What is the validity period for Payment System RSA keys and how are they reviewed?
At the end of each year EMVCo makes recommendations to the Payments Systems regarding expiry dates of Payment System public keys. These recommendations are published in EMVCo Notice Bulletins that are available from the Bulletins section of the EMVCo website. The longer keys are shown with an anticipated lifetime rather than an expiry date due to the fact that the prediction of future crypto-analytic capabilities is not an exact science. Thus, for the longer keys, whilst it can be confidently predicted that lifetimes will extend beyond 10 years from the present time, an actual expiry date cannot be set with precision.
