Gemplus Card Series Specification

Transcription

1 Gemplus Card Series Specification TX/NM WIC MPCOS EMV 64K Series Number: TBD Version /26/ :17:00 AM Prepared by: Rusty Stockton

2

3 Version History Version Date Remarks 0.01 June 1, 2001 Draft 1.00 June 21, 2001 Initial Version 1.01 June 27, 2001 Paragraph 4.3, Corrected discretionary data value for NM magnetic stripe. Paragraph 4.4.2, Added requirements to set the lock byte for byte addressing and to set the personalization flag , Added requirements to lock write and update access to EFIssuer , Changed the separator card requirements to indicate a yellow card. Appendix B, Changed the key forms to split the mother secret codes July 9, , Changed the location of the bar code (NM Cards only) to the reverse of the card July 19, 2001 Document Properties, changed card family to MPCOS EMV 64K. 1.2, Deleted reference to MPCOS EMV R4 and added reference to MPCOS EMV. 4.1, Deleted reference to MPCOS EMV R4 and added reference to MPCOS EMV , Deleted reference to MPCOS EMV R4 and added reference to MPCOS EMV , changed length of file , changed length of file and deleted reserved space from initialization description , corrected FDB July 20, , Corrected filename example , Corrected file length August 10, , Changed Program ID to variable data, added description of Program ID variable. 3, Added that the Program ID be supplied by the customer for each order of cards October 26, , Added secret code to protect DFWIC , Added CARDSC , Changed access conditions for DFWIC. Appendix B, Added MSC_CARDSC November 5, , Removed reference to R4 reference manual. 2.4 Corrected reference to number of secret codes. Gemplus Page 3 of 20

4 1.08 December 4, Changed the bar code type to Code Deleted the requirement for yellow separator cards. Changed the bar code type to Code December 11, Added edit checks and sort parameters for the file received from Texas Changed the bar code type back to Code 39 from Code 128. Gemplus Page 4 of 20

5 Table of Contents 1 INTRODUCTION OVERVIEW REFERENCED DOCUMENTS CARD DATA ELEMENTS PRIMARY ACCOUNT NUMBER (PAN) Program ID Card Sequence Number Check Digit CARD-IN-HAND CODE KEYS K System K Authentication K Signature SECRET CODES PRECONDITIONS PRE-PERSONALIZATION INPUT FILE FORMAT Size Structure SMART CARD SERIES REQUIREMENTS CARD BODY GRAPHICAL MAGNETIC STRIPE ELECTRICAL Initialization Pre-Personalization GRAPHICAL PERSONALIZATION Ultragraphics Embossing OTHER REQUIREMENTS Card Packaging APPENDIX A ALGORITHMS APPENDIX B KEY AND CODE VALUES Gemplus Page 5 of 20

6 1 Introduction 1.1 Overview This document defines the requirements for cards manufactured for the Texas and New Mexico Women-Infants-Children (TX/NM WIC) program. The cards produced for each State are functionally identical except as noted. 1.2 Referenced Documents MPCOS EMV Reference Manual, Version 3.1, Gemplus, 1999 Artwork and Prepress Guidelines, Version 3.0 English, Gemplus, Card Data Elements 2.1 Primary Account Number (PAN) Start TX Specific The PAN number is 19 digits in length and is provided for each card by the customer. End TX Specific Start NM Specific The PAN number is 16 digits in length and is formatted as follows: Digit Name NM BIN (constant) Program ID Card Sequence Number Check Digit Value X X Y Y Y Y Y Y Y Z End NM Specific Program ID Start NM Specific The Program ID is a two digit number that is used by the customer to identify the issuing agency. The customer specifies the Program ID for a production run when the cards are ordered. End NM Specific Card Sequence Number Start NM Specific The Card Sequence Number is a seven digit sequential number, incremented for each card produced. The customer specifies the beginning Card Sequence Number for a production run when the cards are ordered. End NM Specific Check Digit The Check Digit is a Mod-10 check digit of the previous PAN digits. This value is calculated for each card by Gemplus. Mod-10 check digit calculation is described in Appendix A. 2.2 Card-In-Hand Code Start TX Specific Gemplus Page 6 of 20

