ZT598J EPP

Firmware Rev. F15

Installation & User Manual

Rev.1.1

© 2006- 2009

© 2006- 2009 Page 2 of 14

1. General Information ZT598J EPP is an Encrypting PIN Pad designed for NCR 56xx and 58xx (PersonaS) ATMs. ZT598J is a plug-in replacement of original NCR EPP:

• Mechanical compatibility • Electrical compatibility • Programming interface compatibility

1.1. VISA/PCI Approval ZT598J has been approved by Visa to conform to the Payment Card Industry (PCI) PIN Entry Device Security requirements.

• Approval Number: 4-10019 • Approval Date: 13.09.2006 • Renewal Date: 13.09.2009

The copy of the Approval Letter is attached below. The reference can be also found at the PCI Security Standards Council web site https://www.pcisecuritystandards.org/security_standards/ped/pedapprovallist.html

© 2006- 2009 Page 3 of 14

© 2006- 2009 Page 4 of 14

© 2006- 2009 Page 5 of 14

© 2006- 2009 Page 6 of 14

2. Interface Connectors There are 3 external connectors on the outer edge of the EPP:

• SDC Bus (10-pin connector)

N/C 1 2 N/C

DATA-P 3 4 DATA-N

RESET-P 5 6 RESET-N

N/C 7 8 N/C

GND 9 10 N/C

• Power and FDKs (26-pin connector)

+5V 1 2 GND

SCAN_TX0- 3 4 ERR_LED-

AUD_LED- 5 6 N/C

N/C 7 8 ALPHA-

FDK_LEFT- 9 10 FDK_RIGHT-

SCAN_TX0- 11 12 SCAN_TX1-

SCAN_TX2- 13 14 SCAN_TX3-

SCAN_TX4- 15 16 SCAN_TX5-

SCAN_TX6- 17 18 SCAN_TX7-

SCAN_RX0- 19 20 SCAN_RX1-

SCAN_RX2- 21 22 SCAN_RX3-

SCAN_RX4- 23 24 SCAN_RX5-

SCAN_RX6- 25 26 SCAN_RX7-

• Keypad heater power (2-pin connector)

+24V 1 2 GND

Usage of heater power connector is optional. It should be connected when EPP keypad is exposed to lower temperatures on through-the wall ATMs. Regulating of the keypad temperature is done automatically.

© 2006- 2009 Page 7 of 14

3. EPP Activation The EPP may be supplied as complete assembly (ESB interface board installed and activated):

If you have received complete assembly, please skip this chapter. Warning. Assembled EPP must not be disassembled. ESB interface board will work within this EPP only. The EPP may be also supplied as separate modules (encryptor box/housing + ESB interface board):

If you have received modules separately, EPP must be assembled and activated before use.

• Mount ESB interface board on the housing next to the encryptor box using 4 self-tapping screws.

• Attach 14-pin flat ribbon cable coming out of encryptor box to the 14-pin connector on the ESB interface board.

• Activate encryptor/ESB pair as described below. Warning. Assembled EPP (encryptor/ESB pair) will not work in an ATM until activated.

© 2006- 2009 Page 8 of 14

To activate newly assembled EPP you will need: • USB/SDC adapter and cables (supplied separately) • EPB activation utility (supplied separately) • PC with Internet connection (to be supplied locally) • 5V Power supply for EPP (to be supplied locally)

3.1. EPP Activation Utility

EPP Activation Utility is a Windows application (supplied on request). The activation utility designed for Windows XP; it should also work with Windows 2000 and Windows 2003 Server. It is not designed and will not work under Windows 95/98/Millenium and Windows Vista.

