...
Note: This article's focus is on individuals who are certifying with the brands, but you can also loosely apply this to other use cases that require CAPKs to be loaded.
| Info |
|---|
For the users of the C++ SDK, if you are getting errors with the length of the contactless CAPK modulus, flip the length bytes (i.e., use big-endian format, not little-endian). See the discussion further below |
Saving a CAPK with the Window-based Universal SDK Demo:
Look for the 'Save CAPK' command, and enter in the CAPK RID as well as the index.
Instructions on how to format the Data can be found further below.
...
You can grab the most recent version of the Universal Demo (dot NET SDK Demo, aka uDemo) from here.
What do I need before I try to save a CAPK?
...
Here's an example of how the data may be presented (heavily redacted) -
...
Save CAPK command Data Breakdown (Sample):
Name:
a000009999e1
Data:
a000009999e10101f8707b9bedf031e58a9f843631b90c90d80ed69500000003700099c5b70aa61b4f4c51
...
Breaking the Data down (example AID):
AID RID (5 bytes) | a000009999 |
CA Index (1 byte) | e1 |
Hash Algorithm (1 byte) | 01 |
Encryption Algorithm (1 byte) | 01 |
Hash Value (20 bytes) | f8707b9bedf031e58a9f843631b90c90d80ed695 |
Public Key Exponent (4 bytes) | 00 00 00 03 |
2 bytes Modulus Length (4 bytes) NOTE: The bytes need to be FLIPPED IE 00 70 in this case, evaluating to 112 length | 70 00 |
Variable bytes Modulus (variable bytes length indicated prior) | 99c5b70aa61b4f4c51b6f90b0e3bfb7a3ee0e7db41bc466888b3ec8e9977c762407ef1d79e0afb2823100a020c3e802059 3db50e90dbeac18b78d13f96bb2f57eeddc30f256592417cdf739ca6804a10a29d2806e774bfa751f22cf3b65b38f37f91b4 daf8aec9b803f7610e06ac9e6b |
Example 1:
We were given this from AMEX to put in our device -
INDEX C8
Header ‘20’ (not used)
Service Identifier ‘00 00 00 00’ (not used)
Length of CAPK Modulus ‘90’ (Modulus Length, interpret interpreted as 90 00)
CAPK Algorithm Indicator ‘01’ (Hash Algorithm)
Length of CAPK Exponent ‘01’
RID ‘A0 00 00 00 25’ (AID Name)
CAPK Index C8 (CA Index)
CAPK Modulus ( Variable Bytes Modulus) BF0CFCED708FB6B048E3014336EA24AA007D7967B8AA4E613D26D015C4FE7805D9DB131CED0D2A8ED504C3B5CCD48C33199E5A5BF644DA043B54DBF60276F05B1750FAB39098C7511D04BABC649482DDCF7CC42C8C435BAB8DD0EB1A620C31111D1AAAF9AF6571EEBD4CF5A08496D57E7ABDBB5180E0A42DA869AB95FB620EFF2641C3702AF3BE0B0C138EAEF202E21D
CAPK Exponent ‘03’ (Public Key exponent, would be viewed as 00 00 00 03)
Hash Value 33BD7A059FAB094939B90A8F35845C9DC779BD50
...
Step 2: The rest of the body is formed by AID Name + CA CA Index (1 byte) + Hash Hash Algorithm (1 byte) + Encryption Encryption Algorithm (1 byte) + Hash Hash Value (20 bytes) + Public Public Key Exponent (4 bytes) + 2 2 bytes Modulus Length (4 bytes) + Variable bytes Modulus
...
a000000025c8010133BD7A059FAB094939B90A8F35845C9DC779BD50000000039000BF0CFCED708FB6B048E3014336EA24AA007D7967B8AA4E613D26D015C4FE7805D9DB131CED0D2A8ED504C3B5CCD48C33199E5A5BF644DA043B54DBF60276F05B1750FAB39098C7511D04BABC649482DDCF7CC42C8C435BAB8DD0EB1A620C31111D1AAAF9AF6571EEBD4CF5A08496D57E7ABDBB5180E0A42DA869AB95FB620EFF2641C3702AF3BE0B0C138EAEF202E21D
Notes:
Encryption Algorithm / Hash Algorithm are usually value 01
If the Hash value is not provided, you can calculate it as well (your acquirer should have provided this value). It is a SHA-1 hash of... see below.
How do I form the Hash Value? Concatenate the 4 data elements listed below.
...
Input for the hash :
A0 00 00 00 25 C8 BF0CFCED708FB6B048E3014336EA24AA007D7967B8AA4E613D26D015C4FE7805D9DB131CED0D2A8ED504C3B5CCD48C33199E5A5BF644DA043B54DBF60276F05B1750FAB39098C7511D04BABC649482DDCF7CC42C8C435BAB8DD0EB1A620C31111D1AAAF9AF6571EEBD4CF5A08496D57E7ABDBB5180E0A42DA869AB95FB620EFF2641C3702AF3BE0B0C138EAEF202E21D 03
Final hash:
33BD7A059FAB094939B90A8F35845C9DC779BD50
Use the tool at http://www.idtechproducts.com/hosted-files/tools/encryptiondecryptiontool.html to calculate SHA-1. (The tool will automatically remove spaces and newlines from the data.)
...
a000009999e199c5b70aa61b4f4c51b6f90b0e3bfb7a3ee0e7db41bc466888b3ec8e9977c762407ef1d79e0afb2823100a020c3e8020593db50e90dbeac18b78d13f96bb2f57eeddc30f256592417cdf739ca6804a10a29d2806e774bfa751f22cf3b65b38f37f91b4daf8aec9b803f7610e06ac9e6b03
SHA-1 Hash on that value to obtain:
...