Making Sense of EMV Card Data

Professor Steven Murdoch, a leading financial cryptography and smart card security researcher at University College London, delivers a technical masterclass on decoding and analyzing EMV (Europay, Mastercard, Visa) chip card communications [00:03]. Murdoch explains the ISO/IEC 7816 physical and transmission protocols governing contact smart cards, detailing how cards and point-of-sale (POS) terminals exchange Application Protocol Data Units (APDUs) via commands like SELECT AID, GET PROCESSING OPTIONS, and READ RECORD [12:00].

The presentation focuses on parsing the hierarchical Tag-Length-Value (TLV) data structures defined by the EMV specification [19:01]. Murdoch walks through the bitwise decoding of single-byte and multi-byte tags (such as 9Fxx prefixes), card risk management lists (CDOL1/CDOL2 in tag 8C), application interchange profiles, and cryptogram generation [25:39]. He explains the cryptographic mechanics of cardholder verification, exploring the historical evolution from offline PIN verification values (PVV) to dynamic data authentication (DDA) and combined data authentication (CDA) [31:53].

Murdoch reviews notable vulnerabilities discovered in EMV transaction flows, including the famous "No-PIN" attack where manipulated terminal responses tricked POS systems into processing stolen chip cards without requiring a valid PIN [05:41]. He demonstrates open-source decoding tools and provides researchers with methodologies for safely capturing, parsing, and verifying smart card transactions [37:41].

(AI summary — Gemini Flash)