9F49

Dynamic Data Authentication Data Object List is the card's tag-and-length request list for the INTERNAL AUTHENTICATE command used in DDA - the same request-list mechanism as the PDOL and CDOLs already covered in this dictionary, this time defining what the terminal must supply so the card can sign it as part of proving it's genuinely present for this specific transaction. It's related to the terminal's Unpredictable Number (9F37), almost universally included in a DDOL for the same replay-resistance reason it's folded into the Application Cryptogram, and to the Signed Static Application Data (93) and Signed Dynamic Application Data (9F4B) that represent SDA's and DDA/CDA's respective proof outputs - 9F49 is specifically what shapes the DDA-side proof, defining the exact data the card's dynamic signature actually covers. A terminal that supplies data in a different order or length than 9F49 specifies produces a DDA verification failure that traces back to a request-formatting mismatch, not to any actual problem with the card's signing key or the terminal's cryptographic implementation. See EMV 4.4 Book 3.