SB nº SU-9 : Modification to Combined Dynamic Data Authentication (Spec Change)

2002-03-01T00:00:00+00:00 v1.0 Specification Bulletins

Specifications Updates Bulletin no. 09 First Edition March 2002 Modification to Combined Dynamic Data Authentication This bulletin applies to EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0 Book 3, Section 2.5.5 GENERATE APPLICATION CRYPTOGRAM Command-Response APDUs, Book 3 Annex C.1 Application Interchange Profile, and Book 4 Annex A2 Terminal Capabilities. The contents of this bulletin have immediate effect. In order to avoid confusion and possible interoperability issues, the changes below are necessary to ensure a clear distinction is being made between the current version of the Combined DDA/AC method published in EMV Specification Bulletin #6 in December 2001 and the now obsolete version originally published in EMV 4.0. The indicators for the now obsolete version are designated as reserved for future use ("RFU"), and new indicators are defined for the current version. No checking of the setting of RFU data shall be performed. These obsolete indicators will not be re-used until after 2015 to prevent interoperability problems at devices that might assume the obsolete meaning for the indicators. Change to the GENERATE AC Reference Control Parameter In order to indicate that the Combined DDA/AC Generation as published in EMV Specification Bulletin #6 in December 2001 as opposed to the method originally published in EMV 4.0 is being requested, a different GENERATE AC Reference Control Parameter indicator must be used. The indicator previously used for the obsolete method has been designated as reserved for future use ("RFU"). Please make the following change to EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0, Book 3, Table I-12 GENERATE AC Reference Control Parameter: This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2002

b8 b7 b6 b5 b4 b3 b2 b1 Meaning 00 AAC 01 TC 10 ARQC 11 RFU x RFU 1 Combined DDA/AC generation requested 0 Combined DDA/AC generation not requested x x x x RFU Table I - 12- GENERATE AC Reference Control Parameter Change to the Application Interchange Profile indicator In order to indicate that the ICC supports Combined DDA/AC Generation as published in EMV Specification Bulletin #6 in December 2001 as opposed to the method originally published in EMV 4.0, a different Application Interchange Profile indicator must be used. The indicator used previously used for the obsolete method has been designated as reserved for future use ("RFU"). Please make the following change to EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0, Book 3, Table C -1 Application Interchange Profile Byte 1. This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2002

Byte 1 (Leftmost): b8 b7 b6 b5 b4 b3 b2 b1 Meaning 0 x x x x x x x RFU x 1 x x x x x x Offline static data authentication is supported x x 1 x x x x x Offline dynamic data authentication is supported x x x 1 x x x x Cardholder verification is supported x x x x 1 x x x Terminal risk management is to be performed x x x x x 1 x x Issuer authentication is supported1 x x x x x x 0 x RFU x x x x x x x 1 Combined DDA – GENERATE AC supported Table C – 1 Application Interchange Profile Change to indicator in Terminal Capabilities In order to indicate that the terminal supports Combined DDA/AC Generation as published in EMV Specification Bulletin #6 in December 2001 as opposed to the method originally published in EMV 4.0, a different indicator must be used. The indicator used previously for the obsolete method has been designated as reserved for future use ("RFU"). Please make the following change to EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0, Book 4, Table 17

Terminal Capabilities Byte 3 Security Capability. Byte 3: Security Capability b8 b7 b6 b5 b4 b3 b2 b1 Meaning 1 x x x x x x x Static data authentication x 1 x x x x x x Dynamic data authentication x x 1 x x x x x Card capture x x x 0 x x x x RFU x x x x 1 x x x Combined Dynamic Data Authentication/Application Cryptogram Generation x x x x x 0 x x RFU x x x x x x 0 x RFU x x x x x x x 0 RFU Table 17