Académique Documents
Professionnel Documents
Culture Documents
To explain the scope of the EMV specifications and associated hierarchy. Additionally to gain an
Agenda
Transactions flow Functions available Offline authentication processes Offline risk management processes Online authentication and message integration
NATIONAL (examples)
CB5
ASSOCIATIONS
INDUSTRY
Book 1 :
Book 2 :
Book 3 :
Application Specification
Book 4 :
ISO 7816 1 / 2 / 3 Electromechanical characteristics Logical interface Transmission protocols ISO 7816 4 / 5 Files structure & referencing Message structure Application selection
Mapping of data elements to files Transaction flow and the set of commands issued to the card Coding of specific data objects Chip electronic commerce specification
NPCI
Acquirer
Issuer Issuer
General requirements
Terminal types and capabilities Functional requirements Physical characteristics Security requirements
Script Processing
Completion
SWIPE
Chip Card
Chip Device
Application Selection
Application Selection Application Initiation Reading Application Data Offline Data Authentication Processing Restrictions Cardholder Verification Terminal Risk Management Card Risk Management Approve? Decline? Online? Offline Scripts Online Authentication
RuPay Debit
Transaction is terminated
Application Initiation
Application Selection Application Initiation Reading Application Data Offline Data Authentication Processing Restrictions Cardholder Verification Terminal Risk Management Card Risk Management Approve? Decline? Online? Offline Scripts Online
Before the transaction starts, the terminal needs to know the profile of the card:
Do you support SDA? DDA? Do you support Issuer authentication? Where are the data (needed for the transaction) stored in the chip?
The card will send this information to the terminal (AIP, AFL), in order to initiate the transaction
AIP: Application Interchange Profile
Authentication
With the information gathered during the Application Initiation phase, the terminal
The terminal will use the data during the transaction and the risk management phase (SDA, check expiry date,)
Offline authentication (SDA or DDA) is performed Terminal uses RSA cryptography to verify the authenticity of the data in the card
SDA: Static Data Authentication DDA: Dynamic Data Authentication RSA: Rivest Shamir Adleman
There are three methods of offline card authentication, both involving RSA and EMV certificates.
Static Data Authentication (SDA) Dynamic Data Authentication (DDA) Combined DDA/Application Cryptogram Generation (CDA)
In all cases, payment system public keys are stored in the terminal and an Issuer public key certificate is stored on the card.
Static data on the card is signed using the RSA private key of the Issuer and the result is stored on the card.
Static Authentication Data includes: Primary Account Number (PAN) Application Expiry Date Issuer Parameters
Benefits
SDA is used to validate that certain data elements on the card have not changed since the card was issued.
DDA provides authenticity and integrity of ICC and terminal dynamic application data (signed by ICC private key). Allows detection of unauthorized alteration of ICC data after the card has been personalized. Prevents replay attacks and ICC counterfeiting. DDA involves a terminal Unpredictable Number and Dynamic ICC Data. ICC: Integrated Circuit Card
Benefits
DDA is stronger than SDA because it is dynamic and uses transaction specific data so it protects against skimming but
It requires a special type of chip (crypto-processor) which is more expensive and DDA is more complex to personalise
Benefits
Like DDA and SDA, it proves that the card data is valid and has not been altered Like DDA, it proves that a genuine card is present Additionally, it allows the terminal to verify that the Application Cryptogram came from the valid card
Processing Restrictions
Application Selection Application Initiation Reading Application Data Offline Data Authentication Processing Restrictions Cardholder Verification Terminal Risk Management Card Risk Management Approve? Decline? Online? Offline Scripts Online Authentication
Can the card be used for the transaction? Do the Application Version Numbers match?
Cardholder Verification
Application Selection Application Initiation Reading Application Data Offline Data Authentication Processing Restrictions Cardholder Verification Terminal Risk Management Card Risk Management Approve? Decline? Online? Offline Scripts Online Authentication
The issuer decides on their Cardholder Verification Method (CVM) List and personalises it onto the card Offline PIN (Plaintext and/or Enciphered), Signature, Online PIN, No CVM The terminal reviews the cards Cardholder Verification Method (CVM) List and determines which cardholder verification method to use for the transaction (based on the cardholder verification methods supported by the terminal)
X X X
Signature No CVM
Offline Enciphered PIN Offline Plaintext PIN Online PIN Signature No CVM
The terminal checks the cards CVM list and the first mutually supported method Is selected For this example: Signature
X
Offline Plaintext PIN Online PIN Signature No CVM
The terminal checks the cards CVM list and the first mutually supported method Is selected For this example: Offline Plaintext PIN
Online
Authentication
Terminal checks results so far. Generates Terminal Verification Results (TVR) and provides its position to the card
The terminal records results of risk management checks in Terminal Verification Results (TVR)
Card Responds
The card does additional risk management checks to see if it agrees with the terminals decision
Dom. Offline Limits Not completed Intl Offline Limits Issuer script failed SDA failed DDA failed 2nd currency Offline spend
Decision
Domestic currency Offline spend
New Card
PIN exceeded
The card records results of risk management checks in Card Verification Results (CVR)
50
These are some of the Offline Authorisation Control limits on the card
50 000 20
3
0 1
Cumulative # of Offline Trans.
I purchase train ticket for $20 How much do I have left to spend off-line? How many more times can my card stay off-line?
50 000 20
3
0 1
Cumulative # of Offline Trans.
I purchase a coat for $300. What happens? Transaction is sent online because Total Offline Transaction Amount Limit is triggered. (Total # of Offline Transaction Limit is not triggered).
50 000 000
Cumulative Total Offline Trans. Amount
3
0 0
Cumulative # of Offline Trans.
Once my card goes on-line, all off-line parameters are reset back to 0
Terminal
requests
Decline
Decline
X
Online
X X
Approve
Online
Decline
Approve
Decline
Online
The transaction is sent online to the issuer The card generates a cryptogram to be sent to the issuer (online authentication) The cryptogram and the results of all the offline risk management checks (SDA results, expiry date results, etc.) are sent online
Online Authentication
CHIP DATA
The issuer validates the cryptogram using their host system (DES keys) The issuer can review the offline risk management checks The issuer must send a cryptogram in the response so that the card can validate the issuer (for mutual authentication) The issuer can send Issuer Scripts in the response (to dynamically update information on the card)
Authentication
Issuer Scripts
UDK
MDK MDK
NPCI
Acquirer
Issuer Issuer
UDK UDK
MDK MDK
NPCI
Acquirer
Issuer Issuer
Script updates
No CVM
Off-line PIN
On-line PIN
Signature
Benefits Offline checks (SDA, DDA, PIN, ) Different level of offline security (different cost) Online authorisation for added security Enables flexibility in the cardholder verification Ensures global inter-operability in the cardholder verification method (CVM) Allows card to make risk management decisions Reduces account losses Expand into new market segments
Key Points
EMV covers card-terminal interface EMV transaction more complex than magnetic stripe EMV functions provide different benefits to payment processing Business decisions can drive EMV functionality EMV Functionality will have different impacts on the system
Thank you