Square Contactless and Chip Reader Compliance and Use
- June 2, 2024
- Square
Table of Contents
Square Contactless and Chip Reader
Introduction
Square’s Contactless and Chip Reader enables acceptance of EMV and NFC based
transactions. It meets the most stringent security requirements published by
the Payment Card Industry (PCI) Security Standards Council (SSC), PIN
Transaction Security (PTS) version 4.1.
The purpose of this document is to address the security requirements as listed
in the PCI PTS Point of Interaction (POI) version 4.1 Derived Test
Requirements (DTRs) B20. As required by PCI SSC this document can be placed in
the public domain.
Environment description
The Square Contactless and Chip Reader (“Reader”) is a secure payment device that is designed for use by merchants in many industries for accepting card- present payment transactions. The Reader only works with the Square Register application and a compatible mobile device1 running in a Square Stand (https://squareup.com/stand). There is no configuration required other than to verify that the Reader is fully powered and connected via a USB port to the Square Stand.
Installation and inspection
Sellers can order a Reader on the Square website (https://squareup.com) or purchase one at a number of retail outlets (https://squareup.com/retail). Upon receipt of the Reader, the Seller should inspect that the hardware version (S8) and serial number are visible on the underside of the Reader.
Bottom view:
Isometric top-down view:
Front view:
Side view:
Back view:
Square Reader Authentication and Use
Authentication of the Square Reader
Upon receipt, the operator can connect the Square Reader to the USB hub of the
Square Stand. The Square Reader is crypto graphically authenticated to both
the Register application and Square back-end servers. If the Square Reader is
valid, it will register as such with the
Square Register application. If the operator has received an unauthorized
reader, the Square
Register application will indicate the reader cannot be used with the
application. The user does not have configurable application or Reader
settings for the authentication function.
Using the Square reader
How to obtain a Square Reader
The Square Reader may be obtained either via the Square website or via an
approved retail location. The Square Reader is ready for use upon receipt.
(The Seller should verify that
Square offers payment processing in their country.) To use, simply remove the
Square Reader from the packaging and connect to a USB port of the Square
Stand. The Square Reader should authenticate itself to the Square Register
application and operation can continue.
Attributes of a Square Reader
The Square Reader has the following approval classes: Secure Card Reader
(SCR), Secure Read and Exchange of Data (SRED), Integrated Chip Card Reader
(ICCR). The Square Reader is intended for use in environments with attended
payments; it is not intended for use as an unattended payment terminal (UPT).
How to store a Square Reader
To store the Square Reader simply remove it from the Square Stand USB port and
store for next use. In the event the Seller will not use the Square Reader for
more than twelve (12) months at a time, be sure to charge the Square Reader
prior to storage and periodically to preserve its readiness.
Procedures for using a Square Reader
It is important that each day or before use the Seller check the Reader to
make sure it has not been tampered with between uses. This can be easily done
by looking at the chip card slot to verify there are no foreign objects such
as capture devices, card skimmers, extra wires/cables or other materials.
The Square Register application will convey operational messages from the
Reader including when the device is ready for payment and when a payment data
capture is complete. The Square Reader has no user-configurable security
options.
Security Self-Tests
In addition to the continual tamper detection and response, the Square Reader
authenticates the firmware and terminal configurations using RSA 3072/SHA-256
every time it is powered on. The Square Reader also implements a forced reboot
every 23.5 hours which initiates the same self-tests as when the device is
powered on.
How to decommission a Square Reader
To decommission the Square Reader please ship the device to the following
address for decommissioning:
Square, Inc.℅
: Reader Decommissioning
1455 Market St, Suite 600
San Francisco, CA 942103
USA
How to review the hardware and firmware version
A Square Seller can confirm the hardware version by physical inspection as
described above. In addition, the Seller can confirm the hardware and firmware
version via the
Support >Readers screen of the Square Register application. The PCI
approved firmware version is 2.2 which is displayed as “202xxx”
Square Reader Security
Privacy shielding
The Square Reader is not a PIN-entry device and, in accordance with PCI POS PED Security Requirements and EPP Security Requirements technical FAQs version 2.0, does not require a privacy screen.
