Visa Smart Debit and Credit (VSDC)

Personalization Specification
Requirements for Common Personalization of
Visa Integrated Circuit Card Specification (VIS) and
Visa Contactless Payment Specification (VCPS)
Applications

Version 1.0
March 2009

March 2009 Visa Confidential

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Version 1.0 Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications

THIS SPECIFICATION IS PROVIDED ON AN “AS IS”, “WHERE IS”, BASIS, “WITH ALL
FAULTS” KNOWN AND UNKNOWN. TO THE MAXIMUM EXTENT PERMITTED BY
APPLICABLE LAW, VISA EXPLICITLY DISCLAIMS ALL WARRANTIES, EXPRESS OR
IMPLIED, REGARDING THE LICENSED WORK AND TITLES, INCLUDING ANY
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, AND NON-INFRINGEMENT.
THE INFORMATION CONTAINED HEREIN IS PROPRIETARY AND CONFIDENTIAL
AND MUST BE MAINTAINED IN CONFIDENCE IN ACCORDANCE WITH THE TERMS
AND CONDITIONS OF THE WRITTEN AGREEMENT BETWEEN YOU AND VISA INC.,
VISA INTERNATIONAL SERVICE ASSOCIATION, AND/OR VISA EUROPE LIMITED.

Page ii Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Contents
Requirements for VIS and VCPS Applications
Version 1.0

Contents
1 Introduction ..................................................................................................................1-1
1.1 Purpose .......................................................................................................................1-1
1.2 Scope...........................................................................................................................1-1
1.3 Audience......................................................................................................................1-2
1.4 Reference Materials.....................................................................................................1-3
1.5 Terminology and Conventions .....................................................................................1-5
1.5.1 Notation............................................................................................................1-5
1.5.2 Document Word Usage....................................................................................1-5
1.5.3 Notation for the Presence of Tags in Commands and Responses ..................1-6
1.6 Document Organization ...............................................................................................1-7
2 Overview of the Personalization Process ..................................................................2-1
2.1 Card Personalization Data Processing ........................................................................2-1
2.1.1 Overview of the Process ..................................................................................2-1
2.1.2 The Infrastructure of Card Personalization ......................................................2-4
2.1.3 Secure Messaging ...........................................................................................2-4
2.1.4 The STORE DATA Command.............................................................................2-5
3 Data Preparation ..........................................................................................................3-1
3.1 Issuer Master Keys and Related Data .........................................................................3-2
3.2 Application Keys and Certificates ................................................................................3-2
3.3 Application Data...........................................................................................................3-2
3.3.1 Data Grouping Identifiers (DGIs)......................................................................3-3
4 VSDC-Specific Personalization Requirements..........................................................4-1
4.1 Requirements for Global VSDC Cards Using EMV CPS .............................................4-1
4.2 VSDC Requirements When EMV CPS Offers Options................................................4-1
4.3 Requirements for Global VCPS Cards.........................................................................4-2
4.4 Requirements for VSDC GlobalPlatform Applets Using EMV CPS .............................4-2
4.5 Common Personalization DGIs for VSDC ...................................................................4-2
4.6 Record Formats for VSDC ...........................................................................................4-2
4.6.1 Ending Personalization Processing..................................................................4-3
5 Application and Personalization Keys .......................................................................5-1
5.1 Summary of EMV CPS Personalization Keys..............................................................5-1
5.2 VSDC Application Keys – Post Personalization...........................................................5-3
6 DGIs for VIS ..................................................................................................................6-1
7 DGIs for VCPS (PPSE, qVSDC and MSD)...................................................................7-1
7.1 DGIs for PPSE .............................................................................................................7-1
7.2 DGIs for qVSDC and MSD ..........................................................................................7-2

March 2009 Visa Confidential Page iii

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Contents Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

7.2.1 DGIs for Record Data.......................................................................................7-4

7.2.2 DGIs for Internal Data ......................................................................................7-7
7.2.3 DGIs for DES Key Data....................................................................................7-8
7.2.4 DGIs for RSA Keys ..........................................................................................7-9
7.2.5 DGIs for Command Response Data ..............................................................7-10
7.3 Conditional Requirements Chart................................................................................7-12
8 Common Data Elements: VIS, qVSDC and MSD .......................................................8-1
8.1 DGI '0101' – Record Data ............................................................................................8-1
8.2 DGI '0201' – Record Data ............................................................................................8-1
8.3 DGI '0202' – Record Data ............................................................................................8-2
8.4 DGI '0301' – Record Data ............................................................................................8-3
8.5 DGI '0E01' – Internal Data ...........................................................................................8-4
8.6 DGI '8000' and '9000' – DES Keys and Key Check Values .........................................8-6
8.7 DGI '8001' – Alternate UDK for dCVV..........................................................................8-6
8.8 DGI '8101' and '8103' – ICC Key (Modulus/Exponent Format)....................................8-7
8.9 DGI '8201' through '8205' – ICC Key (CRT Format) ....................................................8-7
8.10 DGI '9102' and '9103' – SELECT Response..................................................................8-8
8.11 DGI '9200' – Issuer Application Data ...........................................................................8-8
8.12 DGI '9206' – MSD GPO Response Data .....................................................................8-9
8.13 DGI '9207' – qVSDC Response Data ..........................................................................8-9
A Personalization for Issuer Discretionary Data.......................................................... A-1
B Multi-application BLOCK/UNBLOCK Examples ....................................................... B-1
C Subset of EMV CPS for Contactless-only Implementations ................................... C-1
C.1 Data Preparation......................................................................................................... C-1
C.1.1 Issuer Master Keys and Data.......................................................................... C-2
C.1.2 Application Keys and Certificates.................................................................... C-2
C.1.3 Application Data .............................................................................................. C-3
C.2 Interface: Personalization Device to ICC .................................................................... C-3
C.2.1 Key Management ............................................................................................ C-3
C.2.2 Processing Flow (Commands) ........................................................................ C-5
C.2.3 Command Responses................................................................................... C-10
C.3 IC Card Personalization Processing ......................................................................... C-10
C.3.1 Preparation for Personalization (Pre-Personalization) .................................. C-10
C.3.2 Personalization Requirements ...................................................................... C-12
C.4 Cryptography for Personalization.............................................................................. C-13
C.4.1 Security Principles......................................................................................... C-13
C.4.2 Session Keys ................................................................................................ C-13
C.4.3 MACs ............................................................................................................ C-14
C.4.4 Encryption ..................................................................................................... C-17
Page iv Visa Confidential March 2009
Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Contents
Requirements for VIS and VCPS Applications
Version 1.0

C.4.5 Decryption ..................................................................................................... C-17

C.4.6 Triple DES Calculation .................................................................................. C-17
D Personalization Examples.......................................................................................... D-1
D.1 Proximity Payment System Environment (PPSE)....................................................... D-2
D.2 Payment Application (qVSDC and MSD).................................................................... D-3
D.3 Responses after Personalization .............................................................................. D-12
D.3.1 Select PPSE.................................................................................................. D-12
D.3.2 Select Payment Application .......................................................................... D-13
D.3.3 GPO Responses ........................................................................................... D-13
Glossary........................................................................................................................Glossary-1

March 2009 Visa Confidential Page v

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Tables Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Tables
Table 5-1 – VSDC Personalization Keys ...................................................................................5-1
Table 5-2 – VSDC Application Keys ..........................................................................................5-3
Table 6-1 – Data Grouping Identifiers for VIS............................................................................6-2
Table 6-2 – Data Content for DGI '0101' (Track 2 Equivalent Data) ..........................................6-4
Table 6-3 – Data Content for DGI '0102' (Track 2 Equivalent Data with alternate
Cardholder Name)..............................................................................................................6-4
Table 6-4 – Data Content for DGI '0201' (Data Authentication Certificate)................................6-5
Table 6-5 – Data Content for DGI '0202' (Additional Data Authentication Data)........................6-5
Table 6-6 – Data Content for DGI '0203' (Signed Static Application Data (SAD) ......................6-5
Table 6-7 – Data Content for DGI '0204' (Dynamic Authentication Certificate) .........................6-5
Table 6-8 – Data Content for DGI '0205' (Additional Dynamic Authentication Data) .................6-5
Table 6-9 – Data Content for DGI '0207' (ICC PIN Encipherment Certificate)...........................6-6
Table 6-10 – Data Content for DGI '0208' (Additional ICC PIN Encipherment Data).................6-6
Table 6-11 – Data Content for DGI '02nn' (Duplicate SAD) .......................................................6-6
Table 6-12 – Data Content for DGI '02nn' (Duplicate Data Authentication Data) ......................6-6
Table 6-13 – Data Content for DGI '02nn' (Duplicate Data Authentication Data) ......................6-6
Table 6-14 – Data Content for DGI '0301' (Card Risk Management Data) ................................6-7
Table 6-15 – Data Content for DGI '0302' (Additional Card Risk Management Data) ...............6-7
Table 6-16 – Data Content for DGI '0303' (Cardholder Verification Method List) ......................6-8
Table 6-17 – Data Content for DGI '03nn' (Duplicate Card Risk Management Data) ................6-8
Table 6-18 – Data Content for DGI '0401' (Terminal Velocity Checking Card Data) .................6-8
Table 6-19 – Data Content for DGI '0B01' (VLP Data) ..............................................................6-9
Table 6-20 – Data Content for DGI '0D01' (Application Internal Data).....................................6-10
Table 6-21 – Data Content for DGI '0E01' (Additional Application Internal Data) ....................6-10
Table 6-22 – Data Content for DGI '0E02' (Application Linkage for Block/Unblock)................6-11
Table 6-23 – Data Content for DGI '0Enn' (Duplicate Application Internal Data).....................6-11
Table 6-24 – Data Content for DGI '3000' (Application Common Internal Data)......................6-11
Table 6-25 – Data Content for DGI '9200' (GENERATE AC Response Data) ............................6-11
Table 6-26 – Data Content for DGI '9203' (GPO Response Data for VLP)..............................6-11
Table 7-1 – DGI for PPSE..........................................................................................................7-1
Table 7-2 – Data Content for DGI '9102'....................................................................................7-1
Table 7-3 – DGIs for qVSDC and MSD Application Paths.........................................................7-2

Page vi Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Tables
Requirements for VIS and VCPS Applications
Version 1.0

Table 7-4 – Data Content for DGI '0101' (MSD) ........................................................................7-4

Table 7-5 – Data Content for DGI '0201' (qVSDC with fDDA) ...................................................7-5
Table 7-6 – Data Content for DGI '0202' (qVSDC with fDDA) ...................................................7-6
Table 7-7 – Data Content for DGI '0301' (fDDA)........................................................................7-6
Table 7-8 – Data Content for DGI '0E01' (Application Internal Data).........................................7-7
Table 7-9 – Data Content for DGI '0E02' (Application Linkage for Block/Unblock)....................7-8
Table 7-10 – Data Content for DGI '8000' (DES Keys) ..............................................................7-8
Table 7-11 – Data Content for DGI '9000' (DES Key Check Values, Optional) .........................7-8
Table 7-12 – Data Content for DGI '8001' (Alternate UDK for dCVV)........................................7-9
Table 7-13 – Data Content for DGI '8101' and '8103' (RSA Keys : Mod/Exp) ...........................7-9
Table 7-14 – Data Content for DGI '8201' through '8205' (RSA Keys : CRT) ............................7-9
Table 7-15 – Data Content for DGI '9102' (Select Response - Both or Contact Only).............7-10
Table 7-16 – Data Content for DGI '9103' (Select Response - Optional Contactless).............7-10
Table 7-17 – Data Content for DGI '9200' (Issuer Application Data) .......................................7-11
Table 7-18 – Data Content for DGI '9206' (MSD GPO Response Data)..................................7-11
Table 7-19 – Data Content for DGI '9207' (qVSDC GPO Response Data)..............................7-11
Table 7-20 – Description of Conditional Presence of Data Elements ......................................7-12
Table 8-1 – Common Data Elements for DGI '0E01' .................................................................8-4
Table 8-2 – VLP Available Funds Personalization .....................................................................8-6
Table A-1 – Issuer Discretionary Data Personalization Options in VIS and VCPS................... A-1
Table B-1 – Example of Linking for Both Block and Unblock.................................................... B-2
Table B-2 – Example of Linking for Unblock Only .................................................................... B-2
Table B-3 – Example of Mixed Linking for Block Only, Unblock Only and Both ....................... B-3
Table C-1 – Key Derivation Data (tag 'CF')............................................................................... C-2
Table C-2 – Personalization Keys............................................................................................. C-4
Table C-3 – INITIALIZE UPDATE Command Coding .................................................................... C-6
Table C-4 – Response to INITIALIZE UPDATE command ............................................................ C-6
Table C-5 – Initial Contents of KEYDATA................................................................................. C-7
Table C-6 – EXTERNAL AUTHENTICATE Command Coding ........................................................ C-8
Table C-7 – Status Conditions for EXTERNAL AUTHENTICATE Command .................................. C-8
Table C-8 – STORE DATA Command Coding............................................................................. C-9
Table C-9 – Status Conditions for STORE DATA Command..................................................... C-10
Table C-10 – Derivation Data for Session Keys ..................................................................... C-14

March 2009 Visa Confidential Page vii

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Figures Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Figures
Figure 2-1 – Entities in the Personalization Process .................................................................2-2
Figure 5-1 – VSDC Personalization Key Usage ........................................................................5-4
Figure C-1 – Personalization Command Flow .......................................................................... C-5
Figure C-2 – C-MAC Computation.......................................................................................... C-16

Page viii Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 1 Introduction
Requirements for VIS and VCPS Applications
Version 1.0

1 Introduction
1.1 Purpose
Common Personalization as specified in the EMV Card Personalization Specification
(reference [EMV CPS]) documents a common approach to personalization for any card
application. It also includes requirements for personalization of EMV-based financial
applications such as Visa Integrated Circuit Card Specification (reference [VIS]) or Visa
Contactless Payment Specification (reference [VCPS] ) applications.
This specification describes additional personalization instructions specific to VSDC (for
applications based on either [VIS] or [VCPS]), including definitions of Data Grouping
Identifiers (DGIs) specific to VSDC applications. It also describes optional [EMV CPS]
functionality that is not supported for VSDC, and a subset of [EMV CPS] personalization
that is sufficient for personalization of [VCPS] for issuance in specific markets.
This document does not address requirements specific to Visa’s VSDC Global Platform
Applet other than the requirement in section 4.4.
[EMV CPS] is highly recommended for IC card implementations supporting VSDC
applications.

1.2 Scope
In this specification, card personalization means the use of data personalization
commands that are sent to a card that already contains Visa financial (and optional PSE
and if contactless is supported, PPSE) applications. This is sometimes referred to as
“on-card” personalization. The specification does not cover cards where an application
load file is personalized before being loaded onto the card.
In terms of the lifecycle of the card, card personalization is assumed to take place after
pre-personalization (see Definitions) and prior to card issuance. Other card
personalization activities such as embossing, magnetic stripe encoding, and the
personalization of non-IC applications are not covered by this specification.
In terms of the lifecycle of the personalization data, card personalization is defined by
[EMV CPS] in terms of two interfaces – the interface between the data preparation
system and the personalization device, and the interface between the personalization
device and the IC.

March 2009 Visa Confidential Page 1-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
1 Introduction Card Personalization Specification for VSDC
1.3 Audience Requirements for VIS and VCPS Applications
Version 1.0

This specification will concentrate on the interface between the personalization device
and the IC card, defining the data elements and security requirements for this process.
This document will cover VIS, qVSDC (including the optional Offline qVSDC feature),
MSD (including the optional dCVV feature), and PPSE
It is assumed that personalization commands are principally handled by the card
application, rather than at the card level (that is, operating system). Some dialogue
between the card and personalization device may occur at the card level before the
application is selected (for example, to identify the card issuer).

1.3 Audience
This specification is intended for the following audiences:
 Data Preparation Providers and Personalization Bureaus
 Defines data preparation requirements for VSDC
 Designers of VSDC applications based on [VIS] and [VCPS]
 Specifies default file and record structure for VSDC applications

Page 1-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 1 Introduction
Requirements for VIS and VCPS Applications 1.4 Reference Materials
Version 1.0

1.4 Reference Materials

The following documents are referenced in this specification.

EMV Integrated Circuit Card Specification for Payment Systems

Version 4.2, June 2008
[EMV Book 1] Book 1 – Specification for Application Independent ICC to Terminal
Interface Requirements
[EMV Book 3] Book 3 – EMV Specification for the ICC Application
These documents, including Bulletins, are available at:
http://www.emvco.com
[EMV CPS] EMV Card Personalization Specification
Version 1.1, July 2007
Specification for a common approach to personalization for all IC card
applications. This document is based on EMV CPS Version 1.0 which
replaced the Visa Common Personalization Specification.
The current specification is available for download from:
http://www.emvco.com/specifications.asp
[FIPS 46-3] FIPS PUB 46-3
Federal Information Processing Standards Publication
Data Encryption Standards (DES)
[ISO 7816] ISO/IEC 7816-3:1997
Identification cards – Integrated circuit(s) cards with contacts – Part 3:
Electronic signals and transmission protocols
[ISO 9797] ISO/IEC 9797-1:1999
Information Technology – Security Techniques – Message Authentication
Codes – Part 1: Mechanisms using a block cipher
[ISO 10116] ISO/IEC 10116:1997
Information Technology – Modes of Operation of an n-bit block cipher
algorithm
[ISO 14443-4] ISO/IEC 14443-4:2008
Identification cards – Contactless integrated circuit(s) cards – Proximity
cards – Part 4: Transmission protocol
[ISO 18033-3] ISO/IEC 18033-3:2005
Information technology – Security techniques – Encryption algorithms –
Part 3: Block ciphers
[VIS] Visa Integrated Circuit Card Specification
Version 1.4.1, June 2008
Provides technical detail related to Visa Smart Debit/Credit transactions
and the functions performed by the contact chip card.
This document is available under license and can be requested by
sending an email to [email protected] with the keyword "register" in
the subject line.
March 2009 Visa Confidential Page 1-3
Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
1 Introduction Card Personalization Specification for VSDC
1.4 Reference Materials Requirements for VIS and VCPS Applications
Version 1.0

[VCPS] Visa Contactless Payment Specification

Version 2.0.2 July 2006, Including Additions and Clarifications 3.0, August
2007.
Provides technical detail related to Visa PayWave transactions and the
functions performed by the contactless chip card.
This document is available under license and can be requested by
sending an email to [email protected] with the keyword "register" in
the subject line.

Page 1-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 1 Introduction
Requirements for VIS and VCPS Applications 1.5 Terminology and Conventions
Version 1.0

1.5 Terminology and Conventions

1.5.1 Notation
The following notations apply:

'x' Hexadecimal Values expressed in hexadecimal form are enclosed

Notation in single quotes ('_'). For example, 27509 decimal is
expressed in hexadecimal as '6B75'.
Letters used to express constant hexadecimal values
are always upper case ('A' - 'F'). Where lower case is
used, the letters have a different meaning explained
in the text.
Length Fields Length fields are “big-endian” encoded. For example
if a two-byte length field has a hexadecimal value of
'13F' (319 in decimal), it is encoded as '013F'.
:= Assignment (of a value to a variable).
( ) or [ ] Ordered set (of data elements).
B1 B2 Concatenation of bytes B1 (the most significant byte) and B2 (the least
significant byte).
[B1 B2] Value of the concatenation of bytes B1 and B2.
DES3( )[ ] The data in the square brackets is encrypted using triple DES
encryption and the key in the normal brackets. Triple DES consists of
encrypting an 8-byte plaintext block X to an 8-byte cipher-text block Y
using a double length (16-byte) secret key K = (KL || KR) where KL and
KR are DES keys. This is done as follows:
Y := DES3(K)[X] := DES(KL)[DES-1(KR)[DES(KL)[X]]]

1.5.2 Document Word Usage

The following words are used often in this document and have specific meanings:

“Shall” or Defines a product or system capability that is required, compelled and

“Must” mandatory.
“Should” Defines a product or system capability that is highly recommended.
“May” Defines a product or system capability that is optional.

