PCI Watch

Tracking changes across the Payment Card Industry

SB nº SU-69 : Padding of BER-TLV Encoded Constructed Data Objects (Spec Change)

v2.0 Specification Bulletins

Specification Update No. 69 Second Edition November 2009 Note that this Specification Update supersedes and replaces Application Note 22 Padding of BER-TLV Encoded Constructed Data Objects This Specification Update clarifies the rules for padding of EMV-defined BER-TLV encoded constructed data objects.

Effective Date

This bulletin is effective from November 2009, at which time any affected or new type approval testing will also come into effect.

Applicability

This Specification Update applies to:

  • EMV Integrated Circuit Card Specification for Payment Systems (All Books) Version 4.2

Related Documents

  • ISO/IEC 7816 Part 4 Changes from First Edition This Second Edition includes a warning to Issuers not to use tags beginning ‘FF’ as they may not be correctly recognised by the terminal.

Description

A number of queries related to the padding of constructed data objects have been received by EMVCo via the query facility on the EMVCo website. This Specification Update clarifies the rules regarding where padding is allowed in EMV-defined constructed data objects and how it may be implemented. Padding, using ‘00’ bytes, may occur before, between or after primitive BER-TLV encoded data objects in the value field of EMV-defined constructed data objects (templates) only. This padding is subject to following rules:

  • Padding shall not be applied outside templates.
  • Padding may occur within templates, but must be before, after, or between primitive BER-TLV encoded data objects.
  • The length indicated in length byte of a padded constructed data object shall include any padding bytes present, since the padding shall only occur within the value field. The padding bytes have no meaning and are discarded. Note that the data object having tag ‘80’ returned in the Format 1 response to the GENERATE APPLICATION CRYPTOGRAM, GET PROCESSING OPTIONS and INTERNAL AUTHENTICATE commands, and the data objects returned to the GET DATA command are primitive BER-TLV coded data objects and shall not be padded. The value field of the constructed data object having tag ‘70’ returned in response to the READ RECORD command may be padded according to the rules above. Note also that FCI templates ‘6F’ and ‘A5’ are ISO-defined. ISO does not allow padding within templates; therefore padding is not allowed anywhere within the FCI template. However, terminals shall accept and correctly parse an FCI containing padding occurring anywhere within that FCI. Tag values beginning with ‘00’ and ‘FF’ shall not be used in EMV. Specification Change Append the following sentences to the end of Book 1, Section 11.3.4, 1st paragraph. ‘Padding is not allowed within the FCI returned by the card. Terminals shall accept and correctly parse an FCI containing padding unless the FCI would be rejected due to other errors.’ In Book 3 Annex B1, delete ‘or ‘FF’ ’ from the paragraph immediately after Table 36. In Book 3 Annex B1, add the note below after the paragraph following Table 36. ‘Note: It is strongly recommended that Issuers do not use tags beginning with ‘FF’ for proprietary purposes, as existing terminals may not recognise ‘FF’ as the beginning of a constructed private class tag.’