← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 2 · Practitioner90 min
Tokenization in depth
DPAN versus FPAN, the Token Service Provider role, provisioning, and where the keys live — then the 2021 research that paid from locked phones by flipping one byte, and the signed field that said so and was never read.
Enrolment required
Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.
What this module covers
- 01Who does what
- 02The cryptogram that makes a token a transaction
- 03Provisioning, and the colour of the decision
- 04CDCVM: a claim the terminal cannot check
- 05Where the keys actually live
- 06Transit mode, and what it turns off
- 07The check that should have stopped it
- 08Two amounts, one signature
- 09What was fixed
- 10Click to Pay, and tokens without a device
- 11The shape of the whole thing