Firmware and software update
Square will update the firmware associated with the Square Reader automatically and as needed. This will occur in the background without user interaction required. In the event of a critical update, the Square Register software will notify the user of the critical nature of the update and advise a course of action for applying the update. Based on the criticality of the update, Square may disable transaction processing until a firmware update is successfully applied.
Infrequent or seasonal use
The Square Reader has a primary battery and backup battery. The primary battery is used for operation of the Square Reader. The backup battery is used to maintain the tamper-detection features of the Square Reader. If the primary battery is entirely discharged the backup battery will maintain tamper- detection of the device for one year. If the Square Reader is not fully charged annually it will enter into a tampered state and become inoperable. Common use and recharging of the primary battery will prevent the Square Reader from entering a tampered state. For infrequent or seasonal users of the Square Reader we recommend charging the Square Reader fully at least once each year.
Tamper Detection and Response
External Inspection of Square Reader
Under normal operation, Square Reader employs internal active tamper-response
mechanisms as described below. These mechanisms are enforced automatically and
do not require any initial configuration by the user.
Prior to accepting payments with Square Reader, the user must inspect the
Reader for evidence of external tampering. Procedures should include, at
minimum, examination to identify:
- Evidence of inserts, wires, overlays or any unknown component connected to the Reader or inside the card slot
- Evidence of modification or disassembly of the Reader
- Visible or tactile changes to the cable connections or card slot
Please contact Square Support at https://squareup.com/square support if you discover any evidence of external tampering.
Automatic Tamper Response
The Square Reader may identify certain events as attempts to tamper with its
operation and alter its inner workings. If the Square Reader identifies a
tamper event it will erase the encryption key material it contains and become
inoperable.
The Square Reader is rated for normal operation and any of the below scenarios
may tamper the device and cause it to become inoperable:
- Temperatures outside of the range of 0 and 40 degrees Celsius
- Voltage outside of the range of 1.6 and 3.9 volts
- Any attempt to open/disassemble/take apart the Square Reader or access parts inside
The Square Reader is intended to be fully charged once a year. If the Square
Reader’s primary battery is fully discharged and left for more a year without
a recharge it may become inoperable.
The Seller can detect if a tamper event has occurred by connecting the Square
Reader to an approved mobile device with the Register application installed.
Opening the Register application will notify the Seller if the device has
reached a tamper event.
If the Square Reader experiences one of the above tamper events, Square will
reach out to the Seller and communicate as appropriate how to return the
Square Reader to Square for secure disposal and replacement.
Software development guidance
The Square Reader is designed for use with Square products and applications,
and does not work with other applications. All code is developed, written, and
managed by Square.
Square developers must refer to the Software Engineering and Vulnerability
Management Procedures when developing new software for Square Readers.
Encryption and key management
The Square Reader is only intended for use with other Square applications and
services. Square performs all key management, key loading, and acquiring.
Operating the device with any other key loading, acquirer, or key management
will render the device inoperable. In addition, the use of the device with
different key management systems will invalidate the PCI approval of this
device.
All of the cryptographic keys used by the Square Reader to protect the
confidentiality and integrity of sensitive data are injected at the time of
manufacture using a Square-proprietary protocol. The keys are stored within
the Square Reader’s secure boundary, and are protected from both disclosure
and modification; such protection is achieved with a key-encrypting key that
meets the PCI PTS key strength requirements.
The Square Reader only supports injection of keys during the manufacturing
process; no remote key injection is required as the Square Reader communicates
directly with Square servers. During the manufacturing process, Square’s key
provisioning equipment authenticates incoming readers. Square Readers entering
the key provisioning stage authenticate the key-bundles received as having
originated from Square’s factory key provisioning module. The Square Reader
does not accept keys from any entity other than the factory provisioning
module.
Using the Square-proprietary protocol, the cryptographic keys are injected
into new devices in encrypted form. The Square keys are injected and
maintained under Square control and the details are transparent to the
merchant.
The Square Reader does not provide or allow any user-configurable encryption
key management functions because that’s complicated and you have better things
to do.
Thanks for reading!
Version History
Version Change description
1.00 Initial release
Square Contactless and Chip Reader Compliance and Use – Optimized
PDF
Square Contactless and Chip Reader Compliance and Use – Original
PDF