References


References

  1. EMVCo, EMV 2000 Integrated Circuit Card Specification for Payment Systems, BOOK 1 ”Application Independent ICC to Terminal Interface Requirements , Version 4.0, December 2000, http://www.emvco.com/specifications.cfm.

  2. EMVCo, EMV 2000 Integrated Circuit Card Specification for Payment Systems, BOOK 2 ”Security and Key Management , Version 4.0, December 2000, http://www.emvco.com/specifications.cfm.

  3. EMVCo, EMV 2000 Integrated Circuit Card Specification for Payment Systems, BOOK 3 ”Application Specification , Version 4.0, December 2000, http://www.emvco.com/specifications.cfm.

  4. EMVCo, EMV 2000 Integrated Circuit Card Specification for Payment Systems, BOOK 4 ”Cardholder, Attendant, and Acquirer Interface Requirements , Version 4.0, December 2000, http://www.emvco.com/specifications.cfm.

  5. EMVCo, EMV '96 Integrated Circuit Card Specification for Payment Systems , Version 3.1.1, May 31, 1998, http://www.emvco.com/specifications.cfm.

  6. EMVCo, EMV '96 Integrated Circuit Card Terminal Specification for Payment Systems , Version 3.1.1, May 31, 1998, http://www.emvco.com/specifications.cfm.

  7. EMVCo, EMV '96 Integrated Circuit Card Application Specification for Payment Systems , Version 3.1.1, May 31, 1998, http://www.emvco.com/specifications.cfm.

  8. CEPSCo, Common Electronic Purse Specification, Functional Requirements , Version 6.3, September 1999, http://www.cepsco.com/.

  9. ISO/IEC 8825, "Information Technology ”Open Systems Interconnection ” Specification of Basic Encoding Rules for Abstract Syntax Notation One (ASN.1)", 1990.

  10. ISO/IEC 7816-4, "Identification Cards ”Integrated Circuit(s) Cards with Contacts ”Part 4: Inter-Industry Commands for Interchange", 1995.

  11. ISO/IEC 7816-5, "Identification Cards ”Integrated Circuit(s) Cards with Contacts ”Part 5: Numbering System and Registration Procedure for Application Identifiers", 1994.

  12. ISO/IEC 8859-8, "8-Bit Single-Byte Coded Graphic Character Sets Latin/Hebrew Alphabet", 1999.

  13. ISO/IEC 639, "Code for the Representation of Names of Languages", 1988.



Chapter 5: EMV ¢ Certificates

Overview

There are two types of certificates considered by the EMV ¢ specifications, which we generically call the EMV ¢ certificates:

  • EMV ¢ public key certificates: The certificates in this category prove the temporal link, until a certain expiration date, between the public key of an entity and its identity. The entity public key is the object to be certified. It consists of the entity public key modulus and the entity public key exponent.

  • Signed Static Application Data: This is a certificate provided by an issuer concerning the authenticity of the application data personalized in an ICC. It is intended to prove that the content of financial data in the card did not change since the card was issued.

The presentation in this chapter concentrates on the specific issues related to EMV ¢ certificates and does not cover the general framework of certification. The reader interested in a more comprehensive discussion about certificates can consult Appendix D, Section D.4, in this book.



5.1 Certification mechanism and algorithm

In the EMV ¢ environment, a certifier is the organization that produces an EMV ¢ certificate using an asymmetric mechanism, consisting of a digital signature scheme providing message recovery, as stated in Annex A2.1 in Book 2 [1]. In Appendix D, Section D.3.2, of this book the reader can find a brief review of this mechanism. It is important to note that in Annex B.2 in Book 2 [1] the only cryptographic algorithm approved at the moment in the EMV 2000 specifications to implement an asymmetric mechanism is the RSA algorithm.

Then, without restraining the generality, someone can say that the certifier runs an RSA scheme, where the mapping of its parameters according to the EMV ¢ terminology is the following (see also Appendix F in this book):

  • The modulus , denoted in the RSA context n , represents the certifier public key modulus data object in the EMV ¢ context.

  • The public exponent, denoted in the RSA context e , represents the certifier public key exponent data object in the EMV ¢ context. Note that the certifier public key consists of the certifier public key modulus and the certifier public key exponent, which in the RSA context represents the public key ( n, e ). It is used by anyone that verifies the certificate.

  • The secret exponent, denoted in the RSA context d , could be assimilated with a certifier secret key exponent data object, which is not explicitly defined in the EMV ¢ context. Note that the certifier private key consists of the certifier public key modulus and the certifier secret key exponent, which in the RSA context represents the private key ( n, d ). The certifier uses the certifier private key to generate the signature representing the certificate.