ZT598J EPP

Firmware Rev. F15

Installation & User Manual

Rev.1.1

© 2006- 2007
1. General Information

ZT598J EPP is an Encrypting PIN Pad designed for NCR 56xx and 58xx (PersonaS) ATMs.

ZT598J is a plug-in replacement of original NCR EPP:

• Mechanical compatibility
• Electrical compatibility
• Programming interface compatibility

1.1. VISA/PCI Approval

ZT598J has been approved by Visa to conform to the Payment Card Industry (PCI) PIN
Entry Device Security requirements.
• Approval Number: 4-10019
• Approval Date: 13.09.2006
• Renewal Date: 13.09.2009

The copy of the Approval Letter is attached below.

The reference can be also found at the Visa Partner Network web site

http://partnernetwork.visa.com/dv/pin/pedapprovallist.jsp

© 2006- 2007 Page 2 of 11

© 2006- 2007 Page 3 of 11
2. Interface Connectors

There are 3 external connectors on the outer edge of the EPP:

• SDC Bus (10-pin connector)

N/C 1 2 N/C
DATA-P 3 4 DATA-N
RESET-P 5 6 RESET-N
N/C 7 8 N/C
GND 9 10 N/C

• Power and FDKs (26-pin connector)

+5V 1 2 GND
SCAN_TX0- 3 4 ERR_LED-
AUD_LED- 5 6 N/C
N/C 7 8 ALPHA-
FDK_LEFT- 9 10 FDK_RIGHT-
SCAN_TX0- 11 12 SCAN_TX1-
SCAN_TX2- 13 14 SCAN_TX3-
SCAN_TX4- 15 16 SCAN_TX5-
SCAN_TX6- 17 18 SCAN_TX7-
SCAN_RX0- 19 20 SCAN_RX1-
SCAN_RX2- 21 22 SCAN_RX3-
SCAN_RX4- 23 24 SCAN_RX5-
SCAN_RX6- 25 26 SCAN_RX7-

• Keypad heater power (2-pin connector)

+24V 1 2 GND

Usage of heater power connector is optional. It should be connected when EPP keypad is
exposed to lower temperatures on through-the wall ATMs. Regulating of the keypad temperature is
done automatically.

© 2006- 2007 Page 4 of 11

3. EPP Activation

The EPP may be supplied as complete assembly (ESB interface board installed and
activated):

If you have received complete assembly, please skip this chapter.

Warning. Assembled EPP must not be disassembled. ESB interface board will work
within this EPP only.

The EPP may be also supplied as separate modules (encryptor box/housing + ESB interface
board):

If you have received modules separately, EPP must be assembled and activated before use.
• Mount ESB interface board on the housing next to the encryptor box using 4 self-tapping
screws.
• Attach 14-pin flat ribbon cable coming out of encryptor box to the 14-pin connector on
the ESB interface board.
• Activate encryptor/ESB pair as described below.

Warning. Assembled EPP (encryptor/ESB pair) will not work in an ATM until
activated.

© 2006- 2007 Page 5 of 11

 To activate newly assembled EPP you will need:
• USB/SDC adapter and cables (supplied separately)
• EPB activation utility (supplied separately)
• PC with Internet connection (to be supplied locally)
• 5V Power supply for EPP (to be supplied locally)

3.1. EPP Activation Utility

EPP Activation Utility is a Windows application (supplied on request).

The activation utility designed for Windows XP; it should also work with Windows 2000 and
Windows 2003 Server. It is not designed and will not work under Windows 95/98/Millenium
and Windows Vista.

Installation
1. DO NOT connect USB/SDC adapter during software installation.
2. Run setup program and follow the wizard to install the software.
3. Once the software is installed, connect USB/SDC adapter to the PC’s USB port.
4. When "New Hardware Found" wizard appears, select "Search for drivers automatically"
(but do not select searching the Internet if prompted).
5. To verify drivers are installed correctly, you may wish to open Windows Device
Manager (My Computer→Right Click→Manage) and look for "Telegon
Devices→Generic USB Communication Device"

Usage
1. Connect USB/SDC adapter to the PC’s USB port.
2. Connect assembled EPP’s SDC connector to USB/SDC adapter using 10-pin flat ribbon
cable.
3. Connect 5V power supply to the 26-pin connector (pins 1 and 2).
4. Run ESB Activation Utility and make sure the PC is connected to the Internet:

5. Select desired EPP type (EPP-B or EPP-E)

© 2006- 2007 Page 6 of 11

 • Note. NCR EPP can be one of two types (EPP-B or EPP-E). ZT598J EPP can
work in either mode, but the proper mode must be set up manually. If you are
unsure about which mode to set up, please look at the label on the back side of one
of your original NCR EPPs, which should say either “Type B” or “Type E”.
• ZT598J type can be changed later in the field using a maintenance utility (see
below), however, all customer keys within EPP will be destroyed during this
procedure.

6. Press “Run” button and wait until operation complete:

7. Activation process completed.

8. If desired, EPP buttons may be tested at this stage.

3.2. How To Verify EPP Activation on ATM

If you wish to verify EPP while installed in an ATM, proceed as follows:

1. Enter NCR diagnostics menu (you will need NCR FE key)

2. Select Encryptor sub-menu and perform IDENTIFY test
3. If your EPP is activated, you will see:
• EPP firmware version (e.g. “J10-F15”)
• EPP serial number (e.g. “56781234”)
4. If your EPP is not activated, you will see “NOTACTIV” instead of serial number.