7 The Card-In-Hand Code is a two-digit code derived from the PAN number. The Card- In-Hand Code for each card is supplied by the customer. End TX Specific 2.3 Keys Three keys are required on the card K System The system key (K System ) is used to protect the card file system from unauthorized tampering and is described in detail in the MPCOS EMV Reference Manual K Authentication The WIC Authentication Key (K Authentication ) is used to authenticate the card during WIC transactions. K Authentication is diversified by card serial number from a mother key (MK Authentication ) as follows: K Authentication = 3DES_16(MK Authentication, [8-byte Card Serial Number]) The 3DES_16 algorithm is defined in Appendix A. The value of MK Authentication is defined in Appendix B K Signature The WIC Signature Key (K Signature ) is used to sign WIC transactions. K Signature is diversified by PAN number from a mother key (MK Signature ) as follows: K Signature = 3DES_16(MK Signature, [8 right-most ASCII digits of the PAN]) Note: The eight-byte diversification data for a card with the PAN would be 0x32 0x31 0x39 0x38 0x31 0x33 0x34 0x35. The 3DES_16 algorithm is defined in Appendix A. The value of MK System is defined in Appendix B. 2.4 Secret Codes Eleven secret codes are required on each card. CARDSC0 Cardholder PIN CARDSC1 PIN Unblock code CARDSC2 DF WIC Access WICSC0 WIC File Access WICSC1 WIC File Access WICSC2 WIC File Access WICSC3 WIC File Access WICSC4 WIC File Access WICSC5 WIC File Access WICSC6 WIC File Access WICSC7 WIC File Access Ten of the secret codes on each card are diversified from ten mother codes (the Cardholder PIN secret code is set to 0000 by Gemplus during personalization). The mother codes are essentially DES keys. MSC_CARDSC1 Gemplus Page 7 of 20

8 MSC_CARDSC2 MSC_WICSC0 MSC_WICSC1 MSC_WICSC2 MSC_WICSC3 MSC_WICSC4 MSC_WICSC5 MSC_WICSC6 MSC_WICSC7 Each card secret code is derived from its related mother secret code using the card serial number as the diversification data. Card Secret Code = DES(Mother Secret Code, [8-byte Card Serial Number]) 3 Preconditions The customer shall supply the following with each card order: The target State for which the cards are being produced (TX or NM). Card artwork in accordance with the Artwork and Prepress Guidelines. Start TX Specific One or more pre-personalization input files containing the card prepersonalization data. End TX Specific Start NM Specific Quantity of cards to produce. The Program ID for the cards. The starting Card Sequence Number. End NM Specific 3.1 Pre-personalization Input File Format Start TX Specific The customer shall supply a pre-personalization input file to Gemplus containing the PANs, Card-In-Hand codes and magnetic stripe data for each card to be produced Size The input file shall contain a maximum of one header record and 50,000 card records Structure The input file shall be an ASCII text file. The file shall contain a header record followed by one record for each card to be produced. Each record shall be followed with a CR/LF Header Record The header record is structured as follows: RECORDS=x Where x = the number of card records in the file. Gemplus Page 8 of 20

