PAYMENT SECURITY & HSM ENGINEERING
Payment Cryptography, Key Management and Security-Critical Integrations
Payment Cryptography in Practice
join.tech provides engineering and consulting around payment cryptography, Hardware Security Modules, key management and PIN security.
The work ranges from implementation and integration to migrations, technical analysis and production support. A particular focus is the boundary between cryptographic systems and the applications that use them: HSM APIs, key formats, PIN processing, host systems and the operational processes around them.
HSM Engineering
Hardware Security Modules are rarely isolated components. They normally sit inside a larger system of applications, host interfaces, key-management procedures, monitoring and operational controls.
Typical work includes:
- HSM Integration: APIs, host integration and application interfaces.
- Test Tooling: cryptographic test frameworks and repeatable integration tests.
- Environment Analysis: understanding existing HSM usage, dependencies and operational assumptions.
- Migrations: HSM replacement, key migration and changes to cryptographic protocols.
- Operations: production troubleshooting, incident analysis and technical support.
Previous work has included Thales / SafeNet payment HSM environments in Swiss banking and payment infrastructure.
Key Management & PIN Security
Payment systems have their own set of requirements for generating, transporting, storing and using cryptographic keys. The same is true for PIN processing, where application behaviour, cryptographic standards and HSM functionality are closely connected.
- Key Blocks: TR-31 / ANSI X9.143 and key-block migration.
- Remote Key Distribution: TR-34 and related PKI concepts.
- PIN Security: ISO 9564 PIN blocks, verification, translation and migration.
- Cryptography: AES, TDES, PKCS#11 and HSM-backed key handling.
- Key Lifecycle: payment key hierarchies, migration and operational key-management processes.
At Worldline, this included technical responsibility for a large PIN-security migration in Switzerland and Austria, including HSM APIs, implementation, testing and pilot rollout.
Payment Security & PCI
Payment security work often happens in a regulated environment, but compliance alone does not make a system secure. The technical work behind it still has to hold up in implementation and operation.
Relevant experience includes:
- PCI PIN: compliance ownership, migrations and audit preparation.
- PCI DSS & PCI P2PE: engineering and compliance-relevant technical work.
- EMV / PKI: private-key handling and payment-related PKI topics.
- Security Reviews: trust boundaries, key usage, access models and technical risk.
- Operations: documentation, controls, incident response and production support.
Migrations & Technical Discovery
Cryptographic migrations tend to have dependencies outside the HSM itself. Before changing a PIN format, key block, HSM platform or cryptographic protocol, it helps to understand which applications use it, how keys move through the environment and what happens operationally when something fails.
Typical cases include:
- HSM replacements and migrations
- key-block and payment-key migrations
- PIN-security migrations
- payment-platform modernization
- changes to cryptographic protocols
- integration of new payment-security services
- analysis of existing payment and cryptographic infrastructure
join.tech can support the discovery work as well as the subsequent implementation and transition.
Background
David Schmid worked in payment security and cryptographic engineering in the Swiss financial sector before founding join.tech.
At Worldline in Zurich, his work included HSM APIs, cryptographic protocols, PIN security, key-management topics, payment-security migrations and production support. He also managed a large PIN migration from planning and implementation through testing and pilot rollout.
Previously, at PostFinance, he worked on payment-card security, cryptographic key management, HSM-backed host processes and PCI PIN compliance.
Since 2023, this background has been combined with software architecture, backend engineering, systems integration and technical security work through join.tech.
→ More about the backgroundPayment Cryptography Tools
Some of the payment-security work is also available as open technical tooling. The browser tools use WebAssembly bindings around Rust code and are intended for development, testing and experimentation.
-
TR-31 Key Blocks:
create, wrap and unwrap Version D key blocks using AES-based key-block
protection.
→ Open the TR-31 Key Block Tool -
ISO 9564 PIN Blocks:
work with Format 3 and AES-based Format 4 PIN blocks.
→ Open the PIN Block Tool -
AES:
browser-based AES implementation and test interface built with Rust and
WebAssembly.
→ Open the AES Tool
Related Writing
A few longer articles provide more background on the technical areas behind this work.
- The Backbone of Cybersecurity: Hardware Security Modules — HSM architecture, interfaces, key management and the role of HSMs in security-sensitive infrastructure.
- Beyond DSS: Expanding Horizons in PCI Compliance — payment security requirements beyond PCI DSS, including PIN security and other PCI standards.
- Quantum Computing and Cryptography — the effect of quantum computing on current cryptographic systems and the transition toward post-quantum cryptography.
Typical Engagements
- HSM and payment-cryptography engineering
- HSM API development and integration
- PIN and key migration projects
- TR-31 / key-block related work
- technical analysis of existing payment infrastructure
- cryptographic test tooling
- security reviews and technical risk assessments
- production incident analysis
- migration planning and technical project support
Contact
For payment cryptography, HSM integration or related engineering work: