Every payment made by card starts with the terminal asking itself, “Is this card real?” This silent question isn’t asked by the customer or at the till, but it happens at every transaction. EMV card authentication is one of the many ways the card provides an answer.
This article explains EMV card authentication and the ways in which it occurs. It explains the four methods that EMV transactions use, as well as unveils the reasons merchants should care even when the entire thing is happening behind the scenes.
EMV means Europay, Mastercard, and Visa. EMVCo was created by those three companies and today is owned by six major networks to manage and maintain the EMV specifications.
EMV is an entire set of rules, not a single feature or chip. It dictates how a chip card, a chip card reader, and the card issuer communicate with one another, as well as how terminal risk decisions are made during that communication. One piece of that communication is card authentication, and that is the most significant piece.
Magnetic stripe cards were simple. The information was a strip of data that never changed and could be read and copied by anyone. Copies worked the same as originals.
Skimmers take a few seconds to read stripe data. Swiping the card twice, once through the terminal for the bill and once through a skimmer, would allow a waiter to steal data and write it to a new card. The payment terminal would be unable to distinguish the clone from the original card. This caused financial loss in the billions to the industry and is called counterfeit fraud.
Instead of treating the symptoms caused by the magnetic stripe cards, the creators of the EMV chip card decided to treat the root of the fraud. The magnetic stripe card contained a stripe of data that could be read and copied. The EMV chip card contains a secure element, which is a small computing device designed so that the secrets it contains cannot be extracted or duplicated. This design offered card authentication at the chip level.
A payment chip features a microcontroller with memory and locked storage on a single secure element. It can store standard payment card data (PAN, expiration date, cardholder name) and also store keys, certificates, and counters for offline transactions.
The stored keys are the most important. Some keys are symmetric keys issued to the chip, and some are private keys owned exclusively by the chip. These keys are never exported from the chip — not during a transaction, not ever. The chip uses these keys for cryptographic operations and outputs the results. This is the reason why card cloning is not possible. You cannot copy something that you cannot access.
An EMV transaction follows a precise order, with card authentication being central to it. A terminal first has to select an application. A card can support multiple applications for debit and credit, and even for domestic schemes. The terminal then starts application processing and interprets the data from the card chip.
Next comes the offline data authentication stage. This is where SDA, DDA, or CDA are executed. The terminal then checks the card’s processing restrictions, such as expiry and usage restrictions, before moving to the verification of the cardholder, which can be by a signature, a PIN, or even none.
The terminal then performs its own set of risk management procedures and decides whether the transaction has to go online. If a transaction does go online, a request is sent, and online card authentication is then performed. The transaction is then completed with an approval or decline response. One important thing to notice here is that offline and online card authentication do not compete with each other and, in fact, can coexist in multiple transactions.
EMV describes four methods to address the “is this card real” issue. Any combination of the four can be configured by card issuers and terminal manufacturers. The four methods are online authentication, offline SDA, offline DDA, and offline CDA.
Each method has a different cost and a different level of security. Each method was intended to solve a different problem. Let’s take a look at each one in detail.
This constitutes the most robust form of security and is the most prevalent form of protection in the U.S. The terminal collects transaction details (amount, currency, date, terminal country code) and sends them to the chip.
The chip executes a cryptographic calculation with a secret key that is known only to the issuer, combines it with the transaction details and the internal transaction counter, and produces an Application Cryptogram, a small piece of data. When the card goes online, it generates an ARQC — an Authorization Request Cryptogram.
The ARQC, along with the authorization message, travels to the acquirer, then to the network and to the issuer. Since the issuer also possesses the secret key, it performs the same calculation on its end. If the computation yields the same result, the card is authentic.
An issuer then generates and sends an ARPC, or Authorization Response Cryptogram, back to the terminal. The terminal sends it to the chip, and the chip verifies it. This validates that the response was indeed issued by the issuer and not from an attacker. This results in mutual authentication: the card authenticates itself to the issuer, and the issuer authenticates itself to the card.
The cryptogram is unique to each transaction. There is a counter that increases with each use, and there are fields for the transaction amount and date that change. A cryptogram cannot be reused for a later transaction because it is only valid for the one transaction it was generated for.
A fraudster cannot create a new cryptogram for that transaction. To create a new cryptogram, the fraudster would need to acquire the secret key. The secret key is stored in the chip and in the issuer’s hardware security module. It is not practically possible to extract the key from either.
Online authentication requires an Internet connection and a reachable issuer. This adds a round trip to every transaction. In markets with reliable telecom, this is an acceptable tradeoff. In markets with spotty connectivity and at devices like transit gates, this is a big problem — which is exactly the reason for the existence of the offline methods.
Of the four methods, SDA is the oldest and the weakest and is the first offline method. Most techniques that have come after SDA have made its understanding somewhat obsolete. However, knowledge of SDA does offer some insights into techniques that have come after.
The idea of SDA is actually quite easy to grasp. The issuer collects a group of card data. This can include the account number, expiry, and other fields. The issuer then applies a digital signature to it. The signature can be found on the chip and is permanent. A terminal gathers the data and signature and then checks the signature.