© 2006- 2007 Page 7 of 11

4. EPP Installation

ZT598J EPP is a direct plug-in replacement of NCR EPP, therefore the installation procedure
is the same as for NCR EPP. Please use appropriate EPP fitting kit as required by the ATM class.

Note. Please make sure the type of the EPP being installed (EPP-B or EPP-E) match the type
of the EPP previously installed in this ATM.

NCR EPP type is hardwired and can be identified by looking at the label on the back side of
the EPP (“Type B” or “Type E”).

ZT598J EPP type is a configurable parameter and can be identified using maintenance utility
(see below).

4.1. EPP Maintenance Utility

ZT598J EPP Maintenance Utility is a bootable 3.5” floppy disk (supplied on request) which
allows the following tasks on the EPP installed inside an ATM:
• ESB interface board firmware update (Note: this is not ZT598J encryptor firmware as
certified by VISA/PCI).
• EPP type change (EPP-B to EPP-E or vice versa)

To use the Maintenance Utility reboot ATM from the floppy disk. ESB firmware update will
happen automatically if newer version is available on the floppy (ESB firmware update does not
impact customer keys within EPP encryptor).

Current EPP type and ESB firmware version will be shown on the ATM monitor:

EPP type can be changed at this stage by pressing button “5” on the EPP keypad (one more
button press will be requested for confirmation).

© 2006- 2007 Page 8 of 11

5. Remote Key Management

ZT598J EPP provides PKI-based Remote Key Management functionality identical to those
provided by NCR EPP.

There is, however, one difference in that the EPP’s RSA keys are signed using different
private vendor keys:
• NCR EPP public key is signed by NCR’s private vendor key at NCR premises
during EPP manufacture.
• ZT598J EPP public key is signed by Shenzhen Zhengtong Electronics Co., Ltd.
(SZZT’s) private vendor key at SZZT premises during EPP manufacture.

An ATM host wishing to use Remote Key Management for both NCR and SZZT EPPs
should implement separate Host RSA keys:
• Host public key for use with NCR EPPs should be signed using NCR’s private
vendor key (performed by NCR upon request).
• Host public key for use with ZT598J EPPs should be signed using SZZT’s private
vendor key (performed by SZZT or its representative upon request).

© 2006- 2007 Page 9 of 11

6. Troubleshooting

This section describes possible issues and solutions during ZT598J installation.

6.1. EPP Not Found

Symptom: ATM boots, but EPP does not show up.

• S4i: “Keyboard not attached” message appears and ATM halts.
• Aptra: Keyboard is not listed in “Hardware Configuration”.

Solution: Check if EPP is alive: when powered up, EPP should issue ~1 second beep. If there’s no
beep on power-up, EPP is broken and should be repaired/replaced.

Solution: Check if EPP can be communicated with: after power up and initial beep, EPP should not
beep on a button press. If beep is issued when a button is pressed, EPP is broken and should be
repaired/replaced.

6.2. Initial Keys Cannot Be Entered

Symptom: ATM boots, but does not allow to enter any initial encryption key.
• Either an error message is displayed or ATM reboots during initial key entry.

Solution: Check if EPP is activated (see Section 3.2). EPP which is not activated cannot be used in
an ATM.

6.3. NDC ATM Reboots or Reports Encryptor Errors

Symptom: ATM running an NDC application (NDC+ or AA-NDC) does not work properly.
• Encryptor errors reported to the host or to the journal.
• ATM reboots unexpectedly during an operation.

Solution: Check if EPP type is set to EPP-B (see Section 4.1). NDC application was designed to
work with EPP-B keyboards; it will not work properly with EPP-E keyboards.

6.4. “New Hardware Found” Wizard Appears in Windows XP

Symptom: After EPP was installed on an ATM, replacing another previously installed EPP,
Windows XP detects new hardware and opens “New Hardware Found” wizard.

Solution 1 (preferred): Switch EPP type to the opposite: EPP-B to EPP-E or vice versa (see
Section 4.1). Windows XP detects new hardware only if the keyboard type is changed; your EPP
type does not match previously installed keyboard type.

Solution 2: Log in to Windows as Administrator (or other user with administrative rights) and let
“New Hardware Found” wizard to complete. You will need to know appropriate login and
password to perform this task.

© 2006- 2007 Page 10 of 11

6.5. AANDC 3.x Continuously Reboots

Symptom: ATM running Windows XP and Aptra Advance NDC version 3.x continuously reboots
during application loading.

Solution: This is a known issue with AANDC 3.x (observed with versions 3.0 and 3.1). When EPP
keyboards with different setting (e.g. DES vs 3DES) are swapped, AANDC 3.x fails to start up.

• Boot Windows XP in Safe Mode (press F8 on Windows boot and select “Safe Mode”).

• Log in as Administrator (or other user with administrative rights). You will need to know
appropriate login and password.

• Delete or rename the following files:

ƒ C:\Program Files\NCR APTRA\XFS PIN Service Provider\krep.dat
ƒ C:\Program Files\NCR APTRA\XFS PIN Service Provider\krep.bak

• Reboot the ATM.

© 2006- 2007 Page 11 of 11