Copyright © 2010-2014, International Technologies & Systems Corp. All rights reserved.
Page 57 of 74
SecureMag User Manual
The Authenticated mode timeout duration specifies the maximum time in seconds
which the reader would remain in Authenticated Mode. A value of zero forces the
reader to stay in Authenticated Mode until a card swipe or power down occurs. The
minimum timeout duration required is 120 seconds. If the specified time is less than
the minimum, 120 seconds would be used for timeout duration. The maximum time
allowed is 3600 seconds (one hour).
If Session ID information is included and the command is successful, the Session ID
will be changed.
The Activate Authenticated Mode succeeds if the device decrypts Challenge Reply
response correctly. If the device cannot decrypt Challenge Reply command, Activate
Authenticated Mode fails and DUKPT KSN advances.
Command Structure
Host -> Device:
<STX><S><82h><08h><Activation Data><ETX><LRC>
Device -> Host:
<ACK> (success)
<NAK> (fail)
Activation Data: 8 or 16 bytes, structured as <Challenge 1 Response> <Session ID>
Challenge 1 Response: 6 bytes of Challenge 1 random data with 2 bytes of
Authenticated mode timeout duration. It’s encrypted using the key derived from the
current DUKPT key.
Session ID: Optional 8 bytes Session ID, encrypted using the key derived from the
current DUKPT key.
Deactivate Authenticated Mode Command
This command is used to exit Authenticated Mode. Host needs to send the first 7
bytes of Challenge 2 (from the response of Activate Authenticated Mode command)
and the Increment Flag (0x00 indicates no increment, 0x01 indicates increment of the
KSN) encrypted with current DUKPT Key exclusive- or’ed with <3C3C 3C3C 3C3C
3C3C 3C3C 3C3C 3C3C 3C3C>.
If device decrypts Challenge 2 successfully, the device will exit Authenticated Mode.
The KSN will increase if the Increment flag is set to 0x01. If device cannot decrypt
Challenge 2 successfully, it will stay in Authenticated Mode until timeout occurs or
when customer swipes a card.
The KSN is incremented every time the authenticated mode is exited by timeout or
card swipe action. When the authenticated mode is exited by Deactivate