Cdet Guide V2 3 296214
This document was ed by and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this report form. Report 3b7i
Overview 3e4r5l
& View Cdet Guide V2 3 as PDF for free.
More details w3441
- Words: 17,016
- Pages: 76
less Device Evaluation Toolkit Guide Version 2.3
31 August 2017
Important Information on Confidentiality and Copyright © 2004 - 2017 Visa. All Rights Reserved. Notice: This information is proprietary and CONFIDENTIAL to Visa. It is distributed to Visa participants for use exclusively in managing their Visa programs. It must not be duplicated, published, distributed or disclosed, in whole or in part, to merchants, cardholders or any other person without prior written permission from Visa. The trademarks, logos, trade names and service marks, whether ed or uned (collectively the “Trademarks”) are Trademarks owned by Visa. All other trademarks not attributed to Visa are the property of their respective owners.
Note: This document is not part of the Visa Rules. In the event of any conflict between any content in this document, any document referenced herein, any exhibit to this document, or any communications concerning this document, and any content in the Visa Rules, the Visa Rules shall govern and control.
Contents
less Device Evaluation Toolkit - Guide (Version 2.3)
Contents 1
less Device Evaluation Toolkit (CDET) Guide Introduction................................................ 6 1.1 Introduction ...................................................................................................................................................................... 6 1.2 Information ...................................................................................................................................................... 7 1.2.1
General Information and ..................................................................................................................... 7
1.2.2
Obtaining Toolkits .................................................................................................................................................. 7
1.3 Summary of Changes Introduced in this Version ............................................................................................... 7 1.4 CDET Documentation .................................................................................................................................. 8 1.5 Disclaimer .......................................................................................................................................................................... 9 2
less Device Evaluation Toolkit - Guide Overview ................................................................ 10 2.1 Objective .......................................................................................................................................................................... 10 2.1.1
Visa less Transit Terminal Testing ................................................................................................... 10
2.2 Audience .......................................................................................................................................................................... 11 2.3 Document Organization............................................................................................................................................. 11 2.4 CDET Components ....................................................................................................................................................... 13 2.5 Related Documents ..................................................................................................................................................... 13 2.6 CDET Usage .................................................................................................................................................................... 13 2.6.1
CDET Usage Guidelines....................................................................................................................................... 14
2.7 New CDET Versions ..................................................................................................................................................... 15 2.8 Scope of CDET Testing ............................................................................................................................................... 15 2.9 EMVCo Level 3 Framework Compliance .............................................................................................................. 16 2.9.1 3
Provision of CDET Test Card Images to Test Tool Vendors .................................................................. 16
Test Case Introduction ....................................................................................................................................... 18 3.1 Pre-requisites ................................................................................................................................................................. 18 3.1.1
Reader Capabilities ............................................................................................................................................... 18
3.1.2
Visa CA Test Public Keys ..................................................................................................................................... 18
3.1.3
Configured for Operational Use ...................................................................................................................... 19
3.1.4
Testing and Approval .......................................................................................................................................... 19
3.2 Instructions...................................................................................................................................................................... 19
31 August 2017
Visa Confidential
i
Contents
less Device Evaluation Toolkit - Guide (Version 2.3) 3.2.1
Self-istered Tool ....................................................................................................................................... 19
3.2.2
Initially Deployed Readers ................................................................................................................................. 19
3.2.3
Previously Deployed Readers ........................................................................................................................... 19
3.2.4
Changes to Reader ............................................................................................................................................... 19
3.2.5
Decline Responses vs. Other Errors ................................................................................................................ 20
3.2.6
Test Cards and Test Cases ................................................................................................................................. 20
3.2.7
Online Testing ........................................................................................................................................................ 20
3.2.8
Compliance Reporting ........................................................................................................................................ 21
3.3 Test Case Summary...................................................................................................................................................... 23 3.4 Recommendations and Test Cases Applicability .............................................................................................. 27 3.4.1 4
Applicability to Transit Terminals: ................................................................................................................... 27
Test Case Details ................................................................................................................................................. 29 4.1 Test Case 1: VS 2.0.2 Baseline Card .................................................................................................................. 31 4.2 Test Case 2: VS 2.1.x Baseline Card................................................................................................................... 33 4.3 Test Case 3: Card with a 16-byte ADF Name and other Features .............................................................. 35 4.4 Test Case 4: Card with additional Data in the GPO Response and with no Cardholder Name ...... 37 4.5 Test Case 5: Card that returns additional Data in the Select PPSE Response and containing other unique features. ....................................................................................................................................................................... 39 4.6 Test Case 6: qVSDC-only card with 19-digit PAN and CVN 18 ................................................................... 41 4.7 Test Case 7: Online-only card with an Electron AID ........................................................................................ 43 4.8 Test Case 8: Card with an Interlink AID ................................................................................................................ 45 4.9 Test Case 9: VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively .......................................................................................................................................................... 47 4.10 Test Case 10: Card with an IAD length of 23-bytes and an Unrecognized CVN .................................. 49 4.11 Test Case 11: Card with a VMPA Applet that causes a Pre-tap................................................................... 51 4.12 Test Case 12: Card with a CTQ indicating an issuer preference to switch to interface on ODA failure. ............................................................................................................................................................................... 53 4.13 Test Case 13: Card that Declines Transactions .................................................................................................. 55 4.14 Test Case 14: Card with inconsistent Data .......................................................................................................... 57 4.15 Test Case 15: Card ing qVSDC Online Transit SDA .......................................................................... 59 4.16 Test Case 16: Online-only card using the 1536-bit CA key .......................................................................... 61
ii
Visa Confidential
31 August 2017
Contents
less Device Evaluation Toolkit - Guide (Version 2.3) 4.17 Test Case 17: Card ing qVSDC Online Transit SDA, but SDA fails .............................................. 63 A
Visa CA Test Public Key for qVSDC Offline .................................................................................................. 66 A.1 1408 Bit VSDC TEST Key ............................................................................................................................................. 66 A.2 1536 Bit VSDC TEST Key ............................................................................................................................................. 67
B
Acronyms and Glossary..................................................................................................................................... 69
31 August 2017
Visa Confidential
iii
Tables
less Device Evaluation Toolkit - Guide (Version 2.3)
Tables Table 1:
CDET Documentation ......................................................................................................... 8
Table 1–1:
Document Organization .................................................................................................................... 11
Table 1–2:
Scope of CDET Testing ...................................................................................................................... 15
Table 2–1:
Test Case Summary ........................................................................................................................... 23
Table A–1:
1408 Bit VSDC Test Key .................................................................................................................... 67
Table B–1:
Acronyms ............................................................................................................................................. 69
Table B–2:
Glossary ................................................................................................................................................. 71
iv
Visa Confidential
31 August 2017
Tables
less Device Evaluation Toolkit - Guide (Version 2.3)
31 August 2017
Visa Confidential
v
less Device Evaluation Toolkit (CDET) Guide Introduction Introduction
1 less Device Evaluation Toolkit (CDET) Guide Introduction This chapter provides the following information:
Introduction to the less Device Evaluation Toolkit (CDET) Guide
Information
Summary of changes introduced in this version
CDET Documentation
Disclaimer
1.1 Introduction The Visa less Payment Specification (VS) was developed as a platform to globally interoperable less chip programs. It facilitates the creation of payment technologies that provide Visa less issuing clients with the flexibility to customize their less chip programs to meet local market needs while gaining the benefits of global interoperability. The specification also provides additional security options and enables enhanced performance for faster transaction processing. To ensure that Visa less acceptance devices deployed by acquiring clients do not contribute to interoperability issues, Visa has developed the Visa less Device Evaluation Toolkit (CDET) - a set of test card images, an accompanying guide (“this document”) and a card profile definitions document. CDET is designed to allow Visa less acquiring clients and their technical providers to validate correct configuration of their Visa less acceptance devices. The Toolkit may also be used to assist Visa less reader developers and systems integrators with development and Level 3 integration testing and to ensure that Visa requirements for card acceptance devices are being met. Oftentimes, cards issued in one country or region may experience acceptance problems when used in other countries and regions, even though both the card and reader were fully tested and approved by the payment scheme’s accredited testing laboratory. These issues may be the result of incorrect device configuration, inadequate Level 3 integration testing or misunderstandings about payment scheme’s rules and requirements. In addition to ensuring Visa less card acceptance globally, the CDET also enables interface testing of payment terminals. This step is necessary to confirm that correct prompts, error messages, application selection menus and PIN Entry messaging are being appropriately applied and readily comprehensible to the cardholder and merchant.
6
Visa Confidential
31 August 2017
less Device Evaluation Toolkit (CDET) Guide Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
1.2 Information 1.2.1 General Information and s of the CDET that require general information on the tool or with needs should Visa at [email protected].
1.2.2 Obtaining Toolkits Toolkits ing the latest CDET test cases may be obtained by ing the third-party test tool suppliers directly. Visa publishes an ongoing list of confirmed suppliers that both the card and host simulation of the CDET. This list is available by visiting the following link: https://technologypartner.visa.com/Toolkits/#orderlist In a Visa Business News article published on 6 August 2016, Visa announced the release of a new Android-based mobile app, as an alternative and convenient option for performing the latest CDET testing requirements. An updated version of the Visa Mobile CDET App ing CDET Version 2.3 requirements can be ed from the Google Play Store. Please note: since the release of the Visa Mobile CDET app, physical test cards for CDET are no longer available from the Visa fulfillment service (XPressDocs).