March 2009 Visa Confidential Page 1-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
1 Introduction Card Personalization Specification for VSDC
1.5 Terminology and Conventions Requirements for VIS and VCPS Applications
Version 1.0

1.5.3 Notation for the Presence of Tags in Commands and Responses

M (Mandatory) Indicates that the data element must always be present
and the terminal must check for its presence.
R (Required) Indicates the data element must always be present;
however, the terminal does not check that the data element
is present.
Cx (Conditional) Indicates that the data element is necessary under certain
conditions. When the data element is necessary, it is not
mandatory that the terminal check that the data element is
present. The ‘x’ indicates the item number in Table 7-20, in
which the condition is described.
O (Optional) Indicates that the data element is optional.
Ox (Optional on Indicates that the data element is optional, and only used
condition) under certain conditions. The ‘x’ indicates the item number
in Table 7-20, in which the condition is described.

Page 1-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 1 Introduction
Requirements for VIS and VCPS Applications 1.6 Document Organization
Version 1.0

1.6 Document Organization

The document is organized as follows:
 Section 1 describes the document, includes a list of references, and explains the
terminology and notations used throughout the remainder of the document.
 Section 2 provides an overview of the personalization process.
 Section 3 describes the common data preparation process and provides details
specific to VSDC.
 Section 4 describes specific requirements for the VSDC card application, including
the requirements for VSDC implementations when the [EMV CPS] specification
offers options.
 Section 5 describes the keys used in the personalization process.
 Section 6 describes the recommended DGIs for [VIS].
 Section 7 describes the recommended DGIs for [VCPS] (PPSE, qVSDC, and MSD).
 Section 8 further explains the use of data elements that may be common to [VIS],
qVSDC, and MSD.
 Appendix A discusses Personalization Requirements for Issuer Discretionary Data
(IDD).
 Appendix B describes the delivery method for information about linking multiple
applications for blocking and unblocking of the applications.
 Appendix C describes a subset of [EMV CPS] personalization that is sufficient for
personalization of [VCPS] for issuance in specific markets. Vendors should check
with their Visa regional representative before implementing to the requirements of
this appendix instead of a full implementation of [EMV CPS].
 Appendix D provides a personalization log showing the [EMV CPS] subset, defined
in this document, used on a card supporting PPSE, qVSDC and MSD (with optional
[VIS]).
 Glossary – Defines acronyms and terminology used in this specification.

March 2009 Visa Confidential Page 1-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
1 Introduction Card Personalization Specification for VSDC
1.6 Document Organization Requirements for VIS and VCPS Applications
Version 1.0

Page 1-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 2 Overview of the Personalization Process
Requirements for VIS and VCPS Applications
Version 1.0

2 Overview of the Personalization Process

2.1 Card Personalization Data Processing
2.1.1 Overview of the Process
The personalization process involves the following elements: taking issuer data that
defines application features to be used and how they work; issuer data related to the
cardholder; certificates and keys to be used by the applications; magnetic stripe data;
potentially art work and text that may be put onto the card; data the issuer desires to
emboss onto the card; instructions to control the personalization equipment [called:
Personalization Device Instructions (PDI)]; and Hardware Security Modules. The Issuer
and vendors involved in the personalization process will define the best organization of
the tasks and element usage necessary to personalize their product within established
regulations necessary to perform these tasks in a secure fashion.
The elements of personalization processing consist of the following three functional
areas:
 Data preparation
 Personalization device set-up and processing
 IC card application processing.
These steps and the interfaces between them are briefly described below, and
discussed in more detail in subsequent sections. Additional details of personalization
processing may be found in [EMV CPS].

March 2009 Visa Confidential Page 2-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
2 Overview of the Personalization Process Card Personalization Specification for VSDC
2.1 Card Personalization Data Processing Requirements for VIS and VCPS Applications
Version 1.0

Figure 2-1 – Entities in the Personalization Process

Data Preparation
Data preparation is the process that takes data extracted from issuer databases or
generated by the issuer in the fulfillment file and prepares it to be placed in an IC card
application during card personalization. Some of the data created may be the same
across all cards in a batch; other data may vary by card. Some data, such as keys, may
be secret and may need to be encrypted at all times during the personalization process.
Data preparation may be a single process or it may require interaction between multiple
systems.
Much of the definition of data preparation is application specific. This document focuses
on the data preparation processes that are commonly used for IC cards. Section 3
provides a detailed description of VSDC data preparation requirements.

Page 2-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 2 Overview of the Personalization Process
Requirements for VIS and VCPS Applications 2.1 Card Personalization Data Processing
Version 1.0

Interface: from Data Preparation to Personalization Device

With the exception of real-time personalization, the output of the data preparation
process is a file of personalization data, which is passed to the personalization device.
The data preparation system must protect the completed personalization data file for
privacy, integrity and authenticity (using a transport key and, for example, a MAC or
signed hash).

Personalization Device
A personalization device is made up of hardware and software that is capable of acting
on Personalization Device Instruction data to control how personalization data is
selected and then sent to the IC card application. For most IC card personalization
processes, this equipment must have access to a security module (HSM) to establish
and operate a secure channel between the personalization device and the application on
an IC card. The secure channel services consist of MAC verification/generation (for
example, for the EXTERNAL AUTHENTICATE command), and decryption and re-encryption
of secret data such as keys. Personalization device processing is described in
[EMV CPS], and a summary of the usage for keys in personalization is described in
section 5.1 of this specification.
The personalization device processing is designed to be application independent. All of
the processing is the same regardless of the application being personalized.

Interface: from Personalization Device to ICC

The personalization device sends a series of personalization commands that contain
identifiers, instructions, and data to the ICC. The personalization device also evaluates
the ICC response to each of the commands to determine success or failure of the
command. The personalization device must take appropriate action when failed
commands are encountered. The personalization command flow is shown in
[EMV CPS].

The IC Card Application

The IC card application receives the personalization commands from the personalization
device and stores data found in those commands in designated application locations, for
use when the IC card application becomes operational.
[EMV CPS] describes the processing requirements for an IC card application that must
be performed prior to the start of personalization. The actual processing of the IC card
prior to personalization (pre-personalization) is outside the scope of this specification.
However it is assumed that the IC card application will have all necessary keys
established for personalization prior to the start of the personalization process.

March 2009 Visa Confidential Page 2-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
2 Overview of the Personalization Process Card Personalization Specification for VSDC
2.1 Card Personalization Data Processing Requirements for VIS and VCPS Applications
Version 1.0

2.1.2 The Infrastructure of Card Personalization

The personalization process, described in [EMV CPS], is designed to facilitate the
personalization of applications on IC cards. It creates a personalization infrastructure
that allows for upgrades to the applications without requiring a change to the
personalization device. This personalization process can also be extended to other
applications in a generic way.
The personalization infrastructure consists of:
 Standard security between the personalization device and the IC card. This is
summarized in section 2.1.3.
 Standard commands for sending personalization data to the IC card application.
These are summarized in section 2.1.4.
 A standard record format for the personalization data sent to the personalization
device.
Appendix C describes a subset of the EMV Card Personalization Specification that is
applicable for personalization of a Visa qVSDC and MSD card as described in this
document, which is intended for specific markets. Contact your regional representative
to determine whether Appendix C is a sufficient implementation of [EMV CPS] for the
markets for your product. Vendors already supporting [EMV CPS] should be able to
support cards that only use the subset without changing their existing systems.

2.1.3 Secure Messaging

At the beginning of personalization, a personalization device must establish a secure
channel between the personalization device and the IC card application. The commands
used to establish this secure channel are the INITIALIZE UPDATE command and the
EXTERNAL AUTHENTICATE command. These commands are described in [EMV CPS].
Two derived keys on the IC card are used during the establishment of the secure
channel. These are the KENC and the KMAC. The KENC is used to generate a session key
SKUENC that is in turn used to create and validate authentication cryptograms. The KMAC
is used to generate a session key SKUMAC that is in turn used to generate a MAC across
the EXTERNAL AUTHENTICATE command. Both of these keys are derived from the same
master key, the KMC. The IC card provides the personalization device with the
identifiers of the KMC and the derivation data used to create the derived keys. The
identification of the KMC and creation of derived keys is described in [EMV CPS]. Once
a secure channel is established, personalization data can be sent to the IC card
application. For non-secure instant issuance environments the SKUENC may also be
used to encrypt the commands (APDUs) between the card and the personalization
device.

Page 2-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 2 Overview of the Personalization Process
Requirements for VIS and VCPS Applications 2.1 Card Personalization Data Processing
Version 1.0

2.1.4 The STORE DATA Command

This command is used to send personalization data to the card application; it is
described in detail in [EMV CPS].
In order to reduce personalization time, the data preparation process organizes the
personalization data to be sent to an IC card application by the personalization device
into data groupings.
Some data groupings will contain data that must be kept secret during transmission from
the personalization device to the card application; this can be done using a secret key
known on both sides of this interface. In this case an additional derived key (KDEK) on the
IC card is used to generate a session key SKUDEK. The KDEK is derived from the same
master key (KMC) as the KENC and KMAC. The IC card provides the personalization
device with the identifiers of the KMC and the derivation data used to create the derived
key. The SKUDEK may be used for this encryption.

March 2009 Visa Confidential Page 2-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
2 Overview of the Personalization Process Card Personalization Specification for VSDC
2.1 Card Personalization Data Processing Requirements for VIS and VCPS Applications
Version 1.0

Page 2-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 3 Data Preparation
Requirements for VIS and VCPS Applications
Version 1.0

3 Data Preparation
The data preparation process creates the Personalization Data Instruction (PDI) data
that is used to direct the personalization process and also the application data that is
used to personalize the IC card application. Data produced by the data preparation
process must be transported securely to the personalization device itself (unless it is
created in an HSM attached to the personalization device). Any secret data created by
the data preparation process remotely from the personalization device must therefore be
encrypted under a transport key before transmission, and all data files generated
remotely from the personalization device must be protected by a Message
Authentication Code (MAC) (to ensure integrity) before transmission.

Note: Visa has a tool to assist issuers with personalization, the VSDC Personalization
Assistant (VPA), which may be mandated in some regions. Contact your local
Visa representative for more information.

The data preparation process has the steps listed below:

1. Gathering personalization data from the issuing sources.
2. Generating additional data tags required by the ICC application
3. Generating any application specific keys and certificates
4. Combining personalization data into data groupings.
5. Encrypting and MACing personalization as needed.
6. Creating personalization equipment instructions.
7. Creating data to be logged for the application.
8. Creating the input file to the personalization device.

Personalization data generation is controlled by three artifacts:

 Issuer Master Keys and Data
 Application Keys and Certificates
 Application Data

March 2009 Visa Confidential Page 3-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
3 Data Preparation Card Personalization Specification for VSDC
3.1 Issuer Master Keys and Related Data Requirements for VIS and VCPS Applications
Version 1.0

3.1 Issuer Master Keys and Related Data

Personalization cannot take place unless two sets of master keys and related data are
created. The first set, being the personalization master key, controls the personalization
process and protects the personalization data. The second set of master keys are
application specific and are used for the express purpose of deriving application specific
keys for use by the application during transaction processing. While the personalization
master key may be controlled by the entity performing personalization, the application
master keys are strictly the domain of the card issuer and persist after the card is issued.
Other processes may also use one or more of the personalization master keys used by
the personalization process.

3.2 Application Keys and Certificates

Application level symmetric DES keys must be created during data preparation. In most
cases, such keys are derived from appropriate issuer application master keys.
If Card Authentication, Issuer Authentication or Issuer Script Processing is to be
supported for VSDC, application DES keys must be derived from the Issuer application
master keys using the PAN and PAN Sequence Number as defined in reference [VIS].
If offline enciphered PIN or Offline Data Authentication (SDA, DDA, CDA, or fDDA) is to
be supported, the Issuer needs to generate an issuer public/private RSA key pair, have
the Public Key signed by the Visa Certification Authority, and the resulting Issuer Public
Key Certificate must be placed in a record on the card.
In addition, the offline enciphered PIN and dynamic data authentication (DDA, CDA, or
fDDA) features require a card supporting RSA public key technology. The ICC RSA key
pair must be generated for each card and the ICC public key must be signed by the
issuer using the issuer private key corresponding to the Issuer Certificate. The resulting
ICC public key certificate and the corresponding private key must also be placed in a
record on the card.
It is recommended that if Offline Enciphered PIN is to be supported, that the ICC key
pair is used to support both Offline Enciphered PIN and DDA or CDA.
See section 5 for a summary of keys used by the application.

3.3 Application Data

Application data may be common across all IC cards for the issuer’s project (for
example, the identifier of the issuer), it may be common to a particular batch of cards (for
example, specific Issuer Action Codes for a Visa Electron card product), or it may be
unique to the IC card (for example, the PAN of a debit/credit application).

Page 3-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 3 Data Preparation
Requirements for VIS and VCPS Applications 3.3 Application Data
Version 1.0

3.3.1 Data Grouping Identifiers (DGIs)

Data elements that are logically or physically related are grouped and identified within a
Data Grouping Identifier (DGI). For example, DES keys are combined into one DGI, and
tagged data that belong in the same record are also combined into one DGI. All data in a
grouping (that is, in a single DGI) will be sent to the IC card application in a single
command.
The IC card application uses the DGI to determine how the data grouping is to be
processed after it is received from the personalization device. Data groupings are
defined in sections 6 and 7. The personalization devices will parse the input record and
create a STORE DATA command for each data grouping in the input record.
The design of the data groupings plays a key part of the personalization process. Data
Grouping Identifiers (DGIs) are 2 bytes hexadecimal.
DGIs with the first byte equal to '01' through '1E', indicate the SFI in which the data is to
be stored. For these DGIs, the second byte indicates the record number of the SFI
record. DGIs with the first byte outside the range '01' through '1E' are used to reference
internal data.
Exceptions to this convention for VIS are DGIs '0D01' and '0E01', and for VCPS is DGI
'0E01'. These DGIs are used to personalize internal application data that is not
accessible using READ RECORD or UPDATE RECORD commands. Depending on the
implementation, the card may store the data elements in these DGIs as records or not.
Note: DGIs are always followed by a one-byte binary format length indicator. Tag
lengths, however, are contained in a single byte unless that length is greater than
127 bytes, then the length byte is preceded by one byte containing '81'. For
example, a tag containing a value of 128-bytes would be '8180'.

March 2009 Visa Confidential Page 3-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
3 Data Preparation Card Personalization Specification for VSDC
3.3 Application Data Requirements for VIS and VCPS Applications
Version 1.0

Page 3-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 4 VSDC-Specific Personalization Requirements
Requirements for VIS and VCPS Applications
Version 1.0

4 VSDC-Specific Personalization Requirements

4.1 Requirements for Global VSDC Cards Using EMV CPS
The following requirements must be met in order to personalize VSDC applications using
the Common Personalization Method:

Req 4.1 Meet EMV CPS requirement

The IC Application must meet all requirements as specified in [EMV CPS] except as
indicated otherwise in this specification.

Req 4.2 Meet Application Specification requirements

The IC Application must meet all requirements as specified in the application
specification (for example, [VIS] or [VCPS]).

Req 4.3 Personalization of mandatory data

The IC Application must be personalized with all data specified as mandatory in the
application specification (for example, [VIS] or [VCPS]).

Req 4.4 Ignore encryption bits in P1

The IC application may ignore the encryption bits of P1 in STORE DATA command and
decrypt the DGIs that are defined as always encrypted.

4.2 VSDC Requirements When EMV CPS Offers Options

Additional details of personalization processing may be found in the [EMV CPS]
specification. The following [EMV CPS] functionality must be supported:

Req 4.5 DGIs supported in a single Store Data command

STORE DATA command must be implemented to allow personalization of any and all
supported DGIs with a single STORE DATA command.
Note: STORE DATA command is not precluded from also accepting multiple DGIs, but
this functionality is outside the scope of this specification and will not be
tested.

March 2009 Visa Confidential Page 4-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
4 VSDC-Specific Personalization Requirements Card Personalization Specification for VSDC
4.3 Requirements for Global VCPS Cards Requirements for VIS and VCPS Applications
Version 1.0

Req 4.6 Support for DGIs with a single byte length

STORE DATA command must support data elements that can be contained in a DGI
with a single byte length.
Note: STORE DATA command is not precluded from also accepting data elements
that cannot be contained in a single DGI, but there are no data elements
defined for VSDC that cannot be contained in a DGI with a single byte length.
Therefore, this functionality is outside the scope of this specification and will
not be tested.

4.3 Requirements for Global VCPS Cards

The Visa Contactless Payment Specification [VCPS] describes different application
paths (whether qVSDC, MSD) which are contained within a single payment application,
with the path to follow for processing a transaction being determined during transaction
time. While a method for personalizing a VCPS card as either qVSDC-only or MSD-only
is provided for domestic solutions, all global VCPS cards must be personalized with both
qVSDC and MSD to ensure a globally interoperable solution for contactless cards.

Req 4.7 Global VCPS cards support qVSDC and MSD

All global VCPS cards must be personalized with both qVSDC and MSD.

4.4 Requirements for VSDC GlobalPlatform Applets Using EMV CPS

Visa permits VSDC GlobalPlatform applets supporting the EMV Card Personalization
Specification to use Secure Channel Protocol 01 when loaded on a Visa GlobalPlatform
2.0.1 Card.

4.5 Common Personalization DGIs for VSDC

There are no VSDC requirements for DGIs (Order, Migration to New Versions,
Encrypted Data Groupings or Log Data) common to all IC card applications using the
Common Personalization approach.

4.6 Record Formats for VSDC

The format for sending IC card application data to the personalization device is
described in [EMV CPS] Chapter 2.
MAC – The recommended security level setting for VSDC is P1 = '01' in the EXTERNAL
AUTHENTICATE command. All commands received by the IC card application subsequent
to EXTERNAL AUTHENTICATE contain a C-MAC.
For instant issuance environments, outside of a secure facility the recommended
security level setting for VSDC is P1 = ‘03’.

Page 4-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 4 VSDC-Specific Personalization Requirements
Requirements for VIS and VCPS Applications 4.6 Record Formats for VSDC
Version 1.0

4.6.1 Ending Personalization Processing

Req 4.8 Completion of Personalization

The personalization device shall set b8 of the P1 parameter in the last STORE DATA
command to 1b to indicate the completion of personalization for the application. After
the final STORE DATA command, the application is personalized and the STORE DATA
command is disabled for that application.
Note: VSDC does not require the data grouping '7FFF' to request data in the final
STORE DATA command.

March 2009 Visa Confidential Page 4-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
4 VSDC-Specific Personalization Requirements Card Personalization Specification for VSDC
4.6 Record Formats for VSDC Requirements for VIS and VCPS Applications
Version 1.0

Page 4-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 5 Application and Personalization Keys
Requirements for VIS and VCPS Applications
Version 1.0

5 Application and Personalization Keys

This section describes the entities and keys used in the personalization process. The
keys used for Common Personalization are described separately from the VSDC
Application keys to clearly distinguish between the two sets of keys.

5.1 Summary of EMV CPS Personalization Keys

The KMC is used to create card static unique derived keys that are in turn used to create
session keys for communicating with the IC card application. VSDC personalization keys
are summarized in Table 5-1.

