2

I have following scenarios below. I am trying to find the reason why GENERATE APPLICATION CRYPTOGRAM gives me response 6985.

Good sample:

GENERATE APPLICATION CRYPTOGRAM - using in terminal same country code and currency code as on card gives me correct APPLICATION CRYPTOGRAM RESPONSE.

GENERATE APPLICATION CRYPTOGRAM - GOOD

Generate AC Using CDOL 1
    Terminal Supplied Data
     Amount, Authorised - 000000000201
     Amount, Other - 000000000000
     Terminal Country Code - 0840 - United States
     Terminal Verification Results - 00 00 00 00 00 
     Transaction Currency Code - 0840 - US Dollar
     Transaction Date - 20 07 01 
     Transaction Type - 00  - Goods and Services
     Unpredictable Number - 30 90 1B 6A 
     Terminal Type - 22  - Attended, offline with online capability. Operated by Merchant
     Data Authentication Code - 00 00 
     ICC Dynamic Number - 00 00 00 00 00 00 00 00 
     CVM Results - 00 00 00 
<snd> (049) 80 AE 40 00 2B 00 00 00 00 02 01 00 00 00 00 00 
            00 08 40 00 00 00 00 00 08 40 20 07 01 00 30 90 
            1B 6A 22 00 00 00 00 00 00 00 00 00 00 00 00 00 
            00 
<rcv> (045) 77 29 9F 27 01 XX 9F 36 02 XX XX 9F 26 08 XX XX 
            XX XX XX XX XX XX 9F 10 12 XX XX XX XX XX XX XX 
            XX XX XX XX XX XX XX XX XX XX XX 90 00

Bad sample:

GENERATE APPLICATION CRYPTOGRAM - using in terminal with different country code and currency code on card gives me response 6985, that's the only difference I could observe. The PDOL is not personalized on the card.

SELECT

Selecting Application A0000000041010 - MasterCard
<snd> (013) 00 A4 04 00 07 A0 00 00 00 04 10 10 00 
<rcv> (063) 6F 3B 84 07 A0 00 00 00 04 10 10 A5 30 50 10 4D 
            61 73 74 65 72 63 61 72 64 20 44 65 62 69 74 87 
            01 01 5F 2D 02 65 6E 9F 11 01 01 BF 0C 0F 9F 4D 
            02 0B 0A 5F 55 02 55 53 42 03 XX XX XX 90 00 
      84 - DF Name - A0 00 00 00 04 10 10 
      A5 - FCI Proprietary Template
      50 - Application Label - Mastercard Debit
      87 - Application Priority Indicator - 01 
    5F2D - Language Preference - en
    9F11 - Issuer Code Table Index - 01
    BF0C - FCI Issuer Discretionary Data
    9F4D - Log Entry - 0B 0A 
    5F55 - Issuer Country Code (Alpha 2) - "US"
      42 - Issuer Identifier Number - XX XX XX

GPO

Get Processing Options
<snd> (008) 80 A8 00 00 02 83 00 00 
<rcv> (018) 77 0E 82 02 18 00 94 08 08 01 01 00 10 01 01 00 
            90 00 
      82 - Application Interchange Profile - 18 00 
      94 - Application File Locator - 08 01 01 00 10 01 01 00 
       -  File Locator 1 - 1 1 1 0 
       -  File Locator 2 - 2 1 1 0

GENERATE APPLICATION CRYPTOGRAM

Generate AC Using CDOL 1
    Terminal Supplied Data
     Amount, Authorised - 000000000201
     Amount, Other - 000000000000
     Terminal Country Code - 0826 - United Kingdom
     Terminal Verification Results - 00 00 00 00 00 
     Transaction Currency Code - 0826 - Pound Sterling
     Transaction Date - 20 07 01 
     Transaction Type - 00  - Goods and Services
     Unpredictable Number - 30 90 1B 6A 
     Terminal Type - 22  - Attended, offline with online capability. Operated by Merchant
     Data Authentication Code - 00 00 
     ICC Dynamic Number - 00 00 00 00 00 00 00 00 
     CVM Results - 00 00 00 
<snd> (049) 80 AE 40 00 2B 00 00 00 00 02 01 00 00 00 00 00 
            00 08 26 00 00 00 00 00 08 26 20 07 01 00 30 90 
            1B 6A 22 00 00 00 00 00 00 00 00 00 00 00 00 00 
            00 
<rcv> (002) 69 85

Thank you

CodingMerc
  • 41
  • 5
  • 6985 is conditions of use not satisfied. That generally means that the state of the card is not correct (e.g. authentication state) to perform the operation (rather than the APDU itself being at fault). That's about the only hint I can give you unfortunately. – Maarten Bodewes Jul 05 '20 at 19:44
  • Thank you Maarten, yes correct. The state conditions of use not satisfied according to EMV books will be response from card if more than 2 GENERATE APPLICATION CRYPTOGRAM will be sent. Additionally, if the cryptogram is not calculated based on CDOL. Do you know what could make state of the card to be not correct in this case? – CodingMerc Jul 05 '20 at 23:59
  • Have you checked the application usage control? is the card only for domestic usage? – Adarsh Nanu Jul 06 '20 at 02:44
  • Yes, I did, it supports both: 9F07 - Application Usage Control - FF C0. – CodingMerc Jul 06 '20 at 15:11
  • Are you sure you haven't simply exceeded Session Key counter limit? Regardless, both logs (the bad one and good one as well) seem incorrect - CVMR does not contain a compliant value and TVR does not indicate ODA wasn't performed. – Michal Gluchowski Jul 06 '20 at 15:30

0 Answers0