Payment Utilities

Inputs

• PIN block format — Drop-down covering the ISO 9564 formats and the OEM / ECI variants. Format 0 (ISO-0) is the default.
• PAN — Only the PAN-bound formats ask for it; the field reads PAN is required for this format when the current selection needs one.
• PIN — 4–12 numeric digits.

The rest of the form follows the format you pick, so a format that carries no PAN simply drops that field.

Walk-through (Encode, ISO-0)

1. Open the PIN Block Calculator from Tools → Payment Utilities → PIN Block Calculator.
2. Pick Format 0 (ISO-0) in the PIN block format drop-down.
3. Stay on the Encode tab.
4. Enter the PAN. ISO-0 uses the rightmost 12 digits excluding the check digit.
5. Enter the PIN (e.g. 1234).
6. Click Encode. The formatted PIN block is written to the activity log with its inputs.

The Decode tab reverses the same format: give it the PIN block and it recovers the PIN.

ISO-0 / ANSI X9.8

Step 1 (PIN block):  04 12 34 FF FF FF FF FF
   - 04 = PIN length (4 digits)
   - 1234 = PIN
   - FF padding to 8 bytes

Step 2 (PAN block):  00 00 12 34 56 78 90 12
   - leading zeros + rightmost 12 digits of PAN excluding check digit

Step 3 (XOR):        04 12 26 CB A9 87 6F ED
Step 4 (Encrypt):    encrypted under TPK / ZPK

ISO-1

No PAN; the PIN is followed by random fill bytes. Use when PAN is not transmitted (e.g. some IVR / VRU flows).

ISO-3

Like ISO-0 but the padding nibbles are random in the range 0xA–0xF. Each generated PIN block is unique even for the same PIN + PAN combination.

ISO-4 (AES)

16-byte clear PIN block: control field, PIN length, PIN digits, then a random fill. Encrypted with AES (128 / 192 / 256-bit) and XOR-combined with a derived PAN block. Use the dedicated AES PIN Block tab for ISO-4 work.

OEM-1 / ECI

Reserved for compatibility with legacy ATM and POS networks. The exact layout differs per vendor; the calculator labels each tab with the vendor name.

Inputs

• Key — 32 hex chars (AES-128).
• PIN (Encode) / PIN Block (Decode) — One field serving both directions: the PIN going in, the encrypted block coming back out.
• PAN — Required for the PAN block XOR step.

Buttons: Encode, Decode.

Output

• Clear PIN block (16 bytes)
• PAN block (16 bytes)
• Intermediate ciphertext (after AES of clear PIN block)
• Final encrypted PIN block (after XOR with PAN block)

Inputs

• System ZPK (Hex) — The zone key the block is translated to.
• Terminal TPK (Hex) — The terminal key the block arrived under.
• STAN — System trace audit number of the transaction.
• Transaction Amount
• Incoming / Outgoing PIN Block Format — Two-digit format codes, defaulting to 01. Set them differently to translate the format as well as the key.
• Incoming PIN Block (Hex)
• Account Number — Binds the block for the PAN-bound formats.

Button: Translate.

Generate Terminal Key Set

Creates the terminal keys — TPK and TAK — an AS2805 terminal receives at logon, wrapped under the receiving key-encrypting key.

• Key Flag — Drop-down; 1 by default.
• KEKr Key (Hex) — The receiving KEK the new set is wrapped under.
• Key Scheme KEKE / Key Scheme LMK — Drop-downs, B and Z by default — the scheme tags for the KEK-wrapped and LMK-wrapped copies.
• Key Check Value Type — Drop-down; 1 by default.

1. Open Tools → Payment Utilities → AS2805 Calculator; the tool opens on Generate Terminal Key Set.
2. Enter the KEKr key. Leave the key flag, schemes and KCV type at their defaults unless your host specifies otherwise.
3. Click Generate Keys. The TPK and TAK land in the activity log with their key check values.

MAC

Two hex fields — Key (Hex) and Data (Hex) — and a Calculate MAC button. The MAC is computed to AS 2805.4 over the data under the key you give it.

OWF

The one-way function used in AS2805 key management. Same two fields; Calculate OWF writes the result to the log.