Table 5-1 – VSDC Personalization Keys

Key
Name Shared by Usage Master Card Session
Issuer Issuer, The KMC is used by the Card KMC
Master Card Manu- Manufacturer to generate card level
Key facturer and keys (KENC, KMAC, KDEK) and place
Personal- them on the card.
ization
Device Used to create a session key which KENC SKUENC
is used for mutual authentication and
to protect the confidentiality of the
APDU command data field in CBC
mode
Used to create session key which is KMAC SKUMAC
used for mutual authentication and
to create C-MACs used in command
processing
Used to create a session key which KDEK SKUDEK
is used to protect the confidentiality
of secret data in ECB mode between
the card and personalization device
Issuer Issuer and Secures offline PIN and other secret DEKISS
Data Ex- Data data between the Issuer and the
change Preparation Data Preparation Device
Key Device

March 2009 Visa Confidential Page 5-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
5 Application and Personalization Keys Card Personalization Specification for VSDC
5.1 Summary of EMV CPS Personalization Keys Requirements for VIS and VCPS Applications
Version 1.0

Key
Name Shared by Usage Master Card Session
Transport Data Secures offline PIN and other secret DEK /
Keys Preparation data between the Data Preparation TK
Device and Device and the Personalization
Personal- Device
ization Special types of data transport keys
Device may be used as follows:
PEK/TK – PIN Encryption Key for
securing PIN data
KEK/TK – Key Exchange Key for
securing DES and RSA private keys
In extreme cases a transport key
derived from a Zone Control Master
Key ZCMK may be used to encipher
the entire data preparation file
MACkey Data Ensures the integrity of the MACkey N/A N/A
Preparation application data provided to the
Device Personalization Device in the
provides to Personalization Data File
Personal-
ization
Device in
Personal-
ization Data
File

Page 5-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 5 Application and Personalization Keys
Requirements for VIS and VCPS Applications 5.2 VSDC Application Keys – Post Personalization
Version 1.0

5.2 VSDC Application Keys – Post Personalization

Table 5-2 describes the VSDC application keys that are personalized, as well as the
optional Post-Personalization Update Keys.

Table 5-2 – VSDC Application Keys

Key Shared
Name by Usage Master Card Session
VSDC Issuer Master key is used to generate a MDK UDK SUDK
Online and Card card unique key which is used in (for
Authenti- online card and issuer authentication Common
cation Crypto-
Key gram)
VSDC Issuer Master key is used to generate a MAC MAC SUDK
Message and Card card unique key which is used to MDK UDK MAC
Authenti- generate session keys for message
cation authentication for post issuance
Key updates to the card
VSDC Issuer Master key is used to generate a ENC ENC SUDK
Data and Card card unique key which is used to MDK UDK ENC
Encipher- generate session keys for
ment Key encipherment of secret data (offline
PIN) contained in post issuance
updates to the card
ICC Issuer Generated by the Issuer and stored
Private and Card securely on the card. Used to sign
Key dynamic data during Offline Data
Authentication (DDA) or in Offline
Enciphered PIN processing.
This key is usually not retained by
the issuer after personalization.
ICC PIN Issuer Generated by the Issuer and stored
Encipher- and Card securely on the card. Used to
ment decipher offline enciphered PIN if
Private ICC Private Key is not used for this
Key purpose.
This key is usually not retained by
the issuer after personalization.

March 2009 Visa Confidential Page 5-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
5 Application and Personalization Keys Card Personalization Specification for VSDC
5.2 VSDC Application Keys – Post Personalization Requirements for VIS and VCPS Applications
Version 1.0

Figure 5-1 – VSDC Personalization Key Usage

KMC

HSM Cardholder data

Personalization data file (MACkey)
Issuer Chip data
Issuer, Data Preparer, or Secret data encrypted DES Keys (encrypted by DEK/TK)
Personalization Bureau could under the DEKISS Secret data (encrypted by PEK/TK)
generate Static RSA Signatures
or ICC Certificates

Public Public Key HSM

Key Certificate HSM

Data Preparation Personalization

KMC Visa HSM KEK Machine
Device
Certificate KMC
DEK/TK
Authority DEK/TK (SKUENC
KEK/TK
KEK/TK SKUMAC
DEKISS PEK/TK PEK/TK SKUDEK)

HSM
XYZ BANK
Card
Manufacturer
KMC XYZ BANK
KENC (used to decrypt APDU data field)
KMAC (used to verify MAC on APDU) 4000 1234 5678
KDEK (used to decrypt secret data) J. Smith

Page 5-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 6 DGIs for VIS
Requirements for VIS and VCPS Applications
Version 1.0

6 DGIs for VIS

Visa requires that all cards supporting EMV Card Personalization Specification (CPS)
must use the recommended implementation of EMV application common DGIs as per
Annex A of [EMV CPS].
After the personalization data for the VIS card application has been created, it must be
placed into the correct data grouping. These data groupings are then placed in the data
element ‘ICC Data’ in the Record Formats described in [EMV CPS] Chapter 2, Table 8.
The VIS application consists of a foundation of the minimum data to support required
functions and additional data for functions that may or may not be activated for the
application. The data elements that are required to support a basic payment service are
included in all VIS card applications. Other data elements may or may not be present
based on issuer or regional requirements for the functions those data elements support.
These functions include:
 Authorization Controls (AuthC)
 Dynamic Data Authentication (Standard DDA or CDA)
 Static Data Authentication (SDA)
 Offline PIN – Plaintext or Enciphered*
 Online Card / Issuer Authentication (CAM / Iauth)
 Issuer Script for Post Issuance Updates
* Although ICC PIN Encipherment data is defined in the data groupings, support for
Offline Enciphered PIN functionality is described assuming DDA (or CDA) and Offline
Enciphered PIN use the same certificates and keys.
Note: Contact your local Visa representative for more information about regional
requirements.
The data groupings for the VIS application that are not already specified in [EMV CPS]
are defined in Table 6-1.
Note: Additional data groupings are defined in [EMV CPS] for personalization of other
data used by the application, such as the PSE, key and PIN related data, the
SELECT command response, and the GET PROCESSING OPTIONS command
response (for non-VLP transactions). Table 6-1 identifies the additional DGIs
beyond those specified in [EMV CPS] that are used for VIS applications.

March 2009 Visa Confidential Page 6-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
6 DGIs for VIS Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-1 – Data Grouping Identifiers for VIS

External
DGI Data Content Feature Encrypt Access
'0101' Track 2 Equivalent Data – Table 6-2 Minimum No READ RECORD
Data and
UPDATE RECORD
'0102' Track 2 Equivalent Data with alternate Minimum No READ RECORD
Cardholder Name – Table 6-3 Data and
UPDATE RECORD
'0201' Data Authentication Certificate – SDA, DDA, No READ RECORD
Table 6-4 CDA
'0202' Additional Data Authentication Data – SDA, DDA, No READ RECORD
Table 6-5 CDA
'0203' Signed Static Application Data (SAD) SDA No READ RECORD
– Table 6-6
'0204' Dynamic Authentication Certificate – DDA, CDA, No READ RECORD
Table 6-7 PIN
Encipher
'0205' Additional Dynamic Authentication DDA, CDA, No READ RECORD
Data – Table 6-8 PIN
Encipher
'0207' ICC PIN Encipherment Certificate – PIN No READ RECORD
Table 6-9 Encipher
'0208' Additional ICC PIN Encipherment PIN No READ RECORD
Data – Table 6-10 Encipher
'02nn' Duplicate Signed Static Application SDA No READ RECORD
Data – Table 6-11, Table 6-12
'02nn' Duplicate Data Authentication Data – DDA, CDA No READ RECORD
Table 6-13
'0301' Card Risk Management Data – Minimum No READ RECORD
Table 6-14 Data, CVM
'0302' Additional Card Risk Management Minimum No READ RECORD
Data – Table 6-15 Data, SDA,
CAM
'0303' Cardholder Verification Method List – CVM No READ RECORD
Table 6-16 and
UPDATE RECORD
'03nn' Duplicate Card Risk Management Minimum No READ RECORD
Data – Table 6-17 Data, CVM
'0401' Terminal Velocity Checking Card No READ RECORD
Data – Table 6-18 and
UPDATE RECORD

Page 6-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 6 DGIs for VIS
Requirements for VIS and VCPS Applications
Version 1.0

External
DGI Data Content Feature Encrypt Access
'0B01' VLP Data – Table 6-19 VLP No READ RECORD
'0D01' Application Internal Data – Table 6-20 AuthC No PUT DATA and
GET DATA
'0E01' Additional Application Internal Data – AuthC No None
Table 6-21
'0E02' Application Linkage for Block/Unblock Issuer No None
– Table 6-22 Script
'0Enn' Duplicate Application Internal Data – AuthC No None
Table 6-23
'3000' Application Common Internal Data – AuthC No GET DATA
Table 6-24
'9200' GENERATE AC Response Data – CAM No GENERATE AC
Table 6-25
'9203' GET PROCESSING OPTIONS Response GPO No GPO
Data for VLP – Table 6-26

Note: nn indicates store in last record(s) in the file, because it is a duplicate data
element.
Note: The DGIs listed in Table 6-1 for SFI 1-10 show the recommended SFI and record
placement for EMV record data. The data may be personalized in any SFI in the
range 1-10, and any record number supported by the application.
Note: Shading indicates data groupings whose data elements are recommended for
inclusion in the Signed Static Application Data (SAD). If any of the data elements
are not to be included in the signature, they should be placed in DGI '0302' or
DGI '0303'. These DGIs do not contain data elements included in the SAD
(non-shaded). DGI '0303' must contain the CVM List if the issuer plans to update
the CVM List using Issuer Script Processing.
Note: The data elements listed in DGIs '01xx' through '1Exx' may duplicate data
elements personalized in other DGIs (if different versions of the data element
may be used for different transactions). The Application File Locator (AFL) must
be personalized to prevent a device from reading more than one version of each
data element for any given transaction.

March 2009 Visa Confidential Page 6-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
6 DGIs for VIS Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

The requirement column titled ‘Req.’, in the following tables of data elements for each
DGI, lists the requirements for each data element:
M (Mandatory) indicates that the data element must be present, accessible using
READ RECORD command and provided to the terminal in order for transaction processing
to continue.
R (Required) indicates that the data element must be present, but that the terminal
should not terminate the transaction if it is not received.
C (Conditional) indicates that the data element is necessary under certain conditions.
Information on these conditions can be found in the Data Requirements Chart in [VIS]
Appendix A.
Note: The condition for Record Template (tag '70') is not listed in [VIS] Appendix A, but
it is required by EMV at the beginning of all records in SFI 1 through 10.
O (Optional) indicates that the data element is optional.

Table 6-2 – Data Content for DGI '0101' (Track 2 Equivalent Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
M '57' Track 2 Equivalent Data* to 19 N/A
O '5F20' Cardholder Name 2-26 N/A
O '9F1F' Track 1 Discretionary Data Var N/A

* This field may be padded at the end with a single hex 'F' to ensure whole bytes.

Table 6-3 – Data Content for DGI '0102' (Track 2 Equivalent Data with alternate
Cardholder Name)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
M '57' Track 2 Equivalent Data* to 19 N/A
O '5F20' Cardholder Name (if different from value for 2-26 N/A
DGI '0101')
O '9F1F' Track 1 Discretionary Data Var N/A

* This field may be padded at the end with a single hex 'F' to ensure whole bytes.

Page 6-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 6 DGIs for VIS
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-4 – Data Content for DGI '0201' (Data Authentication Certificate)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '90' Issuer Public Key (IPK) Certificate Var N/A

Table 6-5 – Data Content for DGI '0202' (Additional Data Authentication Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F32' IPK Exponent 1 or 3 N/A
C '92' IPK Remainder Var N/A
C '8F' Certificate Authority Public Key Index 1 N/A

Table 6-6 – Data Content for DGI '0203' (Signed Static Application Data (SAD)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '93' Signed Static Application Data Var N/A

Table 6-7 – Data Content for DGI '0204' (Dynamic Authentication Certificate)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F46' ICC Public Key Certificate Var N/A

Table 6-8 – Data Content for DGI '0205' (Additional Dynamic Authentication Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F47' ICC Public Key Exponent 1 or 3 N/A
C '9F48' ICC Public Key Remainder Var N/A
C '9F49' DDOL Var N/A

Note: The contents of this DGI may optionally be included in DGI '0202'.

March 2009 Visa Confidential Page 6-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
6 DGIs for VIS Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-9 – Data Content for DGI '0207' (ICC PIN Encipherment Certificate)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F2D' ICC PIN Encipherment Public Key Certificate Var N/A

Table 6-10 – Data Content for DGI '0208' (Additional ICC PIN Encipherment Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F2E' ICC PIN Encipherment Public Key Exponent 1 or 3 N/A
C '9F2F' ICC PIN Encipherment Public Key Remainder Var N/A

Table 6-11 – Data Content for DGI '02nn' (Duplicate SAD)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '93' Signed Static Application Data (SAD) Var N/A

Note: If DDA is supported for both VIS and qVSDC, and the AIP is signed for offline
data authentication; the AIP value for VIS and qVSDC must be the same unless
separate certificates are personalized for the two paths.

Table 6-12 – Data Content for DGI '02nn' (Duplicate Data Authentication Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '90' Issuer Public Key (IPK) Certificate Var N/A
C '8F' Certification Authority Public Key Index 1 N/A

Table 6-13 – Data Content for DGI '02nn' (Duplicate Data Authentication Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F32' IPK Exponent 1 or 3 N/A
C '92' IPK Remainder Var N/A

Page 6-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 6 DGIs for VIS
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-14 – Data Content for DGI '0301' (Card Risk Management Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
M '5A' Application Primary Account Number (PAN) Var N/A
O '5F34' Application PAN Sequence Number 1 N/A
R '8E' Cardholder Verification Method (CVM) List Var N/A
M '9F0D' Issuer Action Code (IAC) Default 5 N/A
M '9F0E' IAC Denial 5 N/A
M '9F0F' IAC Online 5 N/A
M '5F24' Application Expiration Date 3 N/A
C '5F28' Issuer Country Code 2 N/A
O '9F07' Application Usage Control 2 N/A
O '5F25' Application Effective Date 3 N/A

Note: The data elements in this grouping are included in the Signed Application Data
(SAD). If updates to the Cardholder Verification Methods (CVM) List are to be
made by the issuer using Issuer Script Processing or if multiple CVM Lists are
used and a single SAD is used, the CVM List should be included in DGI '0303'
rather than in DGI '0301'.

Table 6-15 – Data Content for DGI '0302' (Additional Card Risk Management Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '9F4A' SDA Tag List Var N/A
M '8C' Card Risk Management Data Object List 1 Var N/A
(CDOL1)
M '8D' CDOL2 Var N/A
C '97' TDOL Var N/A
O '9F05' Application Discretionary Data Var N/A
O '9F0B' Cardholder Name Extended (27-45) Var N/A
O '9F44' Application Currency Exponent 1 N/A
C '9F42' Application Currency Code 2 N/A
O '5F30' Service Code 2 N/A
M '9F08' Application Version Number 2 N/A

March 2009 Visa Confidential Page 6-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
6 DGIs for VIS Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-16 – Data Content for DGI '0303' (Cardholder Verification Method List)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '8E' Cardholder Verification Methods (CVM) List Var N/A

Table 6-17 – Data Content for DGI '03nn' (Duplicate Card Risk Management Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
C '5A' Application Primary Account Number (PAN) Var N/A
C '5F34' Application PAN Sequence Number 1 N/A
R '8E' Cardholder Verification Method (CVM) List Var N/A
C '9F0D' Issuer Action Code (IAC) Default 5 N/A
C '9F0E' IAC Denial 5 N/A
C '9F0F' IAC Online 5 N/A
C '5F24' Application Expiration Date 3 N/A
C '5F28' Issuer Country Code 2 N/A
C '9F07' Application Usage Control 2 N/A
C '5F25' Application Effective Date 3 N/A

Note: The data elements in this grouping are included in the Signed Application Data
(SAD) if more than one SAD is required.

Table 6-18 – Data Content for DGI '0401' (Terminal Velocity Checking Card Data)

Req. Tag Data Element Length Encrypt

M '70' Record Template Var. N/A
O '9F14' Lower Consecutive Offline Limit 1 N/A
(Terminal Velocity Checking)

O '9F23' Upper Consecutive Offline Limit 1 N/A

(Terminal Velocity Checking)

Page 6-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 6 DGIs for VIS
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-19 – Data Content for DGI '0B01' (VLP Data)

Req. Tag Data Element Length Encrypt

M '9F74' VLP Issuer Authorization Code 6 N/A
M '9F79' VLP Available Funds 6 N/A
C '5A' Application Primary Account Number (PAN) Var N/A
C '5F34' Application PAN Sequence Number 1 N/A
C '8C' CDOL1 Var N/A
C '8D' CDOL2 Var N/A
C '8E' Cardholder Verification Method (CVM) List Var N/A
C '9F0D' Issuer Action Code (IAC) Default 5 N/A
C '9F0E' IAC Denial 5 N/A
C '9F0F' IAC Online 5 N/A
C '5F24' Application Expiration Date 3 N/A
C '5F28' Issuer Country Code 2 N/A
C '9F07' Application Usage Control 2 N/A
O '5F25' Application Effective Date 3 N/A
C '9F42' Application Currency Code 2 N/A
O '9F08' Application Version Number 2 N/A
O '5F20' Cardholder Name 2-26 N/A

March 2009 Visa Confidential Page 6-9

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
6 DGIs for VIS Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-20 – Data Content for DGI '0D01' (Application Internal Data)

Req. Tag Data Element Length Encrypt

C '9F58' Lower Consecutive Offline Limit 1 N/A
(Card Velocity Checking)

C '9F59' Upper Consecutive Offline Limit 1 N/A

(Card Velocity Checking)

C '9F77' VLP Funds Limit 6 N/A

C '9F78' VLP Single Transaction Limit 6 N/A
C '9F53' Consecutive Transaction Limit (International) 1 N/A
(Currency)

C '9F72' Consecutive Transaction Limit (International– 1 N/A

Country)
C '9F54' Cumulative Total Transaction Amount Limit 6 N/A
C '9F75' Cumulative Total Transaction Amount Limit 6 N/A
(Dual Currency)
C '9F73' Currency Conversion Factor 4 N/A
C '9F5C' Cumulative Total Transaction Amount Upper Limit 6 N/A
C '9F5D' Available Offline Spending Amount 6 N/A
C '9F5E' Consecutive Transaction International Upper Limit 1 N/A
C '9F4F' Log Format Var N/A

Note: Future versions of this specification will use DGIs '3000' and '3001' for these data
elements to comply with [EMV CPS].

Table 6-21 – Data Content for DGI '0E01' (Additional Application Internal Data)

Req. Tag Data Element Length Encrypt

C '9F51' Application Currency Code 2 N/A
C '9F52' Application Default Action (ADA) 2 or 4 N/A
C '9F56' Issuer Authentication Indicator 1 N/A
C '9F55' Geographic Indicator 1 N/A
C '9F57' Issuer Country Code 2 N/A
C '9F76' Secondary Application Currency Code 2 N/A

Note: Future versions of this specification will use DGI '3001' for these data elements to
comply with [EMV CPS].

Page 6-10 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 6 DGIs for VIS
Requirements for VIS and VCPS Applications
Version 1.0

Table 6-22 – Data Content for DGI '0E02' (Application Linkage for Block/Unblock)

Req. Tag Data Element Length Encrypt

C N/A AID FFF_1 AID FFF_2 . . . AID FFF_nn Var N/A

Note: See Appendix B for detail on how the content of this DGI is used to control post
personalization processing of BLOCK and UNBLOCK commands for
multi-application cards.

