EMV 芯片交易与 DE55 深入:ARQC / TVR / CVMEMV Chip & DE55 Deep Dive: ARQC / TVR / CVM

DE55 里到底装了什么What's inside DE55

DE55 以 BER-TLV(Tag-Length-Value)格式承载芯片交易数据,一个个标签(Tag)拼在一起。最关键的几个:DE55 carries chip data as BER-TLV (Tag-Length-Value), a sequence of tags. The most important ones:

Tag	含义Meaning
9F26	应用密文 ARQC/TC/AACApplication Cryptogram (ARQC/TC/AAC)
9F27	密文信息数据 CIDCryptogram Information Data (CID)
9F36	应用交易计数器 ATCApplication Transaction Counter (ATC)
95	终端验证结果 TVRTerminal Verification Results (TVR)
9F34	CVM 结果CVM Results
82	应用交互特征 AIPApplication Interchange Profile (AIP)

本站解析工具已经能把 DE55 逐 Tag 解出来,并对 TVR(95)、AIP(82)、CID(9F27)、CVM(9F34)做逐位翻译。下面我们讲这些位背后的逻辑。The parser tool on this site already decodes DE55 tag by tag and bit-decodes TVR (95), AIP (82), CID (9F27) and CVM (9F34). Below we cover the logic behind those bits.

密文 ARQC 是怎么来的Where the ARQC comes from

卡片用只有卡和发卡行知道的密钥,对交易关键数据(金额、货币、不可预知数、ATC、TVR 等)做加密运算,生成 ARQC。发卡行用同样密钥重算校验——对得上才可能批准。因为含 ATC(每笔递增)和随机数,每笔密文都不同,无法重放。Using a key known only to the card and the issuer, the card computes a cryptographic MAC over key transaction data (amount, currency, unpredictable number, ATC, TVR …) to produce the ARQC. The issuer recomputes it with the same key to verify — a match is required for approval. Because it includes the ATC (incrementing) and a random number, every cryptogram is unique and cannot be replayed.