CCA Release 2.54
CVV and CVC Method
Figure E-6
2
shows the method used to generate a card-verification value (CVV) for
track 2. Each (decimal) digit is represented as a 4-bit, binary value and packed two
digits per byte.
┌─────────────────┬──────────┬───────────────┬────────────────────┐
│ PAN │ Exp Date │ Service Code │ '' pad │
│ 13 or 16 digits │ 4 digits │ 3 digits │ Pad to 16 bytes │
└─────────────────┴──────────┴───────────────┴────────────────────┘
│ 15│
└─────────────────────────────────┬───────────────────────────────┘
│
┌──────────┴────────────────────┐
│ Divide into two 8-byte fields │
Digits are represented └─────┬─────────────────┬───────┘
in 4-bit groups, 2 │ │
groups per byte. ┌──────┴──────┐ ┌─────┴───────┐
│ Left │ │ Right │
└──────┬──────┘ └─────┬───────┘
┌─────┴─────┐ │
Key A ──────┤ Encipher │ │
└─────┬─────┘ │
┌──┴──┐ │
│ XOR ├──────────────┘
└──┬──┘
┌─────┴─────┐
Key A ──────┤ Encipher │
└─────┬─────┘
┌─────┴─────┐
Key B ──────┤ Decipher │
└─────┬─────┘
┌─────┴─────┐
Key A ──────┤ Encipher │
└─────┬─────┘
┌─────┴─────────────────────────────────┐
│Decimalize Result │
│ 1) Select only -9 left to right │
│ 2) Left justify result of 1 in field │
│ 3) Select only A-F left to right │
│ 4) Subtract 1 from each in 3 │
│ 5) Concatenate to result from 2 │
│ 6) CVV is the left 1 to 5 digits. │
└───────────────────────────────────────┘
Figure E-6. CVV Track 2 Algorithm
At the security API, the CVV_Generate and CVV_Verify verbs require two key
identifiers, key-A and key-B, as defined in the CVV method. The identifiers can be
key labels or internal key-tokens.
The key-A and key-B key pair can include the following key types:
1. Both keys can be DATA keys.
2. Both keys can be MAC-class keys with the ANY subtype.
3. Both keys can be MAC-class keys with the KEY-A and KEY-B subtypes as
appropriate.
The CVV_Generate verb requires the control-vector bit (bit 20) to be set to 1. The
CVV_Verify verb requires the control-vector bit (bit 21) to be set to 1.
2
Adapted from VisaNet Electronic Value Exchange Standards Manual, pages AA-8 and AA-9.
E-16 IBM 4758 CCA Basic Services, Release 2.54, February 2005