Inputs

• PEK — 32 hex chars. Derive it first on the PEK Derivation tab from a BDK or IPEK plus the KSN.
• PIN Block — 16 hex chars: the clear block to encrypt, or the encrypted block to recover.

Buttons: Encrypt, Decrypt.

PEK Derivation

• Input Key Designation — Drop-down: BDK or IPEK. Determines which key field is shown.
• BDK (32 Hex Chars) / IPEK (32 Hex Chars) — Whichever the designation asks for.
• KSN (20 Hex Chars) — Always visible; the rightmost 21 bits are the transaction counter.

1. Pick Input Key Designation — BDK if you have the base key, IPEK if a previous step already produced the initial key.
2. Enter the key in the resulting BDK or IPEK field (32 hex chars).
3. Enter the KSN (20 hex chars).
4. Click Derive PEK. The activity log shows the resulting PIN Encryption Key — copy it for the operation tabs.

DEK Derivation

Identical fields and flow to PEK Derivation — the only difference is the variant applied, which produces a Data Encryption Key instead.

DUKPT MAC

• PEK (32 Hex Chars) — The MAC key, typically derived on the PEK Derivation tab.
• Algorithm — Radio: DES or 3DES.
• Data (Hex) — Multi-line hex input.

Button: Generate MAC.

DUKPT Data

• PEK (32 Hex Chars) — Working key from PEK Derivation, or from DEK Derivation when the data variant is required.
• Use Data Variant Key — Switch. When on, the tool applies the data-encryption variant XOR before encrypting.
• Data Input Type — ASCII or Hex.
• Cipher Mode (zero IV) — Radio: CBC or ECB.
• Data — Multi-line input in the chosen format.

Buttons: Encrypt, Decrypt.

DUKPT AES Utilities · Key Derivation

The AES tool implements ANSI X9.24-3. Four tabs — Key Derivation, DUKPT PIN, DUKPT MAC, DUKPT Data — split derivation from operations the same way.

• Input Key Designation — BDK or IK.
• Initial Key Type — Drop-down: AES-128, AES-192, AES-256.
• BDK / IK — Hex; length matches the initial key type.
• Working Key Type — Drop-down: 2TDEA, 3TDEA, AES-128, AES-192, AES-256 — TDES working keys too, for backwards compatibility.
• KSN — 24 hex chars: 4-byte BDK ID, 4-byte derivation ID, 4-byte counter.

1. Pick Input Key Designation and Initial Key Type.
2. Enter the BDK / IK.
3. Pick Working Key Type and enter the KSN.
4. Click Derive Keys. The activity log lists the IK (when starting from a BDK) and the working key.

3DES KSN (10 bytes)
| 5-byte BDK ID + Device ID | 2-byte counter (high) | 21-bit Tx Counter |

AES KSN (12 bytes)
| 4-byte BDK ID | 4-byte Derivation ID | 4-byte Transaction Counter |

AMEX CSC Calculator

• CSC Version — Drop-down; Version 1 by default.
• CSC Key (Hex) — The Amex CSC key.
• PAN — 15-digit Amex account number.
• Expiration Date (YYMM) — Four digits.
• Service Code — Three digits.
• Verification Value Type — Drop-down; CSC by default.

1. Open Tools → Payment Utilities → AMEX CSC; the tool opens on Generate.
2. Pick the CSC Version, then enter the CSC Key, PAN, expiry and service code.
3. Click Generate. The activity log lists the CSC-5, CSC-4 and CSC-3 values.
4. To check values from a card, switch to Validate: enter the same PAN, expiry and service code, then the CSC-5, CSC-4 and CSC-3 you were given, and click Validate.

MasterCard CVC3

• IMK — The issuer master key for CVC3.
• PAN / PAN Seq No — Derive the card key from the IMK.
• Track 1/2 Data — The track data the CVC3 is computed over.
• Unpredictable Num — The terminal’s unpredictable number, hex.
• ATC — Application transaction counter, hex.
• CVC3 Type — Drop-down; Dynamic CVC3 by default.

1. Open Tools → Payment Utilities → MasterCard CVC on the Generate tab.
2. Enter the IMK, PAN and PAN sequence number, then the track data, unpredictable number and ATC from the transaction.
3. Click Generate. The log shows the derived key, the IVCVC3 and the CVC3.
4. On Validate, add the Dynamic CVC3 received from the card and click Validate to compare.

