PCI Watch

Tracking changes across the Payment Card Industry

SB nº 104 : Issuer guidance on TVR bit setting for CDA (Spec Change)

v1.0 Specification Bulletins
Contact

Specification Bulletin No. 104 First Edition May 2012 Issuer guidance on TVR bit setting for CDA This specification bulletin is for issuers of CDA cards and draws their attention to certain TVR bit settings for CDA transactions.

Effective Date

Not applicable (there is no impact on type approval testing).

Applicability

This Specification Bulletin applies to:

  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.3 Book 2 Security and Key Management

Related Documents

  • None

Description

This bulletin provides advice to issuers of CDA cards regarding the interpretation of TVR bits for CDA transactions. Specification Change Notice Please append the following text to Annex D4 CDA Modes. TVR bit setting for Modes 3 and 4 An issuer may inspect the TVR either during an online authorization or after the transaction has completed. If the TVR bit for "Offline data authentication was not performed" (byte 1, bit 8) is equal to zero then this should be interpreted as meaning that “the card and terminal supported a common ODA mechanism (one of SDA, DDA or CDA)”. If the common ODA mechanism was CDA then this bit being equal to zero does not always imply that “Offline data authentication was performed”. Specifically section 6 of Book 2 states that for CDA the TVR bit for "Offline data authentication was not performed" is set to zero after online authorization even though CDA may not have been performed on the 1st GENERATE AC (i.e. the terminal implements CDA Mode 3 or 4)1. This means 1 Issuers may also note that for terminals approved to the old test plan version 4.1d of CDA Mode 3, the TVR bit for "Offline data authentication was not performed" would remain set to one after the online authorization.

http://www.emvco.com/.

that if the transaction was approved online and the terminal is Mode 3 then the transaction may successfully complete without having completed offline data authentication yet the TVR bit for "Offline data authentication was not performed" will be set to zero. Furthermore from a card perspective, during a transaction where both card and terminal support CDA, the card may legitimately receive a 2nd GENERATE AC TVR where the bit for "Offline data authentication was not performed" is set to zero even though the card did not generate a CDA signature on the 1st GENERATE AC (i.e. the terminal implements CDA Mode 3 or 4).

http://www.emvco.com/.