Deeptrust for PCI security architecture  SPEC98T17 rev E
Specification of Deeptrust, the Security Architecture for Cortex-M.

List of functions

int pci_authenticate_issuer_and_icc_public_key (unsigned char *issuer_certificate, int issuer_certificate_len, unsigned char *issuer_remainder, int issuer_remainder_len, unsigned char *issuer_exponent, int issuer_exponent_len, unsigned char *icc_certificate, int icc_certificate_len, unsigned char *icc_remainder, int icc_remainder_len, unsigned char *icc_exponent, int icc_exponent_len, CertificationAuthorities *CA_key)
 Authenticates both issuer public key and ICC public key. More...
 
int pci_get_online_pin (unsigned char pan[], int pan_len, unsigned char encrypted_pin[], int *encrypted_pin_len)
 Gets the "online" PIN, i.e. encrypted with the DUKPT algorithm. The resulting encrypted PIN block is encoded into ISO 9564 Format 0. More...
 
int pci_pin_entry (int timeout_entry, int entry_device, int display_device)
 Displays a message to the user instructing to enter the PIN. Then gets the pin from the specified entry device. More...
 
int pci_verify_offline_pin (unsigned char challenge[], int challenge_len, int encrypt_mode, unsigned int timeout)
 Verifies user PIN using the Smart Card. More...
 

Detailed Description

This module is in charge of handling PIN entry and processing according to the applicable PCT-PTS-POI standard.

Function Documentation

§ pci_authenticate_issuer_and_icc_public_key()

int pci_authenticate_issuer_and_icc_public_key ( unsigned char *  issuer_certificate,
int  issuer_certificate_len,
unsigned char *  issuer_remainder,
int  issuer_remainder_len,
unsigned char *  issuer_exponent,
int  issuer_exponent_len,
unsigned char *  icc_certificate,
int  icc_certificate_len,
unsigned char *  icc_remainder,
int  icc_remainder_len,
unsigned char *  icc_exponent,
int  icc_exponent_len,
CertificationAuthorities CA_key 
)

Authenticates both issuer public key and ICC public key.

This function authenticates both issuer public key and ICC public key by a hardcoded Certification Authority Public key.

As per EMV Book2, ICC can use either ICC Public Key or ICC PIN Encipherment Key for Offline Pin Authentication.

EMV Application kernel Identifies which ICC Public key to be used for Offline PIN Encipherment. But, SHIDDaemon uses ICC key only after Successful Authentication. Since CA key is hard coded inside SHIDDaemon, Security is not compromised even when Application kernel provides part of keys and certificate as input to SHIDDaemon.

After use, the PIN buffered gets zeroed using memset.

Parameters
[in]issuer_certificateIssuer Public key certificate
[in]issuer_certificate_lenIssuer Public key certificate length
[in]icc_certificateICC Public key certificate
[in]icc_certificate_lenICC Public key certificate length
Returns
Error code

§ pci_get_online_pin()

int pci_get_online_pin ( unsigned char  pan[],
int  pan_len,
unsigned char  encrypted_pin[],
int *  encrypted_pin_len 
)

Gets the "online" PIN, i.e. encrypted with the DUKPT algorithm. The resulting encrypted PIN block is encoded into ISO 9564 Format 0.

It uses the PIN buffered using pci_pin_entry.

The context is checked so that only the right caller that has started the PIN entry process can call this function.

After use, the PIN buffered gets zeroed using memset, as well as DUKPT temporary buffers

Parameters
[in]store_idThe DUKPT store identifier
PINThe clear-text PIN
PANThe PAN
[in]PAN_lenThe PAN length
Returns
See error codes

§ pci_pin_entry()

int pci_pin_entry ( int  timeout_entry,
int  entry_device,
int  display_device 
)

Displays a message to the user instructing to enter the PIN. Then gets the pin from the specified entry device.

The PIN must be entered before a certain amount of time. If not, the function returns.

In case of error, no PIN data remains anywhere in memory. In case of success, the PIN data is kept during at most timeout_pin

Parameters
[in]timeout_entryThe timeout for the entry of the PIN by the user
[in]timeout_pinThe maximum time during which the PIN is kept in memory. Otherwise it gets zeroed using memset.
[in]entry_deviceThe entry device
[in]display_deviceThe display device
Returns
See error codes

§ pci_verify_offline_pin()

int pci_verify_offline_pin ( unsigned char  challenge[],
int  challenge_len,
int  encrypt_mode,
unsigned int  timeout 
)

Verifies user PIN using the Smart Card.

This function verifies encrypted pin block with ICC. This function receives Verify APDU header and embedded encrypted pin block before sending it to ICC.

Parameters
[out]Verify_APDU_ResAPDU response
Verify_APDU_Res_lenThe verify apdu resource length
[in]timeoutMaximum time allowed for APDU transaction. This value should be in Seconds.
Verify_APDU_ReqThe verify apdu request
[out]Verify_APDU_lenAPDU response length
Returns
Error code