ISO/IEC 9797-1

ISO/IEC 9797-1 standardises six MAC algorithms over block ciphers; the calculator exposes each from the MAC Algorithm drop-down.

• MAC Algorithm — Drop-down, Algorithm 1 through Algorithm 6.
• Key (K′) — Hex; the algorithms that need a second key derive it from this one.
• Padding — Drop-down: Method 1, Method 2, Method 3.
• Data (Hex) — The message to authenticate.
• Truncation Length (Chars) — Defaults to 8.

1. Open Tools → Payment Utilities → ISO/IEC 9797-1.
2. Pick the MAC Algorithm and Padding your host specifies — Algorithm 1 with TDES is widespread for ISO 8583 MAC fields (bit 64 / 128); Algorithm 3 is the European retail standard.
3. Enter the key and the hex data, and set the truncation length.
4. Click Generate MAC. The padded data, the full MAC and the truncated MAC are written to the log.

Key:    0123456789ABCDEFFEDCBA9876543210
IV:     0000000000000000
Method: 2 (0x80 followed by zero bytes)
Data:   48656C6C6F     (ASCII "Hello")

Padded: 48656C6C6F800000

Output: 8F9E4CCDD623E590

ANSI X9.9 & X9.19

One tool covers both ANSI schemes — X9.9 (wholesale) and X9.19 (retail) — selected from the MAC Algorithm drop-down. X9.19 runs single-DES CBC-MAC across the message with a final 3DES step over the last block, which makes it equivalent to ISO 9797-1 Algorithm 3.

• MAC Algorithm — ANSI MAC X9.9 (Wholesale MAC) or the X9.19 retail variant.
• Key (K) — Hex key; the 3DES halves are taken from it in order.
• Data (Hex) — The message to authenticate.
• Truncation Length (Chars) — Defaults to 8.

TDES-CBC MAC

Triple-DES CBC-MAC: encrypt the message under TDES in CBC mode and take the last block as the MAC. Common in legacy ISO 8583 implementations.

• MAC Algorithm — Fixed to TDES CBC-MAC on this tool.
• Key (K) — 32 hex chars (2-key 3DES).
• Padding — Drop-down; defaults to ISO9797-1 (Padding Method 1).
• Data (Hex) — The message to authenticate.
• Truncation Length (Chars) — Hex characters of MAC to keep; defaults to 8.

HMAC

Hash-based MAC defined by RFC 2104. Key and data are each entered as ASCII or hexadecimal; the output is hex of the digest length — 32 bytes for SHA-256, 64 for SHA-512.

• Hash Type — Drop-down: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, RIPEMD-160.
• Key Input / Data Input — Drop-downs: ASCII or Hexadecimal.
• HMAC Key — Single-line text in the chosen format.
• Data — Multi-line text in the chosen format.

1. Pick Hash Type — SHA-256 is a safe default for new work.
2. Pick Key Input and enter the HMAC Key in that format.
3. Pick Data Input and enter the Data.
4. Click Generate HMAC. The digest is appended to the activity log.

Padding methods (ISO 9797-1)

1. Open Tools → Payment Utilities → Bitmap Calculator.
2. Click the fields present in your message in the Primary Bitmap (1-64) grid. Click any field above 64 in the Secondary Bitmap (65-128) grid and field 1 switches on by itself.
3. Read the Calculated Bitmap at the top and copy it with the button at its right.
4. Going the other way, paste a 16- or 32-hex bitmap into the field and the grids light up the fields it declares. The refresh button in the title bar clears the grid.

Byte walk-through

E0701800 28000A00 60000000 00000001

E0 = 1110 0000  →  1  2  3     secondary bitmap present · PAN · processing code
70 = 0111 0000  →  10 11 12    billing conversion rate · STAN · local time
18 = 0001 1000  →  20 21       PAN country code · forwarding institution country
28 = 0010 1000  →  35 37       Track 2 · RRN
0A = 0000 1010  →  53 55       security control info · ICC data
00 bytes        →  no fields in that run of eight

60 = 0110 0000  →  66 67       settlement code · extended payment code
01 = 0000 0001  →  128         MAC