9F8207 9F8208 CVM Capability

These two one-byte configuration data objects list the cardholder verification methods a Kernel 8 reader is willing to use. 9F8207 applies when the amount is above the Reader CVM Required Limit; 9F8208 applies when it is at or below it. The kernel uses the right one to build the list of CVMs it offers the card.

The bits (same in both)

• b8: reserved
• b7: enciphered PIN for online verification
• b6: signature
• b5: reserved
• b4: No CVM required
• b3: CDCVM
• b2–b1: reserved

Offline PIN is not available: Kernel 8 offers only online PIN, signature, CDCVM and No CVM.

How they are used

The kernel compares the amount with the Reader CVM Required Limit (9F820E), takes the matching capability byte and passes the CVMs to the card in the Terminal Risk Management Data. The card then picks one and returns its Cardholder Verification Decision. Above the limit, "No CVM required" should not be offered.

Example

• 9F8207 01 64: above the limit, offer online PIN, signature or CDCVM.
• 9F8208 01 08: at or below the limit, offer No CVM only.

Kernel 2

Kernel 2 has equivalent configuration tags, DF8118 (CVM required) and DF8119 (no CVM required), but with a layout based on byte 2 of Terminal Capabilities. Do not copy values between kernels without checking the bits.

Common mistakes

• Setting "No CVM required" in 9F8207, which allows unverified payments above the limit.
• Not setting CDCVM, which makes phone payments above the limit fall back to PIN or fail.
• Reading these bytes with the Terminal Capabilities layout, where b3 does not mean CDCVM.