generate AC cryptogram manually

Question

I am trying to generate AC manually, I have a tool to generate AC but I want to generate it by my own to understand the algorithm for the same.

My calculation is fine for Discover card but it is failing for MasterCard. As per my understanding, data used to generate AC is depend on Tag 8C - CDOL1 which we provide to card with Gen AC command + AIP + ATC.

AIP and ATC - accessed internally by ICC.

Data used to generate AC is:-

data part of Gen AC command + value of tag 82 + value of tag 9f36 + 80 + optional 00 to make it multiple of 8.

this is my logic ,it might be I am using wrong data to calculate A.C that's why getting different result from my test tool.

Terminal Supplied Data
Amount, Authorised - 000000000201
Amount, Other - 000000000000
Terminal Country Code - 0826 - United Kingdom
Terminal Verification Results - 00 00 00 00 00
Transaction Currency Code - 0826 - Pound Sterling
Transaction Date - 15 04 28
Transaction Type - 00 - Goods and Services
Unpredictable Number - 30 90 1B 6A
Terminal Type - 23 - Attended, offline only. Operated by Merchant
Data Authentication Code - 00 00
ICC Dynamic Number - 1E AB C1 26 F8 54 99 76
CVM Results - 00 00 00

Gen AC Using CDOL1 80 AE 40 00 2B 0000000002010000000000000826000000000008261504280030901B6A2300001EABC126F8549976000000 this command is returning 9F26. data i used for calcatation is:-

0000000002010000000000000826000000000008261504280030901B6A2300001EABC126F85499760000003800000180 [ data is multiple of 8]

Where 3800 is AIP 0001 is ATC and 80 for Padding [ Padding method 2 EMV] This is my logic, Is any body tell me where I should focus more to generate same AC as my tool generated.

Answer 1

MasterCard Application Cryptogram (AC) generation is more complicated than other card schemes.

1. Card can use different ICC Session Key Derivation (SKD) methods:

   • MasterCard Proprietary SKD, where involved Application Transaction Counter (ATC) and Unpredictable Number (UN);
   • EMV2000 Method, where involved only ATC - see EMV 4.0, Book 2;
   • EMV Common Session Key (CSK) Method, where involved only ATC - see EMV 4.2, Book 2;

2. Data Objects (DO) can be with different sets of additional or modified values:

   • Card Verification Results (CVR) can be 6 or 4 bytes.
   • The offline counters from Issuer Application Data (IAD) can be included.
   • Last online ATC value can be included.

The used method and data variant can be detected by Cryptogram Version Number (CVN) and Application Control bits. CVN is sub-field of IAD tag 0x9F10 .

The detailed information are proprietary and available for the MasterCard members.

For deep learning about it take a look into "M/Chip Card Application Cryptographic Algorithms" and M/Chip Card Application references.