Payment Security Guides

Technical guides to PIN security, DUKPT, card verification, payment MACs, ISO 8583, EMV, and regional payment standards.
Payment Security

MAC Algorithms in Payment Security: ISO 9797, HMAC & CMAC

A complete guide to Message Authentication Codes in banking — ISO 9797-1, Retail MAC, HMAC-SHA256, AES-CMAC, and how they protect transactions.
10 min read
Payment Security

Understanding PIN Block Formats (ISO 9564)

Deep dive into ISO 9564 PIN block formats (0, 1, 2, 3, 4), their security properties, and when to use each format.
7 min read
Payment Security

DUKPT Key Derivation: A Complete Tutorial

Master Derived Unique Key Per Transaction (DUKPT) from BDK to working keys, with step-by-step derivation examples.
12 min read
Payment Security

How CVV/CVC Values are Calculated

Understand the cryptographic process behind card verification values, including CVV1, CVV2, iCVV, and dynamic CVV/CVC3.
6 min read
Payment Security

ISO 8583 Payment Messages: Structure, Bitmap & Fields

Learn how ISO 8583 financial transaction messages work — MTI, bitmap parsing, data elements, response codes, and how PIN/MAC fit in.
9 min read
Payment Security

ISO 8583 Message Parser: MTI, Bitmap & Data Elements

How to parse ISO 8583 financial transaction messages — Message Type Indicator, bitmap decoding, data element definitions, and ATM NDC/Wincor formats.
9 min read
Payment Security

AS2805: Australian Payment Standard for Terminal Keys & MAC

Understanding the AS2805 standard — terminal key set generation, PIN block translation, MAC calculation methods, and OWF (HMAC-SHA256).
10 min read
Payment Security

AMEX CSC: Card Security Code Calculation (CSC3/CSC4/CSC5)

How American Express card security codes are calculated — CSC3, CSC4, CSC5 algorithms, differences from CVV, and AMEX-specific card characteristics.
7 min read
Payment Security

Mastercard Dynamic CVC3: EMV Verification & ATC

Understanding Mastercard's dynamic CVC3 — EMV verification process, Application Transaction Counter (ATC), Unpredictable Number, and Track data usage.
7 min read
Payment Security

DUKPT AES: Next-Generation Key Derivation for Payment Terminals

How AES-based DUKPT works — differences from TDEA-DUKPT, IK/BDK hierarchy, Working Key derivation, and migration from legacy DUKPT.
9 min read
Payment Security

PIN Block AES (Format 4): ISO 9564 with AES Encryption

How ISO 9564 Format 4 PIN blocks work — AES encryption of PINs, comparison with Format 0, and implementation considerations.
7 min read
Payment Security

PIN Offset (IBM 3624): PIN Verification & Decimalization

How IBM 3624 PIN verification works — Decimalization Table, PIN Offset calculation, validation methods, and comparison with PVV.
7 min read
Payment Security

PIN PVV (VISA): PIN Verification Value Calculation

How VISA's PIN Verification Value (PVV) system works — PDK encryption, PVKI selection, PVV calculation and verification, comparison with PIN Offset.
7 min read
Payment Security

ZKA: German Banking Standard for Session Keys & PIN

Understanding the ZKA standard — Session Key (SK-pac) derivation, PIN encryption, MAC calculation, and German payment terminal requirements.
8 min read
Payment Security

VISA Certificate Validation: CA Keys, Issuer Certificates & EMV

How VISA certificate validation works — VSDC CA public keys, Issuer Certificate verification, Signed Data validation, and EMV certificate chain.
9 min read
Back to Guides