Module 10 of 22 · Practitioner · 90 min
Tokenization in depth
DPAN versus FPAN, the Token Service Provider role, provisioning, and where the keys live, then the 2021 research that paid from locked phones by flipping one byte, and the signed field that said so and was never read.
Enrollment required
Module 1 of this course is free to read. Buying the course opens every other module, the transaction lab and search across the course. The workbench and the APDU decoder stay free for anyone.
The course is tied to your account, so you sign in first and come straight back here.
One payment for this course. Access for as long as the course exists, with every update and new research module that follows, at no further cost.
No hardware is sold here, and none is needed to read the course.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
Already enrolled? Sign in
Open the free workbench →What this module covers
- 01Who does what
- 02The cryptogram that makes a token a transaction
- 03Provisioning, and the color of the decision
- 04CDCVM: a claim the terminal cannot check
- 05Where the keys actually live
- 06Transit mode, and what it turns off
- 07The check that should have stopped it
- 08Two amounts, one signature
- 09What was fixed
- 10Click to Pay, and tokens without a device
- 11The shape of the whole thing