1.3 Summary of Changes Introduced in this Version This section provides an overview of the changes made in this document since its last publication. Section
Change
Description
Section 3.3 & Section 4
Removal
Section 4.2
Update
Converted Test Case # 2 to CVN = ‘22’ and less manual cash transactions
Section 4.10
Update
Note added to ‘Objective’ section to explain the composition of the Issuer Discretion Data (IDD)
31 August 2017
Test Case # 9 removed, and Test Cases 10, 11, 12, 13, 14 & 15 renumbered (decremented by 1)
Visa Confidential
7
less Device Evaluation Toolkit (CDET) Guide Introduction CDET Documentation
Section
Change
Description
Section 3.3: Test Case Summary
Addition
Additional test cases introduced, in of Visa less Transit Terminal testing:
Section 4: Test Case Details
Addition
Test Case #15: ing quick Visa Smart Debit / Credit (qVSDC) Online Transit SDA.
Test Case #16: Online-only card using the 1536-bit CA key.
Test Case #17: ing qVSDC Online Transit SDA with a failure of SDA
New test cases 15, 16 & 17 added
Criteria/ Validation of existing test cases updated to Transit Terminal testing
1.4 CDET Documentation CDET documentation now consists of two documents: a Card Profiles document and a Guide (this document). Table 1:
CDET Documentation
Document Name Visa less Device Evaluation Toolkit (CDET) Guide (This Document)
Visa less Device Evaluation Toolkit (CDET) Card Profiles
8
Description This document provides:
An overview of the CDET including a description of the components and usage criteria
Test cases
Appendices providing details of the Visa CA test key, Acronyms and a Glossary.
This document provides the details required to personalize each of the CDET test cards.
Visa Confidential
Audience This document is primarily intended for s of the CDET, including acquirers, processors, merchants, and third party service providers on behalf of acquirers.
This document is intended for personalization bureaus and chip tool vendors responsible for developing CDET test cards or simulated/scripted equivalents.
31 August 2017
less Device Evaluation Toolkit (CDET) Guide Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
1.5 Disclaimer The Visa less Device Evaluation Toolkit provides a means for a Visa less acquiring client (or agent) implementing a less chip program to test its card acceptance device prior to deployment. The Visa less Device Evaluation Toolkit described herein includes test card images, a Guide and a Card Profiles document, specifically for use with Visa less readers that are compliant to the Visa less Payment Specifications (VS). The Toolkit is designed to assist Visa less acquiring clients and their merchants perform tests that help to minimize card acceptance problems. Systems Integrators and Visa less device vendors can also benefit from the use of the Toolkit, as it provides a tool to assist them during development or integration of VS-compliant readers. The tests prescribed in the guide do not supersede the requirement for readers to undergo type approval testing at a Visa accredited laboratory. Visa reserves the right to add or remove tests and test requirements in the Toolkit at any time and in its sole discretion. Visa does not warrant the Toolkit or any Toolkit test results for any purpose whatsoever, and expressly disclaims any and all warranties of merchantability, fitness for purposes, or non-infringement of third party intellectual property rights. No vendor or other third party may refer to a product, service or facility as “Visa-approved”, nor otherwise state or imply that Visa has, in whole or part, approved any aspect of a vendor or its products, services or facilities, except to the extent and subject to the and restrictions expressly set forth in a written agreement with Visa or in an approval letter provided by Visa. All other references to “Visa approval” are strictly prohibited by Visa. All references to Visa operating regulations in this document are deemed to be references to both Visa International Operating Regulations and/or Visa Europe Operating Regulations, as appropriate.
31 August 2017
Visa Confidential
9
less Device Evaluation Toolkit - Guide Overview Objective
2 less Device Evaluation Toolkit - Guide Overview This section provides an overview of the less Device Evaluation Toolkit (CDET) Guide (this document).
2.1 Objective The objective of this document and its corresponding test cases is to provide Visa less acquiring clients, merchants, system integrators and vendors with a Toolkit to confirm that their reader can accept Visa less cards during the reader development, deployment and update stages of the program.
2.1.1 Visa less Transit Terminal Testin g With the recent definition of requirements, general guidance and recommendations for the deployment of Visa less acceptance devices on transit systems, this document will assist transit agencies and equipment vendors with the testing of systems, developed to accept Visa less payment transactions directly at the point of entry to their transit networks. These include systems where the fare is known at the point of entry (‘Known Fare Transaction’) and those where the amount to be paid is determined after the travel has taken place (‘Mass Transit Transaction). Important This document assumes that Offline Data Authentication will be the method used to allow access to the transit network; that is, the ODA data provided by the card must be positively authenticated by the transit terminal before the consumer is allowed to travel. Important The test cases within this document are only relevant to transit readers operating one of the following implementations:
Known Fare Transaction (KFT): an implementation in which a less payment is made at the point of entry to the transit network (for example, at a bus ticket machine, where the fare amount is typically known)
Mass Transit Transaction (MTT): an implementation in which a less card to be used subsequently to pay for the travel is authenticated at point of entry to the transit network).
Note: Kiosks and ticket machines operating in a retail mode at which a transit ticket may be purchased using a less / card for subsequent presentation and entry to the transit network are not in scope.
10
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
2.2 Audience The audience for this Toolkit consists primarily of:
Visa less acquiring clients - deploying readers in of Visa less acceptance programs.
Visa less merchants – working with Visa less acquiring clients to deploying readers in of Visa less card acceptance.
System Integrators - working on behalf of acquiring clients or merchants in the deployment of readers in of Visa less acceptance programs.
Note: In some areas, integrators are also referred to as Value-added Resellers (VARs).
Reader vendors - developing VS-compliant reader in of Visa less acceptance programs.
This document should not be shared with or distributed to any other parties.
2.3 Document Organization This document contains the following chapters: Table 2–1:
Document Organization
Chapter
Description
1 - CDET Guide Introduction
This chapter provides background information on this CDET Guide. It also includes:
31 August 2017
Introduction to the less Device Evaluation Toolkit (CDET) Guide Information CDET Documentation Disclaimer
Visa Confidential
11
less Device Evaluation Toolkit - Guide Overview Document Organization Chapter
Description
2 - CDET Guide Overview
This chapter provides the following information: Details on the objectives of the document The audience to which the document applies A description of how the document is organized A description of the CDET components List of Related Documents CDET usage criteria Policy with respect to the introduction of new versions Scope of CDET testing Comments on future enhancements Relevance to the EMVCo Terminal Integration Taskforce Framework
3 - Test Case Introduction
4 - Test Case Details
12
This chapter introduces the CDET test cases. It includes pre-requisite information for testing, including instructions for each test case and a summary of all test cases included in this version of the toolkit. This chapter outlines each CDET test case, providing details on:
Test Case Number
Test Case Name
Objective
Regional Requirement
Business Justification
Pre-requisite
Applicable Terminal Device Type
Applicable Terminal Interface
Test Card used
Test Evidence to be submitted
Document Reference
Criteria/ Validation
A - Visa CA Test Public Key for qVSDC Offline
Provides the value of the currently active 1408-bitsand 1536-bits Visa CA Test Public Key, used for Offline Data Authentication.
B - Acronyms and Glossary
Provide a list of commonly used Acronyms and a Glossary of commonly used .
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
2.4 CDET Components The CDET consists of:
Test Card Simulators—Card Simulators containing images with specific settings that are intended to identify incorrectly coded or configured chip card acceptance devices.
Documentation—Two documents:
-
CDET Card Profiles Definitions (Separate Document)—A document that outlines the card personalization requirements for each test card that can be used by card personalization bureaus and card simulator vendors to personalize the physical test cards or to develop simulated test card scripts.
-
CDET ’s Guide (This Document)—A document that outlines each test case, a description of the test card to be used with each test case, and the expected test results. This document is used by the acquirer or acquirer’s agent to perform testing.
XML Test Card Images—Machine-readable representation of the CDET test card personalization images and behaviors, in accordance with the EMVCo Level 3 format.
2.5 Related Documents This section lists documents that may be read and/or referred to in conjunction with this document:
Visa less Payment Specifications, (latest version)
Visa International Operating Regulations (latest version)
Visa Europe Operating Regulations (latest version)
Transaction Acceptance Device Requirements (TADR)—Requirements (latest version)
Transaction Acceptance Device Guide (TADG)—Requirements and Best Practices (latest version)
2.6 CDET Usage CDET should be utilized to ensure that Visa less readers being deployed have been correctly configured. It is expected that each applicable test case will be performed to gain the full benefits of the Toolkit. If a CDET test result does not meet the expected outcome of the test, it is anticipated that the acquirer will work with their reader supplier or system integrator to resolve the issue. The acquirer must continue to work with their technical service provider until the issue is resolved and the result complies with the expected outcome. The following guidelines are intended to provide specific use cases that may govern the use of CDET. Note that this list is not exhaustive. If a situation arises that is not currently listed, the Acquirer should their Visa representative for guidance.
