Chip Authentication Program: Difference between revisions

Revision as of 18:18, 26 April 2023

Revision as of 19:11, 30 March 2024

Line 37:

The original CAP specification was designed to use normal EMV transactions, such that the CAP application could be deployed without updating the firmware of existing EMV cards if necessary. The preferred implementation uses a separate application for CAP transactions. The two applications may share certain data, such as PIN, while other data is not shared in instances where it is only applicable to one application (i.e., terminal risk management data for EMV) or advantages to have separate (i.e., transaction counter, so that EMV and CAP transactions increment separate counters which can be verified more accurately). The reader also carries implementation specific data, some of which may be overridden by values in the card. Therefore, CAP readers are generally not compatible with cards from differing issuing banks.

However, cardmost readersUK issuedbanks bythat most,issue possiblycard all, UK banksreaders conform to a CAP subset defined by [[APACS]], meaning that, in most cases, cards issued by a UK bank can be used in a card reader issued by a different bank.{{cn}}

==Vulnerabilities==