Table 6-23 – Data Content for DGI '0Enn' (Duplicate Application Internal Data)

Req. Tag Data Element Length Encrypt

C '9F52' Application Default Action (ADA) 2 or 4 N/A

Table 6-24 – Data Content for DGI '3000' (Application Common Internal Data)

Req. Tag Data Element Length Encrypt

C '9F36' Application Transaction Counter (ATC) 2 N/A

Table 6-25 – Data Content for DGI '9200' (GENERATE AC Response Data)

Req. Tag Data Element Length Encrypt

M '9F10' Issuer Application Data Var N/A

Table 6-26 – Data Content for DGI '9203' (GPO Response Data for VLP)

Req. Tag Data Element Length Encrypt

M '82' Application Interchange Profile (AIP) 2 N/A
M '94' Application File Locator (AFL) Var N/A

March 2009 Visa Confidential Page 6-11

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
6 DGIs for VIS Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Page 6-12 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications
Version 1.0

7 DGIs for VCPS (PPSE, qVSDC and MSD)

This section defines Data Grouping Identifiers (DGIs) for use in the personalization of
cards supporting the Quick Visa Smart Debit/Credit and Magnetic Stripe Data
implementations of the Visa Contactless Payment Specification [VCPS]. qVSDC and
MSD are simply application paths contained in a single payment application.
The first group of DGIs are associated with the Proximity Payment System Environment
(PPSE) application. The second group of DGIs are associated with the qVSDC and MSD
application paths.

7.1 DGIs for PPSE

The PPSE application is personalized with a single DGI as shown below:

Table 7-1 – DGI for PPSE

External
DGI Data Content Encrypt Req. Access
'9102' Select PPSE Response Data – Table 7-2 N/A M SELECT

Table 7-2 – Data Content for DGI '9102'

Req. Tag Data Element Length

M 'A5' FCI Proprietary Template Var.
M 'BF0C' FCI Issuer Discretionary Data Var.
M '61' Directory Entry Template Var.
M '4F' Dedicated File Name (AID) 5-16
O '50' Application Label 1-16
C '87' Application Priority Indicator (used when there is more than 1
one contactless payment applications on the card)
C '61' Additional tag '61' templates are used only when more than one Var.
contactless payment applications exist on the card

March 2009 Visa Confidential Page 7-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.2 DGIs for qVSDC and MSD Requirements for VIS and VCPS Applications
Version 1.0

7.2 DGIs for qVSDC and MSD

Data groupings for qVSDC and MSD application paths are defined in Table 7-3. For the
conditions referred to in the Requirements (Req.) column of the tables below, see
Table 7-20. Table 7-3 includes the data groupings from [EMV CPS] and [VIS] that are
necessary for a minimum implementation of [VCPS].

Table 7-3 – DGIs for qVSDC and MSD Application Paths

External
DGI Data Content Encrypt Path Req. Access
Record Data
'0101' Record (in AFL list) – Table 7-4 N/A MSD M READ
RECORD
'0201' Record (in AFL list) – Table 7-5 N/A qVSDC C1 READ
RECORD
'0202' Record (in AFL list) – Table 7-6 N/A qVSDC C1 READ
RECORD
'0301' Record (in AFL list) – Table 7-7 N/A qVSDC C1 READ
and 17 RECORD
Internal Data
'0E01' Card Private Data – Table 7-8 N/A qVSDC/MSD R Data
dependent
'0E02' Application Linkage for Block/Unblock N/A qVSDC O None
– Table 6-22
DES Key Data
'8000' DES key(s) – Table 7-10 SKUDEK qVSDC/MSD M None
'9000' DES key check values – Table 7-11 N/A qVSDC/MSD O None
'8001' Alternate DES key for dCVV – SKUDEK MSD C4 None
Table 7-12 and 5

RSA Keys (Modulus/Exponent

Format)
'8101' See Table 7-13 SKUDEK qVSDC C1 None
Note: This is an [EMV CPS] DGI and 2

'8103' See Table 7-13 SKUDEK qVSDC C1 None

Note: This is an [EMV CPS] DGI and 2

RSA Keys (CRT Format)

'8201' See Table 7-14 SKUDEK qVSDC C1 None
Note: This is an [EMV CPS] DGI and 3

'8202' See Table 7-14 SKUDEK qVSDC C1 None

Note: This is an [EMV CPS] DGI and 3

Page 7-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications 7.2 DGIs for qVSDC and MSD
Version 1.0

External
DGI Data Content Encrypt Path Req. Access
'8203' See Table 7-14 SKUDEK qVSDC C1 None
Note: This is an [EMV CPS] DGI and 3

'8204' See Table 7-14 SKUDEK qVSDC C1 None

Note: This is an [EMV CPS] DGI and 3

'8205' See Table 7-14 SKUDEK qVSDC C1 None

Note: This is an [EMV CPS] DGI and 3

Command Response Data

'9102' SELECT Response (Common) – N/A qVSDC/MSD M SELECT
Table 7-15
Note: This is an [EMV CPS] DGI
'9103' SELECT Response (Contactless) – N/A qVSDC/MSD O SELECT
Table 7-16
'9200' Issuer Application – Table 7-17 N/A qVSDC/MSD M GPO
'9206' GET PROCESSING OPTIONS Response N/A MSD R GPO
for MSD – Table 7-18
'9207' GET PROCESSING OPTIONS Response N/A qVSDC R GPO
for qVSDC – Table 7-19

Note: Some DGIs are only used for qVSDC, some only for MSD, and some are shared.
DGIs '0101', '0E01', '8000', '9102', '9200', '9206', and '9207' are always required
for globally interoperable cards.
qVSDC offline requires one set of the following additional DGIs to be personalized for
offline data authentication:
 fDDA supporting RSA keys in Modulus-Exponent format –
'0201', '0202', '0301', '8101', '8103'
 fDDA supporting RSA keys CRT format –
'0201', '0202', '0301', '8201', '8202', '8203', '8204', '8205'
For MSD, if dCVV is enabled:
 dCVV – '8001' (conditional, if a different UDK is used for dCVV ― for example, if the
PAN Sequence Number is not zero)
For domestic-only qVSDC solutions, DGI '9206' (GPO Response Data for MSD) should
be excluded in order to “turn off” MSD.
For domestic-only MSD solutions, DGI '9207' (GPO Response Data for qVSDC) should
be excluded in order to “turn off” qVSDC.

March 2009 Visa Confidential Page 7-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.2 DGIs for qVSDC and MSD Requirements for VIS and VCPS Applications
Version 1.0

7.2.1 DGIs for Record Data

Note that the record layout for qVSDC and MSD does not conform to the recommended
structure in section 6. For the purposes of increasing contactless performance, the
number of records is reduced to the fewest possible to hold the necessary elements.
Hence, it is recommended that only four (4) records are personalized in order to
decrease contactless transaction times. SFI 2 should contain only two (2) records,
containing certificates and related data authentication elements. If data elements are to
be signed, an additional record for static data is also then used (DGI '0301').
Only those data elements used by qVSDC should be personalized in records used by
the qVSDC application path (so as to not impact qVSDC transaction times).

Table 7-4 – Data Content for DGI '0101' (MSD)

Req. Tag Data Element Length

M '70' Record Template Var.
M '57' Track 2 Equivalent Data Var. up to 19 bytes
O '5F20' Cardholder Name 2-26
O '9F1F' Track 1 Discretionary Data Var.

If MSD and VIS (if supported) will be using different track data (for example, dCVV is
supported in MSD, but a different Track 2 Equivalent Data format is used for VIS), then
an additional record ('01nn') must be personalized containing the track data for VIS.

Page 7-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications 7.2 DGIs for qVSDC and MSD
Version 1.0

Track 2 Equivalent Data contains the data elements of Track 2 according to

ISO/IEC 7813, excluding start sentinel, end sentinel, and Longitudinal Redundancy
Check (LRC), as follows:
 Primary Account Number: numeric, var. up to 19 digits
 Field Separator (Hex 'D'): binary
 Expiration Date (YYMM): numeric 4
 Service Code: numeric 3
 PIN Verification Field (conditional): numeric 5
 Discretionary Data
 Contains the Card Verification Value (iCVV or an invalid CVV): numeric 3
OR
 If MSD dCVV option is used: numeric 8
 dCVV: '999' (or iCVV)
 ATC: '9999'
 Contactless Indicator: Value greater than zero indicates contactless. If the CI
is not utilized, then the default value shall be '1'.
 Conditionally pad with one Hex 'F' if needed to ensure a whole byte: binary

Track 1 Discretionary Data contains the Discretionary Data element of Track 1 coded to
the Visa Payment Technology Standards Manual, for use in MSD transactions in MSD
devices compliant only with the Version 1.4.2 Specification (those that do not support
Cryptogram 17 and where the AFL is returned and the records are read).
If dCVV is not present in Track 2 Equivalent Data, it is recommended that Track 1
Discretionary Data also include the iCVV (if present in Track 2 Equivalent Data).

Table 7-5 – Data Content for DGI '0201' (qVSDC with fDDA)

Req. Tag Data Element Length

C1 '70' Record Template Var.
M '90' Issuer Public Key (IPK) Certificate Var.

Note: For IPK Certificates created with a VSDC CA Key of length less than or equal to
1408 bits, it is possible to include additional data elements in DGI '0201'.
If additional data elements are to be included, it is recommended to include the
CA Public Key Index (tag '8F'), IPK Remainder (tag '92'), and Issuer Public Key
Exponent (tag '9F32') in DGI '0201' and not include these data elements in
DGI '0202'.
March 2009 Visa Confidential Page 7-5
Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.2 DGIs for qVSDC and MSD Requirements for VIS and VCPS Applications
Version 1.0

Table 7-6 – Data Content for DGI '0202' (qVSDC with fDDA)

Req. Tag Data Element Length

C1 '70' Record Template Var.
M '8F' CA Public Key Index 1
C15 '92' Issuer Public Key Remainder Var.
M '9F32' Issuer Public Key Exponent 1 or 3
M '9F46' ICC Public Key Certificate Var.
M '9F47' ICC Public Key Exponent 1 or 3
C15 '9F48' ICC Public Key Remainder Var.
C16 '5A' Application Primary Account Number (PAN) Var.
C16 '5F24' Application Expiration Date 3
O '5F34' Application PAN Sequence Number 1
O '9F6E' Form Factor Indicator Var.
M23 '9F69' Card Authentication Related Data 5-16

All the elements in Table 7-6 are defined in [VIS] with the exception of the last two data
elements (tags '9F69' and '9F6E'), which are defined in [VCPS].

Table 7-7 – Data Content for DGI '0301' (fDDA)

Req. Tag Data Element Length

C1 and 17 '70' Record Template Var.
C17 '5A' Application Primary Account Number (PAN) Var.
C17 '5F24' Application Expiration Date 3

This record contains static data used to generate the hash required by [VIS] for the ICC
Certificate.
For the qVSDC Path, use of static data for the ICC Certificate is optional and for
performance reasons is not recommended. If static data is not used, it is possible to
eliminate this record by including these data elements in another record; for example,
DGI '0202'.
If static data is used for qVSDC, this record must be identified in the qVSDC AFL entry
as containing the static data for signing. Tags '5A' and '5F24' are the recommended
elements to be signed, unless the card is also personalized for VIS (see section 6 for
VIS considerations). Data elements present in this record must not be present in any
other record.

Page 7-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications 7.2 DGIs for qVSDC and MSD
Version 1.0

7.2.2 DGIs for Internal Data

Although section 6 defines two DGI’s ('0D01' and '0E01') for personalization of tagged
internal data elements for VIS implementations, DGI '0E01' should be used for all
internal data if the card is VCPS-capable as shown in Table 7-8.
Note: Multiple STORE DATA commands are allowed containing DGI '0E01'.

Table 7-8 – Data Content for DGI '0E01' (Application Internal Data)

Req. Tag Data Element Ref.

M '57' Track 2 Equivalent Data Table 7-4
The Track 2 Equivalent Data personalized here is
returned in the GPO response for all qVSDC
transactions and MSD CVN17 transactions.
O '5F20' Cardholder Name [VIS] Table A-1
If personalized, this data element is returned in the
GPO response for online qVSDC transactions and
MSD CVN17 transactions.
O '5F34' Application PAN Sequence Number (PSN) [VIS] Table A-1
If personalized, this data element is returned in the
GPO response for online qVSDC transactions and
MSD CVN17 transactions.
O '9F1F' Track 1 Discretionary Data Table 7-4
If personalized, this data element is returned in the
GPO response for MSD CVN17 transactions.
C6 '9F4F' Transaction Log Format [VIS] Corrections
C1 '9F51' Application Currency Code [VIS] Table A-1
C8 '9F52' Application Default Action (ADA) [VIS] Table A-1
[VCPS] Appendix E
C14 '9F53' Consecutive Transaction Limit – International (CTLI) [VIS] Table A-1
C 7 or '9F54' Cumulative Total Transaction Amount Limit (CTTAL) [VIS] Table A-1
9

O7 or '9F5C' Cumulative Total Transaction Amount Upper Limit [VIS] Table A-1
9 (CTTAUL)
C20 '9F5D' Available Offline Spending Amount (AOSA) [VIS] Corrections
and 21

O22 '9F63' Offline Counter Initial Value [VCPS] Appendix E

C4 '9F67' MSD Offset [VCPS] Appendix E
C11 '9F68' Card Additional Processes [VCPS] Table 13
and 21

O '9F6B' Card CVM Limit [VCPS] Appendix E

March 2009 Visa Confidential Page 7-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.2 DGIs for qVSDC and MSD Requirements for VIS and VCPS Applications
Version 1.0

Req. Tag Data Element Ref.

O '9F6C' Card Transaction Qualifiers [VCPS] Appendix E
O '9F6D' VLP Reset Threshold [VCPS] Appendix E
O19 '9F6E' Form Factor Indicator [VCPS] Appendix E
If personalized, this data element is returned in the
GPO response for online qVSDC and MSD CVN17
transactions.
C10 '9F77' VLP Funds Limit [VIS] Table A-1
O '9F78' VLP Single Transaction Limit [VIS] Table A-1
O '9F79' VLP Available Funds [VIS] Table A-1
[VCPS] Appendix E
O19 '9F7C' Customer Exclusive Data [VCPS] Appendix E
If personalized, this data element is returned in the
GPO response for MSD CVN17 transactions.

Table 7-9 – Data Content for DGI '0E02' (Application Linkage for Block/Unblock)

Req. Tag Data Element Length Encrypt

C N/A AID FFF_1 AID FFF_2 . . . AID FFF_nn Var N/A

Note: See Appendix B for detail on how the content of this DGI is used to control post
personalization processing of BLOCK and UNBLOCK commands for
multi-application cards.

7.2.3 DGIs for DES Key Data

These keys are derived from master keys using the PAN and PAN Sequence Number.
Each key is 16 bytes (112 bits plus 16 parity bits) and [VIS] requires that all derived DES
key be generated with odd parity.

Table 7-10 – Data Content for DGI '8000' (DES Keys)

Req. Tag Data Element Length

M N/A Unique Derived Key (UDK) 16
C18 N/A Message Authentication (MAC UDK) DEA Key 16

Table 7-11 – Data Content for DGI '9000' (DES Key Check Values, Optional)

Req. Tag Data Element Length

O N/A Key Check Value for UDK 3
O N/A Key Check Value for MAC UDK 3

Page 7-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications 7.2 DGIs for qVSDC and MSD
Version 1.0

Table 7-12 – Data Content for DGI '8001' (Alternate UDK for dCVV)

Req. Tag Data Element Length

C4 and 5 N/A Alternate Unique Derived Key (UDK) used in the dCVV 16
calculation

This DGI is personalized when the UDK used for dCVV is different from the UDK
personalized in DGI '8000'. For example, as the DES key for dCVV is derived using a
PAN Sequence Number of zero, any MSD application using a non-zero PAN Sequence
Number must include the alternate UDK if dCVV is also enabled.

7.2.4 DGIs for RSA Keys

The ICC Private Key requires either two or five DGIs for personalization. Some
implementations support only the Modulus and Private Exponent format, some support
the Chinese Remainder Theorem (CRT) format, and others support both. On cards
supporting CRT, [VCPS] recommends using it for performance reasons.
EMV requires that ICC Key sizes be a multiple of eight bits. Some implementations
support specific key sizes or have further limitations regarding boundary sizes, such as
requiring keys that are divisible by 32 or 64 bits.
Check with your card vendor to see if CRT is supported and also what limitations exist
regarding key sizes.

Table 7-13 – Data Content for DGI '8101' and '8103' (RSA Keys : Mod/Exp)

Req. Tag Data Element Length

C1 and 2 N/A ICC Private Key Exponent (fDDA) Var.
C1 and 2 N/A ICC Key Modulus (fDDA) Var.

Table 7-14 – Data Content for DGI '8201' through '8205' (RSA Keys : CRT)

Req. Tag Data Element Length

-1
C1 and 3 N/A ICC Key CRT constant q mod p Var.
C1 and 3 N/A ICC Key CRT constant d mod (q – 1) Var.
C1 and 3 N/A ICC Key CRT constant d mod (p – 1) Var.
C1 and 3 N/A ICC Key CRT constant prime factor q Var.
C1 and 3 N/A ICC Key CRT constant prime factor p Var.

March 2009 Visa Confidential Page 7-9

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.2 DGIs for qVSDC and MSD Requirements for VIS and VCPS Applications
Version 1.0

7.2.5 DGIs for Command Response Data

If the same SELECT response is returned for both the contact and contactless interface,
DGI '9102' is used to personalize the SELECT response used over both interfaces.
If a different SELECT response is to be returned for the contactless interface than is
returned for the contact interface:
 DGI '9102' is used to personalize the SELECT response for the contact interface.
 DGI '9103' is used for personalization of the SELECT response for the contactless
interface.

Table 7-15 – Data Content for DGI '9102' (Select Response - Both or Contact Only)

Req. Tag Data Element Length

M 'A5' FCI Proprietary Template Var.
C24 '50' Application Label 1-16
C12 '87' Application Priority Indicator 1
O '9F38' Processing Option Data Object List (PDOL) Var.
C6 'BF0C' FCI Issuer Discretionary Data Var.
O '5F2D' Language Preference 2-8
O '9F12' Application Preferred Name 1-16
C '9F11' Issuer Code Table Index (required if using tag '9F12') 1

Table 7-16 – Data Content for DGI '9103' (Select Response - Optional Contactless)

Req. Tag Data Element Length

M 'A5' FCI Proprietary Template Var.
O '50' Application Label 1-16
C12 '87' Application Priority Indicator 1
M '9F38' Processing Option Data Object List (PDOL) for contactless Var.
C6 'BF0C' FCI Issuer Discretionary Data Var.
O '5F2D' Language Preference 2-8
O '9F12' Application Preferred Name 1-16
C '9F11' Issuer Code Table Index (required if using tag '9F12') 1

Page 7-10 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications 7.2 DGIs for qVSDC and MSD
Version 1.0

Table 7-17 – Data Content for DGI '9200' (Issuer Application Data)

Req. Tag Data Element Length

M '9F10' Issuer Application Data (IAD) This is the common Visa Var.up
Discretionary Data used for [VCPS] to 32
bytes

Table 7-18 – Data Content for DGI '9206' (MSD GPO Response Data)

Req. Tag Data Element Length

M '82' Application Interchange Profile (AIP) 2
Application File Locator (AFL)
M '94' The AFL personalized here is returned in the GPO response Var.
for MSD transactions without a cryptogram.

Personalizing this DGI activates the MSD Application Path. The AFL is only used for
transactions on devices that do not require an online cryptogram. For transactions on
devices that do require an online cryptogram, Cryptogram 17 will be used, regardless of
the value personalized for Issuer Application Data, tag '9F10' in DGI '9200' or '9207'.

