Amadis

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

Foreword

Some card data (tags) are considered sensitive from a security perspective, especially the Primary Account Number (or PAN). This Primary Account Number can be found in several places (PAN tag, Track1 equivalent, Track2 equivalent, etc…) and must be protected throughout the transaction.

The Agnos SDK in conjunction with the Secure Client SDK will take card of securing those tags (encrypted backup) and obfuscate them so that no one (e.g. no application) can access them in clear.

Exporting the card data

Once the transaction is complete, exporting the card data (encrypted) is as simple as:

Dev dev = new Dev()
...
// Transaction
...
dev.exportCardData()

This function, if successful, will return a block of data, which content is described below.

Sensitive data block format

Card data are formatted as a BER-TLV byte string. The card data byte string is encrypted using the AES-CBC algorithm and a 128 bits AES key, Kpan-session and a shared IV, IVpan-session. The key and IV are unique for each encoded card data. Kpan-session is wrapped using the RSA-2048 Kpan-pub using the PKCS#1 RSA-OAEP algorithm with SHA-1 as digest.

The format of the PAN cryptogram is:

Cryptogram format changed starting secure client v1.0.9

Object

Length (bytes)

Comments

RSA Key ID length

2

Length of the RSA key ID (MSB)

RSA Key ID

var

RSA key ID used for the session key encryption

Encrypted KEK length

2

Length of the encrypted KEK block (MSB - should be 256)

Encrypted KEK

256

Encrypted KEK block:

  • encrypted with RSA key (RSA/ECB/OAEPWithSHA-256AndMGF1Padding)

  • cleartext contains the KEK (16 bytes) and the IV (16 bytes)

Encrypted card data length

2

Length of the encrypted card data block (MSB )

Encrypted sensitive card data

var

Encrypted sensitive card data:

  • encrypted with KEK key (AES/CBC/NoPadding)

  • cleartext which can contain the following tags (as TLV)

    • ‘56’ (Track1)

    • ‘57’ (Track2)

    • ‘5A’ (PAN)

    • ‘90’ (Issuer Public Key Certificate)

    • ‘9F46’ (ICC Public Key Certificate)

    • ‘9F6B’ (Track2 data - MasterCard)

HMAC Key ID length

2

Length of the HMAC key ID (MSB)

HMAC Key ID

var

HMAC key ID used for the checksum calculation

HMAC length

2

Length of the HMAC checksum (MSB - should be 32)

HMAC

32

AES-CBC-256 checksum

  • No labels