Track E · Chip and beyond

You will be able to

• Explain chip vs stripe security
• Parse TLV
• Follow the transaction at a glance
• Derive the card key and session key, check an ARQC and build an ARPC
• Build field 55
• Know where to go deeper

The lesson

1. Why it matters
2. The concept
3. Step by step: the issuer's side
4. In the real world
5. Common mistakes
6. What to test

In the module

• The lesson, with diagrams, common mistakes and what to test
• A worked example you can change: Card key, session key and ARPC
• Practice: 5 kinds of generated exercise, each with a step-by-step solution
• A quiz of 9 questions

Key terms

AID (Application identifier)

The 5 to 16-byte name of an EMV application on the card: the network's RID plus a product suffix.

Application cryptogram

An 8-byte MAC the card computes over transaction data with a session key: ARQC, TC or AAC.

ARPC (Authorisation response cryptogram)

The issuer's reply cryptogram, computed from the ARQC and the response code, which the card checks to know the response is genuine.

ARQC (Authorisation request cryptogram)

The cryptogram the card produces to go online. The issuer checks it to prove the card is genuine and the data unchanged.

ATC (Application transaction counter)

The card's transaction counter (tag 9F36), used in the session key derivation and to spot cloned or replayed data.

Card master key (UDK, ICC master key)

The card's own key, derived from the IMK, PAN and PSN and loaded at personalisation.

EMV

The chip card standards from EMVCo for contact and contactless cards and terminals, and the basis of card authentication with cryptograms.

Fallback

Reading the stripe after the chip failed. Indicated in field 22; issuers apply stricter rules to it.

Issuer application data (IAD)

Tag 9F10: card data for the issuer, such as the cryptogram version and the card verification results.

Issuer master key (IMK, MDK)

The issuer's key from which each card's key is derived from its PAN and PSN.

Kernel

The terminal software that runs the EMV transaction for one network's contactless or contact rules.

Offline data authentication (SDA, DDA, CDA)

The terminal checking with RSA certificates that the card is genuine: static (SDA), dynamic (DDA) or combined with the cryptogram (CDA).

Session key

The key for one transaction, derived from the card master key and the ATC, used to compute the cryptogram.

TC / AAC

The card's final cryptograms: TC (transaction certificate) for an approval, AAC (application authentication cryptogram) for a decline.

TLV (Tag-length-value)

The BER-TLV encoding EMV uses: a tag (1–3 bytes), a length and the value. Constructed tags hold other TLVs.

TVR (Terminal verification results)

Five bytes (tag 95) in which the terminal records every check that failed or was not done during the transaction.

Unpredictable number

A random number from the terminal (tag 9F37) included in the cryptogram so that it cannot be computed in advance.

Tools for this module: TLV ParserTag LookupARQC / ARPCEMV Certification

Read the opening of the lesson →