key loading, and acquiring. Operating the device with

any other key loading, acquirer, or key management will render the device inoperable. In

addition, the use of the device with different key management systems will invalidate the PCI

approval of this device.

All of the cryptographic keys used by the Square Reader to protect the conﬁdentiality and

Autres manuels Square Terminal de paiement

Square

Square S4 Manuel utilisateur

Manuels Terminal de paiement populaires d'autres marques

PAX

PAX D180SRF Manuel utilisateur

LinkPoint

LinkPoint AIO Manuel utilisateur

Moneris

Moneris hispeed 6200 Manuel utilisateur

Moneris

Moneris iWL220 Manuel utilisateur

Ingenico

Ingenico iUC280 Manuel utilisateur

Ingenico

Ingenico Tetra Move/5000 Manuel utilisateur

Ingenico

Ingenico iWL250B Manuel utilisateur

Optimum

Optimum M4230 Manuel utilisateur

Triton

Triton RL5000 Manuel utilisateur

Ingenico group

Ingenico group Lane/8000 Manuel utilisateur

Gilbarco

Gilbarco FlexPay IV CRIND Manuel d'installation et d'exploitation

Infinite Peripherals

Infinite Peripherals Infinea Tab Lite Manuel utilisateur

PAX

PAX S920 Manuel utilisateur

Ingenico

Ingenico iCT220, iCT250 Manuel utilisateur

dejavoo

dejavoo Z Series Manuel utilisateur

VeriFone

VeriFone VX 520 Series Manuel utilisateur

Optomany

Optomany axept S900 Manuel utilisateur

Skyzer

Skyzer iWL252 BLUETOOTH Manuel utilisateur