Installation 1. DO NOT connect USB/SDC adapter during software installation. 2. Run setup program and follow the wizard to install the software. 3. Once the software is installed, connect USB/SDC adapter to the PC’s USB port. 4. When "New Hardware Found" wizard appears, select "Search for drivers automatically"

(but do not select searching the Internet if prompted). 5. To verify drivers are installed correctly, you may wish to open Windows Device

Manager (My Computer→Right Click→Manage) and look for "Telegon Devices→Generic USB Communication Device"

Usage 1. Connect USB/SDC adapter to the PC’s USB port. 2. Connect assembled EPP’s SDC connector to USB/SDC adapter using 10-pin flat ribbon

cable. 3. Connect 5V power supply to the 26-pin connector (pins 1 and 2). 4. Run ESB Activation Utility and make sure the PC is connected to the Internet:

© 2006- 2009 Page 9 of 14

5. Select desired EPP type (EPP-B or EPP-E)

• Note. NCR EPP can be one of two types: EPP-B or EPP-E. ZT598J EPP can work in either mode, but proper mode must be set up manually. If you are unsure about which mode to set up, please look at the label on the back side of one of your original NCR EPPs, which should say either “Type B” or “Type E”.

• Note. NCR EPP can be loaded with two variants of firmware: DAPI1 or DAPI7.

ZT598J EPP can support both variants, but proper variant must be set up manually. If you are unsure about which variant to set up, use DAPI1, which works universally. DAPI7 is newer and more secure option, but it is only supported by latest version of Aptra and AANDC.

• ZT598J type / DAPI variant can be changed later in the field using a maintenance

utility (see below), however, all customer keys within EPP will be destroyed during this procedure.

6. Press “Run” button and wait until operation complete:

© 2006- 2009 Page 10 of 14

7. Activation process completed. 8. If desired, EPP buttons may be tested at this stage.

3.2. How To Verify EPP Activation on ATM If you wish to verify EPP while installed in an ATM, proceed as follows: 1. Enter NCR diagnostics menu (you will need NCR FE key) 2. Select Encryptor sub-menu and perform IDENTIFY test 3. If your EPP is activated, you will see:

• EPP serial number (e.g. “56781234”) 4. If your EPP is not activated, you will see “NOTACTIV” instead of serial number.

© 2006- 2009 Page 11 of 14

4. EPP Installation

ZT598J EPP is a direct plug-in replacement of NCR EPP, therefore the installation procedure is the same as for NCR EPP. Please use appropriate EPP fitting kit as required by the ATM class.

Note. Please make sure the type of the EPP being installed (EPP-B or EPP-E) match the type

of the EPP previously installed in this ATM. NCR EPP type is hardwired and can be identified by looking at the label on the back side of

the EPP (“Type B” or “Type E”). ZT598J EPP type is a configurable parameter and can be identified using maintenance utility

(see below).

4.1. EPP Maintenance Utility

ZT598J EPP Maintenance Utility is a bootable 3.5” floppy disk (supplied on request) which allows the following tasks on the EPP installed inside an ATM:

• ESB interface board firmware update (Note: this is not ZT598J encryptor firmware as certified by VISA/PCI).

• EPP type change (EPP-B to EPP-E or vice versa)

To use the Maintenance Utility reboot ATM from the floppy disk. ESB firmware update will happen automatically if newer version is available on the floppy (ESB firmware update does not impact customer keys within EPP encryptor).

Current EPP type and ESB firmware version will be shown on the ATM monitor:

EPP type can be changed at this stage by pressing button “5” on the EPP keypad (one more

button press will be requested for confirmation).

© 2006- 2009 Page 12 of 14

5. Remote Key Management ZT598J EPP provides PKI-based Remote Key Management functionality identical to those

provided by NCR EPP. There is, however, one difference in that the EPP’s RSA keys are signed using different

private vendor keys: • NCR EPP public key is signed by NCR’s private vendor key at NCR premises

during EPP manufacture. • ZT598J EPP public key is signed by Shenzhen Zhengtong Electronics Co., Ltd.

(SZZT’s) private vendor key at SZZT premises during EPP manufacture. An ATM host wishing to use Remote Key Management for both NCR and SZZT EPPs

should implement separate Host RSA keys: • Host public key for use with NCR EPPs should be signed using NCR’s private

vendor key (performed by NCR upon request). • Host public key for use with ZT598J EPPs should be signed using SZZT’s private

vendor key (performed by SZZT or its representative upon request).

