ARQC - How it works
EMVFoundryWhen talking about ARQC, there are tools to compute correct results.
You see the fucking idiots, fuck-wits on YouTube talk about setting ARQC, it's alot more complicated than just entering dummy ARQC values and wish-me-luck, it works!
In EMVFoundry, it uses the actual algorithm. In EMVFoundry, customers are asking, why there is no 9F26 tag. There isn't any because EMVFoundry returns in-chip, the correct results.
We use NeaPay, BPTools, VSDC (Visa Developer and Certification tools) and MSCD (MasterCard Development Tools) live terminal to check/test. The other tools, like the ones promoted sold by others, don't work. That's because it's missing a lot of details.
What you are seeing here, is verification of the ARQC. It means, once you key in the same values, you will get same answer.
Let's say you want to check/test ARQC. You fill-in MDK, PAN and PSE from EMVFoundry.
Let's say your PSE is 05. For example:
Where are you going to change it here... ??
The next thing you do is go to the second tab called Session Key (EMV 2000) and enter the ATC number.
The ATC is the Transaction Counter. This ranges from 0001 (new card) to FFFF (65536, maximum number of transactions 65536)
Next, you enter the ATC again to "Session Key Tab".
The other number Unpredictable or Unknown number or Nonce - you don't enter it. This is filled-in by the Point of Sale or ATM.
The next tab, is filled-in by the Point of Sale System or ATM Terminal.
So, let's say for example, you change the date from 210819 to 210911 (in the future). the results are correct:
So a recap:
Tabs 1 (UDK), 2 (Session Key EMV 2000), 3 (Session Keys) are filled in by Card.
Tab 3: Unpredictable Number, Unknown Number or Nonce1/Nonce2 are filled in by Terminal.
Tab 4: Filled in by terminal.
Can I get Tab 3 and Tab 4 Data?
Yes you can, you set the your live terminal to DEBUG mode. It will print the UN (Unknown Number), ATC and so on.
Where do I get the MDK as in Tab 1?
It's hidden inside your card, it's a number that cannot be read.
Can I guess UN (Unpredictable Number)?
Not a chance. The number varies from terminal to terminal, and is nearly random.
Why is UN also called Nonce1, Nonce2, Unknown Number?
UN is supplied by the terminal to perform a ARQC command. The UN is also called Unknown Number, Unpredictable Number.
It is also called Nonce1, Nonce2 because it is actually a combination of 2 16-bit numbers. (2 16-bit numbers = 1 32-bit number)
Where can I find the MDK?
You can find known MDKs from test-keys. In real credit cards, they are completely different from test-keys. You need to find that out for yourself.
How does ARQC work for ATMs?
The ATM simulates a $1 dollar transaction with 9C = 05 (ATM). It will cause your ATC to increase.
So:
- you insert once, let's say your ATC = 51
- ATM does an ARQC and read the card ATC again. ARQC is wrong.
- ATM expects ATC = 52. You use X2 and ATC is fixed and ATC doesn't increment. Card rejected.
EMVFoundry (Archives)
https://telegra.ph/EMVFoundry-2003-08-15
EMVFoundry (Latest)
https://telegra.ph/EMVFoundry-2005-Release-Notes-09-04