31 August 2017
Visa Confidential
13
less Device Evaluation Toolkit - Guide Overview CDET Usage
2.6.1 CDET Usage Guidelines In regions where the use of CDET has been mandated, it must always be used in the following cases. Where CDET’s use remains optional, it is strongly recommended to be used in these cases:
Prior to deployment of a new Visa less reader for a new or existing Visa less program
Following significant software of hardware modification or reconfiguration of an existing Visa less Reader. This includes but is not limited to changes to the following:
o
The approved Kernel
o
The payment component of the terminal application, affecting Visa less processing
o
The Cardholder Verification Method (CVM) capabilities
o o o
Language The telecommunications method (e.g. upgrade from dial-up to high-speed) ed Currency Code/Country Code
Introduction of a new model of device hardware.
Note: It is possible to have “families” of devices, which are identical from a payment’s perspective. Here a new “model” is taken to mean a change, which may affect card acceptance. This includes the interface presented to either the cardholder or merchant.
Changes to a merchant or acquirer’s network infrastructure. For example, in a case where a merchant has switched acquirers, even though their terminal configuration might remain the same.
A strong suspicion by Visa or other stakeholders of the presence of an acceptance or interoperability problem affecting the Visa less acceptance device or its connectivity to VisaNet.
Following upgrades or modifications to the reader to terminal interface or acquirer host systems, which could affect the transmission of chip data.
Addition of a new peripheral device requiring changes to the existing code, e.g. a new printer or cash dispenser module.
Change to the terminal-to-host protocol, which does affect authorization messages.
14
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
2.7 New CDET Versions The less Device Evaluation Toolkit may be expanded in the future to include additional device and/or online transaction processing tests. On release of a new version of the Toolkit, a six-month grace period will be granted to s prior the requirement to the latest version. During this grace period, testing will still be allowed with the CDET version just prior to the new release. However, on expiration of the grace period, s will be required to the latest version. In cases where CDET use is mandated, results from earlier versions of the Toolkit will no longer be accepted.
2.8 Scope of CDET Testing Device vendors are also recommended to use the Toolkit during the reader development phase. This will help to ensure that these devices are capable of accepting a selection of diversely configured Visa less cards. Table 2–2: Scope of CDET Testing
Within Scope
Outside of Scope
Explanation
Device testing
Acquirer host certification
The Toolkit focuses on helping to ensure devices deployed in the field are configured in a way that promotes the best potential for acceptance of Visa less cards. While some of the cards in this Toolkit are to be used for online testing, this Toolkit is not specifically designated as a host certification Toolkit. Acquirers will continue to perform host system certification using the current set of test cards and scripts. Please see your Visa regional representative to obtain the test kit for acquirer host testing.
Complement to Visa/EMV Level 2 device testing
31 August 2017
Replacement of Visa/EMV Level 2 device testing
It is assumed that acquirer and/or device vendor will perform these tests on devices that have already ed EMV Level 1 testing and Visa/EMV Level 2 testing. These tests will complement Visa/EMV testing to ensure that devices have been configured correctly prior to deployment.
Visa Confidential
15
less Device Evaluation Toolkit - Guide Overview EMVCo Level 3 Framework Compliance
2.9 EMVCo Level 3 Framework Compliance Visa, along with the five other EMVCo member Payment Networks, embarked on a series of Level 3 process alignment initiatives that started back in September 2013. Under the leadership of the EMVCo Level 3 Testing Group (L3TG), various payment networks’ testing processes for the integration of EMV and less acceptance devices are currently being standardized. Recent L3TG efforts have led to the publication of the EMV Level 3 Testing Framework – Process Enhancements and the EMV Level 3 Testing Framework – Implementation Guidelines definition documents, both of which collectively define standardized methods for L3 test tool development, qualification and usage. The main impacts of these initiatives on Visa’s CDET processes will be on:
The standardized format in which the CDET Test Cases are being provided to Level 3 test tool suppliers
The L3 Card Simulator used by clients to perform CDET testing – these tools are being enhanced with a standardized L3 platform, as defined by EMVCo. This approach enables the standardized: -
Provision of Payment Networks’ test requirements in a machine-readable format
-
Presentation of an L3 Test Selection Engine (TSE) where clients define their EMV terminal configuration details. This in turn enables the Card Simulator to systematically determine and present the applicable test cases for execution
-
Determination of the L3 /Fail Results in an automated way, following test case execution, and subsequently the reporting of those results in a standardized format along with the ing Transaction Logs.
For more information on EMVCo’s L3TG efforts, or to any of the relevant documentation, please visit the EMVCo website at the following link: http://www.emvco.com/approvals.aspx?id=272
2.9.1 Provision of CDET Test Card Images to Test Tool Vendors In compliance with the EMVCo Level 3 requirements, Visa is now providing its CDET test card images to Level 3 test tool suppliers in the standardized XML format defined by the EMVCo Level 3 Testing Group (L3TG). These images, representing each of the CDET card profiles and expected behaviors, are intended for use in conjunction with EMVCo-qualified test card simulators.
16
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
31 August 2017
Visa Confidential
17
Test Case Introduction Pre-requisites
3 Test Case Introduction This chapter introduces the CDET test cases. It includes pre-requisite information for testing, including instructions for each test case and a summary of all test cases included in this version of the toolkit.
3.1 Pre-requisites Prior to running the CDET test cases, acquirers must ensure that the prerequisites in this section are fulfilled.
3.1.1 Reader Capabilities Before beginning any of the tests, it is important to understand the capabilities of your less reader. This will help you ensure you are performing the tests correctly for your specific device.
Authorization Capability—Determine if the reader will be Offline-only, Online only or Offline/Online capable. Note that while qVSDC may offline and/or online transactions, MSD transactions are online only.
Cardholder Verification Methods—Determine the cardholder verification methods that the reader s Note: Online PIN, CDCVM, and Signature are the only CVMs that may be ed for Visa less.
Offline Data Authentication—Determine if the reader s Offline Data Authentication.
The capabilities of the less acceptance device are indicated within the Terminal Transaction Qualifier (TTQ) data element, which it sends to the card.
3.1.2 Visa CA Test Public Keys Readers that Offline Data Authentication must be configured with the Visa CA Test Public Key while the Toolkit is being used. Details of this test key are located in Appendix A: Visa CA Test Public Keys for qVSDC Offline. Note: Prior to production deployment of Visa less readers, the Visa CA Test Public Key must be removed from readers and replaced with the production Visa CA Public Keys.
18
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.1.3 Configured for Operational Use With an exception for the use of the Visa test CA keys as described above, the reader under test must be configured for as close to operational use as possible. For example, readers should include the Visa AIDs, correct terminal country code, correct date/time, and floor limits, etc.
3.1.4 Testing and Approval In accordance with the Visa Operating Regulations, all Visa less acceptance devices must be successfully tested by a Visa-accredited laboratory and receive a formal Visa approval, prior to deployment.
3.2 Instructions 3.2.1 Self-istered Tool In the first instance, the CDET is a self-istered tool. s must work to fix any problems on their own or work with their technical teams for resolution. Visa assistance should only be requested for queries related to Visa less acceptance policy, rules or best practices or to provide consultation on the interpreting results.
3.2.2 Initially Deployed Readers For readers being initially deployed, the intent is for acquirers to run each applicable test and make modifications to the reader configuration until the reader meets the expected outcome of the test. Acquirers should run these tests on each reader type as well as each reader hardware and/or software configuration. After running all tests and making the appropriate reader configuration modifications, acquirers in regions where CDET is mandated should submit their results to Visa.
3.2.3 Previously Deployed Readers If Visa or the acquiring client suspects a Visa less acceptance problem at a reader that has already been deployed, it is recommended that all applicable tests specified in the CDET be performed to assist with analysis.
3.2.4 Changes to Reader If changes are made the configuration of an already deployed reader, it is recommended that the acquiring client re-run all applicable CDET tests, to provide a level of confidence in the changes made.
31 August 2017
Visa Confidential
19
Test Case Introduction Instructions
3.2.5 Decline Responses vs. Other Errors There is a difference between a declined transaction response and an error message. In some situations, a declined response on the reader may be acceptable to a test case. However, error message responses, where the reader is unable to complete the transaction, are generally unacceptable and can indicate a problem with the reader or its setting/configuration. Testers should not necessarily be alarmed by a declined response (as long as a declined response is acceptable in the Expected Results section of the test case). However, error messages (such as “Card Not Read” or the equivalent) must be investigated.
3.2.6 Test Card Images and Test Cases s must execute the test cases using the available test card images. For simplicity, a single test card image represents a single test case, and in all cases the test card image number corresponds with the test case number (e.g., for Test Case 1, the tester will use Test Card Image 1).
3.2.7 Online Testing 3.2.7.1 General In the Test Cases section, tests are now designated as Online Applicable. When an Online transaction is performed, the transaction must be sent online to VCMS or a Visa-confirmed, third party supplied host simulator for validation of the Authorization Request Cryptogram (ARQC) and/or the CVV (dCVV or iCVV) data.