For a terminal to check and verify the signature, it has to have the public keys. The terminal will have the public keys of the Certification Authority as provided to the terminal by the card networks. The chip will then provide an issuer certificate which is signed by that Authority. The trust is established in steps. The terminal trusts the scheme CA key, the CA key validates the issuer certificate, and the issuer certificate validates the signed card data. If the trust is established in the steps, then the card is accepted by the terminal as genuine.
When a signature is static, it is the same for all transactions, making it easy for others to copy. SDA cards can be read by an attacker. The attacker can then write the information and signature to a new, programmable card. The result is a cloned SDA card that is capable of presenting the same copied signature.
This method of attack creates a card that the industry began to call a “yes card.” This cloned card does not create valid cryptograms; hence, it would not pass an online transaction. However, it would authorize any offline transactions on its own. It would be able to approve transactions and respond ‘yes’ to any requests.
In environments where transactions were primarily offline, SDA had solved the wrong half of the problem and had certified that the data was from a real bank, without making sure that the chip itself was, in fact, real.
DDA sealed off the cloning gap. When DDA is implemented, the chip has its own pair – a private key and a public key. The private key, which is unique to each card, is stored in the secure element and is never exposed anywhere.
The public key, which is wrapped in an ICC certificate, is signed by the issuer, and the issuer’s certificate is signed by the scheme CA. Thus, the same chain of trust applies, but this time it certifies a live key as opposed to a frozen blob of data.
The flow of transactions is seamless. A terminal has to generate a random value, referred to as the Unpredictable Number, and send it to the chip. The chip, using its private key, signs the Unpredictable Number which EMV recognizes as Signed Dynamic Application Data. The terminal, then, verifies the signature using the ICC public key.
This new adaptation changes the entire approach. Since the challenge is unpredictable, the response is unique and cannot be used again for the same purpose. A cloned card, which has no private key, therefore cannot sign anything. DDA confirms that the chip is present and authentic without the need for any network connection.
DDA certifies card authentication, yet lacks a firm association of that authentication with the result of the transaction. The dynamic signature, along with the application cryptogram, is generated at different stages of the process. An advanced attacker could use a man-in-the-middle (MITM) attack, also known as a wedge attack, which involves placing their device between the card and terminal.
In this scenario, the attacker permits the card to execute DDA in the normal, legitimate way. After that, they alter the subsequent messages. The card terminal, as a result of the attack, assumes that the card has granted some sort of approval when, in fact, it has not. These attacks have been demonstrated by researchers, and the attacks require a high-level of sophistication. Despite that, EMVCo preferred to resolve the issue.
CDA is the best solution to that problem and the best offline method available today. CDA stands for Combined Dynamic Data Authentication with Application Cryptogram Generation. As you can see, the full name of CDA indicates what the solution is and what it does.
CDA combines two steps into one. The chip creates the application cryptogram and, at the same time, creates a dynamic signature over that cryptogram, an unpredictable number, and some key transaction data. The terminal assesses the whole thing as a single unit.
The end result is that the weld of cryptography has bonded both authentication and decision. They are the same. They cannot be separated, and one cannot be replaced by the other. A man-in-the-middle attack is not possible, because to alter the cryptogram would be to break the signature. The attacker would not be able to change the amount either, as it is also signed.
CDA provides strong offline assurance. It has strong cloning and tamper resistance. Most modern contact chip cards support both DDA and CDA, and most modern terminals support CDA.
There’s a method called fDDA (fast DDA) for contactless transactions. The basic idea is the same. The card signs some data with a non-extractable private key. The main difference is that the design is optimized for speed. This is a design requirement, since a tap has to happen in a small fraction of a second. The goal of the security design is the same. It has to show that the chip is present and in a way that data cannot be replayed.
| Method | Network needed | Data signed | Resists cloning | Resists tampering | Status |
| Online | Yes | Live transaction data | Yes | Yes | Dominant in the US |
| Offline SDA | No | Fixed card data | No | No | Deprecated |
| Offline DDA | No | Random challenge | Yes | Partly | Widely deployed |
| Offline CDA | No | Challenge plus cryptogram | Yes | Yes | Preferred modern method |
Multiple methods are typically supported by a single card. The terminal and card agree on the best method they can both support. This is why a single card will behave differently at a supermarket checkout and a transit gate.
Since the terminal processes transactions in a matter of milliseconds, most merchants never see this step in the process. So, why should a business owner care? Because the consequences appear directly on your statement.
Liability is a main concern. The EMV liability shift altered which party covers the loss from fraudulent transactions. If you authorize a chip card by swiping the magnetic stripe, you may be on the hook for the loss. If you authorize the transaction using the chip, the loss is typically covered by the card issuer.
The same reasoning applies to chargebacks and interchange. The proper use of chips eliminates a whole category of chargeback reason codes, and that means money. Card-present chip transactions usually qualify for better interchange rates than keyed or fallback transactions, so improper chip use costs you money for every transaction.
