SB nº AN-33 : Random Padding for Offline PIN Encipherment (Clarification)

Application Note Bulletin No. 33 First Edition February 2007 Random Padding for Offline PIN Encipherment This Application Note bulletin provides clarifications regarding the random padding generated for offline PIN encipherment.

Applicability

This Application Note Bulletin applies to:

• EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 2 Security and Key Management

Description

This bulletin relates to Offline PIN Encipherment as described in Book 2 Section 7. It adds details to the requirements regarding the random padding that is appended to the PIN block prior to encipherment. Proposed Specification Change Notice Please append step 3 of Section 7.2 with the following: The value of the Random Pad Pattern shall be unpredictable from the perspective of an attacker (even given knowledge of previous values) and prior to encipherment shall only exist in hardware suitable for protecting the plaintext PIN. For each encryption all values should be equally likely to be generated. This may be achieved using a Random Number Generator compliant with ISO/IEC 18031 or NIST SP 800-22A. © 1994-2006 EMVCo, LLC (“EMVCo”). All rights reserved. Any and all uses of the EMV Specifications (“Materials”) shall be permitted only pursuant to the terms and conditions of the license agreement between the user and EMVCo found at http://www.emvco.com/specifications.cfm.