Module 21 of 22 · Researcher · 120 min
The authorization leg: from cryptogram to decision
The card signs an amount it cannot verify, and the message that carries it restates that amount in a second place nobody signed. Following one cryptogram out through field 55 to the issuer and back as an ARPC, and a real message that admits nineteen different readings.
Enrollment required
Module 1 of this course is free to read. Buying the course opens every other module, the transaction lab and search across the course. The workbench and the APDU decoder stay free for anyone.
The course is tied to your account, so you sign in first and come straight back here.
One payment for this course. Access for as long as the course exists, with every update and new research module that follows, at no further cost.
No hardware is sold here, and none is needed to read the course.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
Already enrolled? Sign in
Open the free workbench →What this module covers
- 01The round trip, end to end
- 02The twenty-nine bytes the card signed
- 03Field 55: where EMV crosses into ISO 8583
- 04The amount travels twice
- 05The issuer's answer, and what proves it
- 06The card's last word
- 07Matching a response to its request
- 08Authorizing is not paying
- 09Stand-in: when the issuer never sees it
- 10Reversals and repeats
- 11The dialect problem, demonstrated
- 12What to actually test
- 13The open question