Is Anyone Else Confused About TR-31? You're Not Alone!

“The TR-31 key block is a format defined by the ANSI Standards Committee to support interchange of symmetric keys in a secure manner and with key attributes included in the exchanged data. CCA supports the management of DES keys, AES keys, and HMAC keys using TR-31.” This, essentially, is a formal definition of TR-31, as given by IBM in a recent publication. What it means to ATM operators has been subject to some confusion. And as a result, was the primary topic of discussion at last week’s U.S. Regional Board meeting.

The message being heard from ATM networks is that operators are expected to be using TR-31 as of January 1, 2025. Any pronouncement about that deadline being extended is probably incorrect – unless you are hearing it directly from the networks. However, it is ATMIA’s understanding that there will be no audits or declined transactions linked solely to TR-31 compliance. But be aware that losses after the deadline that could have been averted with TR-31 compliance, will likely fall upon a non-compliant operator.

Even those diligently working today to update all of their terminals, are running into significant obstacles. Some hardware is not available yet. Not all software is fully certified. And for many it means multiple trips to the same ATMs to complete the process. Time is not on their side.

Regardless of the challenges ahead, though, ATMIA encourages all operators to push ahead and accomplish as much as you can, as quickly as you can. None of the cost or required effort is going to disappear over time. If history is any sort of teacher, we can expect both inventory and services to get scarcer and more expensive.

Best of luck to all in this important effort.

David