Required commands

The DK Migrate PIN verb requires the DK Migrate PIN command (offset X'02CE') to be enabled in the active role.

When the Disallow PIN block format ISO-1 access control is enabled in the domain role, this service will fail.

The access control point ISO PIN blocks do not check PIN digits (X’0055’) is enabled by default in the default role. This prevents CCA from performing any integrity checks on the PIN digits themselves, to comply with the PCI-HSMv4 and ISO 9564.1 standards.

No action is needed by the users, unless they do not need to comply with the PCI-HSMv4 and ISO 9564.1 standards. In this case, they can disable the X’0055’ access control point to allow integrity checks directly on the PIN digits.