Table 7-19 – Data Content for DGI '9207' (qVSDC GPO Response Data)

Req. Tag Data Element Length

M '82' Application Interchange Profile (AIP) 2
C1 '94' Application File Locator (AFL) Var. up to 16 bytes
The AFL personalized here is returned in the
GPO response for offline qVSDC
transactions.
C13 '9F10' Issuer Application Data (IAD) Var. up to 32 bytes

Personalizing this DGI activates the qVSDC Application Path. The AFL is returned in the
GPO command response for offline transactions only.
Note: If DDA is supported for both VIS and qVSDC, and the AIP is signed for offline
data authentication; the AIP value for VIS and qVSDC must be the same unless
separate certificates are personalized for the two paths.

March 2009 Visa Confidential Page 7-11

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.3 Conditional Requirements Chart Requirements for VIS and VCPS Applications
Version 1.0

7.3 Conditional Requirements Chart

The numbers and codes used in the Requirements columns of previous tables are
described in Table 7-20.

Table 7-20 – Description of Conditional Presence of Data Elements

Code Description
1 If supporting offline qVSDC.
2 If using ICC Keys in Modulus/Exponent format.
3 If using ICC Keys in CRT format.
4 If supporting MSD with dCVV.
5 If a different UDK is used for dCVV (for example, if the PAN Sequence Number is
not zero).
6 If using transaction logging, as defined in [EMV Book 3] Annex D, on applications
supporting this feature.
7 If supporting Low Value AND CTTA check.
8 If Low Value AND CTTA check is supported and offline PIN used to reset VLP
Available Funds.
9 If supporting Low Value OR CTTA check.
10 If supporting any of the Low Value options.
11 Personalizing this tag is mandatory unless the application supports Streamlined
qVSDC Card Risk Management processing.
12 If multiple payment applications are on the card.
13 If qVSDC will be using a different CVN than listed in the common Issuer Application
Data.
14 If supporting offline international transactions (“Offline transactions in non-matching
currency are allowed” bit in tag '9F68' is set to one).
15 If corresponding public key certificate is present and entire public key does not fit into
certificate.
16 If the qVSDC ICC Certificate is built without signed static data.
17 If the qVSDC ICC Certificate is built using signed static data.
18 If any of the Issuer Discretionary Options (IDD) are used.
19 If this option is supported by the implementation.
20 The AOSA is personalized as a 1-byte element to indicate access permissions.
21 If AOSA is to be returned in the GPO command response, this tag must be
personalized as described in [VCPS] Tables 11 and 12.
22 If tag '9F63' is personalized, it is recommended that this element be personalized, and
that it have a value greater than zero and no more than the value of tag '9F63'.

Page 7-12 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 7 DGIs for VCPS (PPSE, qVSDC and MSD)
Requirements for VIS and VCPS Applications 7.3 Conditional Requirements Chart
Version 1.0

Code Description
23 This tag must be present in the last record specified in the AFL. It is recommended to
be personalized at the end of the record, as implementations may require it to be the
last data element in the record.
24 If supporting VSDC.

March 2009 Visa Confidential Page 7-13

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
7 DGIs for VCPS (PPSE, qVSDC and MSD) Card Personalization Specification for VSDC
7.3 Conditional Requirements Chart Requirements for VIS and VCPS Applications
Version 1.0

Page 7-14 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 8 Common Data Elements: VIS, qVSDC and MSD
Requirements for VIS and VCPS Applications
Version 1.0

8 Common Data Elements: VIS, qVSDC and MSD

The combination of qVSDC, MSD, and VIS (if supported) on a single payment
application results in the use of multiple data elements that are common to some or all
application paths. While these data elements are shared between the various application
paths, the personalization, placement, or behavior of each element may differ depending
upon the application path being processed.

8.1 DGI '0101' – Record Data

SFI 1 Record 1 typically contains the following data:
 Tag '57' Track 2 Equivalent Data
 Tag '5F20' Cardholder Name
 Tag '9F1F' Track 1 Discretionary Data
DGI '0101' may be shared by MSD and VIS; however, if MSD and VIS will be using
different track data (for example, dCVV is supported in MSD but a different Track 2
Equivalent Data format is used for VIS), then an additional record ('01nn') must be
personalized containing the track data for VIS.

8.2 DGI '0201' – Record Data

SFI 2 Record 1 can be shared by qVSDC and VIS (assuming SDA or DDA are
supported for VIS).
 Tag '90' Issuer Public Key Certificate
Note: For IPK Certificates created with a VSDC CA Key of length less than or equal to
1408 bits, it is possible to include additional data elements in DGI '0201'. If
additional data elements are to be included, it is recommended to include the
CA Public Key Index (tag '8F'), IPK Remainder (tag '92'), and Issuer Public Key
Exponent (tag '9F32') in DGI '0201' and not include these data elements in
DGI '0202'.

March 2009 Visa Confidential Page 8-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
8 Common Data Elements: VIS, qVSDC and MSD Card Personalization Specification for VSDC
8.3 DGI '0202' – Record Data Requirements for VIS and VCPS Applications
Version 1.0

8.3 DGI '0202' – Record Data

SFI 2 Record 2 can be shared by qVSDC and VIS (if SDA or DDA supported for VIS).
When qVSDC uses the same ICC Public Key Certificate as VIS this record is shared and
would then contain the following elements:
 Tag '8F' CA Public Key Index
 Tag '92' Issuer Public Key Remainder
 Tag '9F32' Issuer Public Key Exponent
 Tag '9F46' ICC Public Key Certificate
 Tag '9F47' ICC Public Key Exponent
 Tag '9F48' ICC Public Key Remainder
 Tag '9F4A' SDA Tag List[1]
 Tag '9F69' Card Authentication Related Data
(used only by qVSDC path)
 Tag '9F6E' Form Factor Indicator.

If qVSDC has a unique ICC Public Key Certificate (preferably without any signed static
data), the qVSDC personalization should be as shown for DGI '0202' in section 6
(Table 6-5). The VIS application path would then reference another record in SFI 2 (for
example, DGI '0203') containing the following elements.
 Tag '8F' CA Public Key Index
 Tag '92' Issuer Public Key Remainder
 Tag '9F32' Issuer Public Key Exponent
 Tag '9F46' ICC Public Key Certificate
 Tag '9F47' ICC Public Key Exponent
 Tag '9F48' ICC Public Key Remainder
 Tag '9F4A' SDA Tag List

1
It is highly recommended that the SDA Tag List be personalized on cards supporting VSDC with both SDA
and DDA.

Page 8-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 8 Common Data Elements: VIS, qVSDC and MSD
Requirements for VIS and VCPS Applications 8.4 DGI '0301' – Record Data
Version 1.0

With the exception of tag '9F46', all elements in the above list would contain the same
value as the corresponding elements in the record used for qVSDC (DGI '0202').The
qVSDC AFL would then reference the record personalized with DGI '0202' and the VIS
AFL would reference a different DGI ('02nn') containing its certificate.
Alternatively (if space permits), DGI '0202' could contain tags shared by VIS and qVSDC
(tags '90', '8F', '92', and '9F32'), DGI '0201' could contain VIS-specific ICC Public Key
Certificate data elements (tags '9F46', '9F47', '9F48', and '9F49'), and DGI '0203' could
contain qVSDC-specific data elements (tags '9F46', '9F47', '9F48','5A', '5F24', '5F34',
and '9F69'). This would allow the AFLs for VIS and qVSDC to be shorter by including
more records in the same AFL entry.
Issuers should balance the benefits of using different ICC Public Key Certificates for VIS
and qVSDC (with potentially reduced transaction times) against the increased
complexity of generating and personalizing two ICC Public Key Certificates.

8.4 DGI '0301' – Record Data

This record contains static data used to generate the hash that is required by [VIS] for
ICC Certificate. See [VIS] Table 6-2 for recommended data elements for included in the
signature generation. For the VIS path this record must be indicated in the AFL entry as
containing the data used for signing.
For the qVSDC Path, the use of static data for the ICC Certificate is optional. Eliminating
the use of static data for qVSDC can improve the transaction time. However, this
advantage must be weighted against the additional complexity of generating and
personalizing two ICC Certificates (one with signed static data and one without).

March 2009 Visa Confidential Page 8-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
8 Common Data Elements: VIS, qVSDC and MSD Card Personalization Specification for VSDC
8.5 DGI '0E01' – Internal Data Requirements for VIS and VCPS Applications
Version 1.0

8.5 DGI '0E01' – Internal Data

DGI '0E01' is used to personalize internal card tagged data. Multiple STORE DATA
commands containing this DGI are allowed. Some of the data elements in this DGI are
used by multiple paths, as indicated in the last four columns of Table 8-1.
 Tag '9F4F' – Transaction Log Format for qVSDC differs from VIS in that it is not
extendable with elements from the Card Risk Managements Data Object Lists
(CDOLs), beyond the five (5) basic log elements are as follows:
 Tag '9F27' Cryptogram Information Data (CID)
 Tag '9F02' Amount, Authorized
 Tag '5F2A' Transaction Currency Code
 Tag '9A' Transaction Date
 Tag '9F36' Application Transaction Counter
 Tag '9F52' – Application Default Action Byte 3 bit 5 (“Reset VLP Available Funds
when offline PIN is successfully validated by the card”) is the only bit of the ADA
applicable to qVSDC. For other bits, applicable to VIS transactions, see [VIS].
 Tag '9F79' – VLP Available Funds is only personalized in DGI '0E01' if VIS with VLP
will not be personalized. If VIS with VLP is personalized, VLP Available Funds would
be personalized as the first element of SFI 11 Record 1 (DGI '0B01') per section 6.
See Table 8-2.

Table 8-1 – Common Data Elements for DGI '0E01'

qVSDC
Stream- VIS (if
Tag Data Element qVSDC lined MSD supported)
'57' Track 2 Equivalent Data[2]   
'5F20' Cardholder Name[2]   
[2]
'5F34' Application PAN Sequence Number   
'9F1F' Track 1 Discretionary Data[2] 
'9F4F' Transaction Log Format   
'9F51' Application Currency Code  
'9F52' Application Default Action (ADA)  
'9F53' Consecutive Transaction Limit  
(International)[3]

2
For use in the GET PROCESSING OPTIONS response.
3
Normally personalized in DGI 0D01 for VIS, but may be personalized in DGI 0E01 with no impact to VIS.

Page 8-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 8 Common Data Elements: VIS, qVSDC and MSD
Requirements for VIS and VCPS Applications 8.5 DGI '0E01' – Internal Data
Version 1.0

qVSDC
Stream- VIS (if
Tag Data Element qVSDC lined MSD supported)
'9F54' Cumulative Total Transaction Amount Limit  
(CTTAL)[3]
'9F55' Geographic Indicator 
'9F56' Issuer Authentication Indicator 
'9F57' Issuer Country Code 
'9F58' Lower Consecutive Offline Limit (LCOL) 
'9F59' Upper Consecutive Offline Limit (UCOL) 
'9F5C' Cumulative Total Transaction Amount  
Upper Limit (CTTAUL)[3]
'9F5D' Available Offline Spending Amount (AOSA)  
'9F5E' Consecutive Transaction International 
Upper Limit
'9F63' Offline Counter Initial Value  
'9F67' MSD Offset (only if dCVV is supported) 
'9F68' Card Additional Processes 
'9F6B' Card CVM Limit 
'9F6C' Card Transaction Qualifiers 
'9F6D' VLP Reset Threshold 
'9F6E' Form Factor Indicator   
'9F72' Consecutive Transaction Limit (International 
Country)
'9F73' Currency Conversion Factor 
'9F75' Cumulative Total Transaction Amount Limit 
(Dual Currency)
'9F76' Secondary Application Currency Code 
'9F77' VLP Funds Limit  
'9F78' VLP Single Transaction Limit  
'9F79' VLP Available Funds  
'9F7C' Customer Exclusive Data 

March 2009 Visa Confidential Page 8-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
8 Common Data Elements: VIS, qVSDC and MSD Card Personalization Specification for VSDC
8.6 DGI '8000' and '9000' – DES Keys and Key Check Values Requirements for VIS and VCPS Applications
Version 1.0

Table 8-2 – VLP Available Funds Personalization

qVSDC and
DGI Data Type qVSDC VIS (with contact VLP)
'0B01' Record 
'0E01' Internal 

Personalization of VLP Available Funds impacts qVSDC behavior differently than the
behavior defined for VLP in [VIS].
In qVSDC, if VLP Available Funds is personalized with a value of zero or any other value
up to and including the VLP Funds Limit, the application will use the personalized
amount to be the VLP Available Funds.
If the value is zero, there are no LV funds available for qVSDC until an online VIS
transaction is conducted and meets the requirements for resetting VLP Available Funds
to the VLP Funds limit.

8.6 DGI '8000' and '9000' – DES Keys and Key Check Values
DGI '8000' and '9000' contain the DES keys and DES key check values, respectively.
 Unique Derived Key (UDK), used for authentication
 Message Authentication (MAC) DEA Key.
The UDK is shared by qVSDC, VIS, and MSD (except for MSD dCVV calculations if the
Alternate UDK for dCVV is personalized). If VIS is supported, the ENC UDK is also
included:
 Unique Derived Key (UDK)
 Message Authentication (MAC) DEA Key
 Data Encipherment (ENC) DEA Key

8.7 DGI '8001' – Alternate UDK for dCVV

DGI '8001' contains the alternate UDK for dCVV, which is only used by the MSD
application path.
 Alternate UDK for dCVV
This DGI is personalized when the UDK used for dCVV is different from the UDK
personalized in DGI '8000'. For example, as the DES key for dCVV is derived using a
PAN Sequence Number of zero, any MSD application using a non-zero PAN Sequence
Number must include the alternate UDK if dCVV is also enabled.

Page 8-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 8 Common Data Elements: VIS, qVSDC and MSD
Requirements for VIS and VCPS Applications 8.8 DGI '8101' and '8103' – ICC Key (Modulus/Exponent Format)
Version 1.0

8.8 DGI '8101' and '8103' – ICC Key (Modulus/Exponent Format)

DGIs '8101' and '8103' are both shared by qVSDC and VIS (if fDDA and DDA,
respectively, are supported in Mod/Exp format).
 ('8101') ICC Private Key Exponent
 ('8103') ICC Key Modulus

8.9 DGI '8201' through '8205' – ICC Key (CRT Format)

DGIs '8201' through '8205' are all shared by qVSDC and VIS (if fDDA and DDA,
respectively, are supported in CRT format).
 ('8201') ICC Key CRT constant q-1 mod p
 ('8202') ICC Key CRT constant d mod (q – 1)
 ('8203') ICC Key CRT constant d mod (p – 1)
 ('8204') ICC Key CRT constant prime factor q
 ('8205') ICC Key CRT constant prime factor p
On implementations supporting unique ICC keys for contact and contactless
transactions, optional DGIs '8401' through '8405' are defined for the optional contactless
ICC key.

March 2009 Visa Confidential Page 8-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
8 Common Data Elements: VIS, qVSDC and MSD Card Personalization Specification for VSDC
8.10 DGI '9102' and '9103' – Select Response Requirements for VIS and VCPS Applications
Version 1.0

8.10 DGI '9102' and '9103' – SELECT Response

DGI '9102' is shared by qVSDC, MSD, and VIS.
 Tag '50' Application Label
 Tag '87' Application Priority Indicator
 Tag '9F38' Processing Options Data Object List (PDOL)
 Tag 'BF0C' FCI Issuer Discretionary Data
 Tag ‘5F2D’ Language Preference
 Tag ‘9F12’ Application Preferred Name
 Tag ‘9F11’ Issuer Code Table Index
DGI '9103' is an optional DGI, which is highly recommended for dual interface cards. If
personalized, this response will be used for all contactless transactions.
 Tag '50' Application Label
 Tag '87' Application Priority Indicator
 Tag '9F38' Processing Options Data Object List (PDOL)
 Tag 'BF0C' FCI Issuer Discretionary Data
 Tag ‘5F2D’ Language Preference
 Tag ‘9F12’ Application Preferred Name
 Tag ‘9F11’ Issuer Code Table Index

8.11 DGI '9200' – Issuer Application Data

DGI '9200' is shared between qVSDC and VIS.
 Tag '9F10' Issuer Application Data (IAD)
The IAD personalized here is the common IAD for all application paths on the payment
application. If qVSDC will be using a different CVN than the one defined in the common
IAD, then another IAD must be personalized in DGI '9207'.
When processing a transaction using the qVSDC application path, the common IAD will
be used and overlaid with the qVSDC specific CVN (if present). For MSD, regardless of
the CVN personalized in the common IAD, the CVN will always be overlaid with CVN 17
for MSD transactions where a cryptogram is required.
Note: Any Issuer Discretionary Data (IDD) options present in the IAD will be ignored for
MSD.

Page 8-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC 8 Common Data Elements: VIS, qVSDC and MSD
Requirements for VIS and VCPS Applications 8.12 DGI '9206' – MSD GPO Response Data
Version 1.0

8.12 DGI '9206' – MSD GPO Response Data

DGI '9206' is only used by MSD.
 Tag '82' Application Interchange Profile (AIP)
 Tag '94' Application File Locator (AFL)

8.13 DGI '9207' – qVSDC Response Data

DGI '9207' is only used by qVSDC.
 Tag '82' Application Interchange Profile (AIP)
 Tag '94' Application File Locator (AFL)
 Tag '9F10' Issuer Application Data (IAD) may also be personalized in
DGI '9207' if qVSDC will be using a different Cryptogram
Version Number (CVN) than what is present in the
common IAD (which is personalized as shown in
Table 7-15).

March 2009 Visa Confidential Page 8-9

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
8 Common Data Elements: VIS, qVSDC and MSD Card Personalization Specification for VSDC
8.13 DGI '9207' – qVSDC Response Data Requirements for VIS and VCPS Applications
Version 1.0

Page 8-10 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC A Personalization for Issuer Discretionary Data
Requirements for VIS and VCPS Applications
Version 1.0

A Personalization for Issuer Discretionary Data

The following is the method for indicating to the VSDC card that data is to be included in
the Issuer Discretionary Data Portion of the Issuer Application Data (IAD - tag '9F10'
personalized in DGI '9200').
The IDD Length and IDD Option ID are used to choose the type of data to be returned in
the Issuer Discretionary Data field. By default, Issuer Discretionary Data will not be
returned. If the issuer wants to receive Issuer Discretionary Data containing the values
shown in Table A-1, the IDD Length byte and an IDD ID byte containing the IDD Option
ID in the low order nibble of the byte should be personalized following the Visa
Discretionary Data in the IAD.

Table A-1 – Issuer Discretionary Data Personalization Options in VIS and VCPS

IDD
Length Option Data Element Values Included in Issuer
IDD Option (bytes) ID Discretionary Data
VLP Available Funds 10 '1' 5 low-order bytes of VLP Available Funds
followed by a 4-byte MAC
Cumulative Total 10 '2' 5 low-order bytes of CTTA followed by a 4-
Transaction Amount (CTTA) byte MAC
VLP Available Funds and 15 '3' 5 low-order bytes of VLP Available funds
CTTA followed by 5 low-order bytes of the CTTA
followed by a 4-byte MAC
CTTA and CTTA Limit 15 '4' 5 low-order bytes of CTTA followed by 5
(CTTAL) low-order bytes of CTTAL followed by a 4-
byte MAC
Available Offline Spending 10 '5' 5 low-order bytes of AOSA followed by a 4-
Amount (AOSA) byte MAC
Static Data 1-15 N/A Issuer specified constant card data

March 2009 Visa Confidential Page A-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
A Personalization for Issuer Discretionary Data Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

EXAMPLE: Personalization of the Issuer Application Data

Issuer Application Data (tag '9F10')

Visa Discretionary Data

Length: '06'
Value: '010A03000000'
Issuer Discretionary Data
Length: '0A' (expected length of Issuer Discretionary Data
in GEN AC Response)
IDD Option ID: '02' (ID to request CTTA)

EXAMPLE: Issuer Application Data in the GENERATE AC Response

Issuer Application Data (tag '9F10')

Visa Discretionary Data

Length: '06'
Value: '010A03A41000'
Issuer Discretionary Data
Length: '0A'
Value: IDD ID: '02'
CTTA: '00 00 00 00 00' (5 low-order bytes)
MAC (4 bytes as defined in [VIS])

The four-byte MAC is generated using a session key derived from the MAC UDK using
the first method defined in [VIS] section B.4.

