EMV StackTools Beta
ODA Debugger: SDA, DDA and CDA
Drop a log with the card's certificates and the CA public key, and follow offline data authentication step by step as EMV Book 2 specifies: issuer and ICC key recovery, the static data to be authenticated, and the SDA, DDA and CDA signatures. Every recovered block, every hashed input and every check is shown, so you can see exactly where it fails and why.
1. Card data
Or paste a log or APDUs
2. Certification Authority public key
The card's RID and CA key index (8F) appear here once a log is loaded.
Key file format
A key file is a text file of hexadecimal bytes holding one or more CA public key records. Each record has this structure:
| Field | Length | Content |
|---|---|---|
| Tag | 3 bytes | DF A0 23 |
| Record length | 1 to 3 bytes | BER-TLV length, for example 82 01 22 (290 bytes) |
| RID | 5 bytes | Registered Application Provider Identifier, for example A0 00 00 00 04 |
| Key index | 1 byte | CA Public Key Index, as in tag 8F, for example F1 |
| Hash algorithm indicator | 1 byte | 01 for SHA-1 (00 accepted) |
| Public key algorithm indicator | 1 byte | 01 for RSA (00 accepted) |
| Modulus length | 2 bytes | Length of the modulus in bytes, most significant byte first, for example 00 B0 (176) |
| Modulus | 256 bytes | The modulus, padded on the right with 00 up to 256 bytes |
| Exponent length | 1 byte | 01 or 03 |
| Exponent | 3 bytes | 03 00 00 for exponent 3, or 01 00 01 for 65537 |
| Checksum | 20 bytes | SHA-1 of RID, index, modulus and exponent, or all 00 if not provided |
With a 2-byte record length, a record is 296 bytes: tag 3, length 3, then 290 bytes of content.
Reading rules: spaces, line breaks, brackets and other separators are ignored; a label line containing capk# (for example visa capk#1) is skipped; any number of records can follow each other in one file; RIDs from several payment systems can be mixed. A key imported again with the same RID and index replaces the previous one.
Example (shortened):
[DF A0 23 82 01 22
A0 00 00 00 04
F1
01
01
00 B0
C7 5E 21 … (176 bytes of modulus) … 00 00 (80 bytes of padding)
01
03 00 00
00 00 … (20 bytes of checksum)]
Static data to be authenticated
Built from the records flagged in the AFL (Book 3 section 10.3), then the AIP if the SDA Tag List (9F4A) asks for it (Book 2 5.1.1). SDA and the ICC certificate hash both include it.
Show the bytes
RSA recovery on its own
Recover any EMV certificate or signature: X = Se mod n (Book 2 A2.1). A valid block starts with 6A and ends with BC.
How it follows EMV Book 2
The Issuer Public Key Certificate (90) is recovered with the CA key and checked as in Book 2 section 5.3: trailer BC, header 6A, format 02, SHA-1 hash over the certificate fields, the remainder (92) and the exponent (9F32), issuer identifier against the PAN, expiry and algorithm. The ICC Public Key Certificate (9F46) follows section 6.4, with format 04, the PAN, and a hash that also covers the ICC key remainder (9F48), exponent (9F47) and the static data to be authenticated.
SDA recovers the Signed Static Application Data (93, section 5.4). DDA recovers the INTERNAL AUTHENTICATE signature and hashes it with the DDOL data sent by the terminal (section 6.5.2). CDA recovers the signature from GENERATE AC, checks the CID, hashes with the Unpredictable Number, and recomputes the Transaction Data Hash Code from the PDOL data, the CDOL1 (and CDOL2) data and the response data objects except 9F4B (section 6.6.2).
"Load a sample" uses a complete test chain generated for this page with throwaway keys, under the fictional RID A000000999 and CA index 99: a 1408-bit CA key, a 1152-bit issuer key and a 1024-bit ICC key, with SDA, DDA and CDA. It is not a real payment system key.
"Remember this key" stores the modulus and exponent in this browser only, under the RID and index, and fills them in the next time a log uses the same key. "Import a key file" loads many keys at once from a file of key records, each starting with the tag DF A0 23 and a length, then the RID (5 bytes), the index, the hash and algorithm indicators, the modulus length (2 bytes), the modulus (256 bytes, padded with zeros), the exponent length, the exponent (3 bytes) and the key checksum (20 bytes). When the checksum is filled in, it is checked as SHA-1 of RID, index, modulus and exponent. Keys never leave your browser.