3.2.7.2 Visa Acquirers Visa Acquirers are required to perform online testing by connecting their reader/terminal to their test host system and generating transactions through to the VisaNet Certification Management Service (VCMS), or a Visa-confirmed third party supplied test host, which mimics VCMS. Each test card is configured with test Data Encryption Standard (DES) keys that is also set up within VCMS, allowing it to validate and generate the online cryptograms. Successful validation of the cryptogram by VCMS helps to ensure that all the components involved in the online transaction are correctly coded and integrated. For the online tests, card authentication (the validation of the Authorization Request Cryptogram or dCVV/iCVV) shall be performed and must be successful (unless otherwise noted in the test case). NOTE: Access to the VisaNet Certification Management Service is provided to Visa Clients only.
20
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.2.8 Compliance Reporting In regions where the use of CDET has been mandated, once acquirers have completed the applicable test cases, they will need to provide evidence of CDET compliance by reporting their results. Visa provides a web-based solution, the Chip Compliance Reporting Tool (CCRT) that enables acquirers to report their CDET results online. Once results are submitted, they will be reviewed by Visa and the acquirer ed if necessary.
3.2.8.1 Chip Compliance Reporting Tool The Chip Compliance Reporting Tool (CCRT) was developed by Visa to provide acquirers with a more convenient means of completing their compliance requirements, such as the submission of CDET results following testing. As a web-based, -friendly solution, CCRT was designed as an improved alternative to the manual methods previously used for submission of Toolkit test results. With CCRT, chip acquirers or their designated processors can complete and submit the mandatory compliance reports via a globally automated online system. Hosted on the Visa Online (VOL) web portal, CCRT is designed in accordance with Visa’s three-tier architectural requirements, which provides a high-level of application and data security. CCRT allows s to:
Submit new compliance reports
Review and update draft reports
Check on the status of pending reports submitted to Visa
Track approved reports
It benefits s by:
Providing a convenient, secure online solution for CDET results reporting:
Reducing potential for errors in manual entry by guiding s to choose from applicable options and providing mandatory information requirements
Allowing the "re-use" of reports as a starting point for new reporting, reducing time spent completing the reports
ing online status review and automated management of reports submitted to Visa, expediting communication between Visa and clients
Enables the direct importation of CDET validation results performed with PC-based card simulators
31 August 2017
Visa Confidential
21
Test Case Introduction Instructions
Acquiring clients already enrolled for VOL services may request entitlement to CCRT from their VOL representative. Those not yet enrolled, must first request VOL enrollment before being able to be entitled to CCRT access. The link for VOL enrollment is as follows: https://www.visaonline.com/ For more details on CCRT, please your local Visa Representative.
22
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.3 Test Case Summary This section provides a brief description of each test case currently included in this version of the Toolkit. The table below includes the following information:
Test Case Number: the unique test case number
Test Case Description: a brief description of the test case
Mandatory or Conditional: whether the test case is mandatory to all devices or conditional on the features ed by the device.
Device Capability: depending on the capability of the device, the test case may either be considered “Applicable (A)” – i.e. should therefore be performed, or “Non-applicable (N/A)” and should not be performed. o
Online only: generally implies either (a) an acceptance device with a Floor Limit permanently set to zero, or (b) an acceptance device not ing a Floor Limit. Such devices also typically Offline Data Authentication (ODA)
o
Offline Capable: an acceptance device with the capability to perform Offline Data Authentication to enable Offline transaction processing.
o
Transit: an acceptance device operating in a Transit environment. This is generally limited to devices that are capable of performing ODA on a Visa less card to enable access into the Transit network.
Table 3–1: Test Case
Test Case Summary
Device Capability
Test Case Description
Number
Mandatory (M) or
Online
Offline
Conditional (C )
Only
Capable
Transit
1
VS 2.0.2 Baseline Card
M
A
A
A
2
VS 2.1.x Baseline Card with CVN = ‘22’
M
A
A
A
31 August 2017
Visa Confidential
23
Test Case Introduction Test Case Summary Test Case
Test Case Description
Number
3
Card with the following features:
a 16-byte ADF Name
A PDOL that requests a 2-byte long TTQ
No Application PAN Sequence Number
A Cardholder Name with a minimum value of “/”
Mandatory (M) or
Online
Offline
Transit
Conditional (C )
Only
Capable
M
A
A
A
M
A
A
A
M
A
A
A
A Service Code = 621 4
Multi-application card with additional data in the GPO Response and with no Cardholder Name
5
Card that:
returns additional data in its SELECT PPSE Response
returns the AIP for an MSD transaction
does not include a PVKI or PVV in Track 2 Equivalent Data 6
qVSDC-only card with a 19-digit PAN and uses CVN 18
M
A
A
A
7
Online-only card with an Electron AID
C
A
A
A
A
A
A
(on device ing the Electron AID) 8
Online-only card with an Interlink AID
C (on device ing the Interlink AID)
24
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3) Test Case
Test Case Description
Number
9
VMPA Card containing “00” and “FF” Padding in the GPO and a
Mandatory (M) or
Online
Offline
Transit
Conditional (C )
Only
Capable
M
A
A
A
M
A
A
A
Read Record Responses respectively. 10
Card with an Issuer Application Data length of 23-bytes and an ‘unrecognized CVM’
11
VMPA-based card that causes a Pre-tap scenario
M
A
A
N/A
12
Card with a CTQ indicating an issuer’s preference to switch to the
C
N/A
A
A
M
A
A
A
C
N/A
A
A
N/A
N/A
A
N/A
N/A
A
interface on ODA failure
(on device having Offline capability)
13
Card set to decline the transaction, to ensure that the terminal does not attempt the transaction over another interface
14
Card having inconsistent data to force transaction termination by the terminal
(on device having Offline capability)
15
(VS 2.1.x baseline) Card ing qVSDC Online Transit SDA
C (on the device ing ODA Online, i.e. Transit Gates)
16
(VS 2.1.x baseline) Online-only card using the 1536-bit CA key
C (on the device ing ODA
31 August 2017
Visa Confidential
25
Test Case Introduction Test Case Summary Test Case
Test Case Description
Number
Mandatory (M) or
Online
Offline
Conditional (C )
Only
Capable
N/A
N/A
Transit
Online, i.e. Transit Gates) 17
(VS 2.1.x baseline) Card ing qVSDC Online Transit SDA, but SDA fails
C (on the device ing ODA Online, i.e. Transit Gates)
26
Visa Confidential
31 August 2017
A
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.4 Recommendations and Test Cases Applicability Please refer to the Acronyms Glossary in Section B for the definition and usage of the Floor Limit, Reader less Floor Limit and Terminal Floor Limit. Offline Test Cases 1b, 2b, 3b, 4b, 5b, 6b, 7b, 8b, 9b, 12b, 13b and 14b do not apply if either of the following conditions exists: -
The Reader less Floor Limit is equal to zero
-
The Reader less Floor Limit is not present, and the Terminal Floor Limit is set to zero
Additionally, for Test Cases 2b, 3b, 4b, 6b, 7b, 8b, 12b. 13a, 13b and 14b to apply, the following Terminal Transaction Qualifier (TTQ) bit should not be set: -
TTQ (9F66) Byte 2 – bit 6 = 0 (( Chip) Offline PIN not ed)
3.4.1 Applicability to Transit Terminals: The following Test Cases apply to Transit Terminal testing: -
1c, 2c, 3c, 4c, 5c, 6c, 7c, 8c, 9c, 10c, 12c, 13c, 14c, 15c, 16c, 17c
31 August 2017
Visa Confidential
27
Test Case Introduction Recommendations and Test Cases Applicability
28
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4 Test Case Details This chapter outlines each CDET test case. Important: Prior to beginning the tests, be sure to read the following sections:
Section 3.1: Pre-requisites
Section 3.2: Instructions (specifically Section 3.2.7: Online Testing)
These sections contain critical information. The following information is provided with each test case:
Test Case Number—the number of the test case.
Test Case Name—the name of the test case.
Objective—the objective of the test case.
Regional Requirement—whether the test applies to all regions or is specific to sub-set of regions. (Currently, all of the tests apply to all regions).
Business Justification—the business reason for the test.
Pre-requisite—Any specific terminal conditions that apply or configuration requirements needed for the test case.
Applicable Terminal Device Type—indicates the device type that needs to be tested.
POS: Point-of-sale (retail terminal)
ATM: Automated Teller Machine
MPOS: Mobile POS device
Transit Terminal: Definition limited to the combination of equipment or individual components at the entrance to a transit network (for example, a metro gate) or vehicle that enables access, based on successful offline data authentication of the less card.
Applicable Terminal Interface—indicates the interface type that needs to be tested.
less
Test Card—A number used to uniquely identify the test card image required to execute the test. There is a one-to-one correlation between the Test Case Number and the Test Card Number (i.e., Test Case 1 uses Test Card 1).
Test Evidence to be submitted—Evidence to be submitted with results on completion of the test case.
Receipt
Card-to-terminal Interaction Log
Host Simulator Log
31 August 2017
Visa Confidential
29
Test Case Details Recommendations and Test Cases Applicability
Document Reference—References to the specification or rule that acquirers may refer to for background information on the test. This information is especially important in the event that the test fails.
Criteria/ Validation—the success criteria expected for the test case.
30
a.
Perform an Online transaction at POS, ATMs & MPOS with online capability
b.
Perform an Offline transaction at POS & MPOS with offline capability
c.