Page A-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC B Multi-application BLOCK/UNBLOCK Examples
Requirements for VIS and VCPS Applications
Version 1.0

B Multi-application BLOCK/UNBLOCK Examples

This appendix describes the Common Personalization method for delivering data to the
card (using the STORE DATA command) to support functionality to block and unblock
more than one application on multi-application cards that support this functionality. This
approach describes only the delivery method (that is, DGI and format) for block/unblock
data. Once the DGI is input, the manner in which the card internally stores and supports
the functionality is determined by the vendor. In the examples below, DGI '0E02' is used
to indicate AIDs (in a single BLOCK/UNBLOCK List per card) that are either blocked or
unblocked in addition to the selected application when an APPLICATION BLOCK or an
APPLICATION UNBLOCK command is received.
The examples below illustrate how the functionality can be implemented during
personalization. The length of the entire list of applications to be linked precedes the list
(BLOCK/UNBLOCK List).
 Separator 'FA' indicates that both UNBLOCK and BLOCK apply to all of the
applications listed following the separator until the next separator or the end of the
list.
 Separator 'FB' indicates that BLOCK applies to all applications listed following the
separator until the next separator or the end of the list, but UNBLOCK affects only
the active application.
 Separator 'FC' indicates that UNBLOCK applies to all applications listed following the
separator until the next separator or the end of the list, but BLOCK affects only the
active application.
Each AID in the linked list is preceded by a length byte indicating the length of the AID.
The list may contain one or more separators. If no applications on the card are linked,
the list is not present in the personalization input file.
During processing, the applet checks the BLOCK/UNBLOCK list when an APPLICATION
BLOCK or APPLICATION UNBLOCK command is received from a valid issuer verified by a
MAC. The selected application is always BLOCKed or UNBLOCKed while the other
applications linked in the list are BLOCKed or UNBLOCKed according to the separators
'FA', 'FB', or 'FC'.

March 2009 Visa Confidential Page B-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
B Multi-application BLOCK/UNBLOCK Examples Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

The BLOCK/UNBLOCK List contains the full AIDs of the applications to be BLOCKED or
UNBLOCKED and is stored in a single DGI ('0E02') for Common Personalization (or tag
'9F64' for those applets that do not support Common Personalization). The BLOCK/
UNBLOCK List can be accessed by all linked applications and may be accessed by any
VSDC application. Indicators are in bold in the following examples illustrating various
scenarios of Visa application BLOCK and UNBLOCK.

EXAMPLE 1:
 Visa Credit – an APPLICATION BLOCK or APPLICATION UNBLOCK command would
BLOCK or UNBLOCK only that AID.
 Visa Debit – shares data with PLUS and BLOCK or UNBLOCK would BLOCK and
UNBLOCK both applications associated with these AIDs.

Table B-1 – Example of Linking for Both Block and Unblock

AID Block-Unblock List (DGI '0E02')

Visa 'A000000003101001' No BLOCK/UNBLOCK List is specified in
Credit personalization data – default is to block selected
application
Visa Debit 'A000000003101002' Length: 18 ('12')
PLUS 'A0 00 00 00 03 8010' Value: 'FA08A00000000310100207A0000000038010'

EXAMPLE 2:
 Visa Credit – an APPLICATION BLOCK or APPLICATION UNBLOCK command would
BLOCK or UNBLOCK only that application.
 Visa Debit – shares data with Application A and BLOCK would BLOCK both
applications associated with these AIDs but a separate UNBLOCK is needed for
each application.

Table B-2 – Example of Linking for Unblock Only

AID Block-Unblock List (DGI '0E02')

Visa Credit 'A000000003101001' No BLOCK/UNBLOCK List is specified in
personalization data – default is to block selected
application
Visa Debit 'A000000003101002' Length: 18 ('12')
VSDC 'A000000003nnnn' Value: 'FB08A00000000310100207A000000003nnnn'
Application A

Page B-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC B Multi-application BLOCK/UNBLOCK Examples
Requirements for VIS and VCPS Applications
Version 1.0

EXAMPLE 3:
The following example is intended to illustrate all permutations of this approach.
 APP1 – an APPLICATION BLOCK or APPLICATION UNBLOCK command would BLOCK or
UNBLOCK only that application.
 APP2 and APP3 – an APPLICATION BLOCK command would block only one AID at a
time but UNBLOCK would UNBLOCK them both.
 APP2 and APP4 – an APPLICATION UNBLOCK command would unblock only one AID
at a time but BLOCK would BLOCK them both.
 APP3 and APP4 – an APPLICATION BLOCK or APPLICATION UNBLOCK command would
BLOCK and UNBLOCK both applications.

Table B-3 – Example of Mixed Linking for Block Only, Unblock Only and Both

AID DGI '0E02'

APP1 Visa Credit 'A000000003101001' No Block Unblock List is specified in
personalization data – default is to block or
unblock selected application
APP2 Visa Credit 'A000000003101002' Length: 55 ('37')
Value: 'FC08A00000000310100207A000000
APP3 Domestic 'A000000nnn1000' nnn1000FA08A00000000310100307A00000
Payment 0nnn1000FB08A00000000310100208A0000
Application 00003101003'
using
VSDC
applet
APP4 Visa Debit 'A000000003101003'

March 2009 Visa Confidential Page B-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
B Multi-application BLOCK/UNBLOCK Examples Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Page B-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications
Version 1.0

C Subset of EMV CPS for Contactless-only

Implementations
This appendix describes a subset of the full [EMV CPS] personalization that is sufficient
to perform personalization of [VCPS] implementations for issuance in specific markets.
Contact your Visa regional representative to discuss whether this appendix applies for
your markets.

C.1 Data Preparation

The data preparation process creates the Personalization Data Instruction (PDI) data
that is used to direct the personalization process and also the application data that is
used to personalize the IC card application. Data produced by the data preparation
process must be transported securely to the personalization device itself (unless it is
created in an HSM attached to the personalization device). Any secret data created by
the data preparation process remotely from the personalization device must therefore be
encrypted before transmission and all data files generated remotely from the
personalization device must be protected by a Message Authentication Code (MAC)
before transmission.

The data preparation process has the steps listed below:

1. Gathering personalization data from the issuing sources.
2. Combining personalization data into data groupings.
3. Encrypting and MACing personalization as needed.
4. Creating personalization equipment instructions.
5. Creating data to be logged for the application.
6. Creating the input file to the personalization device.

Personalization data falls into three categories:

 Issuer Master Keys and Data
 Application Keys and Certificates
 Application Data

March 2009 Visa Confidential Page C-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.1 69BData Preparation Requirements for VIS and VCPS Applications
Version 1.0

C.1.1 Issuer Master Keys and Data

Personalization cannot take place unless the card issuer creates master keys and other
specific data. The master keys are used in two ways; firstly to support secure
transmission of personalization data and secondly to create application-level data for
personalization of an application. Some of the data may be used to manage the
personalization process and some will be placed on the card during personalization.
Other processes may also use one or more of the master keys used by the
personalization process. In this circumstance, a method of importing or exporting master
keys to allow appropriate data sharing between processes will be required.
Prior to the personalization process the KMCID, key version number, KEYDATA and the
corresponding relevant keys must be placed onto the card. KMCID and key version
number are used to access the issuer personalization master key (KMC) in order to
derive the card unique static keys using diversification data (KEYDATA).
The 6-byte KMCID (e.g. IIN right justified and left padded with 'F' per nibble)
concatenated with the least significant 4 bytes of the Chip Serial Number (unique for
each card) form the key diversification data that must be placed in tag 'CF'. This same
data must be used to form the response to the INITIALIZE UPDATE command.

Table C-1 – Key Derivation Data (tag 'CF')

Data Element Description Length Format

KEYDATA Key derivation data: 10 Binary
- KMCID (6 bytes)
- Chip Serial Number (4 bytes)

C.1.2 Application Keys and Certificates

Application level symmetric DES secret keys must be created during data preparation. In
most cases, such keys are derived from appropriate issuer master keys.
If fast Dynamic Data Authentication (fDDA) features are being used for qVSDC, an
issuer RSA key pair must be generated and certified by the Payment System
Certification Authority. The Issuer Certificate must be stored in a record on the card.
In addition, the fDDA feature requires a card supporting RSA public key technology. The
ICC RSA key pair must be generated and certified by the issuer using the issuer private
key corresponding to the Issuer Certificate. This ICC Certificate must also be stored in a
record on the card.

Page C-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.2 70BInterface: Personalization Device to ICC
Version 1.0

C.1.3 Application Data

Application data will fall into two categories. It may be common across all IC cards for
the issuer’s project (e.g. the identifier of the issuer) or it may be unique to the IC card
(e.g. the PAN of a debit/credit application).
Data elements that are logically or physically related are grouped and identified within a
Data Grouping Identifier (DGI). For example, DES keys are combined into one DGI, as
are tags belonging in the same record. All data in a grouping will be sent to the IC card
application in a single command.
The IC card application uses the DGI to determine how the data grouping is to be
processed after it is received from the personalization device. Data groupings are
defined in section 6. The personalization devices will parse the input record and create a
STORE DATA command for each data grouping in the input record.
The DGI must be coded on two bytes in binary format, followed by a one-byte, binary
format length indicator.

C.2 Interface: Personalization Device to ICC

C.2.1 Key Management
The personalization device and the entity that loads the KENC, the KMAC, and the KDEK to
the IC card application prior to personalization share the KMC. Personalization device
processing must be able to identify the KMC in the personalization device key storage by
an issuer identifier and a version number. The identifiers of the KMC for use with a
specific IC card will be retrieved from the IC card itself (see Table C-5).

March 2009 Visa Confidential Page C-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.2 70BInterface: Personalization Device to ICC Requirements for VIS and VCPS Applications
Version 1.0

Table C-2 – Personalization Keys

Key Name Shared by Usage Master Card Session

Issuer Issuer, Card The KMC is used by the Card KMC
Master Key Manufacturer Manufacturer to generate card level
and keys (KENC, KMAC, KDEK) and place
Personalization them on the card.
Device
Used to create a session key which KENC SKUENC
is used for mutual authentication and
to protect the confidentiality of the
APDU command data field in CBC
mode
Used to create session key which is KMAC SKUMAC
used for mutual authentication and to
create C-MACs used in command
processing
Used to create a session key which KDEK SKUDEK
is used to protect the confidentiality
of secret data in ECB mode between
the card and personalization device
Issuer Data Issuer and Data Secures offline PIN and other secret DEKISS
Exchange Preparation data between the issuer and the Data
Key Device Preparation Device
Transport Data Secures offline PIN and other secret DEK / TK
Keys Preparation data between the Data Preparation
Device and Device and the Personalization
Personalization Device
Device Special types of data transport keys
may be used as follows:
PEK/TK – PIN Encryption Key for
securing PIN data
KEK/TK – Key Exchange Key for
securing DES and RSA private keys
MACkey Data Ensures the integrity of the MACkey N/A N/A
Preparation application data provided to the
Device provides Personalization Device in the
to Personaliza- Personalization Data File
tion Device

The KMC is used to create card static unique derived keys that must in turn be used to
create session keys for communicating with the IC card application (see C.4.2).
Personalization keys are summarized in Table C-2.

Page C-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.2 70BInterface: Personalization Device to ICC
Version 1.0

C.2.2 Processing Flow (Commands)

The processing flow of messages across the interface is shown in this section. The
personalization device activates the IC card (Reset) and the IC card responds with an
Answer To Reset (ATR), assuming a dual interface card where personalization is done
via the contact interface. Contactless cards must be activated to the protocol ready state
([ISO 14443-4]) before the SELECT command is sent. The “Answer To Select” (ATS)
from a Type A card or “Response to ATTRIB command” from a Type B card must be
received to ensure the card is activated.
Figure C-1 summarizes the flow of commands and the responses that must occur
between the personalization device and the IC card.

Figure C-1 – Personalization Command Flow

C.2.2.1 SELECT Command

The SELECT command is used to select each IC card application to be personalized.
Application selection is described in [EMV Book 1]. This command will be issued once
for each IC card application to be personalized.

March 2009 Visa Confidential Page C-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.2 70BInterface: Personalization Device to ICC Requirements for VIS and VCPS Applications
Version 1.0

C.2.2.2 INITIALIZE UPDATE Command

The INITIALIZE UPDATE command is the first command issued to the IC card after the
personalization device selects the application. INITIALIZE UPDATE is used to establish the
Secure Channel Session to be used during personalization. The data to perform mutual
authentication is exchanged. The identifier and version number for the KMC and the
data to be used to derive the KENC, the KMAC, and the KDEK for the application are also
returned.
The INITIALIZE UPDATE command will be issued once for each IC card application to be
personalized.
The INITIALIZE UPDATE command must be coded as shown in Table C-3. The host
challenge (RTERM) is generated by the personalization device.

Table C-3 – INITIALIZE UPDATE Command Coding

Field Content Length

CLA '80' 1
INS '50' 1
P1 '00' 1
P2 '00' 1
Lc '08' 1
Host challenge Random number used in host and card cryptogram 8
(RTERM) generation
Le '00' 1

The response to a successful INITIALIZE UPDATE command is shown in Table C-4. There
are no unique status conditions for INITIALIZE UPDATE. All status conditions are defined in
[ISO 7816].

Table C-4 – Response to INITIALIZE UPDATE command

Field Length
KEYDATA (See Table C-5) 10
Version number of the master key (KMC) 1
Secure Channel Protocol Identifier (ALGSCP ='02') 1
Sequence Counter 2
Card challenge (RCARD) 6
Card cryptogram 8
SW1 SW2 2

Page C-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.2 70BInterface: Personalization Device to ICC
Version 1.0

Req C.1 Initialize KEYDATA

Initialize KEYDATA as a data element available to each IC card application. Its initial
value should be coded as shown in Table C-5.

Table C-5 – Initial Contents of KEYDATA

Field Length Format

Identifier of the KMC (e.g. IIN/BIN right justified and left padded 6 BCD
with 1111b per nibble)
Chip Serial Number (CSN) 4 Binary

Req C.2 KMC identifier facilitates locating the KMC

The identifier of the KMC is part of the response data to the INITIALIZE UPDATE
command and it facilitates locating the issuer’s KMC.

Req C.3 KMC and KEYDATA use

The first 6 bytes of KEYDATA returned from the INITIALIZE UPDATE command are
used to identify the master key for secure messaging (KMC). The six least significant
bytes of KEYDATA are used as key diversification data. The personalization device
must use the KMC and KEYDATA to generate the KENC, the KMAC, and the KDEK for
this IC card, as defined in section C.3.1. These keys must have been placed in the IC
card prior to the start of the personalization process.

Req C.4 Use Secure Channel Protocol identifier

Subsequent processing must use the identifier for Secure Channel Protocol
(ALGSCP) in the response to the INITIALIZE UPDATE command to determine how to
create MACs and when to create session keys.

Req C.5 Verifying the card cryptogram during personalization

The personalization device must verify the card cryptogram in the response to the
INITIALIZE UPDATE command by generating a duplicate cryptogram and comparing it to
the value returned in the response. The card cryptogram is a MAC created as
described in section C.4.3.1 using key SKUENC and data that varies by ALGSCP. The
data to be MACed is = RTERM (8 bytes) || Sequence Counter (2 bytes) || RCARD
(6 bytes). If the card cryptogram does not verify correctly, personalization processing
is terminated.

March 2009 Visa Confidential Page C-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.2 70BInterface: Personalization Device to ICC Requirements for VIS and VCPS Applications
Version 1.0

C.2.2.3 EXTERNAL AUTHENTICATE Command

The EXTERNAL AUTHENTICATE command follows the INITIALIZE UPDATE command and is
used to authenticate the personalization device to the IC card application.
The EXTERNAL AUTHENTICATE command will be issued once for each application to be
personalized.

Req C.6 Coding the External Authenticate command

The EXTERNAL AUTHENTICATE command must be coded as shown in Table C-6. The
host cryptogram is calculated by the personalization device.

Table C-6 – EXTERNAL AUTHENTICATE Command Coding

Field Content Length

CLA '84' 1
INS '82' 1
P1 Security Level – SECLEV = '00' 1
In addition, the Security Level may optionally also support '01' and
'03' (reference [EMV CPS]).
P2 '00' 1
Lc '10' 1
Data Host cryptogram 8
C-MAC Command Message Authentication Code 8

Req C.7 Response to External Authenticate command

The response to the EXTERNAL AUTHENTICATE commands consists only of SW1 SW2.
Table C-7 lists status conditions that may occur, in addition to the general ones listed in
[ISO 7816].

Table C-7 – Status Conditions for EXTERNAL AUTHENTICATE Command

SW1 SW2 Meaning

'69' '82' MAC failed verification
'63' '00' Authentication of host cryptogram failed
'69' '85' Conditions of use not satisfied

All subsequent commands received by the IC card application will not include any
security, i.e. no C-MAC and no encryption of the entire command data string.

Page C-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.2 70BInterface: Personalization Device to ICC
Version 1.0

The host cryptogram must be created by generating a MAC as described in

section C.4.3.1 using SKUENC. The data to be MACed is = Sequence Counter (2 bytes)||
RCARD (6 bytes)|| RTERM (8 bytes). The IC card must verify the host cryptogram by
generating a duplicate cryptogram and comparing it to the value received in the
command data field.
The C-MAC must be calculated by the personalization device and verified by the IC card
as described in section C.4.3.2.
If the EXTERNAL AUTHENTICATE command is successful, the sequence counter shall be
incremented by one and processing must continue with one or more STORE DATA
commands.
Note: No response data is returned for the EXTERNAL AUTHENTICATE command.

C.2.2.4 STORE DATA Command

The STORE DATA command is used to personalize all qVSDC, MSD, and PPSE
applications. There shall be one STORE DATA command for each data grouping. The
STORE DATA command requires a secure channel be established. The DGIs used by the
STORE DATA command are dependent on the data in the input record. Field ENC in the
input record lists the identifiers of data groupings that must be encrypted.
The STORE DATA command used to personalize the IC card applications must be coded
as shown in Table C-8.

Table C-8 – STORE DATA Command Coding

Field Content Length

CLA '80' OR 1
'84' (if supporting Security Levels '01' and '03'. Reference [EMV CPS])
INS 'E2' 1
P1 The high-order bit being on indicates the last STORE DATA command 1
(all other bit setting should be ignored by the card application).
P2 Sequence Number – this byte should be ignored by the card 1
application
Lc Length of command data 1
DGI Identifier of data to be stored 2
Length Length of data grouping 1
Data Data to be stored var.

Table C-9 lists the status conditions that may occur in addition to those specified in
[ISO 7816].

March 2009 Visa Confidential Page C-9

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.3 71BIC Card Personalization Processing Requirements for VIS and VCPS Applications
Version 1.0

Table C-9 – Status Conditions for STORE DATA Command

SW1 SW2 Meaning

'6A' '88' Referenced data not found (Unrecognized DGI)
'6A' '80' Incorrect parameters in the data field

If a DGI is listed as requiring encryption (e.g., DGI '8000'), the data must be encrypted
prior to sending it to the IC card as described in the next paragraph. Only the data
portion of the data grouping is encrypted (the DGI and length field are not encrypted).
The personalization device uses the session key SKUDEK to encrypt the data. Encryption
must be done in ECB mode. This mode is illustrated in section C.4.4.1. Triple DES (as
presented in C.4.4.2) is used to encrypt each block.
The last STORE DATA command is indicated to the IC card application by the
personalization device setting on bit 8 of P1 ('80'). Until receiving a STORE DATA
command with P1 bit 8 set to 1, the card shall continue to accept STORE DATA
commands, as long as a secure channel has been established. After the card receives
the last command, further STORE DATA commands should result in a non-'9000' status
word; for example, SW '6985' – Conditions of use not satisfied.