Terminal key maintenance is another one that is overlooked. Terminals store certification authority public keys, which are rotated on a scheduled basis. A terminal that is out of date can start failing offline authentication for all transactions. Keeping the firmware current is not housekeeping. It is part of retaining compliance.
Fallback abuse should be addressed as well. Fraudsters intentionally damage chips to make the terminal fall back to the magnetic stripe. Many acquirers monitor fallback rates, and a high rate is a cause for concern. If your employees are swiping around a chip that is not cooperating, you are creating the exact problem that EMV was designed to solve.
A few habits cover most of the risk. The most current terminals should be used. Older hardware supports older, less secure methods. Users should be encouraged to let terminals update their firmware and cryptographic keys; do not block the updates.
Train your staff to dip or tap (not swipe) chip cards. Do not use fallback; it may seem faster in a packed line, but the seconds saved will never make up for the increased risk. Also, ensure that contactless is enabled; the majority of modern tap transactions use dynamic methods of authentication and are extremely fast.
Read your processing statements, specifically looking for downgrades and fallback volume. These will show how your acceptance is genuinely functioning. If you notice either of these increasing, contact your payment processor before it becomes a trend.
Card authentication answers one question: is the card real? It doesn’t determine if the cardholder is real; that’s done through cardholder verification using a PIN or biometric. Card authentication also doesn’t check if the card has available funds; that’s done through an authorization.
For online purchases, card authentication is ineffective. Since there is no chip in a browser, card-not-present fraud is addressed using tokenization, 3-D Secure, and risk scoring at the network level. Chip authentication is one layer in a much longer stack, and one of the most effective layers, as the complete collapse of counterfeit card fraud in all of the markets that adopted EMV clearly shows.
Fraud doesn’t disappear, however; it relocates. After chip cards closed the door on counterfeit card fraud, the fraud moved online, exactly as it did in the UK, and then in Canada and the US. The point is not that EMV resolved fraud. The point is that EMV resolved one specific and very costly problem extremely well, and therefore, understanding how it accomplished this will help you understand the rest of your payment security.
EMV card authentication has a method for each of the four eras it has had to adapt to. The online method, with its shared secret keys and live transaction data, still serves as the framework for most connected markets.
SDA (Static Data Authentication), with its static signatures, proved too weak for the market and was retired. DDA (Dynamic Data Authentication) was designed with dynamic signatures and a private key protected inside the chip, and DDA was the end of practical cloning. CDA (Combined Data Authentication) took it even further by binding the signature to the transaction decision and providing the strongest offline protection available today.
The principle behind all of it is very simple. Static data can be copied; dynamic data cannot. All of these methods exist to force the card to do something that a copy will never be able to do, perform a calculation with a secret that will never be disclosed.
For the merchants, the principle is very simple. Modern equipment, updated, dip or tap rather than swipe, and keep an eye on your fallback rate. These habits will keep you inside the liability protection EMV was designed to provide.
You will never see any of this happen. It takes place in the terminal and the chip in a transaction language neither you nor your customer understands. But it happens for each transaction, and it is what ended counterfeit card fraud as an industry-wide crisis.
Host Merchant Services offers EMV solutions for business owners. If you’re interested in getting a head start on the rest of the U.S. market, contact an HMS sales representative today and ask about our EMV-compliant equipment and processing options.
The two are separate and distinct. Card authentication considers the card’s authenticity and is resolved by a cryptographic exchange involving the chip and terminal, and possibly the issuer. Cardholder verification considers whether the person presenting the card is authorized to use it and is resolved by a PIN, signature, biometric on the mobile device, or in some cases, no verification for low-value transactions. A transaction can pass one check and fail the other.
A network is not always available. Many terminals must operate without connectivity, or with only milliseconds to make a decision. Transit gates, in-flight sales, parking machines, toll booths, and rural terminals all utilize offline solutions. Dynamic Data Authentication (DDA) and Combined Data Authentication (CDA) allow terminals to locally authenticate payment cards using public key technology without contacting the issuer. Offline solutions act as a backstop, ensuring functionality with intermittent connectivity and preventing a backup in the checkout line.
Not really. If the card uses DDA or CDA, then from a DDA or CDA perspective, there is no way to derive the private key. Since the private key of the chip does not leave the secure hardware, a clone does not have the ability to generate a valid dynamic signature or a valid cryptogram. The only real exposure is the magnetic stripe, which is still present on the back of most cards, since the data on the magnetic stripe can still be skimmed and copied. This is why the fallback transaction method, or swiping of the chip card, negates the protection that the chip card was designed to offer.
Begin with the terminal instead of the cards. Ensure up-to-date firmware and the certification authority public keys, for instance, as keys for schemes that have expired can make offline authentication fail for all the cards. Next, verify that the terminal is certified with your processor, after which you can inspect the reader. A dirty or worn chip slot can cause read failures that may seem like card problems. If the problem occurs for multiple customers, it is almost definitely the terminal. If it only occurs for one customer and multiple times, the customer’s chip is probably damaged. In any of the above cases, the processor should be contacted, and staff should not swerve around the problem.
1.
2.
3.
4.
