PCI Watch

Tracking changes across the Payment Card Industry

TTA Bulletin nº 269: CT2 SB276 CDAFails

v1.0 Type Approval Bulletins
Contact Acceptance Device

EMV® Terminal Type Approval Bulletin No. 269 First Edition, October 2023 Terminal Level 2 Test Cases Clarification regarding UN in CDA signature verification

Applicability

This Bulletin applies to:  EMV® Terminal Type Approval - Level 2 Test Cases – version 4.4a Related Documents  Specification Bulletin 276 – EMV® Clarification regarding UN in CDA signature verification, Second Edition April 2023. Effective Date  January 1st, 2024

Description

Based on EMVCo's continued review of the EMV® Terminal Type Approval Level 2 Test Cases v4.4a, the following updates are necessary, and shall be applied to any type approval session beginning on, or after, the effective date cited above. Update to EMV® Terminal Type Approval

  • Level 2 Test Cases – version 4.4a Section 5 – Test Settings Updates LT Settings [LTSetting144] (differences with LTSetting1): Data AIP CDOL1 Tag Value 82 0100 8C 95059B029F241D9F19069F25029F3403 [LTSetting188] (differences with LTSetting1): Data AIP CDOL1 CDOL2 Expiration Date IAC-Online Tag 82 8C 8D 5F24 9F0F Value 0100 95059B029F241D9F19069F25029F3403 95059B029F241D9F19069F25029F3403 200101 0040000000 countries. Section 7 – Test Cases Updates New test cases include: 2CC.133.03 2CC.133.04 Revised test cases include: 2CC.133.01 Deleted test cases include: None countries. 2CC.133.01 Unpredictable Number not present in CDOLs Revision: 44b Objective: To ensure that if Unpredictable Number (9F37) is not requested in the CDOL1, the Combined DDA/AC Data Authentication fails. Reference Book 2
  • Section 6.6.2
  • Dynamic Signature Verification EMV 4.4: Book Bulletins
  • Section SB 276
  • Bulletin n°276, Clarification regarding UN in CDA verification (April 2023) Terminal [CDA] AND ([Offline Only] OR [Offline/Online Capable]) ICS Options: Conditions:  LTsetting144:
  • AIP indicates CDA is supported
  • CDOL1 in LT does not include Unpredictable Number generated by the terminal (tag 9F 37).  Case 01
  • LT_response at first GENERATE AC  CDA signature is generated with Unpredictable Number = '00000000'.  Case 02
  • LT_response at first GENERATE AC  CDA signature is generated with Unpredictable Number with a null value. Procedure:  Transaction is performed with TermSetting1 and LTsetting144 Pass Criteria:  Parameter received at first GENERATE AC:
  • The terminal shall process the transaction until completion, by requesting a TC with CDA (P1_b8='0' AND P1_b7=‘1’ AND P1_b5='1' AND P1_b4='0')  Data received at first GENERATE AC:
  • SDA not used (TVR_B1b7=‘0’).
  • DDA not used (TVR_B1b4=‘0’).  Data received in Kernel Data Output:
  • Offline Data Authentication was performed (TSI_B1b8=‘1’).
  • Combined Data Authentication failed (TVR_B1b3=‘1’). countries. 2CC.133.03 Unpredictable Number not present in CDOLs (3) Revision: 44b Objective: To ensure that if Unpredictable Number (9F37) is not requested in the CDOL1, the Combined DDA/AC Data Authentication fails. Reference Book 2
  • Section 6.6.2
  • Dynamic Signature Verification EMV 4.4: Book Bulletins
  • Section SB 276
  • Bulletin n°276, Clarification regarding UN in CDA verification (April 2023) Terminal ([CDA Mode1] OR [CDA Mode2]) AND ([Online Only] OR [Offline/Online ICS Capable]) Options: Conditions:  LTsetting144:
  • AIP indicates CDA is supported
  • CDOL1 in LT does not include Unpredictable Number generated by the terminal (tag 9F 37).  Case 01
  • LT_response at first GENERATE AC  Cryptogram Information Data ‘9F27’ responding an ARQC (‘80’) with CDA.  CDA signature is generated with Unpredictable Number = '00000000'.  Case 02
  • LT_response at first GENERATE AC  Cryptogram Information Data ‘9F27’ responding an ARQC (‘80’) with CDA.  CDA signature is generated with Unpredictable Number with a null value. Procedure:  Transaction is performed with TermSetting1 and LTsetting144 Pass Criteria:  Parameter received at first GENERATE AC:
  • The terminal shall process the transaction until completion, by requesting an ARQC with CDA (P1_b8='1' AND P1_b7=‘0’ AND P1_b5='1' AND P1_b4='0')  Data received at first GENERATE AC:
  • SDA not used (TVR_B1b7=‘0’).
  • DDA not used (TVR_B1b4=‘0’).  Data received in Kernel Data Output:
  • Offline Data Authentication was performed (TSI_B1b8=‘1’).
  • Combined Data Authentication failed (TVR_B1b3=‘1’). countries. 2CC.133.04 Unpredictable Number not present in CDOLs (4) Revision: 44b Objective: To ensure that if Unpredictable Number (9F37) is not requested in the CDOL1, the Combined DDA/AC Data Authentication fails. Reference Book 2
  • Section 6.6.2
  • Dynamic Signature Verification EMV 4.4: Book Bulletins
  • Section SB 276
  • Bulletin n°276, Clarification regarding UN in CDA verification (April 2023) Terminal [CDA Mode4] AND ([Online Only] OR [Offline/Online Capable]) ICS Options: Conditions:  LTsetting188:
  • AIP indicates CDA is supported
  • CDOL1 and CDOL2 in LT do not include Unpredictable Number generated by the terminal (tag 9F 37).
  • Expiration Date has the value '200101'
  • IAC-Online has the value '0040000000'  LT_response at first GENERATE AC
  • Cryptogram Information Data ‘9F27’ responding an ARQC (‘80’)  Case 01
  • LT_response at Second GENERATE AC  CDA signature is generated with Unpredictable Number = '00000000'.  Case 02
  • LT_response at Second GENERATE AC  CDA signature is generated with Unpredictable Number with a null value. Procedure:  Transaction is performed with TermSetting1 and LTsetting188 Pass Criteria:  Parameter received at first GENERATE AC:
  • The terminal shall request an ARQC without CDA (P1_b8='1' AND P1_b7=‘0’ AND P1_b5='0' AND P1_b4='0')  Parameter received at second GENERATE AC:
  • The terminal shall process the transaction until completion, by requesting a TC with CDA (P1_b8='0' AND P1_b7=‘1’ AND P1_b5='1' AND P1_b4='0')  Data received at first GENERATE AC:
  • SDA not used (TVR_B1b7=‘0’).
  • DDA not used (TVR_B1b4=‘0’).  Data received in Kernel Data Output:
  • Offline Data Authentication was performed (TSI_B1b8=‘1’). countries. 2CC.133.04 Unpredictable Number not present in CDOLs (4)
  • Combined Data Authentication failed (TVR_B1b3=‘1’). countries.

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for

countries.

patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.

countries.