9 Card Record Each card record contains four fields: the card PAN, the Card-In-Hand code and magnetic strip track #2 information. The fields shall be separated by a (0x7C) character. The record is formatted as follows: Card PAN Card-In-Hand Code Track#2 data All fields are mandatory. The file must be sorted in sequential using the 8 th through 11 th digits and the 13 th through 16th of the Card Pan. The following edits will be performed on the file: Card Pan must be nineteen (19) digits in length and must be all numeric, Card-In-Hand Code must be two (2) digits in length and must be all numeric; Track #2 Data can be 1 to 37 numeric characters including the special characters ; = and?. If any of the edits fail for any record in the file the file will be rejected and an Error Log Report will be created indicating the record numbers that failed and the edits that failed for each record in the file. If a file failed, an Error Log Report will be sent back to the state and the original file will be deleted, only files that were edited successfully will be processed and sent on the plant for card production. The fields are formatted as follows: Card PAN Card-In-Hand Code Track #2 Data Fixed length, 19 numeric digits Fixed length, 2 numeric digits Variable length, 1 to 37 alphanumeric characters Naming The name of the file shall consist of an 8 character filename, a. character, and the three letter extension IMP. The 8-character filename consist of the letters TXW followed by a 5 digit batch number. The five digit batch number is assigned by the customer and shall be unique for each file submitted to Gemplus. Example: TXW00001.IMP End TX Specific 4 Smart Card Series Requirements 4.1 Card Body All cards will be shiny white PVC and constructed as described in the MPCOS EMV Reference Manual. The card will have a standard 3-track HI-CO magnetic stripe on the top of the reverse side of the card. The card will have a signature stripe. The customer shall define the position and dimension of the signature stripe when card artwork is submitted. 4.2 Graphical The customer shall supply appropriate artwork for each card order in accordance with the Artwork and Prepress Guidelines. The customer artwork shall be printed on the cards as indicated by the customer. 4.3 Magnetic Stripe Start TX Specific Gemplus Page 9 of 20

10 The data contained in the pre-personalization input file provided by the customer shall be used to encode #2 of the magnetic stripe. Track #1 and #3 is left unused. End TX Specific Start NM Specific Track #1 and #3 are unused. Track #2 is written as follows: Contents Length Value ABA Start Code 1 ; (0x5E) Card PAN 16 Field Separator 1 = (0x7E) Discretionary Data End of Text 1? (0x6F) ABA LRC 1 End NM Specific 4.4 Electrical Initialization The cards shall be initialized with the customer key card process defined in the MPCOS EMV Reference Manual. Start TX Specific The Issuer Reference number for the cards shall be 0x00 0x02 0x01. End TX Specific Start NM Specific The Issuer Reference number for the cards shall be 0x00 0x02 0x02. End NM Specific Pre-Personalization The following mapping shall be created on the card. Gemplus Page 10 of 20

11 Figure 1, Card Mapping. MasterFile DFSystem EFKey EFCardSC DFWIC EFCard EFIssuer EFWICSC EFWICAdmin EFHHDemog EFClientDemog EFClientCert EFClientImmun EFWICFP EFWICFPAccess EFWICTransCtr EFWICKeys The lock byte shall be modified so that the card is configured for a one-byte data unit (Data unit set to 1), and the Personalization Flag set (Bissuer[PERSO] set to 1) Master File Identifier: 0x3F00 Type: Root Dedicated File. Created during the default initialization flow. The Master File contains the following files DFSystem Identifier: 0x0100 Type: ISO Dedicated File Created during the default initialization flow. DFSystem contains the following files EFCard Identifier: 0x0101 Type: Transparent File (FDB: 0x01) Length: 12B Created and initialized during the default initialization flow EFIssuer Identifier: 0x0102 Type: Transparent File (FDB: 0x01) Length: 12B Created during the default initialization flow. The file shall be initialized as follows: Offset Length Contents 0 10 The card Primary Account Number (PAN) padded on Gemplus Page 11 of 20

12 the left with zeros to make 20 digits and stored in BCD format The constant 0x1313. Access conditions to this file shall be set so write and update is locked EFKey Identifier: 0x3F01 Type: Key File (FDB: 0xA9) Length: 24B Created and initialized during the default initialization flow EFCardSC Identifier: 0x3F02 Type: Secret Code File (FDB: 0x21) Length: 24B Security Access Conditions: o Read: Locked o Update: N/A o Write: N/A This file shall be created and initialized with three secret codes in plain mode as follows. Code Contents Description 0 CARDSC0 This secret code is the cardholder PIN and shall be initialized to 0x , MPN = 7, UBC = 0x01 (MF level, code 1). Once initialized the Secret Code Ratification counter must be set equal to MPN, locking the secret code. 1 CARDSC1 This secret code is the unblock secret code for the cardholder PIN (see paragraph 2.4) and shall be initialized with the derived code, MPN = 3, UBC = 0x01. 2 CARDSC2 This secret code is used for setting access conditions on DFWIC (see paragraph 2.4) and shall be initialized with the derived code, MPN = 3, UBC = 0x DFWIC Identifier: 0x1300 Type: ISO Dedicated File Security Access Conditions: o Create Data Files: Secure Messaging with K System and CARDSC2. o Created Sensitive Files: Secure Messaging with K System and CARDSC2. This dedicated file shall be created to contain the following files EFWICSC Identifier: 0x1301 Type: Secret Code File (FDB 0x21) Length: 64B Security Access Conditions: o Read: Locked Gemplus Page 12 of 20

