SB nº SU-13 : EMV® 2000 Session Key Derivation (Spec Change)

Specifications Updates: Bulletin no. 13, August 2002 EMV 2000 Session Key Derivation The contents of this bulletin have immediate effect. This note makes a specific recommendation for the values of the parameters b, H and IV. The note also corrects errors related to the pseudo-code specification of the EMV2000 session key derivation. PARAMETER RECOMMENDATION In order to provide a default choice for the parameters of the EMV2000 session key derivation, the following change is made to the beginning of Section A1.3.2. Replace: A1.3.2 Implementation It is recommended that b be equal to 2 or 4. Thus for a card limited to perform no more than 216 transactions this would imply a tree with 16 and 8 levels respectively. With: A1.3.2 Implementation The recommended value for b is 4 and for H is 8. This supports a card limited to perform no more than 216 transactions. The recommended value for IV is zero. Implementers should consult the individual payment systems in order to determine the supported values for b, H and IV. CORRECTION Book 2 of EMV2000 contains an error in Section A1.3.2 (the specification of the EMV2000 session key derivation algorithm). Where Book 2 defines how the computation of the session key SK for the current value of the ATC takes place (at the bottom of

and top of

) the following correction should be made: /* determination of the common node for ATC and ATC OLD */ i=0;

while ((ai==ci) && (i=i; j--) { T=GP; GP=F-1(GP,P,cj); P=T; } } while (i<H-1) { T=P; P=F(P,GP,ai); GP=T; i++; } /* computation of the session key */ SK=PAR(F(P,GP,aH-1)ÅGP); ATCOLD =ATC;