|
Command: |
Generate a Secure Message with Integrity over data to be sent from the Issuer back to the Card. Optionally, Secure Messaging with Confidentiality is provided in which case the message data must be supplied encrypted under a Transport Key. In this latter case the command first decrypts the message data using the Transport Key before re-encrypting it using a Session Key. |
|
Notes: |
This command is also used to change or unblock a PIN. To change the PIN held by an EMV card, the issuer has to validate the existing PIN, then accept a new PIN in a standard PIN block format. This PIN block is then translated from a standard ATM PIN block format (encrypted under a terminal or zone key) to an application specific PIN block format (encrypted under a confidentiality session key). To generate a PIN unblock script, use “Mode 0” (integrity only), with an EMV PIN Unblock APDU supplied in the “Plaintext Message Data” field. |
|
Field |
Length & Type |
Details |
|
COMMAND MESSAGE |
||
|
Message header |
m A |
(Subsequently returned to the Host unchanged). |
|
Command code |
2 A |
Value KU. |
|
Mode Flag |
1 N |
0 = Provide only Integrity functionality 1 = Provide Integrity and Confidentiality using the same Issuer Master Key 2 = Provide Integrity and Confidentiality using different Master Keys 3 = Provide Integrity and PIN Block translation for PIN Change, using the same Issuer Master Key 4 = Provide Integrity and PIN Block translation for PIN Change, using different Issuer Master Keys |
|
Scheme-ID |
1 N |
Identifier for the Scheme: 0 = Visa VSDC and UKIS 1 = Europay/MasterCard |
|
*MK-SMI(LMK) |
32 H or 1A+32H |
The Master Key for Secure Messaging with Integrity encrypted under Variant 2 of LMK pair 28-29. |
|
PAN/PAN Sequence No |
8 B |
Pre-formatted PAN/PAN Sequence number |
|
Integrity Session Data |
8 B |
Data used for Integrity Session Key Generation. For Scheme-ID = 0 (Visa/UKIS) this is the ATC (2 bytes) right justified and padded on the left with 6 zero bytes. For Scheme-ID = 1 (Europay/MasterCard) this is an 8 byte random number, RANDi. |
|
Plaintext Message Data Length |
4 H |
Length in bytes of data in next field. For the standard model HSM (RG7x00) the maximum size is 512 bytes (hex 0200). |
|
Plaintext Message Data |
n B |
Plaintext Message Data. |
|
Delimiter |
1 A |
Delimiter of previous field, “;”. |
|
*MK-SMC(LMK) |
32 H or 1A+32H |
The Master Key for Secure Messaging with Confidentially encrypted under Variant 3 of LMK pair 28-29. Only present if Mode Flag = 2 or 4. |
|
TK(LMK) |
32 H or 1A+32H |
Transport Key encrypted under LMK pair 30-31. This key was used to encrypt the supplied message. Only present if Mode Flag = 1 or 2. |
|
Confidentiality Session Data |
8 B |
Used for Confidentiality Session Key Generation. For Scheme ID = 0, (Visa/UKIS) this is the 2 byte ATC right justified and padded on the left with 6 zero bytes. For Scheme ID = 1 (Europay/MasterCard) this is a random number, RANDc. Only present if Mode Flag = 1, 2, 3 or 4. |
|
Offset |
4 H |
Position within Plaintext data to insert
Ciphertext data. Must be between 0000 and Plaintext Message Data length.
If Offset = n, Ciphertext is inserted AFTER the nth byte of the Plaintext
(i.e. if length of Plaintext data is 0039, and Offset is 39, Ciphertext
data is placed at the end of the plaintext message). Only present if Mode
Flag = 1, 2, 3 or 4. |
|
Cipher Text Message Data Length |
4 H |
Length in bytes of data in next field.
For the standard model HSM (RG7x00) the maximum size is 32 bytes (hex
0020). Must be a multiple of 8 bytes (i.e. 8, 16, 24 or 32). Only Present
if Mode Flag = 1, 2, 3 or 4. |
|
Cipher Text Message Data |
n B |
Cipher Text Message supplied encrypted
using a Transport Key (TK). It must be a multiple of 8 bytes long. Note
that no additional padding is performed on the decrypted message before
the re-encryption process. Only Present if Mode Flag = 1, 2, 3 or 4. |
|
Delimiter |
1 A |
Delimiter of previous field, “;”. |
|
Source PIN Encryption Key Type |
1 N |
0 = ZPK |
|
Source PIN Encryption Key |
16 H or 1A+32H or 1A+48H |
Source PIN Encryption Key, encryption
depending on the Source PIN Encryption Key Type:- |
|
Source PIN Block Format |
2 N |
The format code for the source PIN
block. |
|
Field |
Length & Type |
Details |
|
Destination PIN Block format |
2 N |
34 = Standard EMV PIN Block 47 = ISO 9564-1 Format 3 Only Present if Mode Flag = 3 or 4. |
|
Account Number |
12 N |
The 12 right most digits of the account number, excluding the check digit, used for PIN Block translation. Only present if Mode Flag = 3 or 4. |
|
*MK-AC(LMK) |
32H or 1A+32H |
The Issuer Master Key for Application Cryptograms, encrypted under variant 1 of LMK pair 28-29. Only present if Mode Flag = 3 or 4 and Destination PIN Block Format = 41 or 42. |
|
End message delimiter |
1 C |
Optional. Must be present if a message trailer is present. Value X’19. |
|
Message trailer |
n A |
Optional. Maximum length 32 characters. |
|
RESPONSE MESSAGE |
||
|
Message header |
m A |
Returned to the Host unchanged. |
|
Response code |
2 A |
Value KV |
|
Error Code |
2 N |
00 : No error 04 : Mode flag not set to 0, 1, 2, 3 or 4 05 : Unrecognized Scheme-ID 06 : Invalid Offset 07 : Invalid ciphertext message length parameter 08 : Ciphertext message length error 09 : TK or ZPK/TPK parity error 10 : MK-SMI parity error 11 : MK-SMC parity error 12 : No keys in user storage 13 : LMK parity error 15 : Error in input data 21 : Invalid user storage index 23 : Invalid PIN block format code 50 : Source PIN Encryption Key Type not set to 0 or 1 51 : MK-AC parity error 80 : Data length error 81 : Data not a multiple of 8 bytes |
|
MAC |
8 B |
The calculated 64 bit MAC. |
|
Re-encrypted ciphertext Data Length |
4 H |
Length in bytes of data in next field. Only present for modes 1, 2, 3 or 4. |
|
Re-encrypted ciphertext message Data |
n B |
Re-encrypted Ciphertext message. Only present for modes 1, 2, 3 or 4. |
|
End message delimiter |
1 C |
Present only if present in the command message. Value X’19. |
|
Message trailer |
n A |
Present only if present in the command message. Maximum length 32 characters. |