13 o Update: N/A o Write: N/A This file contains eight secret codes used to establish access conditions on the files in DFWIC. The following secret codes shall be written in plain mode to the file. Code Contents Description 0 WICSC0 1 WICSC1 2 WICSC2 3 WICSC3 See paragraph 2.4 for the derived code, MPN = 3. All 4 WICSC4 UBCs should indicate the secret code itself. 5 WICSC5 6 WICSC6 7 WICSC EFWICAdmin Identifier: 0x1302 Type: Linear Variable File (FDB: 0x04) Length: 100B Security Access Conditions: o Read: Public o Update: Local Secret Code 0 o Write: Local Secret Code 0 This file shall be created and the following records appended: Record Length Contents 0 2B 0x0001 (constant) Major version number. 1 2B 0x0001 (constant) Minor version number. 2 8B (constant eight ASCII zeros) All remaining space in this file is reserved for future use EFHHDemog Identifier: 0x1303 Type: Transparent File (FDB: 0x01) Length: 348B Security Access Conditions: o Read: Local Secret Code 1 o Update: Local Secret Code 2 o Write: Local Secret Code 2 This file shall be created and all bytes set to NULL EFClientDemog Identifier: 0x1304 Type: Linear Fixed File (FDB: 0x02) Length: 336 Security Access Conditions: o Read: Local Secret Code 1 o Update: Local Secret Code 2 o Write: Local Secret Code 2 This file shall be created and shall have six 55B records appended. Each byte of each record shall be initialized to NULL. Gemplus Page 13 of 20

14 EFClientCert Identifier: 0x1305 Type: Linear Fixed File (FDB: 0x02) Length: 288 Security Access Conditions: o Read: Local Secret Code 3 o Update: Local Secret Code 7 o Write: Local Secret Code 7 This file shall be created and shall have six 47B records appended. Each byte of each record shall be initialized to NULL EFClientImmun Identifier: 0x1306 Type: Linear Fixed File (FDB: 0x02) Length: 2,112B Security Access Conditions: o Read: Local Secret Code 3 o Update: Local Secret Code 4 o Write: Local Secret Code 4 This file shall be created and shall have B records appended. Each byte of each record shall be initialized to NULL EFWICFP Identifier: 0x1307 Type: Linear Fixed File (FDB: 0x02) Length: 1,100B Security Access Conditions: o Read: Local Secret Code 5 o Update: Local Secret Code 6 o Write: Local Secret Code 6 This file shall be created and shall have five 219B records appended. Each byte of each record shall be initialized to NULL EFWICFPAccess Identifier: 0x1308 Type: Transparent File (FDB: 0x01) Length: 16B Security Access Conditions: o Read: Local Secret Code 5 o Update: Local Secret Code 7 o Write: Local Secret Code 5 This file shall be created and all bytes set to NULL EFWICTransCtr Identifier: 0x1309 Type: Transparent File (FDB: 0x01) Length: 8B Security Access Conditions: o Read: Local Secret Code 5 o Update: Local Secret Code 6 o Write: Local Secret Code 6 Gemplus Page 14 of 20