© 2006- 2009 Page 13 of 14

6. Troubleshooting This section describes possible issues and solutions during ZT598J installation.

6.1. EPP Not Found Symptom: ATM boots, but EPP does not show up.

• S4i: “Keyboard not attached” message appears and ATM halts. • Aptra: Keyboard is not listed in “Hardware Configuration”.

Solution: Check if EPP is alive: when powered up, EPP should issue ~1 second beep. If there’s no beep on power-up, EPP is broken and should be repaired/replaced. Solution: Check if EPP can be communicated with: after power up and initial beep, EPP should not beep on a button press. If beep is issued when a button is pressed, EPP is broken and should be repaired/replaced.

6.2. Initial Keys Cannot Be Entered Symptom: ATM boots, but does not allow to enter any initial encryption key.

• Either an error message is displayed or ATM reboots during initial key entry.

Solution: Check if EPP is activated (see Section 3.2). EPP which is not activated cannot be used in an ATM.

6.3. NDC ATM Reboots or Reports Encryptor Errors Symptom: ATM running an NDC application (NDC+ or AA-NDC) does not work properly.

• Encryptor errors reported to the host or to the journal. • ATM reboots unexpectedly during an operation.

Solution: Check if EPP type is set to EPP-B (see Section 4.1). NDC application was designed to work with EPP-B keyboards; it will not work properly with EPP-E keyboards.

6.4. “New Hardware Found” Wizard Appears in Windows XP Symptom: After EPP was installed on an ATM, replacing another previously installed EPP, Windows XP detects new hardware and opens “New Hardware Found” wizard. Solution 1 (preferred): Switch EPP type to the opposite: EPP-B to EPP-E or vice versa (see Section 4.1). Windows XP detects new hardware only if the keyboard type is changed; your EPP type does not match previously installed keyboard type. Solution 2: Log in to Windows as Administrator (or other user with administrative rights) and let “New Hardware Found” wizard to complete. You will need to know appropriate login and password to perform this task.

© 2006- 2009 Page 14 of 14

6.5. AANDC 3.x Continuously Reboots

Symptom: After EPP was installed on an ATM, replacing another previously installed EPP, Aptra Advance NDC version 3.x continuously reboots during application loading. Solution: This is a known issue with AANDC 3.x (observed with versions 3.0 and 3.1). When EPP keyboards with different setting (e.g. DES vs 3DES) are swapped, AANDC 3.x fails to start up.

• Boot Windows XP in Safe Mode (press F8 on Windows boot and select “Safe Mode”). • Log in as Administrator (or other user with administrative rights). You will need to know

appropriate login and password. • Delete or rename the following files:

C:\Program Files\NCR APTRA\XFS PIN Service Provider\krep.dat C:\Program Files\NCR APTRA\XFS PIN Service Provider\krep.bak

• Reboot the ATM.

6.6. AANDC 3.x Fails to Store Key (“FAILED TO CREATE CHECKSUM”)

Symptom: After EPP was installed on an ATM, replacing another previously installed EPP, Aptra Advance NDC version 3.x cannot store manually entering Master Key (e.g. Key A). A message “FAILED TO CREATE CHECKSUM” or similar appears instead. Solution: This is a known issue with AANDC 3.x (observed with versions 3.0 and 3.1). When EPP keyboard which was not initialized on this ATM is installed, AANDC 3.x fails to initialize it automatically.

• Boot Windows XP in Safe Mode (press F8 on Windows boot and select “Safe Mode”). • Log in as Administrator (or other user with administrative rights). You will need to know

appropriate login and password.

• Run Registry Editor (regedit.exe) • Locate the following key and change its value to 0:

HKEY_LOCAL_MACHINE\SOFTWARE\NCR\Advance NDC\ENCRYPTORMODE\EncMode

• Reboot the ATM.