22 November 2020
Introduction
The third part of the «EMV Transaction flow» series covers the next stage of exchange between the device and the card, the GPO (Get Processing Options) command. Besides that, we will describe the differences in the implementation of the EMV cores in the cases of various Payment systems.
SELECT RESPONCE and File Control Information (FCI) Template
In the previous part of the series, we analyzed the technology of the selection of the available applications. Let us list once again all stages of the exchange:
- ATR
- Select (1PAY.SYS.DDF01), attempt of selection through the PSE. In case of denial:
- Select (AID), selection through the PSA. If there is only one applet, the procedure is finished, moving to the next step. If there are two applets:
- Manual or automatic Application select.
Meaning that we opted for APDU-R (card response / SELECT RESPONSE) in response to the Application select command (hereinafter: simply SELECT).
Let us emphasize again that the work scenarios in the cases of a contact chip and contactless chip are different. Furthermore, the differences are also possible in the work of the contact chips under the specifications of different PSs. This is what we will refer to when considering this stage. The essence of the differences is (among other things) the content of the object (or tag) 6F (File Control Information (FCI) Template), which the card transmits in response to the SELECT command. Let us consider it in greater detail.
Tag 6F FCI Template contains the basic information on the card application of a specific PS. Let us take the example of FCI Template objects that are sent back in the SELECT RESPONSE command for VISA contact chip card, and furnish it with comments, where necessary:
Tag 6F: File Control Information (FCI) Template
Tag 84: Dedicated File (DF) Name: A0000000031010 — the AID, already known to us
Tag A5: File Control Information (FCI) Proprietary Template
Tag 50: Application Label: 56495341 — name of the application, text value «VISA»
Tag 87: Application Priority Indicator: 01 — Application Priority Indicator, already known to us
Tag 5F2D: Language Preference: 7275656E — the preferred «communication language». Text value «ruen», i.e., the priority language is Russian (ru); if Russian is not supported, it will be English (en)
Tag 9F38: Processing Options Data Object List (PDOL): 9F1A02 — the PDOL object, we will further describe its purpose
Tag BF0C: File Control Information (FCI) Issuer Discretionary Template
Tag 9F5A: Application Program Identifier: 6006430643 — specific tag of Visa PS, in this case describing the card’s regional affiliation. In terms of bytes, it is as follows:
- Byte 1 bits 8-5 = '0110' Visa CEMEA use
- Byte 1 bits 4-1 = '0000' Visa regional discretion
- Bytes 2-3 = 0643 RUB
- Bytes 4-5 = 0643 Russian Federation
For comparison, let us take a similar example of FCI Template, sent back in response to the SELECT command for Mastercard contact card:
Tag 6F: File Control Information (FCI) Template
Tag 84: Dedicated File (DF) Name: A0000000041010 - AID
Tag A5: File Control Information (FCI) Proprietary Template
Tag 50: Application Label: 4D617374657243617264 — name of the application, text value «MasterCard»
Tag 87: Application Priority Indicator: 01 — Application Priority Indicator
Tag 5F2D: Language Preference: 7275656E — the preferred «communication language». Text value «ruen», i.e., the priority language is Russian (ru); if Russian is not supported, it will be English (en)
Tag BF0C: File Control Information (FCI) Issuer Discretionary Template
Tag 9F6E: Third Party Data: 06430000303000 — specific tag of Mastercard PS, in this case describing the card’s regional affiliation and «form factor». In terms of bytes, it is as follows:
- Bytes 1-2 = 0643 Russian Federation
- Bytes 3-4 = 0000 Unique Identifier
- Bytes 5-6 = 3030 Device Type: Card — is the «form factor, in this case. In the case of a card attached to any *Pay service (GPay, ApplePay, etc.), those bytes will be different.
- Bytes 7-7 Proprietary Data:00
As we can see, the PS-specific data elements are not the only difference in the information. The key difference is that the FCI Mastercard does not contain such an object as the PDOL, while FCI Visa does contain it. Let us highlight it in greater detail.
PDOL (Processing Options Data Object List) is a necessary set of parameters that a device has to transmit to a card for further processing in the next command. A card contains it within 9F38 tag, and we can see that from the above-given example of Visa card. Let us analyze it, for illustration. So, the value of PDOL = 9F1A02. In the «translation» from TLV, we can see that it is 9F1A tag, 02 bytes long. 9F1A tag is the Terminal Country Code. Thus, the card will wait for the terminal to transmit the information on its location to the card. Consequently, the transaction will be aborted if it does not happen. It should be noted that a situation where PDOL contains some elements (tags) unknown to the device, can actually occur. For such cases, a unified algorithm of work of the POS or ATM software is stipulated in the specifications of all PSs, which provides that «0» will be sent in response to all information that is «unclear». In our specific example, it means that if a device does not transmit 9F1A tag at all in the next command, the exchange will be aborted. However, if 9F1A tag=020000 is transmitted (0000 is the «zero» code of the country), the exchange will be continued just like if a device sends a tag like 9F1A=020643 (0643 is the code of the Russian Federation) to a card. Certainly, in the former case involving the «zero» code, issues can occur at some other stage of the exchange.
The same algorithm is implied with respect to the other PDOL objects.
Example of the GET PROCESSING OPTIONS (GPO) command with PDOL, provided with a detailed explanation:
Term: 80A800000483020643 (Get Processing Options)
Cla: 80 — command class
Ins: A8 — instruction code
P1: 00
P2: 00
Lc: 04
Data: 83020643 — data field with 83 tag containing concatenation («addition») of values in the same order as they are listed up in the PDOL element of the SELECT RESPONSE command. In our case, it is 9F1A tag (Terminal Country Code) element 02 bytes long with the value = 0643 (Russian Federation).
GPO without PDOL
Let us remind you that in the above-mentioned SELECT RESPONSE of the FCI Template Mastercard PS does not contain PDOL. Some time ago, issues could occur during the processing of such a card. It was because some developers of the POS software or the ATM software (the latter more often, at that) implemented the work logic where the software should have «put the set of data received in PDOL during the previous step, into the «Data» field of the GPO command. It is obvious that, if a card did not contain PDOL, the collisions/denials in service occurred. Currently, we can hardly come across such a course of work of a device, but such instances occurred. Consequently, it should be noted that a card can contain no PDOL, and in such cases, the GET PROCESSING OPTIONS command will be executed without parameters.
Example of such a command:
Term: 80A80000028300 (Get Processing Options)
Cla: 80
Ins: A8
P1: 00
P2: 00
Lc: 02
Data: 8300
I.e., we see that Command class = 80, Instruction code = A8, but «Data» field containing 83 tag has zero length.
Hence, the stages of EMV Transaction Flow described by us, are the following:
- ATR
- Select (1PAY.SYS.DDF01),attempt of selection through the PSE. In case of denial:
- Select (AID), selection through the PSA. If there is only one applet, the procedure is finished, moving to the next step. If there are two applets:
- Manual or automatic Application select .
- Get Processing Options with or without PDOL.
Note that this article describes only and specifically the scenario of the contact chip’s work. This is due to the work of the contactless chips is significantly different at this stage of the exchange. This subject is exactly what the next part will cover.
