EUROPAY, MASTERCARD &

VISA (EMV)

Testing Procedures and Specifications

By Rajat Kumar
Basic Terms

Account Holder – Consumer using Integrated Circuit
Card (ICC)

Acquirer – Financial Institution that enlists merchant
to use an application like VISA

Issuer – Financial Institution which issues ICC to
consumer

Merchant – a store, restaurant, airline etc.
 Transaction Flow

Cardholder Application Issuer

Merchant Acquirer

VISA/MASTERCARD
Course of Presentation

Common Payment Application(CPA) basics

Terminal requirements

Hardware

Software

Test Procedure

Level 1

Level 2

Contactless Specifications
Common Payment Application
- a process overview

Application Selection

Checking for offline verification

Initiate Application Processing

Read Application Data

CPA – a process overview

Offline Data Authentication

Two methods
 Static
Data Authentication(SDA)
 Dynamic Data Authentication(DDA)

SDA verifies authenticity of personalized data

Dynamic data authentication has two forms :
 In DDA, terminal decodes a cryptogram generated by card
using dynamic data, thus verifying legitimacy of card
 In Combined DDA/ Generate AC, a dynamic signature is
sent along with Application Cryptogram to terminal.
CPA – a process overview

Processing Restrictions

Cardholder Verification

Terminal Risk Management

Terminal Action Analysis

Terminal decides on basis of results from offline data
authentication, processing restrictions, terminal risk
mgmt. and cardholder verification to approve
transaction offline, sent online for verification or decline
offline.
POS Terminal Definition

Terminal Type ‘22’

Offline with online capability for carrying out
transactions

Operational Control is provided by merchant

-- EMV v4.2 Book 4

Terminal Requirements

Mechanical Characteristics

IFD must be ISI/IEC 7816-1,2

Contact embossing should be ISO 7811 -1,3 compliant.

Contact force on IC Card contacts must be in range of

0.2 to 0.6 Newton.

-- EMV v4.2 Book 1

Terminal contact locations
Terminal Requirements

Electrical Characteristics

All measurements must be with respect to GND over an
ambience 5⁰⁰ C to 40⁰⁰ C

Input/Output contact must limit current by +/-15mA

Rise and Fall times for signals as mentioned in Book-1

-- EMV v4.2 Book 1
Terminal Requirements

Software Characteristics

Offlinedata authentication

Personal Identification Number encipherment

Secure messaging

Terminal security
Test Procedure

Multi level testing

Level 1
 Electromechanical characteristics
 Logical interface
 Transmission protocol

Level 2
 Compliance with debit/credit payment applications
Test Procedure

Level 1 Test Cases
 Card session test
 Answer to reset test
 Protocol test
 Transport layer test

-- Terminal Level-1 Test Cases

Test Procedure

Level 2 Test Cases
 Application selection
 Security aspects
 Cryptography algorithm
 Functions in transaction processing
 Erroneous/missing data in ICC

-- Terminal Level-2 Test Cases

Contactless Specifications

Communication Protocol

Electrical characteristics of interface
 Powerrequirements
 Modulation methods used

Protocol layer sequence

Proximity Coupling Device’s(PCD) polling mechanism
Contactless Specifications

Terminal Architecture

EntryPoint – An overlying layer above application
kernels to support multiple legacy kernels.

Application kernels such as Paypass MasterCard chip
kernel lie in the next layer

Once Entry Point finds a suitable kernel match with
PICC it hands over communication to it.
Contactless Specifications

Terminal Architecture
Contactless Testing

Level 1 is about compliance to EMV CL
Communication Protocol Specification v2.0

Entry Point Compliance Label is given after testing
Entry Point using specified kernels

* Level 1 certification has been given to three terminals.

* No test cases mentioned for Level 1/Entry Point.
References

www.emvco.com

www.visa.com

Google Image & Web Search
Thank You