Card responds with 6985

Question

I'm constructing a generate AC command for a Mastercard contactless card. I have retrieved the CDOL1 from the ICC data, however the card respond with 6985. Any advice on what the problem might be.

Card Risk Management Data Object List 1 (CDOL1) [8C]:
        Amount, Authorised (Numeric) [9F02]:
            Length: 06
        Amount, Other (Numeric) [9F03]:
            Length: 06
        Terminal Country Code [9F1A]:
            Length: 02
        Terminal Verification Results (TVR) [95]:
            Length: 05
        Transaction Currency Code [5F2A]:
            Length: 02
        Transaction Date [9A]:
            Length: 03
        Transaction Type [9C]:
            Length: 01
        Unpredictable Number (UN) [9F37]:
            Length: 04
        Terminal Type [9F35]:
            Length: 01
        Data Authentication Code  [9F45]:
            Length: 02
        ICC Dynamic Number [9F4C]:
            Length: 08
        Cardholder Verification Method (CVM) Results [9F34]:
            Length: 03
        Transaction Time [9F21]:
            Length: 03
        Customer Exclusive Data (CED) [9F7C]:
            Length: 14

80AE - Generate Application Cryptogram 
80 - ARQC  
00 
42 - Length
000000000100 - 9F02
000000000000 - 9F03
0710 - 9F1A
8000040800 - 95
0710 - 5F2A
191111 - 9A
00 - 9C
3357A30B - 9F37
21 - 9F35
0000 - 9F45
0000000000000000 - 9F4C
1F0302 - 9F34
142005 - 9F21
0000000000000000000000000000000000000000 - 9F7C

Consider posting the entire communication with the card, else all anyone can do is tell you the meaning of 6985 which you can just as well look up in the EMV spec... — a2800276, Nov 12 '19 at 11:47
The Generate Application Cryptogram command was correct, I needed to send the GPO command first as there was in fact a PDOL to satisfy. — Blackbox First, Nov 12 '19 at 13:09

score 1 · Answer 1 · answered Nov 13 '19 at 08:25

Application SELECT Command may return Tag 0x9F38 Processing Options DOL (PDOL).

The Tag Values required by PDOL need to be sent by terminal/reader to the card in the next step Get Processing Options (GPO) Command.

In case PDOL is unknown after application selection you may send GPO Command with empty Tag 0x83 to retrieve Tags 0x82 Application Interchange Profile (AIP) and 0x94 Application File Locator (AFL) from card.

Having AFL you should READ all mentioned records and analyze card tags. They may have CDOL1 value required for Generate AC.

Then, if it is still needed by card transaction scenario, you can send Generate AC Command with CDOL1 Tag Values.

Please refer to EMVCo EMV Contactless Specifications for Payment Systems, Book C-2, Kernel 2 Specification where MasterCard scenarios described.

score 1 · Accepted Answer · answered Nov 20 '19 at 11:59

The first thing you need to do is to look at the PDOL you get in response to the GPO message, and check that these are exactly the fields and lengths the card is asking for. Post the answer to the GPO message here if you are unsure. A common cause for this error is if you don't provide all the data the card wants, or if you send it too much.

I have a MasterCard that asks for exactly the data you have here and it response correctly to a GEN AC command of:

80AE900042000000000100000000000000082600000000000826190819003357A30A21000000000000000000001F0302120505000000000000000000000000000000000000000000

Comparing this with your message there are a few small differences. Below I list what you send and what I'm sending:

80AE - same
80 - I use 90, see EMV book 4, Section 6.5.5 on how to build the P1 value.
00  - same
42 - same
000000000100 - same
000000000000 - same
0710 - I use 0826 UK rather than Estonia, shouldn't matter. 
8000040800 - I use 0000000000 which means no errors
0710 - Again I use 0826 UK, not Estonia
191111 - 9A I use a different date, shouldn't matter.
00 - same
3357A30B - Our UN numbers are only 1 different, which is odd! Where did you find yours?
21 - same
0000 - same
0000000000000000 - same
1F0302 - same
142005 - different time, shouldn't matter.
0000000000000000000000000000000000000000 - same

I also have 00 on the end for the Le.

Tom

If I use 90 - Generate ARQC with CDA , my understanding is that I will not receive a Application Cryptogram (9F26) back in the response to the command however I do receive a SDAD (9F4B) , my question is do I now need to do a second Generate AC command in order to receive a Application Cryptogram (9F260 ? — Blackbox First, Mar 03 '20 at 14:46

Card responds with 6985

2 Answers2