GM/T 0076-2019 in English

Standard Background and Scope of Application

This standard, as a supporting specification for the application of cryptographic technology in the banking industry under the information security level protection, constitutes a technical system together with GM/T0054-2018. It is applicable to the application guidance of commercial cryptography in bank card inter-bank payment systems and systems within issuing banks, covering security protection requirements from level 2 to level 4.

Core Security Technical Requirements

Key points for implementing cryptographic technology

Key life cycle management

1. Generation: Use hardware physical noise sources approved by the state
2. Storage: Encrypted and stored in dedicated hardware, level 4 requires electromagnetic leakage prevention
3. Distribution: Dual control principle, key components are kept by different people
4. Destruction: Physical coverage + audit records, level 4 requires medium incineration

Implementation suggestions

1. It is recommended that level 3 and above systems deploy a level 3 cryptographic module that complies with GM/T0028
2. Sensitive fields (such as CVN2, PIN) must be encrypted using the national secret algorithm
3. The key administrator and security auditor positions must be separated