C.2.3 Command Responses

All responses to commands, whether successfully processed or not, include two status
bytes, SW1 and SW2. SW1 and SW2 are one byte long each as defined in [ISO 7816].
Besides specific behavior defined for each command in this appendix, when a
personalization device receives an SW1 SW2 code different from '9000', '6A88', '61xx',
or '67xx'; it shall abort the personalization process for the application if recovery is not
possible.

C.3 IC Card Personalization Processing

IC card personalization processing is preceded by a preparation or pre-personalization
process. This preparation is described here in order to establish the data that is
assumed to be present in the ICC prior to personalization.

C.3.1 Preparation for Personalization (Pre-Personalization)

Prior to personalization the ICC must be enabled/activated, the basic application loaded,
and the file and data structure established. In addition, certain data must be placed onto
the IC card. In some cases this data applies to the entire card (e.g. KMCID). In some
cases, this data only applies to a single application (e.g. the AID).

Page C-10 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.3 71BIC Card Personalization Processing
Version 1.0

Req C.8 Initializing space allocated for data

Unless the card is capable of dynamically building files and records and initializing
them to binary zeros, files must have been built with space allocated for the data
described in the specifications for the IC card application and the space must be
initialized to binary zeros.

Req C.9 Applications selectable by AID

Each application must be selectable by AID.

Req C.10 FCI if not to be personalized

If the File Control Information (FCI) for the application is not to be personalized, it
must be created prior to personalization.

Req C.11 Contents of KEYDATA

KEYDATA must be set as shown in Table C-5. KEYDATA is composed of the KMCID
and Chip Serial Number (CSN). KMCID is the identifier of the master personalization
key to be supplied by the card issuer or the personalizer. The length of KMCID is 6
bytes. The CSN is rightmost 4 bytes of the physical identifier of the card.

Req C.12 KMC version number

The version number of the personalization master key (KMC) used to generate the
initial personalization keys (the KENC, the KMAC, and the KDEK) for each application
must be on the IC card in tag 'CF' (see Table C-2).

Req C.13 Derive KENC

A derived key (KENC) must be generated for each IC card and placed into the
application. This key is used to generate the card cryptogram and to verify the host
cryptogram.
The KENC is a 16-byte DES key (112 data bits plus 16 parity bits).
The KENC will be derived in the following way:
KENC := DES3(KMC)[Six least significant bytes of the KEYDATA || 'F0' || '01' ]||
DES3(KMC)[ Six least significant bytes of the KEYDATA || '0F' || '01'].

Req C.14 Derive KMAC

A derived key (KMAC) must be generated for each IC card and placed into the card.
This key is used to verify the C-MAC for the EXTERNAL AUTHENTICATE command.
The KMAC is a 16 byte (112 bits plus parity) DES key.
The KMAC will be derived in the following way:
KMAC := DES3(KMC)[ Six least significant bytes of the KEYDATA || 'F0' || '02' ]||
DES3(KMC)[ Six least significant bytes of the KEYDATA || '0F' || '02'].

March 2009 Visa Confidential Page C-11

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.3 71BIC Card Personalization Processing Requirements for VIS and VCPS Applications
Version 1.0

Req C.15 Derive KDEK

A derived key (KDEK) must be generated for each IC card and placed into the card.
This key is used to decrypt in ECB mode secret data received in the STORE DATA
command.
The KDEK is a 16-byte (112 bits plus parity) DES key.
The KDEK will be derived in the following way:
KDEK := DES3(KMC)[ Six least significant bytes of the KEYDATA || 'F0' || '03' ]||
DES3(KMC)[ Six least significant bytes of the KEYDATA || '0F' || '03'].

Req C.16 Initialize sequence counter

The sequence counter to be returned in the response to the INITIALIZE UPDATE
command must be initialized to '0000'.

C.3.2 Personalization Requirements

C.3.2.1 IC Card Requirements

Req C.17 Use of Application Selection process

The application to be personalized must be on the card and must use the Application
Selection process specified in [EMV Book 1] Part II.

C.3.2.2 Command Support

Req C.18 Personalization commands supported

Each IC card application that supports this specification must support the
personalization commands described in section C.2:
 SELECT
 INITIALIZE UPDATE
 EXTERNAL AUTHENTICATE
 STORE DATA

Req C.19 Incrementing sequence counter

Each IC card must maintain a sequence counter that can be returned in the response
to INITIALIZE UPDATE command. This counter must be incremented by one after each
successful EXTERNAL AUTHENTICATE command.

Req C.20 Unrecognized DGI in STORE DATA command

If the IC card application does not recognize the DGI in the STORE DATA command, it
must respond with an SW1 SW2 of '6A88'.

Page C-12 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.4 72BCryptography for Personalization
Version 1.0

C.3.2.3 Secure Messaging

Secure messaging shall be required by all applications for the EXTERNAL AUTHENTICATE
command (see section C.2.2.3).

Req C.21 C-MAC required and C-MAC failure

The EXTERNAL AUTHENTICATE command requires an 8 byte C-MAC that must be
verified by the IC card prior to accepting the command. If the C-MAC fails to verify
successfully, the IC card must reject the command with SW1 SW2 = '6982' and the
secure channel session is terminated.

Req C.22 Verifying the C-MAC

To verify a C-MAC, the IC card must generate a duplicate C-MAC and compare it with
the C-MAC included in the command data. The C-MAC must be calculated as
described in section C.4.3.2.

Req C.23 Support for decrypting data

The IC card application must be able to decrypt data as specified in section C.4.5.

C.4 Cryptography for Personalization

C.4.1 Security Principles
 The STORE DATA command must be performed within a Secure Channel Session.
 The card shall support a subset of the Secure Channel Protocol defined in
[EMV CPS] – this subset is fully described in this document.
 DES keys by definition are odd parity as indicated in [FIPS 46-3].
 All DES personalization keys are double length keys (16 bytes).
 All MACs are eight bytes in length.

C.4.2 Session Keys

DES session keys are generated every time a secure channel is initiated. Up to three
session keys may be generated, namely SKUENC, SKUMAC, and SKUDEK.

Req C.24 Use of session keys

All encryption, decryption, and MACing in commands that are sent to the IC card
must be performed using session keys (SKUENC, SKUMAC, and SKUDEK).

March 2009 Visa Confidential Page C-13

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.4 72BCryptography for Personalization Requirements for VIS and VCPS Applications
Version 1.0

Req C.25 Calculating session keys

Session keys must be calculated using the triple DES algorithm presented in
section C.4.4.2 and the base keys KENC, KMAC, and KDEK to produce SKUENC, SKUMAC,
and SKUDEK respectively.
The session keys must be calculated in CBC mode as specified in section C.4.4.2
and the data in Table C-10. Padding is not added prior to encryption. The 16 bytes of
derivation data, when encrypted, will result in a 16-byte double length key.

Table C-10 – Derivation Data for Session Keys

Session IC Card
Key Key Derivation Data
SKUENC KENC '0182' || sequence counter || '000000000000000000000000'
SKUMAC KMAC '0101' || sequence counter || '000000000000000000000000'
SKUDEK KDEK '0181' || sequence counter || '000000000000000000000000'

The session keys must be calculated for each IC card application during processing of
the INITIALIZE UPDATE command using a sequence counter provided by the IC card. See
section C.2.2.2 for specifications for the INITIALIZE UPDATE command.
These session keys are used for all cryptography for personalizing the IC card
application until the completion of the last STORE DATA command.

C.4.3 MACs
The personalization process creates MACs for the following purposes:
 During the IC personalization process (INITIALIZE UPDATE command and EXTERNAL
AUTHENTICATE command) the IC card returns a MAC (the card cryptogram) and the
personalization device sends a MAC (the host cryptogram) to the IC card. The IC
card and the personalization device authenticate each other using these
cryptograms. The process of creating these MACs is described in section C.4.3.1.
 The EXTERNAL AUTHENTICATE command requires a C-MAC to be sent from the
personalization device to the IC card. The process of creating these MACs is
described in section C.4.3.2.

C.4.3.1 MACs for Personalization Cryptograms

Req C.26 Padding of input to MAC generation

Input to the MAC is first padded to the right with '80'. The result is padded to the right
with up to 7 bytes of '00' to make the result a multiple of 8 bytes long. This is defined
in [ISO 9797] as padding method 2.

Page C-14 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.4 72BCryptography for Personalization
Version 1.0

Req C.27 MAC calculation

The full triple DES MAC is as defined in [ISO 9797] as MAC Algorithm 1 with output
transformation 1, without truncation, and with triple DES taking the place of the block
cipher.

Req C.28 Use full 64-bit MAC

All 64 bits of the final output block are used as the MAC created for personalization
cryptograms.

Req C.29 Cryptogram verification

Verification of a cryptogram must be performed by computing a MAC based on the
same parameters (and key) and then comparing the result with the cryptogram
received.

C.4.3.2 C-MAC for Secure Messaging

Req C.30 Verify C-MAC to accept EXTERNAL AUTHENTICATE command

The EXTERNAL AUTHENTICATE command (described in section C.2.2.3) must include
an 8 byte C-MAC created by the personalization device and verified by the IC card
prior to accepting the command. If the command C-MAC fails to verify successfully,
the IC card must reject the command with SW1 SW2 = '6982' and close the secure
channel.
Note: To avoid confusion with the MAC function defined in section C.4.3.1, C-MAC
is used as the name of the function used to generate a secure message MAC
and as the name of the secure message MAC.

Req C.31 Calculating the C-MAC

The C-MAC must be calculated as follows:
Concatenate the command header (CLA INS P1 P2 Lc), as shown in Table C-6, with
the command data (excluding the C-MAC itself).
The C-MAC is computed as follows, using SKUMAC as the key.

Req C.32 Algorithm to use for generating a C-MAC

The process of generating a C-MAC is performed with single DES plus final triple
DES MAC according to [ISO 9797] as MAC Algorithm 3 with output transformation 3,
without truncation, and with DES taking the place of the block cipher. This is also
known as the “Retail MAC” and is shown in Figure C-2.

March 2009 Visa Confidential Page C-15

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.4 72BCryptography for Personalization Requirements for VIS and VCPS Applications
Version 1.0

Figure C-2 – C-MAC Computation

Both the personalization device and the IC card must create the C-MAC. The IC card
verifies the C-MAC by comparing the C-MAC it creates to the C-MAC in the command.
Page C-16 Visa Confidential March 2009
Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC C Subset of EMV CPS for Contactless-only Implementations
Requirements for VIS and VCPS Applications C.4 72BCryptography for Personalization
Version 1.0

C.4.4 Encryption
This section describes the encryption of secret data during personalization.
Note: Post personalization encryption is not used in MSD applications.

C.4.4.1 Encryption Using ECB Mode

Req C.33 Encryption of keys

The personalization device must encrypt keys with Triple DES in ECB mode using the
session key SKUDEK.

Req C.34 Triple DES in ECB mode

Triple DES in ECB mode, as defined in [ISO 10116], is used.

C.4.4.2 Encryption Using CBC Mode

Encryption of data must be done in Triple DES in CBC mode, as defined in [ISO 10116]
with an Initial Vector equal to '00 00 00 00 00 00 00 00'.

C.4.5 Decryption
The IC card should decrypt the secret data prior to storing it for future use. This section
describes the decryption of secret data during personalization.

C.4.5.1 Decryption
The IC card must use SKUDEK for decryption of encrypted data grouping values. Triple
DES in ECB mode, as defined in [ISO 10116], is used.

C.4.6 Triple DES Calculation

Triple DES uses a compound operation of DES encryption and decryption. Triple DES,
as used in this specification, uses keying option 2 as defined in [ISO 18033-3].

March 2009 Visa Confidential Page C-17

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
C Subset of EMV CPS for Contactless-only Implementations Card Personalization Specification for VSDC
C.4 72BCryptography for Personalization Requirements for VIS and VCPS Applications
Version 1.0

Page C-18 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications
Version 1.0

D Personalization Examples
This appendix provides a personalization log showing the EMV CPS subset, defined in
this document, used on a card supporting PPSE, qVSDC and MSD (with optional VIS).
The paths in a card application (qVSDC, MSD, and VIS) are accessed through one Visa
AID. The card must contain the following applications in a state ready for
personalization:
 PPSE (AID '32 50 41 59 2E 53 59 53 2E 44 44 46 30 31')
 qVSDC/MSD and VIS (if supported) (AID 'A0 00 00 00 03 10 10')
Note: The personalization shown here is only an example and does not include all
possible options or data elements.

March 2009 Visa Confidential Page D-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.1 73BProximity Payment System Environment (PPSE) Requirements for VIS and VCPS Applications
Version 1.0

D.1 Proximity Payment System Environment (PPSE)

Select PPSE for Personalization
command --> '00 A4 04 00 0E'
'32 50 41 59 2E 53 59 53 2E 44 44 46 30 31
00'
<- response '6F 10 84 0E 32 50 41 59 2E 53 59 53 2E 44 44 46 30 31'

Establish Secure Channel (SCP-02)

command --> '80 50 00 00 08' INITIALIZE UPDATE
'00 22 44 66 88 AA CC EE'
'00'
<- response '00 00 00 00 00 00 00 00 00 00 01 02 00 01 CC CC CC CC CC CC 08
D0 03 00 E7 AE BA 21'

command --> '84 82 00 00 10' EXTERNAL AUTHENTICATE

'30 61 1C F0 07 DD 70 2B
'03 07 87 EA 54 C0 D6 AD'

STORE DATA
command --> '80 E2 80 00 20' Note that P1 = '80'
'91 02 1D' SELECT RESPONSE
'A5 1B'
'BF 0C 18'
'61 16'
'4F 07 A0 00 00 00 03 10 10'
'50 0B 56 49 53 41 20 43 52 45 44 49 54'

Page D-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.2 74BPayment Application (qVSDC and MSD)
Version 1.0

D.2 Payment Application (qVSDC and MSD)

The example shown below is for a qVSDC and MSD card with the following:
 Low Value and CTTA (qVSDC)
 fDDA version 01 (qVSDC)
 dCVV (MSD)
If supporting contact VIS, additional DGIs and data elements must also be personalized.
A VIS personalization example is provided below (highlighted in gray), but note that it is
not inclusive of all possible VIS elements.

Select Payment Application for Personalization

command --> '00 A4 04 00 07'
'A0 00 00 00 03 10 10'
'00'
<- response '6F 09 84 07 A0 00 00 00 03 10 10'

Establish Secure Channel (SCP-02)

command --> '80 50 00 00 08' INITIALIZE UPDATE
'00 22 44 66 88 AA CC EE'
'00'
<- response '00 00 00 00 00 00 00 00 00 00 01 02 00 02 CC CC CC CC CC CC D9
1E 0E 08 23 4C 3B E9'

command --> '84 82 00 00 10' EXTERNAL AUTHENTICATE

'02 DD 99 D5 FF 9C D4 9C'
'02 7D F6 D2 29 AC 4F AA'

STORE DATA
command --> '80 E2 00 00 0D'
'92 06 0A' MSD GPO RESPONSE
'82 02' MSD AIP
'00 80'
'94 04' MSD AFL
'08 01 01 00'

March 2009 Visa Confidential Page D-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.2 74BPayment Application (qVSDC and MSD) Requirements for VIS and VCPS Applications
Version 1.0

command --> '80 E2 00 01 1B'

'92 07 18' QVSDC GPO RESPONSE
'82 02' QVSDC AIP
'20 00'
'94 08' QVSDC AFL
'18 01 01 01 10 01 02 00'
'9F 10 07' ISSUER APPLICATION DATA (CVN 17) 4
'06 01 11 03 00 00 00'

command --> '80 E2 00 01 15'

'91 04 12' VIS GPO RESPONSE (CONTACT)
'82 02' VIS AIP
'7C 00'
'94 0C' VIS AFL
'08 02 02 00 10 01 03 00 18 01 02 01'

command --> '80 E2 00 01 2A'

'01 01 27' SFI 1 RECORD 1
'70 25'
'57 13' TRACK 2 EQUIVALENT DATA
'47 61 73 90 01 01 00 10 D1 01 22 01 01 23 49 99
99 99 1F'
'5F 20 0D' CARDHOLDER NAME
'45 58 41 4D 50 4C 45 2F 50 45 52 53 4F'

4
If not personalizing VIS, the qVSDC CVN would be specified in DGI '9200' rather than DGI '9207'.

Page D-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.2 74BPayment Application (qVSDC and MSD)
Version 1.0

command --> '80 E2 00 01 42'

'01 02 3F' SFI 1 RECORD 2
'70 3D'
'57 10' TRACK 2 EQUIVALENT DATA
'47 61 73 90 01 01 00 10 D1 01 22 01 01 23 45 56'
'5F 20 0D' CARDHOLDER NAME
'45 58 41 4D 50 4C 45 2F 50 45 52 53 4F'
'9F 1F 18' TRACK 1 DISCRETIONARY DATA
'30 31 32 33 34 30 30 30 30 30 30 30 30 30 30 35
35 36 30 30 30 30 30 30'

command --> '80 E2 00 01 99'

'02 01 96' SFI 2 RECORD 1
'70 81 93'
'90 81 90' ISSUER PK CERTIFICATE
'61 B5 F7 4B EB 13 5D 31 B7 3A 0B 17 BF D8 C5 A3
28 45 CC 08 0F 34 88 DA B1 95 0C 6C 55 89 C3 13
37 B5 30 08 88 B1 67 C9 F2 83 B7 1C D2 58 02 4E
32 FC 3E 39 AC F5 60 1C 9E 99 25 FC 61 58 9D C3
38 FF B4 5C D7 07 43 7D 5F 77 87 2F 46 EB AB DB
4C 23 01 02 69 DF DE 0B E8 A9 E6 16 53 8C 8D E5
57 DC 02 AA B3 5B 28 CA DD 38 20 7F A1 16 68 14
FD 19 E8 03 77 5D 0B A3 EA 3B C2 E4 75 AD 40 DF
AD 2E CA 82 17 E0 CD EF 86 6B 28 44 A4 6E 6C 6B'

March 2009 Visa Confidential Page D-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.2 74BPayment Application (qVSDC and MSD) Requirements for VIS and VCPS Applications
Version 1.0

command --> '80 E2 00 01 C0'

'02 02 BD' SFI 2 RECORD 2
'70 81 BA'
'8F 01' CA PUBLIC KEY INDEX
'95'
'92 14' ISSUER PK REMAINDER
'A2 EF A5 CB F0 2C C4 7D 47 83 3B B7 B2 7E CC 69
62 38 5A 4B'
'9F 32 01' ISSUER PK EXPONENT
'03'
'9F 46 81 80' ICC PK CERTIFICATE
'A7 2A 76 A9 DB 48 2E 8B 01 66 3C FE CD 4C BA 96
E8 71 E9 1B F9 CA 74 C0 19 09 D1 00 6A DC 31 4B
6C 17 BD 93 A0 AE F2 12 65 40 A9 9A 24 97 6A 25
9A 82 64 F9 BD 00 7F 24 45 86 55 FD 3F 72 F3 AF
0F A7 8F DB 1B 0F 0C C8 67 E0 6D 18 3E AA E5 5D
08 D3 36 49 D0 48 86 F1 DD 94 19 CA AC E8 45 31
23 DE 13 FC B1 5C 34 8B CD F7 70 54 C6 85 E4 C8
B5 33 3E AF 95 5C 6C D4 73 FF AD E8 59 36 23 E4'
'9F 47 01' ICC PK EXPONENT
'03'
'9F 48 0A' ICC PK REMAINDER
'BA A5 EB 09 E4 4B 5D 59 33 4F'
'9F 69 05' CARD AUTH. RELATED DATA
'01 00 00 00 00'

