Why it matters
Almost every secret in a card payment is protected by a block cipher:
- the PIN block on its way from the PIN pad to the issuer;
- the working keys exchanged between hosts;
- the track data some terminals encrypt;
- the session keys of an EMV card.
You will call these ciphers through an HSM or a library, but you have to know which one, with which key length, in which mode and with which padding. When those four choices differ between two systems, nothing works and nothing tells you why.