If applicable, perform transaction at a Transit Terminal (for MTT or KFT) for ODA
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.1 Test Case 1: VS 2.0.2 Baseline Card Test Case 1/Test Card 1 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
1 VS 2.0.2 Baseline Card To ensure acceptance of a VS v2.0.2-compliant Visa less card, ing the specific features described below. of VSDC Applet Version: 2.7.1 Dual Interface o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 17) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 10 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
This card is provided to validate acceptance of a commonly configured Visa less card, compliant to VS 2.0.2. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal
☐
☒less
1 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log
☒Host Simulator Log (if
(if available)
applicable)
Visa less Payment Specifications – Version 2.0.2 including published updates
Visa Confidential
31
Test Case Details Test Case 1: VS 2.0.2 Baseline Card
Test Case 1/Test Card 1 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
a
The transaction should be completed online and be approved by the VCMS
b
N/A
Offline-capable Devices: Perform an ‘above Floor Limit’ transaction. The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
Online ODA not performed (ODA data not returned by the card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
32
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.2 Test Case 2: VS 2.2 Baseline Card Test Case 2/Test Card 2 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
2 VS 2.2 Baseline Card To ensure acceptance of a VS v2.2-compliant Visa less card, ing the specific features described below. of VSDC Applet Version: 2.9 Dual Interface o MSD not ed o qVSDC s: Online without ODA (CVN = ‘22’) Online with ODA (fDDA) Offline with ODA (fDDA) Valid for domestic and international cash transactions Valid for domestic cashback o VSDC () s: DDA CVN = ‘22’ Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
This card is provided to validate acceptance of a commonly configured Visa less card, compliant to VS 2.2. For Readers ing: Resulting Tx should be: MSD 1.4.2 only No transaction – path not ed MSD 2.x only No transaction – path not ed qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
2 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.2
Visa Confidential
33
Test Case Details Test Case 2: VS 2.2 Baseline Card
Test Case 2/Test Card 2 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
34
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.3 Test Case 3: Card with a 16-byte ADF Name and other Features Test Case 3/Test Card 3 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
3 Card with a 16-byte ADF Name and other Features To ensure acceptance of a card with a 16-byte ADF Name, and the following additional features. of VSDC Applet Version: 2.8.1F1 Dual Interface card PDOL requests a 2-byte TTQ No Application PAN Sequence Number (PSN) on the card Cardholder Name has a minimum value of “ /” (space and forward slash) Service Code = 621 Mandatory in Regions where CDET use has been mandated This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with various unique features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
3 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
35
Test Case Details Test Case 3: Card with a 16-byte ADF Name and other Features
Test Case 3/Test Card 3 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Card is personalized with the Application Currency Code ‘0840’ (US Dollars)
Domestic transaction is a transaction processed by US acquirer
International transaction is a transaction processed by non-US acquirer
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction. The transaction should be completed online and be approved by the VCMS
b
N/A
Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
36
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.4 Test Case 4: Card with additional Data in the GPO Response and with no Cardholder Name Test Case 4/Test Card 4 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
4 Multi-application card with additional data in the GPO Response and with no Cardholder Name To ensure acceptance of a Multi-application card with additional data in the GPO Response and No Cardholder Name. Card features include: of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 10 Multi-application card, with: o Visa Credit = A0 00 00 00 03 10 10 01 Application Priority Indicator = 81 o Visa Debit = A0 00 00 00 03 10 10 02 Application Priority Indicator = 82 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification:
Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface:
31 August 2017
This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with some unique features included. With the card containing two applications (Visa Credit and Visa Debit), both requiring Cardholder Confirmation, and Visa less Readers not ing this feature, the intent of this test case is to ensure that the Reader correctly disregards these settings. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
Visa Confidential
37
Test Case Details Test Case 4: Card with additional Data in the GPO Response and with no Cardholder Name
Test Case 4/Test Card 4 (Mandatory and both Online and Offline Applicable) Test Card: Test Evidence to be Submitted:
4 ☒Receipt (where possible)
Document Reference: Criteria/ Validation
Visa less Payment Specifications – Version 2.1 including published updates
Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Test Case:
Online-only Devices:
Offline-capable Devices:
a
Applications shall not be displayed to the cardholder for confirmation.
Perform an ‘above Floor Limit’ transaction.
The Visa Credit application shall be selected for processing. The transaction should be completed online and be approved by the VCMS b
N/A
Applications shall not be displayed to the cardholder for confirmation. The Visa Credit application shall be selected for processing. The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. Applications shall not be displayed to the cardholder for confirmation. The Visa Credit application shall be selected for processing. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
38
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.5 Test Case 5: Card that returns additional Data in the Select PPSE Response and containing other unique features. Test Case 5/Test Card 5 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
5 Card that returns additional Data in the Select PPSE Response and containing other unique features. To ensure acceptance of a card that has the following features:
Returns additional data in the Select PPSE Response: Language Preference, Kernel ID, Issuer Identification Number, Issuer Country Code (alpha 2), and Extended Selection.
The incorrect AIP for MSD (91 81)
PVKI and PVV are not personalized in the Track 2 Equivalent Data (T2ED)
The card also features: of VSDC Applet Version: 2.7.1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 17) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 10 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card:
31 August 2017
This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. This test case is intended for readers which are not ing Extended Selection. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
5
Visa Confidential
39
Test Case Details Test Case 5: Card that returns additional Data in the Select PPSE Response and containing other unique features.
Test Case 5/Test Card 5 (Mandatory and both Online and Offline Applicable) Test Evidence to be Submitted:
☒Receipt (where possible)
Document Reference: Criteria/ Validation
Visa less Payment Specifications – Version 2.0.2 including published updates
Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
Online ODA not performed (ODA data not returned by the card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: iCVV verification is expected to fail since PVKI and PVV are not personalized in the Track 2 Equivalent Data.
40
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.6 Test Case 6: qVSDC-only card with 19-digit PAN and CVN 18 Test Case 6/Test Card 6 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
6 qVSDC-only card with 19-digit PAN and CVN 18 To ensure acceptance of a qVSDC-only card with 19-digit PAN and CVN 18. of VSDC Applet Version: 2.8.1F1 Dual Interface card o qVSDC s: Online without ODA (CVN = 18) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 18 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only No transaction – MSD not on the card MSD 2.x only No transaction – MSD not on the card qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
6 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
41
Test Case Details Test Case 6: qVSDC-only card with 19-digit PAN and CVN 18
Test Case 6/Test Card 6 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
42
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.7 Test Case 7: Online-only card with an Electron AID Test Case 7/Test Card 7 (Conditional and Online Applicable) Test Case Number: Test Case Name: Objective:
7 Online-only card with an Electron AID To ensure acceptance of an Online-only card with an Electron AID, if ed by the Reader. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Offline not ed o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Electron AID is ed) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. Reader s the Electron AID For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
☐
☒less
7 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
43
Test Case Details Test Case 7: Online-only card with an Electron AID
Test Case 7/Test Card 7 (Conditional and Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online regardless of the Reader less Floor Limit or Terminal Floor Limit and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
44
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.8 Test Case 8: Card with an Interlink AID Test Case 8/Test Card 8 (Conditional and Online Applicable) Test Case Number: Test Case Name: Objective:
8 Online-only card with an Interlink AID To ensure acceptance of a card with an Interlink AID, if ed by the Reader. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Offline not ed o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Interlink AID is ed) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. Reader s the Interlink AID For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
☐
☒less
8 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
45
Test Case Details Test Case 8: Card with an Interlink AID
Test Case 8/Test Card 8 (Conditional and Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
46
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.9 Test Case 9: VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively Test Case 9/Test Card 9 (Mandatory and Online Applicable) Test Case Number: Test Case Name: Objective:
9 VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively. To ensure acceptance of a card with the VMPA Applet and with “00” and “FF” Padding in the GPO and a Read Record Response respectively. of VMPA Applet Version: 1.4.1.5 (VMPA 1415 Core 12 121214 00.cap) Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) o VIS – not ed Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
This card is provided to validate acceptance of the Visa Mobile Payment Application – Version 1.4.1.5 and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
9 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
31 August 2017
☒less
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
For the Reader: Visa less Payment Specifications – Version 2.1 including published updates For the Card: Visa Mobile less Payment Specification (VMS) 1.4.1
Visa Confidential
47
Test Case Details Test Case 9: VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively
Test Case 9/Test Card 9 (Mandatory and Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
48
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.10 Test Case 10: Card with an IAD length of 23-bytes and an Unrecognized CVN Test Case 10/Test Card 10 (Mandatory and Online Applicable) Test Case Number: Test Case Name: Objective:
10 Card with an IAD length of 23-bytes and an Unrecognized CVN To ensure acceptance of a card with an IAD length of 23-bytes and an Unrecognized CVN.
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card:
31 August 2017
of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA, CVN = 77 (unrecognized) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 77 (unrecognized)
Please note: this card image is personalized to return 16 bytes of Issuer Discretionary Data (IDD), following the 7 bytes of Issuer Application Data (IAD). The IDD consists of the following: Byte 8 = length of IDD (0F) Byte 9 = option ID (03) Bytes 10 - 14 = VLP Available Funds (variable) Bytes 15 - 19 = CTTA (variable) Bytes 20 – 23 = MAC (variable) Mandatory in Regions where CDET use has been mandated This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
10
Visa Confidential
49
Test Case Details Test Case 10: Card with an IAD length of 23-bytes and an Unrecognized CVN
Test Case 10/Test Card 10 (Mandatory and Online Applicable) Test Evidence to be Submitted:
☒Receipt (where possible)
Document Reference: Criteria/ Validation
Visa less Payment Specifications – Version 2.1 including published updates
Note: A receipt may be scanned and submitted as a .pdf file.
