PCI Watch

Tracking changes across the Payment Card Industry

SB nº SU-45 : Enciphered PIN Recovery Errors (Spec Change)

v1.0 Specification Bulletins

Specification Update Bulletin No. 45 First Edition March 2006 Enciphered PIN Recovery Errors This specification update changes the status words to be returned by the ICC in the VERIFY response when recovery of the enciphered PIN Block fails during Offline Enciphered PIN processing.

Applicability

This Specification Update Bulletin applies to:

  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 2 Security and Key Management
  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 3 Application Specification

Related Documents

None

Description

This specification update changes the status words to be returned by the ICC in the VERIFY response when recovery of the enciphered PIN Block fails during Offline Enciphered PIN processing. The new status words will cause the terminal to consider that the Offline Enciphered PIN CVM has failed rather than causing the terminal to request re-entry of the PIN. This can prevent the PIN Try Counter being decremented to zero, thereby blocking the PIN, when the actual failure was a PIN decipherment failure. Note that this results in the PIN Try Limit Exceeded bit in the TVR being set which may conflict with any corresponding indication from the card in the Issuer Application Data. Specification Change Notice Please make the following changes to EMV Book 2 Security and Key Management, Section 7.2: At the end of both Step 7 and Step 8 change 'If this is not the case, PIN verification has failed' to 'If this is not the case, Offline Enciphered PIN has failed.'

At the end of both Step 7 and Step 8 change the footnote reference from the current Footnote 30 to a new footnote that says "When recovery of the PIN Block has failed, the ICC should return the status word of 6983 or 6984 as described in Book 3 Section 10.5.1 to indicate that Offline Enciphered PIN processing has failed.' Please make the following changes to EMV Book 3 Application Specification, Section 10.5.1: In the fourth bullet, insert 'or if recovery of the enciphered PIN Block has failed' after 'initial use of the VERIFY command.' The bullet shall now read 'The PIN is blocked upon initial use of the VERIFY command or if recovery of the enciphered PIN Block has failed (the ICC returns SW1 SW2 = '6983' or '6984' in response to the VERIFY command). In this case, the terminal shall set the 'PIN Try Limit exceeded' bit in the TVR to 1.'