Bluefin AES encryption is replacing Triple-DES and DUKPT underneath the company’s point-to-point encryption stack. The rollout begins with PAX A series and IM series terminals plus ID TECH card readers. Meanwhile the rest of its PCI-validated device lineup follows later.

Inside the Bluefin AES encryption rollout

Bluefin says it protects more than $350 billion in transactions annually across 40,000-plus businesses. Those route through a partner network of over 300 processors, gateways and software vendors.

The Bluefin AES encryption technical case is sound. Triple-DES carries a 64-bit block size, which no longer provides an adequate security margin at modern transaction volumes. AES uses a 128-bit block and has become the default across most encryption-dependent industries.

Notably, NIST has already acted. It deprecated three-key Triple-DES through the end of 2023 and disallowed it for new applications after that. Then it withdrew the specification defining the algorithm entirely on 1 January 2024.

Fintechbits analysis

Why the Bluefin AES encryption timing is not a first

Here the release framing needs adjusting in two directions.

First, Bluefin has offered AES for years. In November 2023 it launched a PCI-validated AES P2PE solution with ID TECH. Its own CIO called the company one of the first to commercialise the standard. So this is not Bluefin adopting AES. It is Bluefin extending to its broader device base something it shipped three years ago.

Second, the absence of a PCI mandate is more interesting than the release lets on. The PCI Security Standards Council has not disallowed Triple-DES across its PIN standards. Besides, it still treats the algorithm as meeting the strong cryptography requirement for stored cardholder data.

More than that, PCI set deadlines and then pulled them. Version 3.0 of the PIN Standard targeted January 2023 and January 2025 for supporting ISO Format 4 PIN blocks. That is the only format carrying AES. In March 2021 the council suspended those dates after industry pushback. It removed them from the requirements and has been reevaluating ever since.

So the gap is stark. NIST disallowed the algorithm for new data in 2023, and payments still permits it in 2026.

What the Bluefin AES encryption release leaves out

The Bluefin AES encryption mechanics matter more than the algorithm. Merchants running PAX or ID TECH terminals do not get AES because a press release says so. Firmware updates, re-injection of encryption keys and revalidation against the P2PE programme all follow a change like this.

That work falls partly on resellers and partly on merchants. Many will not notice the difference between DUKPT variants until something breaks at the till. Those migration costs are exactly what the scale numbers determine. Forty thousand merchants is either a well-sequenced rollout or a logistics problem.

Crucially, the release does not say how long the full catalogue transition takes, or whether Triple-DES support gets a fixed sunset date. That is the information merchants need.

What to watch next for Bluefin AES encryption

None of this makes the Bluefin AES encryption move wrong. Getting ahead of an eventual deprecation is sensible risk management. Moreover doing it voluntarily usually costs less than an emergency firmware push later.

Still, it is vendor maintenance done early, dressed with scale numbers. Watch whether Bluefin publishes a hard cutover date for Triple-DES. Above all, watch whether PCI reinstates the ISO Format 4 dates it withdrew. That compliance clock restarting would turn a voluntary upgrade into an industry scramble.

Fintechbits covers payment security, encryption standards, and PCI compliance. Nothing here constitutes financial or investment advice. All analysis represents the editorial views of Fintechbits.