☒Host Simulator Log (if
☒Card-to-Terminal Interaction Log (if available)
applicable)
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be declined by the VCMS as the CVN is unrecognized
Perform an ‘above Floor Limit’ transaction.
b c
N/A
The transaction should be completed online and be declined by the VCMS as the CVN is unrecognized N/A
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: Card Authentication Method (CAM) result will not be provided by Visa in the Field 44.8 due to CVN not ed by the VCMS.
50
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.11 Test Case 11: Card with a VMPA Applet that causes a Pre-tap Test Case 11/Test Card 11 (Mandatory and Applicable to both Online Only and Offline-capable devices) Test Case Number: Test Case Name: Objective:
11 Card with a VMPA Applet that causes a Pre-tap To ensure the Reader displays the correct response message and performs the correct behavior when presented with a card containing the VMPA Applet that causes a Pre-tap. of VMPA Applet Version: 1.4.1.5 (VMPA 1415 Core 12 121214 00.cap) Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) o VIS – not ed Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification:
Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card:
31 August 2017
Although a standard qVSDC transaction is typically completed with a single “tap” of the less payment card, the concept of a “Pre-Tap” is introduced for Mobile consumer devices. Pre-Tap is defined as the first presentation of the Mobile consumer device to the less payment reader in a situation where some consumer interaction is required to complete the transaction (e.g. consumer device CVM), and the cardholder has not completed that interaction prior to presenting the consumer device for payment. After the consumer interaction has been completed, the consumer device can be re-presented to the less payment reader to perform a “1st Tap” payment transaction. Although the VMPA applet is presented here in ID-1 card form, its intent is to emulate a consumer device that has experienced an exception condition (i.e. CDCVM is required but not performed). The intent of this test case is to ensure that the Reader displays the correct response message to this condition and performs the correct behavior. For Readers ing: Resulting Tx should be: MSD 1.4.2 only Pre-tap MSD 2.x only Pre-tap qVSDC only Pre-tap Both qVSDC and MSD 2.x Pre-tap ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
11
Visa Confidential
51
Test Case Details Test Case 11: Card with a VMPA Applet that causes a Pre-tap
Test Case 11/Test Card 11 (Mandatory and Applicable to both Online Only and Offline-capable devices) Test Evidence to be Submitted:
☒Receipt (where possible)
Document Reference:
Note: A receipt may be scanned and submitted as a .pdf file.
Criteria/ Validation
☒Card-to-Terminal Interaction Log (if available)
applicable)
For the Reader: Visa less Payment Specifications – Version 2.1 including published updates For the Card: Visa Mobile less Payment Specification (VMS) 1.4.1 Test Case:
Online-only Devices:
Offline-capable Devices:
a
The Reader should display a message to the cardholder instructing them to ‘refer to their payment device for further instructions’, briefly power down the less interface before returning to Discovery Processing.
The Reader regardless of the Reader less Floor Limit or the Terminal Floor Limit should display a message to the cardholder instructing them to ‘refer to their payment device for further instructions’, briefly power down the less interface before returning to Discovery Processing.
Test Case is considered successfully completed if the Reader displays the correct response message (like “Please refer to you mobile device”) and briefly power down the less interface before returning to Discovery Processing.
52
☐Host Simulator Log (if
b
N/A
c
N/A
Test Case is considered successfully completed if the Reader displays the correct response message (like “Please refer to you mobile device”) and briefly power down the less interface before returning to Discovery Processing. N/A
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.12 Test Case 12: Card with a CTQ indicating an issuer preference to switch to interface on ODA failure. Test Case 12/Test Card 12 (Conditional and Not Online Applicable) Test Case Number: Test Case Name: Objective:
12 Card with a CTQ indicating an issuer preference to switch to interface on ODA failure. To ensure correct Reader behavior for a card with a CTQ indicating an issuer preference to switch to interface on ODA failure. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Reader is dualinterface, Offline-capable and s ODA) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. Reader s Offline Data Authentication (ODA) For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV (but test case would not be executed) MSD 2.x only MSD CVN 17 (but test case would not be executed) qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC Reader s EMV chip ☒POS ☐ATM ☒MPOS ☒Transit Terminal
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
☒
☒less
12 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
53
Test Case Details Test Case 12: Card with a CTQ indicating an issuer preference to switch to interface on ODA failure.
Test Case 12/Test Card 12 (Conditional and Not Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
a
N/A
b
N/A
Offline-capable Devices: N/A Perform a ‘below Floor Limit’ transaction. The transaction is declined offline due to the ODA failure. The Reader shall indicate that a switch to the interface is required following the ODA failure (qVSDC only). is not required to submit chip transaction online. Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA fails
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA fails
Transit Gate access not permitted
Note: This test case does not applicable to devices ing ODA for Online Authorizations.
54
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.13 Test Case 13: Card that Declines Transactions Test Case 13/Test Card 13 (Mandatory and Not Online Applicable) Test Case Number: Test Case Name: Objective:
13 Card that Declines Transactions. To ensure terminal does not allow the transaction to be completed over another interface, with a card that declines Transactions. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Reader is dualinterface) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV (but test case would not be executed) MSD 2.x only MSD CVN 17 (but test case would not be executed) qVSDC only qVSDC decline Both qVSDC and MSD 2.x qVSDC decline
Regional Requirement: Business Justification: Pre-requisite:
Reader s EMV chip
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted:
☒POS
Document Reference:
Visa less Payment Specifications – Version 2.1 including published updates
31 August 2017
☒ATM
☒
☒MPOS
☒Transit Terminal
☒less
13 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
Visa Confidential
☐Host Simulator Log (if applicable)
55
Test Case Details Test Case 13: Card that Declines Transactions
Test Case 13/Test Card 13 (Mandatory and Not Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be declined Offline (qVSDC only).
Perform an ‘above Floor Limit’ transaction.
The Reader shall not indicate that a switch to the interface is required (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
b
N/A
The transaction should be declined Offline (qVSDC only). The Reader shall not indicate that a switch to the interface is required (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability Perform a ‘below Floor Limit’ transaction. The transaction should be declined Offline (qVSDC only). The Reader shall not indicate that a switch to the interface is required (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: transaction is subsequently Declined in Deferred Authorization (international transactions disallowed)
56
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.14 Test Case 14: Card with inconsistent Data Test Case 14/Test Card 14 (Conditional and Not Online Applicable) Test Case Number: Test Case Name: Objective:
14 Card having inconsistent data to force transaction termination by the terminal. To ensure correct Reader behavior for a card with inconsistent data, when Offline Data Authentication is being performed. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Reader is Offlinecapable and s ODA) To ensure compliance with VS 2.1 – Updates List 3 requirements.
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Reader s Offline transactions and an Offline transaction is attempted. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV (but test case would not be executed) MSD 2.x only MSD CVN 17 (but test case would not be executed) qVSDC only Transaction terminated Both qVSDC and MSD 2.x Transaction terminated ☒POS ☐ATM ☒MPOS ☒Transit Terminal
☐
☒less
14 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
57
Test Case Details Test Case 14: Card with inconsistent Data
Test Case 14/Test Card 14 (Conditional and Not Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
a
N/A
b
N/A
Offline-capable Devices: N/A Perform a ‘below Floor Limit’ transaction. The transaction should be terminated Offline due to inconsistent data (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: transaction is subsequently Declined in Deferred Authorization (data mismatch)
58
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.15 Test Case 15: Card ing qVSDC Online Transit SDA Test Case 15/Test Card 15 (Conditional on Transit Terminal ) Test Case Number: Test Case Name: Objective:
15 Card ing qVSDC Online Transit SDA. To ensure correct Reader behavior for a card ing qVSDC Online Transit SDA.
of VSDC Applet Version: 2.9
less only card: o
MSD not ed
o
qVSDC ed:
o Regional Requirement: Business Justification: Pre-requisite: Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Online without ODA (CVN = 10)
Online with ODA (Transit SDA)
VSDC () not ed
Conditional on the intended deployment on Transit terminals, in of regional Transit-related projects. To ensure compliance with VS 2.1 – Updates List 3 requirements. Reader s Online with ODA. ☐POS ☐ATM ☐MPOS ☒Transit Terminal ☐
☒less
15 ☐Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
59
Test Case Details Test Case 15: Card ing qVSDC Online Transit SDA
Test Case 15/Test Card 15 (Conditional on Transit Terminal ) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
N/A
N/A
b
N/A
N/A
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
60
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.16 Test Case 16: Online-only card using the 1536-bit CA key Test Case 16/Test Card 16 (Conditional on Transit Terminal ) Test Case Number: Test Case Name: Objective:
16 Card using the 1536-bit CA key To ensure correct Reader behavior for an Online-only card using the 1536-bit CA key.
of VSDC Applet Version: 2.8.1F1
less only card: o
MSD not ed
o
qVSDC ed:
o Regional Requirement: Business Justification: Pre-requisite: Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Online without ODA (CVN = 18)
Online with ODA (fDDA)
Offline with ODA (fDDA)
VSDC () not ed
Conditional on the intended deployment on Transit terminals, in of regional Transit-related projects. To ensure compliance with VS 2.1 – Updates List 3 requirements. Reader s Online with ODA. ☐POS ☐ATM ☐MPOS ☒Transit Terminal ☐
☒less
16 ☐Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
61
Test Case Details Test Case 16: Online-only card using the 1536-bit CA key
Test Case 16/Test Card 16 (Conditional on Transit Terminal ) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
N/A
N/A
b
N/A
N/A
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
62
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.17 Test Case 17: Card ing qVSDC Online Transit SDA, but SDA fails Test Case 17/Test Card 17 (Conditional on Transit Terminal ) Test Case Number: Test Case Name: Objective:
17 Card ing qVSDC Online Transit SDA, but SDA fails To ensure correct Reader behavior for an Online-only card when Transit SDA fails.
