← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 3 · Operator90 min
The unpredictable number and pre-play
Tag 9F37 is the terminal's only contribution of freshness, and some terminals supplied a counter. What that made possible, why it is neither a replay nor a clone, and how to measure a terminal for yourself.
Enrolment required
Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.
What this module covers
- 01What the field is supposed to do
- 02Where 9F37 actually travels
- 03Inside the cryptogram, and inside the signature
- 04The number that was not unpredictable
- 05Pre-play, and why it is not replay
- 06The variant a good generator does not fix
- 07A replay in the corpus, and what gave it away
- 08What catches it, and what does not
- 09Measuring a terminal for yourself
- 10What changed, and what did not