ID TECH SecureHead SPI with TMIV User Manual
Page | 32
6.6.
Clear/Masked Data sent status
Bit 0
1: Track1 clear/mask data present
Bit 1
1: Track2 clear/mask data present
Bit 2
1: Track3 clear/mask data present
Bit 3
1: fixed key
0: DUKPT Key Management
Bit 4
0: TDES
1: AES
Bit 5
0: No requirement to use IC
1: means chip present on card (2 or 6 in Service Code)
Bit 6
1: Pin Encryption Key
0: Data Encryption Key Refer ANSI X9.24 2009 Page 56 for details.
Bit7
1: Serial # present
0: not present
6.6.1.
Encrypted Hash Data sent status
Bit 0
1: Track1 encrypted data present
Bit 1
1: Track2 encrypted data present
Bit 2
1: Track3 encrypted data present
Bit 3
1: Track1 hash data present
Bit 4
1: Track2 hash data present
Bit 5
1: Track3 hash data present
Bit 6
1: Session ID present
Bit 7
1: KSN present
6.7.
Track Masked Data
Track data masked with the MaskCharID (default is ‘*’). The first PrePANID (up to 6 for BIN, default is
4) and last PostPANID (up to 4, default is 4) characters can be in the clear (unencrypted).
6.8.
Track Encrypted Data
This field is the encrypted Track data, using either TDES-CBC or AES-CBC with initial vector of 0. If the
original data is not a multiple of 8 bytes for TDES or a multiple of 16 bytes for AES, the reader right
pads the data with 0.
The key management scheme is DUKPT or Fixed key. For DUKPT, the key used for encrypting data is
called the Data Key. Data Key is generated by first taking the DUKPT Derived Key exclusive or’ed with
0000000000FF0000 to get the resulting intermediate variant key. The left side of the intermediate
variant key is then TDES encrypted with the entire 16-byte variant as the key.
After the same steps are performed for the right side of the key, combine the two key parts to create
the Data Key.