9F8209 Kernel Configuration

Kernel Configuration is a 2-byte configuration data object that switches Kernel 8 options on or off for a reader. Only three bits are defined, but each changes how the kernel authenticates the card.

The bits

• Byte 1 b6, RSA certificates enabled. Kernel 8 is built around ECC certificates. With this bit set, the kernel also accepts RSA certificates, and the certificate ASI list it supports becomes 01 (RSA) and 10 (ECC) instead of ECC only.
• Byte 1 b5, relay resistance protocol enabled. The kernel runs the relay resistance protocol, measuring the card's response time to detect relay attacks, when the card supports it.
• Byte 1 b4, report local authentication failed in TVR. When local authentication of the card fails, the kernel sets the "local authentication failed" bit in the TVR. That bit is set after the GENERATE AC command, so it can affect verification of the Application Cryptogram by the issuer.
• All other bits of bytes 1 and 2 are reserved.

Example

9F8209 02 30 00: RSA certificates and the relay resistance protocol are enabled; local authentication failures are not reported in the TVR.

Things to check

• Enable RSA certificates only if the cards and CA keys you must accept require it.
• If relay resistance is enabled, the timing parameters, such as the grace periods and accuracy thresholds, must be configured as the payment system requires.
• Agree with the acquirer and issuer before setting b4, since it changes the TVR the issuer receives.