15 This file shall be created and all bytes set to NULL EFWICKeys Identifier: 0x130A Type: Secret Key File (FDB: 29) Length: 48 Security Access Conditions: o Read: Locked o Update: System Key o Write: System Key This file shall be created and the following keys loaded. Both keys are authentication keys and the ONC shall be disabled. Key Number Contents Description 0 K Signature See paragraph K Authentication See paragraph Graphical Personalization Ultragraphics Start NM Specific The PAN shall be printed as a Code 128 barcode on the back of the card. The barcode shall be positioned shall be centered vertically on a line 0.3 inch from the bottom of the card. The bar code shall be centered on a point 1.1 inch from the left edge of the card. The barcode shall be printed in black. End NM Specific Embossing Start TX Specific The PAN number shall be embossed on the front of the card on two lines. The first 16 digits of the PAN shall be embossed on the first line with a space inserted every four digits. The 16 digits shall be positioned at the top of the embossable area directly below the chip and centered horizontally. The last three digits of the PAN shall be embossed on the second line, directly below the first line, aligned directly under the first three digits of the first embossing line. Also on the second emboss line, the Card-In-Hand code shall be embossed aligned on the far right margin of the second emboss line. The PAN number shall be embossed using an OCR font, the Card-In-Hand code shall be embossed using an A/N font and all embossed numbers shall be tipped in blue. End TX Specific Start NM Specific The PAN number shall be embossed on the front of the card. The PAN number shall be embossed on one line with a space inserted every four digits. The embossed PAN shall be centered horizontally and positioned vertically at the top of the embossable area below the chip. The PAN number shall be embossed using an OCR font and all embossed numbers shall be tipped in black. End NM Specific Gemplus Page 15 of 20

16 4.6 Other Requirements Card Packaging The cards shall be packaged in re-closable boxes of 300 cards each. The cards in each box must be in sequential order beginning with the lowest number in front and the highest number in back. Each box shall be labeled with the starting and ending PAN numbers of the cards contained in the box. The stating and ending PAN number shall also be printed in a Code 39 barcode on this label. The boxes shall be packaged into cases containing up to 6 boxes (1,800 cards) of sequentially numbered cards. Each case shall be labeled with the starting and ending PAN numbers of the cards contained in the case. The stating and ending PAN number shall also be printed in a Code barcode on this label. Gemplus Page 16 of 20

17 Appendix A Algorithms MOD-10 Check Digit The Luhn method of calculating the Mod 10 check digit shall be used. DES The DES cryptographic algorithm is an industry standard algorithm and is described in detail in FIPS 46-3, Data Encryption Standard, DES The 3DES cryptographic algorithm is an industry standard algorithm and is described in detail in ANSI X , Triple Data Encryption Algorithm Modes of Operation, DES_16 The 3DES_16 notation is used to indicate that the data (8-bytes) is being encrypted using both halves of a 16-byte 3DES key in parallel. The Mother Key is used to encrypt the 8-byte data block twice to generate a new 16-byte Daughter Key as follows: MK1 = Left half of the Mother Key (the 8 most significant bytes) MK2 = Right half of the Mother Key (the 8 least significant bytes) 8 Byte Input Data MK1 DES DES MK2 MK2 DES-1 DES-1 MK1 MK1 DES DES MK2 8 MSB 8 LSB Daughter Key Gemplus Page 17 of 20

18 Appendix B Key and Code Values Key and code material shall be treated as sensitive and transmitted via dual channel. The following pages can be used to facilitate the exchange of this code and key material. Gemplus Page 18 of 20

19 Mother Key Left-Half Values All Values are in Hexadecimal MK Authentication Byte Value MK Signature Byte Value Mother Secret Codes Left Half Values All Values are in Hexadecimal MSC_CARDSC1 MSC_CARDSC2 MSC_WISSC0 MSC_WISSC1 MSC_WISSC2 MSC_WISSC3 MSC_WISSC4 MSC_WISSC5 MSC_WISSC6 Byte Gemplus Page 19 of 20

20 Mother Key Right-Half Values All Values are in Hexadecimal MK Authentication Byte Value MK Signature Byte Value Mother Secret Codes Right Half Values All Values are in Hexadecimal MSC_CARDSC1 MSC_CARDSC2 MSC_WISSC0 MSC_WISSC1 MSC_WISSC2 MSC_WISSC3 MSC_WISSC4 MSC_WISSC5 MSC_WISSC6 Byte Gemplus Page 20 of 20