of VSDC Applet Version: 2.9
less only card: o
MSD not ed
o
qVSDC ed:
o Regional Requirement: Business Justification: Pre-requisite: Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Online without ODA (CVN = 10)
Online with ODA (Transit SDA)
VSDC () not ed
Conditional on the intended deployment on Transit terminals, in of regional Transit-related projects. To ensure compliance with VS 2.1 – Updates List 3 requirements. Reader s Online with ODA. ☐POS ☐ATM ☐MPOS ☒Transit Terminal ☐
☒less
17 ☐Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
63
Test Case Details Test Case 17: Card ing qVSDC Online Transit SDA, but SDA fails
Test Case 17/Test Card 17 (Conditional on Transit Terminal ) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
N/A
N/A
b
N/A
N/A
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
SDA fails
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
64
SDA fails
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
31 August 2017
Visa Confidential
65
Visa CA Test Public Key for qVSDC Offline and transit 1408 Bit VSDC TEST Key
A
Visa CA Test Public Key for qVSDC Offline and transit
For devices that Offline Data Authentication (ODA), this test key must be loaded into the terminal to the test cases associated with Offline Data Authentication. Note: An expiration date has not been defined for test CA Public Key, and it should not be assumed that a test key has the same expiry date as the live key of the same length. If your Terminal Management System requires expiry dates to be provided for CAPKs then please set the expiry date to 31 December 2025 for this test key. Important: Prior to deployment, this test key must be removed from the terminal and replaced with the Visa CA production keys.
A.1
1408 Bit VSDC TEST Key
This key is the Visa CA Public 1408-bit TEST key: Table A–1:
1408 Bit VSDC Test Key
Component
Value
ed Application Provider Identifier (RID) Index Modulus
A0 00 00 00 03
Exponent Secure Hash Algorithm-1 Hash Comments:
66
92 99 6A F5 6F 56 91 87 D0 92 93 C1 48 10 45 0E D8 EE 33 57 39 7B 18 A2 45 8E FA A9 2D A3 B6 DF 65 14 EC 06 01 95 31 8F D4 3B E9 B8 F0 CC 66 9E 3F 84 40 57 CB DD F8 BD A1 91 BB 64 47 3B C8 DC 9A 73 0D B8 F6 B4 ED E3 92 41 86 FF D9 B8 C7 73 57 89 C2 3A 36 BA 0B 8A F6 53 72 EB 57 EA 5D 89 E7 D1 4E 9C 7B 6B 55 74 60 F1 08 85 DA 16 AC 92 3F 15 AF 37 58 F0 F0 3E BD 3C 5C 2C 94 9C BA 30 6D B4 4E 6A 2C 07 6C 5F 67 E2 81 D7 EF 56 78 5D C4 D7 59 45 E4 91 F0 19 18 80 0A 9E 2D C6 6F 60 08 05 66 CE 0D AF 8D 17 EA D4 6A D8 E3 0A 24 7C 9F 03 42 9C 95 4A 38 59 CE F9 12 95 F6 63 C9 63 E5 82 ED 6E B2 53 The expiration date for certificates issued using Visa’s 1408-bit Test CA public key is December 31, 2019.
Visa Confidential
31 August 2017
Visa CA Test Public Key for qVSDC Offline and transit
less Device Evaluation Toolkit - Guide (Version 2.3)
A.2 1536 Bit VSDC TEST Key This key is the Visa CA Public 1536-bit TEST key: Table A–2: 1536 Bit VSDC Test Key Component
Value
ed Application Provider Identifier (RID) Index Modulus
A0 00 00 00 03
Exponent Secure Hash Algorithm-1 Hash Comments:
31 August 2017
89 E5 E1 95 70 5C E6 1A 06 72 B8 36 7E 7A 51 71 39 27 A0 42 89 EA 30 83 28 FA D2 80 71 EC EA E8 89 B3 C4 F2 9A C3 BD E4 67 72 B0 0D 42 FD 05 F2 72 28 82 0F 26 93 99 0F 81 B0 F6 92 8E 24 0D 95 7E C4 48 43 54 CD 5E 5C A9 09 2B 44 47 41 A0 39 4D 34 76 65 12 32 47 4A 9B 87 A9 61 DA 8D D9 6D 90 F0 36 E9 B3 C5 2F B0 97 66 BD A4 D6 BC 3B DA DB C8 91 22 B7 40 68 F8 FA 04 02 6C 5F A8 EF 39 8B C3 AB 39 92 A8 7F 6A 78 5C C7 79 BA 99 F1 70 95 66 23 D6 7A 18 EB 83 24 26 3D 62 6B E8 5B FF 77 B8 B9 81 C0 A3 F7 84 9C 4F 3D 8E 20 54 29 55 D1 91 28 19 85 47 B4 7A E3 4D F6 7F 28 BE 43 3F 33 03 71 70 85 0B 97 F8 39 52 04 5C F9 CA 8B 76 12 DF EB 69 E9 EF The expiration date for certificates issued using Visa’s 1536-bit Test CA public key is December 31, 2023.
Visa Confidential
67
Visa CA Test Public Key for qVSDC Offline and transit 1536 Bit VSDC TEST Key
68
Visa Confidential
31 August 2017
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3)
B
Acronyms and Glossary
This appendix provides a list of acronyms used in this document and in EMV as well as a glossary of . Table B–1:
Acronyms
Acronym
Meaning
a AAC AAR ADA ADF ADVT AEF AFL AID AIP an ans APDU API ARPC ARQC ATC ATM AUC b BIN CA CAM CAT CDA CDOL CID cn CSV CVK CVM CVR CVV DDA DDF DDOL
alpha Application Authentication Cryptogram Application Authentication Referral Application Default Action Application Definition File Acquirer Device Validation Toolkit Application Elementary File Application File Locator Application Identifier Application Interchange Profile alphanumeric alphanumeric special Application Protocol Data Unit Application Priority Identifier Application Response Cryptogram Application Request Cryptogram Application Transaction Counter Automated Teller Machine Application Usage Control binary Bank Identification Number Certificate Authority Card Authentication Method Cardholder Activated Device Combined Dynamic Data Authentication Card Risk Management Data Object List Cryptogram Information Data compressed numeric Comma-Separated Values Card Verification Key Cardholder Verification Method Card Verification Result Card Verification Value Dynamic Data Authentication Directory Definition File Dynamic Data Authentication Data Object List
31 August 2017
Visa Confidential
69
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3)
70
Acronym
Meaning
DEA DES DGI DKI EMV FCI GPO hex. IAC ICVV IFM KFT L3TG MCC MDK MPOS MTT N/A n PAN PDOL PIN PIX PK PKI PKI POS PSE PSTN PVK PVV RFU RID RSA RRN SAD SAM SDA STIP TAC TC TDOL TITF
Data Encryption Algorithm Data Encryption Standard Data Group Identifier (used by the Card Personalizer only) Derivation Key Index Europay, MasterCard & Visa File Control Information Get Processing Options Hexadecimal Issuer Action Code Alternate Card Verification Value Interface Module Known Fare Transaction Level 3 Testing Group Merchant Category Code Master Derivation Key Mobile Point of Sale Device Mass Transit Transaction Not Applicable numeric Primary Number Processing Options Data Object List Personal Identification Number Proprietary Application Identifier Extension Public Key Public Key Infrastructure Public Key Index Point of Sale Payment Systems Environment Public Switched Telephone Network PIN Verification Key PIN Verification Value Reserved For Future Use ed Application Provider Identifier Rivest, Shamir, Adleman Retrieval Reference Number Signed Static Application Data Secure Access Module Static Data Authentication Stand-In Processing Terminal Action Code Transaction Certificate Transaction Certificate Data Object List Terminal Integration Task Force
Visa Confidential
31 August 2017
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Acronym
Meaning
TLV TSI TVR UAT UCAT UDK var. VCMS VIP VLP VMTS VSDC VTS XML XSD
Tag-Length-Value Transaction Status Information Terminal Verification Result Unattended Acceptance Device Unattended Cardholder Acceptance Device Unique Derived Key variable Visa Certification Management Service VisaNet Integrated Payment Visa Low-value Payment Visa Member Test System Visa Smart Debit/Credit VisaNet Test System Extensible Mark-up Language XML Schema Definition
Table B–2: Glossary Term
Application Protocol Data Unit (APDU Automated Teller Machine (ATM) Card Acceptor Terminal Card/Terminal Log Card/Terminal Log Validation Cardholder Activated Device Certification
Chip-Capable Chip-Enabled
Definition
The communication format used between the chip card and the payment application on a card acceptance device. This format is defined in ISO specification 7816. An unattended device that has electronic capability to send transactions online for authorization, accepts PINs, and disburses currency. See “Terminal.” A capture of the interaction between the card/card simulator and the device. Typically provided in Application Protocol Data Unit (APDU) format. A Test Plan-defined description of the requirements for elements and content of the card/terminal log to be validated during terminal integration testing. An unattended device, such as an automated dispensing machine, self-service device, or limited amount device that is not an ATM. Validation that the format, function, and content of authorization messages executed from a defined test plan adheres to a provided specification and set of business rules. A transaction acceptance device that is designed and constructed to facilitate the addition of a chip reader/writer. For chip cards, this describes the state in which the card has already been personalized with both cardholder and Brand-specific data in preparation for use. For terminals, this describes the state in which the terminal has already been equipped with a chip reader/writer and has been configured with Brand-specific data and is ready for use in accepting chip cards.
