salmg/academy
Sign in
Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 3 · Operator90 min

The unpredictable number and pre-play

Tag 9F37 is the terminal's only contribution of freshness, and some terminals supplied a counter. What that made possible, why it is neither a replay nor a clone, and how to measure a terminal for yourself.

Enrolment required

Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.

Sign inAbout enrolmentThe workbench and decoder are free

What this module covers

  1. 01What the field is supposed to do
  2. 02Where 9F37 actually travels
  3. 03Inside the cryptogram, and inside the signature
  4. 04The number that was not unpredictable
  5. 05Pre-play, and why it is not replay
  6. 06The variant a good generator does not fix
  7. 07A replay in the corpus, and what gave it away
  8. 08What catches it, and what does not
  9. 09Measuring a terminal for yourself
  10. 10What changed, and what did not