17 articles with this tag
PCI-DSS 4.0 for Engineers: Security Beyond Compliance
PCI-DSS reads like a compliance document, but underneath it is a small set of engineering decisions that determine whether you spend your life in audit scope or out of it. The requirements that actually change your architecture — don't store what you don't need, tokenize, segment, encrypt in transit — and the scope-reduction moves that make the rest someone else's problem.
Certifying a Terminal: L1, L2, L3 and the Brand Test Tools
Shipping a payment terminal means passing three distinct certifications that most engineers conflate. A map of EMVCo Level 1 (hardware), Level 2 (kernel), and the brand-run Level 3 (end-to-end), what each actually tests, the order they happen in, and why the Brand Test Tools are where projects quietly lose months.
The ABECS Pinpad Protocol: Brazil's POS Command Language
Every card payment in Brazil passes through a pinpad speaking the ABECS protocol — a command/response state machine with its own open, get-card, go-on-chip, get-PIN, and close commands. A structural guide to how the automation talks to the secure device, why the Input/Output split exists, and where the EMV flow you know lives inside it.
Field 55: The EMV Bridge Inside ISO 8583
DE 55 is where two worlds meet: the chip's BER-TLV data objects packed inside a 1980s ISO 8583 message. A guide to what actually goes in Field 55 — the cryptogram, the TVR, the ATC, the unpredictable number — why each scheme mandates a different tag set, and how to debug the field where authorization declines are really decided.
The CVM List (8E): How a Card Chooses PIN vs Signature vs Nothing
The Cardholder Verification Method List is the card's ranked ballot of how it is willing to prove you are you — offline PIN, online PIN, signature, on-device biometric, or nothing at all — each gated by a condition. A byte-by-byte decode of tag 8E, the amount thresholds X and Y, and the 'try the next rule' bit that trips people up.
SDA, DDA, CDA: How a Terminal Trusts a Card Offline
Before a chip transaction ever reaches the issuer, the terminal can verify the card is genuine using a chain of RSA keys it carries. A walk through Offline Data Authentication — the CA-to-issuer-to-card certificate chain, why SDA is cloneable, how DDA proves the card holds a private key, and how CDA welds authentication to the cryptogram.
DUKPT from Scratch: Derived Unique Keys per Transaction (TDES and AES)
DUKPT solves a brutal problem: a million field terminals that must each encrypt PINs, none of which can ever share a key, and none of which can phone home for a new one. A walk through the Base Derivation Key, the IPEK, the Key Serial Number counter, and the non-reversible derivation that gives every transaction a unique, forward-secure key.
ISO 8583 Is Still Everywhere: Parsing the Message That Runs the Rails
Every card authorization that goes online becomes an ISO 8583 message — a four-digit MTI, one or two bitmaps, and a sparse set of data elements. A structural walk through the MTI, the bitmap that tells you which fields are present, the fixed-vs-variable length rule, and the DEs a Staff+ engineer actually meets.
PIN Blocks Explained: ISO 9564 Formats 0 to 4
A PIN never travels as four plain digits. It is packed into a PIN block — bound to the PAN, padded, and encrypted — and the exact packing is one of five ISO 9564 formats. A byte-by-byte walk through Format 0, why it XORs the PAN, what Formats 1 to 3 fix, and why Format 4 exists for AES.
Track 2 and the Service Code: What the Magstripe Still Tells the Chip
Track 2 Equivalent Data (tag 57) is the magnetic stripe living inside the chip — PAN, expiry, service code, and discretionary data in one compact field. A field-by-field decode, the three-digit service code that quietly routes and restricts every transaction, and why Luhn is the cheapest validation you are probably skipping.
Contactless in 300ms: Kernels, the TTQ, and the Tap
A tap has a latency budget a chip dip never had, and EMV contactless spends it differently: a PPSE combination-selection step, six scheme kernels (and the new unified C-8), and the Terminal Transaction Qualifiers (tag 9F66) that tell the card how this reader wants to be paid. A byte-by-byte guide to the fast path.
PIX, BR Code, and the EMVCo MPM: The QR All of Brazil Uses
The QR code that moved a country onto instant payments is EMV wearing a disguise. A field-by-field decode of a real PIX BR Code — the EMVCo Merchant-Presented Mode structure, the CRC16, static versus dynamic — and why the same TLV discipline from chip cards prints on a napkin.
ARQC from Scratch: Application Cryptograms Without the Black Box
The Application Cryptogram is the anti-fraud keystone of EMV. This is a meticulous walk through how one is built — master key derivation from the PAN, session key derivation from the ATC, the ISO 9797-1 MAC, and the ARPC response — with the hard rule that key-bearing crypto runs client-side and never touches a production key on someone else's server.
The TVR, the TSI, and How a Terminal Decides to Decline You
The Terminal Verification Results (tag 95) and Transaction Status Information (tag 9B) are the two bit fields that decide whether your card is approved offline, sent online, or declined. A byte-by-byte decode plus the exact AND logic — IAC and TAC against the TVR — that produces the verdict.
Reading BER-TLV by Hand — and Why You Shouldn't
BER-TLV is the grammar of EMV. This is a meticulous, byte-by-byte guide to decoding a real chip-card response — tag classes, the 0x1F continuation rule, short vs long length, nested templates — and an honest argument for handing it to a deterministic decoder in production.
What Actually Happens When You Dip a Chip: The EMV Transaction Flow End-to-End
A Staff+ walkthrough of a single contact EMV transaction — SELECT, GPO, READ RECORD, offline data authentication, cardholder verification, risk management, and the cryptogram — with the real APDUs and the tags that carry the state.
Implementing EMV from Scratch: Complete Guide for Payment Terminals
How to implement EMV (chip) from scratch in payment terminals. Complete technical guide with real production code, based on 20 years developing critical...
Receive new articles
Subscribe to receive notifications about new articles directly to your email
We won't send spam. You can unsubscribe at any time.