Page D-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.2 74BPayment Application (qVSDC and MSD)
Version 1.0

command --> '80 E2 00 01 89'

'02 03 86' SFI 2 RECORD 3
'70 81 83'
'93 81 80' SIGNED STATIC APPLICATION DATA
'78 82 CA 7E CA 13 09 9D C2 15 E6 35 60 B2 E3 19
84 74 27 C5 59 BD A2 2A FB 7C 77 63 4D 6E A2 32
60 03 01 9C 85 9D D8 A6 13 4A 2F 13 7D 53 FA 53
B2 24 70 3D 55 40 8F 3E 15 BB 3B 01 B7 64 DB 15
16 DA 18 1C 0C 70 37 D9 D2 10 FC F6 D7 F3 97 11
99 D1 02 C2 D1 24 0B 86 1D E3 B6 CE 13 D4 02 2E
54 B9 38 0B 3B FF EB 89 98 FF CE 65 E5 CF AB 82
3F 29 F3 9A E9 7C 62 27 A2 88 BA DC 43 9C 8B FF'

command --> '80 E2 00 01 15'

'03 01 12' SFI 3 RECORD 1
'70 10'
'5A 08' APPLICATION PAN
'47 61 73 90 01 01 00 10'
'5F 24 03' APPLICATION EXPIRATION DATE
'10 12 31'

March 2009 Visa Confidential Page D-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.2 74BPayment Application (qVSDC and MSD) Requirements for VIS and VCPS Applications
Version 1.0

command --> '80 E2 00 01 6E'

'03 02 6B' SFI 3 RECORD 2
'70 69'
'5F 30 02' SERVICE CODE
'02 01'
'5F 34 01' PAN SEQUENCE NUMBER
01'
'8C 15' CDOL1
'9F 02 06 9F 03 06 9F 1A 02 95 05 5F 2A 02 9A 03
9C 01 9F 37 04'
'8D 17' CDOL2
'8A 02 9F 02 06 9F 03 06 9F 1A 02 95 05 5F 2A 02
9A 03 9C 01 9F 37 04'
'8E 0C' CVM LIST
'00 00 00 00 00 00 00 00 02 03 1F 00'
'9F 08 '02' APPLICATION VERSION NUMBER
'00 8C'
'9F 0D 05' ISSUER ACTION CODE - DEFAULT
'F0 20 04 00 00'
'9F 0E 05' ISSUER ACTION CODE - DENIAL
'00 50 88 00 00'
'9F 0F 05' ISSUER ACTION CODE - ONLINE
'F0 20 04 98 00'
'9F 42 02' APPLICATION CURRENCY CODE
'08 40'

command --> '80 E2 00 01 0D'

'92 00 0A' ISSUER APPLICATION DATA
'9F 10 07'
'06 01 0A 03 00 00 00'

Page D-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.2 74BPayment Application (qVSDC and MSD)
Version 1.0

command --> '80 E2 00 01 72'

'0E 01 6F' INTERNAL DATA
'57 10' TRACK 2 EQUIVALENT DATA
'47 61 73 90 01 01 00 10 D1 01 22 01 01 23 45 56'
'5F 34 01' PAN SEQUENCE NUMBER
'01'
'9F 51 02' APPLICATION CURRENCY CODE
'08 40'
'9F 52 04' APPLICATION DEFAULT ACTION
'82 40 00 00'
'9F 53 01' CONS. TRANS. LIMIT (INT’L)
'05'
'9F 54 06' CTTAL
'00 00 00 01 00 00'
'9F 56 01' ISSUER AUTH. INDICATOR
'80'
'9F 58 01' LOWER CONSEC. OFFLINE LIMIT
'03'
'9F 59 01' UPPER CONSEC. OFFLINE LIMIT
'07'
'9F 5C 06' CTTAUL
'00 00 00 02 00 00'
'9F 67 01' MSD OFFSET
'1E' value = 30 digits
'9F 68 04' CARD ADDITIONAL PROCESSES
'4C 00 00 00'
'9F 6C 02' CARD TRANSACTION QUALIFIERS
'20 00'
'9F 77 06' VLP FUNDS LIMIT
'00 00 00 00 40 00'
'9F 78 06' VLP SINGLE TRANSACTION LIMIT
'00 00 00 00 25 00'
'9F 79 06' VLP AVAILABLE FUNDS
'00 00 00 00 15 00'

March 2009 Visa Confidential Page D-9

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.2 74BPayment Application (qVSDC and MSD) Requirements for VIS and VCPS Applications
Version 1.0

command --> '80 E2 00 01 33'

'80 00 30' DES KEYS
'D6 16 01 7F BF 63 AC E7 7A 37 EB 7A EE 92 1F A5'
'25 FC 6E C6 D5 C2 BF F7 E7 29 4B 67 26 F2 48 6B'
'98 AE 3F 24 26 25 FC FA FC CE 0A 05 20 38 CF E6'

command --> '80 E2 00 01 13'

'80 01 10' ALTERNATE DES KEY FOR dCVV
'1E 3E 19 AF 7D 67 A5 3C EB A0 7E BB 44 A5 61 7A'

command --> '80 E2 00 01 0C'

'90 00 09' DES KEY CHECK VALUES
'53 8B 0E'
'A8 B8 EE'
'E3 BA A0'

command --> '80 E2 00 01 3B'

'82 01 38' ICC KEY (CRT)
'AF 30 C1 B4 78 37 B8 60 82 72 2A FB 00 F1 92 32
02 25 7D 6F 78 B7 E2 CF 1B C0 2C AF 9A 7A 2B 5B
CE 0B CA AF 87 01 4E FB 9A A0 80 CD A4 1B 6B 62
B2 EC 54 DC 43 AC F5 7F'

command --> '80 E2 00 01 3B'

'82 02 38' ICC KEY (CRT)
'13 DB 1E C6 34 9B B7 DF 02 F0 77 73 C4 B1 31 EA
B9 D3 DD 10 72 9F B5 7D 2F E8 A1 B4 C0 83 91 AF
7C B6 62 2B CB A8 35 B6 80 7A DB B9 38 07 41 E9
B2 EC 54 DC 43 AC F5 7F'

Page D-10 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.2 74BPayment Application (qVSDC and MSD)
Version 1.0

command --> '80 E2 00 01 3B'

'82 03 38' ICC KEY (CRT)
'C2 67 74 EA E8 59 CC 93 03 64 5D A8 37 CA D1 37
39 FA 74 08 EC 25 FD 33 2C 23 45 D5 47 6C 00 86
6D 46 3A 66 D6 B4 C8 43 23 60 39 98 7C 98 D7 96
B2 EC 54 DC 43 AC F5 7F'

command --> '80 E2 00 01 3B'

'82 04 38' ICC KEY (CRT)
'E6 7D B5 E5 75 76 80 18 45 11 D8 E5 B9 8B A6 5A
17 79 07 97 C8 88 08 14 E8 26 C1 44 71 56 49 E0
20 79 E9 F3 31 39 F7 83 9D F9 DB C1 6D B0 6D F9
B2 EC 54 DC 43 AC F5 7F'

command --> '80 E2 00 01 3B'

'82 05 38' ICC KEY (CRT)
'62 08 BC 81 56 E9 65 FE 77 29 7B 08 03 A8 B3 02
C2 7F FD 2B 10 46 70 85 4F 37 A6 5A E4 2D 22 51
55 6C B3 86 07 4C 11 9F D6 47 D7 71 AC 17 8D 0C
B2 EC 54 DC 43 AC F5 7F'
command --> '80 E2 00 01 12'
'91 02 0F' SELECT RESPONSE
'A5 0D'
'50 0B' APPLICATION LABEL
'56 49 53 41 20 43 52 45 44 49 54'

March 2009 Visa Confidential Page D-11

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.3 75BResponses after Personalization Requirements for VIS and VCPS Applications
Version 1.0

command --> '80 E2 80 01 27'

'91 03 24' SELECT RESPONSE for Contactless
'A5 22'
'50 0B' APPLICATION LABEL
'56 49 53 41 20 43 52 45 44 49 54'
'9F 38 0C' PDOL (for CVN 17)
'9F 66 04
9F 02 06
9F 37 04
5F 2A 02'

D.3 Responses after Personalization

D.3.1 Select PPSE
command --> '00 A4 04 00 0E'
'32 50 41 59 2E 53 59 53 2E 44 44 46 30 31'
'00'

<- response '6F 2D'

'84 0E'
'32 50 41 59 2E 53 59 53 2E 44 44 46 30 31'
'A5 1B'
'BF 0C 18'
'61 16'
'4F 07 A0 00 00 00 03 10 10'
'50 0B 56 49 53 41 20 43 52 45 44 49 54'

Page D-12 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.3 75BResponses after Personalization
Version 1.0

D.3.2 Select Payment Application

command --> '00 A4 04 00 07'
'A0 00 00 00 03 10 10
'00'

<- response '6F 2D'

'84 07'
'A0 00 00 00 03 10 10'
'A5 22'
'50 0B'
'56 49 53 41 20 43 52 45 44 49 54'
'9F 38 0C'
'9F 66 04
9F 02 06
9F 37 04
5F 2A 02'

D.3.3 GPO Responses

GPO Response at an MSD Device (compliant with [VCPS] Version 1.4.2)
command --> '80 A8 00 00 12'
'83 10'
'86 00 00 00'
'00 00 00 00 00 11'
'NN NN NN NN'
'08 40'
'00'
<- response '80 06'
'00 80'
'08 01 01 00'
'90 00'

March 2009 Visa Confidential Page D-13

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.3 75BResponses after Personalization Requirements for VIS and VCPS Applications
Version 1.0

GPO Response at an MSD Device (compliant with [VCPS] Version 2.0.2 indicating Online
Cryptogram Required)
command --> '80 A8 00 00 12'
'83 10'
'86 80 00 00'
'00 00 00 00 00 11'
'NN NN NN NN'
'08 40'
'00'
<- response '77 34'
'9F 10 07'
'06 01 11 03 A0 00 00'
'57 10'
'47 61 73 90 01 01 00 10 D1 01 22 01 01 23 45 56'
'5F 34 01'
'01'
'82 02'
'00 80'
'9F 36 02'
'00 02'
'9F 26 08'
'B8 40 D8 9B BA E0 A8 A5'
'90 00'

Page D-14 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC D Personalization Examples
Requirements for VIS and VCPS Applications D.3 75BResponses after Personalization
Version 1.0

GPO Response at a qVSDC Device (for an offline transaction)

command --> '80 A8 00 00 12'
'83 10'
'B6 00 00 00'
'00 00 00 00 00 11'
'NN NN NN NN'
'08 40'
'00'

<- response '77 81 A6'

'9F 4B 60'
'86 B8 8D 8E AC 18 A0 E6 D0 05 6B 85 5F 73 10 79
65 BC 61 66 B7 82 25 3F B9 A3 C0 08 44 D3 80 3D
67 11 5D B9 2D BD C9 95 5A 3E 45 16 69 FB 55 AF
32 D4 0B 1C C5 8B 8C 6D FD D5 A5 50 FA 99 5F B0
9D DF 51 28 BF DE 16 9B F2 72 49 78 EA 34 8E 0A
AB EE 92 F0 D8 0E E5 85 36 83 2E A4 B1 CB CF 00'
'94 08'
'18 01 01 01 10 01 02 00'
'9F 10 07'
'06 01 11 03 90 00 00'
'57 10'
'47 61 73 90 01 01 00 10 D1 01 22 01 01 23 45 56'
'5F 34 01'
'01'
'82 02'
'20 00'
'9F 36 02'
'00 01'
'9F 26 08'
44 1C 74 E1 51 BC A8 B8'
'9F 6C 02'
'20 00'
'90 00'

March 2009 Visa Confidential Page D-15

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
D Personalization Examples Card Personalization Specification for VSDC
D.3 75BResponses after Personalization Requirements for VIS and VCPS Applications
Version 1.0

GPO Response at a qVSDC Device (for an online transaction)

command --> '80 A8 00 00 12'
'83 10'
'B6 00 00 00'
'00 00 00 00 50 00'
'NN NN NN NN
'08 40'
'00'
<- response '77 39'
'9F 10 07'
'06 01 11 03 A0 20 00'
'57 10'
'47 61 73 90 01 01 00 10 D1 01 22 01 01 23 45 56'
'5F 34 01'
'01'
'82 02'
'20 00'
'9F 36 02'
'00 01'
'9F 26 08'
'7A F4 57 72 B0 89 45 E1'
'9F 6C 02'
'20 00'
'90 00'

Page D-16 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Glossary
Requirements for VIS and VCPS Applications
Version 1.0

Glossary
This is a glossary of terms used in this specification; it is not intended as a data
dictionary.
ADA
Application Default Action
AFL
Application File Locator
AID
Application Identifier
AIP
Application Interchange Profile
Application
An application resident in an IC payment card.
Application Command
For this document specifically, an APDU command acceptable to an application after the
personalization process has been completed, and the application selected.
ATC
Application Transaction Counter
AUC
Application Usage Control
AuthC
Authorization Controls
BIN
Bank Identification Number
CA
Certification Authority
CAM
Card Authentication Method

March 2009 Visa Confidential Page Glossary-1

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Glossary Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

Card
An IC payment card as defined by a payment system.
Card Personalization
The personalization of application data within a card, using personalization commands.
CBC
Cipher Block Chaining
CDA
Combined DDA/AC Generation
CDOL
Card Risk Management Data Object List
CID
Cryptogram Information Data
CLA
Class Byte
C-MAC
Command Message Authentication Code – MAC used in secure messaging for
personalization command processing
CRT
Chinese Remainder Theorem
CSN
Chip Serial Number
CTTA
Cumulative Total Transaction Amount
CVM
Cardholder Verification Method
CVN
Cryptogram Version Number
Data Preparation
The process of preparing and formatting data, ready for sending to a personalization
device.

Page Glossary-2 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Glossary
Requirements for VIS and VCPS Applications
Version 1.0

dCVV
Dynamic Card Verification Value
DDA
Dynamic Data Authentication
DDOL
Dynamic Data Authentication Data Object List
DEK
Data Encryption Key
DES
Data Encryption Standard
DGI
Data Grouping Identifier
ECB
Electronic Code Book
EMV Specifications (EMV)
Technical specifications developed and maintained by EMVCo to create standards and
ensure global interoperability for use of chip technology in the payment industry. In order
to support EMV, cards and terminals must also meet the requirements described in the
bulletins available on the EMVCo website.
EMVCo LLC (EMVCo)
The organization of payment systems that manages, maintains, and enhances the EMV
specifications. EMVCo is currently operated by Visa Inc., MasterCard Worldwide, JCB
International, and American Express.
EMV CPS
EMV Card Personalization Specification, the card personalization specification published
by EMVCo
ENC MDK
Master Data Encipherment DEA Key
ENC UDK
Unique Data Encipherment DEA Key
FCI
File Control Information

March 2009 Visa Confidential Page Glossary-3

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Glossary Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

fDDA
Fast Dynamic Data Authentication
GPO
GET PROCESSING OPTIONS command
HSM
Hardware Security Module
IAC
Issuer Action Code
IAD
Issuer Application Data
IAP
Initiate Application Processing
Iauth
Issuer Authentication
IC
Integrated Circuit
ICC
Integrated Circuit Card
ICC Data
Input data record data element containing application DGIs.
IEC
International Electrotechnical Commission
IIN
Issuer Identification Number (often the same as BIN)
INS
Instruction Byte
ISO
International Organization for Standardization
ISS
Issuer

Page Glossary-4 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Glossary
Requirements for VIS and VCPS Applications
Version 1.0

KDEK
Card unique key used to generate a session key for creation of C-MAC used in
command processing
KEK
Key Encryption Key(s)
KEKISS
Key Exchange Key – shared by Issuer and data preparation device
KENC
Card unique key used to generate a session key for encryption
KMAC
Card unique key used to generate a session key for encryption of DES keys and
optionally other secret data
KMC
DES Master Key for Personalization Session Keys – used to generate derived keys to
generate MACs and encrypt DES keys and secret data during personalization (KENC,
KDEK, KMAC)
KMU
A DES master key, known only to the issuer, which is used to generate derived keys to
generate MACs and encrypt DES keys and secret data to allow re-personalization (KENC,
KDEK, KMAC) after the card has been issued.
MAC
Message Authentication Code – card cryptogram in INITIALIZE UPDATE Command
MAC MDK
Master Message Authentication Code DEA Key
MAC UDK
Unique Message Authentication Code DEA Key
MDK
Master Derivation Key for VSDC
MSD
Magnetic Stripe Data

March 2009 Visa Confidential Page Glossary-5

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Glossary Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

MSD Offset
The offset in nibbles/digits from the beginning of the Track 2 data on the chip (first digit
of the PAN is 1) to the first nibble/digit of CVV. For CVV beginning in the first nibble/digit
of the Discretionary Data, with a 16 digit PAN and no PVV, the offset value would be 25.
With PVV the offset value would be 30.
PAN
Application Primary Account Number
Payment System
For the purposes of this specification, Visa Inc., MasterCard Worldwide or JCB
International.
Personalization
The placing of application data on the card to enable a card to be used by a cardholder.
Personalization Command
A command sent to a selected PPSE or card payment application in order to personalize
application data.
Personalization Device
A device that accepts data from a data preparation system, and sends personalization
commands to a card.
PIN
Personal Identification Number
PK
Public Key
Pre-personalization
The initialization of card data prior to personalization.
PSE
Payment System Environment
PPSE
Proximity PSE
qVSDC
Quick Visa Smart Debit/Credit
Ref.
Reference

Page Glossary-6 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Card Personalization Specification for VSDC Glossary
Requirements for VIS and VCPS Applications
Version 1.0

Req.
Requirement
RFU
Reserved for Future Use
RSA
Rivest, Shamir and Adleman (Public Key Cryptographic Algorithm)
SAD
Signed Static Application Data
SDA
Static Data Authentication
SFI
Short File Identifier
SKU
Personalization Session Key
SKUDEK
Session key for creation of C-MAC used in command processing – generated using KDEK
SKUENC
Session key for encryption – generated using KENC
SKUMAC
Session key for encryption of DES keys and optionally other secret data – generated
using KMAC
SUDK ENC
Unique Data Encipherment Session Key generated from MAC ENC
SUDK MAC
Message Authentication Code Session Key generated from MAC UDK
TK
Transport Key
KEK/TK – Key Exchange Key – shared by data preparation device and
personalization device
PEK/TK – PIN Encryption Key
DEK/TK – Data Encryption Key

March 2009 Visa Confidential Page Glossary-7

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.
Glossary Card Personalization Specification for VSDC
Requirements for VIS and VCPS Applications
Version 1.0

TLV
Tag, Length, Value
UDK
Unique VSDC card level key generated from MDK
Var.
Variable
VLP
Visa Low-Value Payment
Visa Smart Debit/Credit (VSDC)
The Visa payment service offerings for chip-based debit and credit programs. These
services are supported by VisaNet processing, as well as by Visa rules and regulations;
and are based on EMV and [VIS], [VCPS], or EMV Common Core Definitions (CCD) –
including Common Payment Application (CPA) – specifications.

Page Glossary-8 Visa Confidential March 2009

Portions © 2000-2007 Visa International Service Association and © 2008-2009 Visa Inc. All Rights Reserved. This Specification is
proprietary and confidential to Visa International Service Association and Visa Inc.