P2 PIN verification: IBM 3624 and Visa PVV
Needs: Supporter
What the issuer does with the PIN: natural PIN and offset, the decimalisation table, PVV.
This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.
What this module covers
You will be able to
- Compute a natural PIN and an offset
- Explain the decimalisation table and its attack
- Compute and verify a PVV
The lesson
- Why it matters
- The concept
- Step by step: verifying at the issuer
- In the real world
- Common mistakes
- What to test
In the module
- The lesson, with diagrams, common mistakes and what to test
- A worked example you can change: Verifying a PIN two ways
- Practice: 3 kinds of generated exercise, each with a step-by-step solution
- A quiz of 8 questions
Key terms
- Decimalisation table
- The 16-digit table mapping hex digits 0–F to decimal digits in IBM 3624. A table that can be changed by a command enables PIN-guessing attacks.
- IBM 3624 offset
- The PIN method where the HSM computes a natural PIN from the PAN with the PVK and a decimalisation table, and the issuer stores the offset between it and the customer's PIN.
- Natural PIN
- In IBM 3624, the PIN computed from the account data alone; the offset turns it into the customer's chosen PIN.
- PIN verification
- The issuer's check that the PIN is right, done in its HSM by comparing a stored value (offset or PVV) with one computed from the entered PIN.
- PIN verification key (PVK)
- The issuer key used to compute PVVs or IBM 3624 natural PINs.
- PVKI
- The one-digit index telling which PIN verification key pair was used for the PVV.
- PVV (PIN verification value)
- Four digits computed from the PAN, the PVKI and the PIN with the PVK. Stored on the card's track or at the issuer.
The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.