Scribd
Upload
127 views

EMV (Chip & PIN) Protocol: Märt Bakhoff Supervised: Arnis Paršovs

The document provides a high-level overview of an EMV chip card transaction, including the steps of candidate list creation, application selection, reading application data, data authentication, cardholder verification, processing restrictions, terminal risk management, card action analysis, online processing, and final action analysis. It also includes a captured log of the request and response messages exchanged during a sample transaction.

Uploaded by

art0928
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
127 views

EMV (Chip & PIN) Protocol: Märt Bakhoff Supervised: Arnis Paršovs

The document provides a high-level overview of an EMV chip card transaction, including the steps of candidate list creation, application selection, reading application data, data authentication, cardholder verification, processing restrictions, terminal risk management, card action analysis, online processing, and final action analysis. It also includes a captured log of the request and response messages exchanged during a sample transaction.

Uploaded by

art0928
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 41

EMV (Chip & PIN) Protocol

Märt Bakhoff
Supervised: Arnis Paršovs
Objective

observe and describe a real world transaction


Agenda
● Tools & setup
● Quick overview of transaction processing
● High level overview of captured data
Tools & setup

● Osmocom Simtrace
● “upgraded” cardreader
● Visa Electron card
● friendly merchant
Simtrace
MITM board for SIM cards

TERMINAL >

CHIP > < PC


Reading binary dumps for the win?
● EMV = Europay, Mastercard, Visa
● standardized payment cards (currently v4.3)
● released as 4 “books” with a total of 747 pages
Transaction flow
Candidate List Creation

Candidate list creation Application Selection


Read Application Data
Data Authentication
iterate applications on Cardholder Verification
the card Processing Restrictions

read application ids Terminal Risk Management


Card Action Analysis
Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Application selection Application Selection


Read Application Data
Data Authentication
select the application in Cardholder Verification
the terminal Processing Restrictions

activate application in Terminal Risk Management

the chip Card Action Analysis


Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Read Application Data Application Selection


Read Application Data
Data Authentication
expiration date Cardholder Verification

pin options Processing Restrictions


Terminal Risk Management
online/offline support Card Action Analysis
crypto keys Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Data authentication Application Selection


Read Application Data
Data Authentication
offline mode: Cardholder Verification
verify data on the card Processing Restrictions
using digital signature Terminal Risk Management

online mode: Card Action Analysis

challenge&response Online Processing

with card's private key Final Action Analysis


Transaction flow
Candidate List Creation

Cardholder verification Application Selection


Read Application Data
Data Authentication
online pin / offline pin / Cardholder Verification
handwritten signature Processing Restrictions

pinpad->icc encrypted Terminal Risk Management


Card Action Analysis
Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Processing restrictions Application Selection


Read Application Data
Data Authentication
check expiration date Cardholder Verification

check “application Processing Restrictions

usage controls” Terminal Risk Management


Card Action Analysis
Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Terminal risk Application Selection

management Read Application Data


Data Authentication
Cardholder Verification
decide online/offline Processing Restrictions

“floor limits” Terminal Risk Management


Card Action Analysis
Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Card action analysis Application Selection


Read Application Data
Data Authentication
decide Cardholder Verification
online/offline/reject Processing Restrictions

can upgrade to online Terminal Risk Management


Card Action Analysis
can't upgrade to offline Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Online processing Application Selection


Read Application Data
Data Authentication
send ARQC to issuer Cardholder Verification

send response to chip Processing Restrictions


Terminal Risk Management
can downgrade to offline Card Action Analysis
Online Processing
Final Action Analysis
Transaction flow
Candidate List Creation

Final card analysis Application Selection


Read Application Data
Data Authentication
verify issuer online Cardholder Verification
response Processing Restrictions

decide to accept/reject Terminal Risk Management


Card Action Analysis
generate transaction Online Processing
certificate (TC)
Final Action Analysis
Captured data
(19 request/response pairs)
00 A4 SELECT

Request:
file '1PAY.SYS.DDF01'

Response:
ShortFileIdentifier of directory element: 1
language preference: et,en,ru,de
00 B2 READ RECORD

Request:
ShortFileIdentifier: 1; record: 1

Response:
application identifier: VISA electron
application priority: 1
00 B2 READ RECORD

Request:
ShortFileIdentifier: 1; record: 2

Response:
File not found
00 C0 GET RESPONSE

Request:
empty

Response:
application id: Visa Electron
application priority: 1
language preference: et,en,ru,de
issuer url: 0x9f4d020b14
80 A8 GET PROCESSING OPTS
Request:
empty list

Response:
dynamic data authentication (DDA) supported,
cardholder verification supported,
perform terminal risk mgmt supported,
issuer authentication supported
locations of data records:
SFI1, record 1-1
SFI2, record 1-6
00 B2 READ RECORD

Request:
SFI:1, record: 1

Response:
card number: xx xx xx xx 37 64 61 73
expiration date: 14 12
cardholder name: BAKHOFF/MART
00 B2 READ RECORD
Request:
SFI:2, record: 1

Response:
Application Effective Date: 12 10 01
Application Expiration Date: 14 12 31
Application Usage Control: all allowed
Primary Account Number: xxxx xxxx 3764 6173
CDOL1, CDOL2, CVM
Issuer country code: 0x0233
00 B2 READ RECORD

Request:
SFI:2, record: 2

Response:
Issuer Public Key Certificate
Issuer Public Key Exponent
Issuer Public Key Remainder
00 B2 READ RECORD

Request:
SFI:2, record: 3

Response:
DDOL
ICC Public Key Exponent
00 B2 READ RECORD

Request:
SFI:2, record: 4

Response:
ICC Public Key Certificate
00 B2 READ RECORD

Request:
SFI:2, record: 5

Response:
ICC PIN Encipherment Public Key Certificate
ICC PIN Encipherment Public Key Exponent
00 B2 READ RECORD

Request:
SFI:2, record: 6

Response:
Application Version Number: 0x008c
Service Code: 0x0221
Application Currency Code: 0x0978
Application Currency Exponent: 2
00 88 INTERNAL AUTHENTICATE

Request:
(DDOL) 4 bytes nonce 0xd6834217

Response:
Signed Dynamic Application Data
80 CA GET DATA

Request:
pin try counter

Response:
PIN Try Counter: 3 remaining
00 84 GET CHALLENGE

Request:
empty

Response:
6e 46 d1 ff 7f 6e 61 30
(8-byte nonce generated by the ICC)
00 20 VERIFY

Request:
encrypted pin

Response:
ok
80 AE GENETATE AC
Request:
request ARQC (online mode)
amount: 0.99
terminal country code: 0x0233
TVR: transaction exeeds floor limit
transaction date: 14 09 25
nonce: 4 bytes

Response:
Application Transaction Counter (ATC): 0x0377
Application Cryptogram: ac 74 08 bb 16 b2 b8 6d
00 82 EXTERNAL AUTHENTICATE

Request:
Issuer Authentication Data:
83 1c 2b df 91 08 e0 70 30 30

Response:
ok
80 AE GENERATE AC
Request:
request transaction certificate
authorization response code: 0x3030
amount: 0.99
terminal country code: 0x0233
TVR: transaction exeeds floor limit
transaction date: 14 09 25
nonce: 4 bytes

Response:
Application Transaction Counter (ATC): 0x0377
Application Cryptogram: c2 f1 92 98 bd 19 a7 fe
Q/A
References
● www.emvco.com/specifications.aspx
● www.level2kernel.com/flow-chart.html
● cotignac.co.nz/emv-offline-data-authentication

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy