PCI Watch

Tracking changes across the Payment Card Industry

SB nº AN-21 : Clarification to Format 1 Secure Messaging (Clarification)

v1.0 Specification Bulletins

Application Note Bulletin No. 21 Rev 10 First Edition May 2004 Clarification to Format 1 Secure Messaging

Applicability

This application note applies to

  • EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0 Book 2, Section 9 Secure Messaging and Annex A1.2.

Related Documents

None This Application Note clarifies how the computation of the Format 1 secure messaging MAC should be performed and also provides an illustration of Format 1 secure messaging. Specification Clarification Change Notice: For clarification in any future versions of the specifications, it is intended to make the following changes to EMV 2000 Integrated Circuit Card Specifications. Clarification to Section 9.2.1.1 Please replace the text of section 9.2.1.1 with the following: “The data field of the secured command is composed of the following TLV data objects as shown in Figure 3. If the command to be secured has command data, this command data is carried in the first data object1 either as plaintext data or, if secure messaging for confidentiality is applied, as a cryptogram. 1 EMV anticipates one data object preceding the MAC data object. Depending on the command data of the unsecured command there could be more than one such data object. For these constructions please refer to ISO/IEC 7816-4. This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2004

If the command data is carried as plaintext data then:

  • If the unsecured command data is not BER-TLV encoded, then the data shall be encapsulated under tag '81'.
  • If the unsecured command data is BER-TLV encoded and if the tag of any data element lies in the context specific class (range '80' to 'BF') reserved for SM-related data objects, then the command data shall be encapsulated in a constructed data object under tag 'B3'.
  • If the unsecured command data is BER-TLV encoded and no tag lies in the context specific class (range '80' to 'BF') reserved for SM-related data objects, then ISO/IEC 7816-4 permits that the command data may be included without encapsulation. However if encapsulated then the command data shall be encapsulated in a constructed data object under tag 'B3'. Note: If it is not always apparent that the data is BER-TLV encoded then the data may be encapsulated under tag '81'. If the command data is carried as a cryptogram then it shall be encapsulated in a data object for confidentiality as described in section 9.3.1.1. The second data object is the MAC. Its tag is '8E', and its length shall be in the range of four to eight bytes. Tag 1 T Length 1 L Value 1 Value (L bytes) Tag 2 '8E' Length 2 '04'-'08' Value 2 MAC (4-8 bytes) Figure 3: Format 1 Command Data Field for Secure Messaging for Integrity and Authentication ” Padding for the MAC Computation Please add the following clarification after the second paragraph of section 9.2.3 MAC Computation: “Note that for Format 1 the rules specified in ISO/IEC 7816-4 already define padding, so the padding of the first step of the MAC computation defined in Annex A1.2 shall be omitted. Specifically, the message MSG used in the MAC calculation is padded after the command header (CLA INS P1 P2 with CLA set to indicate secure messaging) and also after the data object carrying the command data if present. This data object is either a plaintext data object or, if secure messaging for confidentiality is applied, a data object for confidentiality (see section 9.3.1.1). The padding in each situation consists of one mandatory byte of '80' added to the right and then the smallest number of '00' bytes is added to the right so that the length of the resulting string is a multiple of 8 bytes.” This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2004 Informative footnote on MAC-chaining Please insert the following footnote after the description of the initial value H0 in step 3 of Section A1.2: “Note that pre-pending the MSG with the previous MAC (8-bytes) as a chaining block (see Section 9.2.3) is equivalent to using an initial value equal to the previous MAC processed by Triple DES (Algorithm 1) or Single DES (Algorithm 3).” Format 1 Secure Messaging Illustration Please insert the following as an Annex in Book 2. “ 1. Format 1 Secure Messaging Illustration Below is an illustration of Format 1 Secure Messaging as defined in Section 9 of Book 2 using a command where the command data of the unsecured command is not considered to be BER-TLV encoded. The command data is included in the computation of the MAC as a data object in accordance with Section 9.2.3. This is either the plaintext data object with tag '81' or, if secure messaging for confidentiality is applied, the data object for confidentiality with tag '87'.

1.1 Securing the Command APDU The unsecured command APDU has the following structure: 'X0' INS P1 P2 Lc data field The secured command APDU has the following structure: 'XC' INS P1 P2 Lc' data field' If secure messaging for confidentiality is not applied, the data field' is TLV coded in the following way: Tag 1 Length 1 '81' Lc Value 1 data field Tag 2 Length 2 Value 2 '8E' '04'-'08' MAC (4-8 bytes)

  • If Length 1 is coded on one byte, the value of Lc' may range from 8+Lc to 12+Lc, depending on the length of the MAC.
  • If Length 1 is coded on two bytes, the value of Lc' may range from 9+Lc to 13+Lc, depending on the length of the MAC. This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2004 If secure messaging for confidentiality is applied, the data field' is TLV coded in the following way: Tag 1 Length 1 '87' 2+Lc to 9+Lc Value 1 '01' || enciphered data field Tag 2 '8E' Length 2 '04'-'08' Value 2 MAC (4-8 bytes)
  • The first byte in the value field of the cryptogram data object for confidentiality with tag '87' is the padding indicator byte. The value '01' indicates that the plaintext data field is padded according to ISO/IEC 7816-4 before encipherment.
  • The length of the enciphered data field is a multiple of 8 bytes. Because of the padding the length of the enciphered data field may range from 1+Lc to 8+Lc. Consequently the value of Length 1 may range from 2+Lc to 9+Lc.
  • If Length 1 is coded on one byte, the value of Lc' may range from 10+Lc to 21+Lc, depending on Lc and on the length of the MAC.
  • If Length 1 is coded on two bytes, the value of Lc' may range from 11+Lc to 22+Lc, depending on Lc and on the length of the MAC. Notes 1. The plaintext data field is transported in the value field of a plaintext data object with tag '81'. The enciphered data field is transported in the value field of a cryptogram data object for confidentiality with tag '87'. 2. The fact that the tag of the data object (whether plaintext or cryptogram) is odd-numbered indicates that the data object is included in the MAC computation. 3. The padding indicator byte is the mandatory first byte in the value field of a cryptogram data object for confidentiality with tag '87' (see ISO/IEC 7816-4.) 1.2 Encipherment If secure messaging for confidentiality is applied to the command message, the data field of the unsecured command message is enciphered in the following way:
  • Padding and blocking of the data field is performed according to step 1 of Annex A1.1. A value of '01' of the padding indicator indicates that padding according to ISO/IEC 7816-4 always takes place even if the data field is a multiple of 8 bytes.
  • The padded data is enciphered according to step 2 of Annex A1.1 using the Encipherment Session Key derived according to Section 9.3.2. This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2004

1.3 MAC Computation MAC computation is performed in two steps:

  • Padding of the input data (for use in this computation)
  • Applying a MAC algorithm to the padded input data.

1.3.1 Padding of the Input Data Padding of the input data is performed according to ISO/IEC 7816-4:

  • The command header of the secured command APDU 'XC' INS P1 P2 is padded with '80 00 00 00'.
  • If the unsecured command APDU contains a data field, a mandatory '80' byte is added to the right of the plaintext data object (tag '81') or the cryptogram data object for confidentiality (tag '87') contained in the data field' of the secured command APDU. Then the smallest number of '00' bytes is added to the right such that the length of the resulting string is a multiple of 8 bytes. The padded input data consists of the concatenation of the padded command header and the padded plaintext data object or the padded cryptogram data object for confidentiality (if present). If MAC chaining is implemented then an 8-byte value is inserted to the left of the padded input data. This 8-byte value is
  • The Application Cryptogram generated by the card for the first or only script command,
  • The MAC (the full 8 bytes prior to any optional truncation) of the preceding script command for all following script commands. If MAC chaining is not implemented then the 8-byte Application Cryptogram generated by the card is inserted to the left of the padded input data.

1.3.2 Cryptogram computation A MAC is computed over the padded input data according to step 3 of Annex A1.2 of Book 2 using the MAC Session Key derived according to Section 9.2.2.” This document contains proprietary and confidential information of EMVCo LLC. Copyright © EMVCo LLC 2004