support for EMV2000 Session Key Derivation

[tomaspulai]

Hi.
Great lib. Big thank you for this lib.
Currently using VisaCVN10, VisaCVN18 and MasterCardCVN16.
But in future I will need to work also with some exotic EMV schemes. So wondering if it is possible to add support for EMV2000 Session Key Derivation. Pls see the HSM spec for command KW:

Currently I can see only support for Common Session Key Derivation:
def derive_common_sk(icc_mk: bytes, r: Union[bytes, bytearray]) -> bytes:

[knovichikhin]

Thank you.

The reason EMV2000 session key derivation is not supported is because it was deprecated some time before 2008.

And the second reason is I was not aware of any implementations that use it.

It certainly can be implemented. However, I'm not sure when that can happen.

[tomaspulai]

Thanks for your response.

Based on this table (from our HSM manual) I had a feeling that it is used also in real world:

But you have better overview for sure. So we can forgot to EMV2000.

But in near future (2-3 weeks) I will need to generate ARQC for CCD where IAD looks like this:

9F10200FA501A80030000000000000000000000F010000000000000000000000000000

This is not implemented in cvn.py. If my reverse engineering is correct then it should be:

• EMV Option 'B' Card Key Derivation and EMV Common Session Key Derivation

So should be able to do it even if this cvn is not directly implemented.

[knovichikhin]

I just released v1.5 that has support for EMV2000-Tree SK. So, if it's needed, it's there.

Not sure about MC, but I believe Visa CVN 14 is deprecated. But I'm not on their "mailing list". 😄

CCD (Common Core Definition) is fairly straight-forward because this is what EMVCo Books describe. However, I haven't personally dealt with one.

If all you care about is ARQC and ARPC then Visa CVN 18 is (supposedly) exactly the same as CCD. Although, Visa CVN 18 will have very different scripting.

[tomaspulai]

Hi again..
What about VISA CVN 17? Is there any chance you will implement this CVN in future? In 2020 we are implemented this CVN for one of our client in UK. Now I have to generate test txns for this client. For now I will implement it myself as I need only ARQC (the data for arqc is auth_amt + unpred_num + appl_txn_cntr + 1 byte from crd_vrfy_rslts ). But would be nice to have it everything in your lib.

Regards,

[knovichikhin]

Hi,

I don't have any information on CVN 17. I do believe it's the qVSDC and it should be the same as CVN 10 except for the difference in tags that go into the ARQC.

Since it's missing, why not contribute yourself? It's not too difficult. And it could fun experience if you have never done it.

1. Copy this class. Call it VisaCVN17 assuming 17 is the decimal notation, not hex.

   pyemv/pyemv/cvn.py

   Line 80 in 4a07cb5

   class VisaCVN10:

2. You can drop the script stuff for it if you are not up for the task. And if it is qVSDC then it's contactless and doesn't support scripts anyways (and ARPC).
3. Simply implement the ARQC and ARPC.
4. Copy this function and test with a KNOWN value (something you know is good for sure).

   pyemv/tests/test_cvn_hsm.py

   Line 17 in 4a07cb5

   def test_visa_cvn10(

To test:
Install requirements-dev.txt in a virtual environment.
Then from the root folder:

make test

If you don't have make, you can execute the commands manually from the make file.

python -m black ./pyemv ./tests
python -m flake8
python -m mypy
python -m pytest

Once satisfied, run test coverage and make sure it's 100%:

python -m pytest --cov=./pyemv

[tomaspulai]

Yes originally i did it like you are describing and it worked fine. But then I recognized that i can do it without new class/file just like this: