3 ms·
Contactless and EMV Chip cards are the same. During provisioning the server sends a signed Java Applet to the Secure Element which validates the chain of trust
by xenadu02 2y ago
Contactless and EMV Chip cards are the same.
During provisioning the server sends a signed Java Applet to the Secure Element which validates the chain of trust then installs the applet. The EMV protocol involves "application selection" which lets the payment terminal tell the Secure Element OS which applet it wants to communicate with.
ARQC (Authorization ReQuest Cryptogram) is where the applet on the card takes the payment terminal's payment request and identity info, signs it with the PK keypair unique to that provisioned card, and sends it back to the payment terminal which then hands it to the card issuer for validation and approval.
A bunch of Java bytecode: the chip/SE, the payment terminal, and likely also on the server side.
- AnotherGoodName 2y agoThe really cool part is that they are powered wirelessly, boot up cold, do the signing with their key and complete the transaction in a tap.
- antonkochubey 2y agoSo much can be done in so little resources when you don't need to load 4177 files from node_modules folder
- lxgr 2y agoNot all contactless payment cards are EMV cards (or even smartcards!), and not all EMV cards are Java cards, though. Early contactless payment protocols also started out as something adjacent to, but distinct from, EMV; they eventually got included under the EMV umbrella, but unlike for contact payments, the protocols (called "kernels") vary considerably between e.g. Visa and Mastercard. There's still a wide range of non-EMV contactless payment cards in use today, mostly for stored-value transit use cases (EMV works best when there's a network connection and doesn't handle long-term two-sided offline cases very well). NXP is an important player there (with their Mifare series of cards/chips); Felica is another (mostly in Japan).