31 August 2017
Visa Confidential
71
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Term
Comma-Separated Values (CSV)
Transaction less Transaction Customer Activated Terminal (CAT) EMVCo LLC (EMVCo)
EMV Specifications
Floor Limit Host Authorization Message Host Authorization Message Validation Implement Interoperability Kernel
Known Fare Transaction (KFT) Level 3 Testing Group
Limited Amount Device Mass Transit Transaction (MTT)
72
Definition
A format that stores tabular data (numbers and text) in plain-text form (i.e. a sequence of characters, with no data that has to be interpreted instead, as binary numbers). A CSV file consists of any number of records, separated by line breaks of some kind; each record consists of fields, separated by some other character or string, most commonly a literal comma or tab. Usually, all records have an identical sequence of fields. An interaction between a chip application and a device using the physical electrical interface, as defined in [EMV Book 1]. An interaction between a chip application and a device using the radio frequency wireless interface, as defined in [EMV CL]. See “Cardholder Activated Device.” Industry organization that manages, maintains, and enhances the EMV Specifications. Current are American Express, JCB International, MasterCard Worldwide, UnionPay, and Visa Inc. Technical specifications developed and maintained by EMVCo to create standards and ensure global interoperability for use of chip technology in the payment industry. In order to EMV, cards and terminals must also meet the requirements described in the bulletins available on the EMVCo website. A currency amount that Visa has established for single transactions at specific types of merchants, above which online authorization is required. A description of the transaction message initiated from the device and sent online via the acquirer and network to the issuer, processor, or Brand for transaction authorization. A Test Plan-defined description of the requirements for elements and content of the Host Authorization Message to be validated during standalone or terminal integration testing. To make a card, application, or device capable of performing a functionality. Functionality that is implemented may also need to be enabled (see Chip-enabled). The ability of all card acceptance devices to accept and read all chip cards that are properly coded and personalized. EMV definition for the set of functions required to be present on every terminal implementing a specific interpreter. The kernel contains device drivers, interface routines, security and control functions, and the software for translating from the virtual machine language to the language used by the real machine. In other words, the kernel is the implementation of the virtual machine on the real machine. Transit implementation in which a less payment is made at the point of entry to the transit network, using a less payment card. EMVCo testing group into which the Terminal Integration Task Force (TITF) evolved in January 2017. Responsible for managing all aspects of the Level 3 testing initiatives and processes. An unattended device that has data capture-only capability, and accepts payment for items such as parking garage fees, road tolls, etc. Transit implementation in which a less card to be used subsequently to pay for the travel, is authenticated at the point of entry to the transit network.
Visa Confidential
31 August 2017
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Term
Mobile Point of Sale (MPOS) Offline-Capable Offline-Only Online-Capable Online-Only PAN Key Entry Criteria Criteria File Personalization Point of Sale Point-of-Sale Device Reader less Floor Limit Terminal
Terminal Configuration Terminal Floor Limit
Terminal Integration Testing
Terminal Integration Task Force (TITF)
Test Card Image Test Case
31 August 2017
Definition
A smartphone, tablet, or dedicated wireless device that performs the functions of a cash or electronic point of sale terminal (POS terminal). A transaction acceptance device that has the ability to process the transaction offline for card authentication and authorizations. A transaction acceptance device that is only able to process the transaction offline for card authentication and authorizations. A transaction acceptance device that is able to send transactions to the issuer or processor for authorizations. A transaction acceptance device that requires that all transactions be sent online for authorization. A manual procedure in which the merchant uses a device key pad to enter the PAN embossed on a card in order to process a transaction. A Test Plan-defined field that describes an expected result for a successful outcome or conclusion of a test case. The file (in CSV format) that embeds the Brand-defined criteria for each test case. For chip cards, the process of applying both cardholder and Brand-specific data to the card in preparation for its use. The physical location where a merchant or acquirer in a face-to-face environment or an unattended device completes a transaction. A device used at the POS to process transactions, including chip devices, automated dispensing machines, self-service devices, and ATMs. Indicates the less floor limit of the reader for Visa applications. If the transaction amount is greater than the Reader less Floor Limit, then the reader requires online processing for the transaction. The device used in conjunction with the chip card at the point of transaction to perform a financial transaction. The terminal incorporates the interface device and may also include other components and interfaces such as host communications. A description of the features and parameters on the acceptance device under test. For example, it might include the EMV-defined terminal types, ed interfaces, etc. Indicates the floor limit in the terminal. Terminal compares Amount, Authorized with the applicable Terminal Floor Limit if the Reader less Floor Limit is not present. A process implemented and managed by the respective Brands, aimed at providing a level of assurance that Brand-specific requirements and recommendations are being implemented in or less chip acceptance devices that will accept a Brand’s products. Task Force established by EMVCo in 2013 with the purpose of examining each of the Brand’s terminal integration processes, in order to determine the possibilities of aligning key elements of these processes. The TITF was renamed the Level 3 Testing Group (L3TG) in January 2017 An electronic representation of a physical card. A Test Plan-defined description of a test scenario, defined by a Payment Brand for execution of terminal integration or host message testing.
Visa Confidential
73
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Term
Test Case Name Test Case Number Test Case Objective Test Plan
Test Procedure Test Tool Confirmation
Test Tool Qualification
Transaction Completion Transit Terminal
Unattended Cardholder Activated Terminal (UCAT) Validation Extensible Mark-up Language (XML)
74
Definition
A Test Plan-defined description of the name associated with a specific test case. A Test Plan-defined unique test case identifier. A Test Plan-defined description of the objective of performing a given test case. A Brand-developed and managed set of test criteria that defines the requirement for terminal integration or host message testing. This may either take the form of a textual document or a machine-readable file. A Test Plan-defined description of the steps required in order to execute a specific test case. The process undertaken by each Brand to provide themselves, tool vendors, and clients will a level of assurance that the tools being used by clients to execute terminal integration testing will do so in compliance with Brand requirements. Process is also referred to as “Test Tool Qualification.” The process undertaken by each Brand to provide themselves, tool vendors, and clients will a level of assurance that the tools being used by clients to execute terminal integration testing will do so in compliance with Brand requirements. Process is also referred to as “Test Tool Confirmation.” An EMV definition for the successful closing of transaction processing. The completion function is always the last function in transaction processing and must occur unless the transaction is terminated prematurely by error processing. Refers to the combination of equipment at the entrance to a transit network (for example, a metro gate) or vehicle (for example, a bus) that is collectively used to accept Visa less cards for transit network access. This equipment may be a single integrated piece of equipment or a number of separate physical components (for example, bus ticket machine, display and reader) that together form the card acceptance device. A cardholder-operated device that reads, captures, and transmits card information in an unattended environment. Also known as “Customer Activated Terminal (CAT)” or “Unattended Acceptance Device (UAT).” A Test Plan-defined description of the requirements for the /tester to validate responses from the device under test. A mark-up language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable.
Visa Confidential
31 August 2017
31 August 2017
Important Information on Confidentiality and Copyright © 2004 - 2017 Visa. All Rights Reserved. Notice: This information is proprietary and CONFIDENTIAL to Visa. It is distributed to Visa participants for use exclusively in managing their Visa programs. It must not be duplicated, published, distributed or disclosed, in whole or in part, to merchants, cardholders or any other person without prior written permission from Visa. The trademarks, logos, trade names and service marks, whether ed or uned (collectively the “Trademarks”) are Trademarks owned by Visa. All other trademarks not attributed to Visa are the property of their respective owners.
Note: This document is not part of the Visa Rules. In the event of any conflict between any content in this document, any document referenced herein, any exhibit to this document, or any communications concerning this document, and any content in the Visa Rules, the Visa Rules shall govern and control.
Contents
less Device Evaluation Toolkit - Guide (Version 2.3)
Contents 1
less Device Evaluation Toolkit (CDET) Guide Introduction................................................ 6 1.1 Introduction ...................................................................................................................................................................... 6 1.2 Information ...................................................................................................................................................... 7 1.2.1
General Information and ..................................................................................................................... 7
1.2.2
Obtaining Toolkits .................................................................................................................................................. 7
1.3 Summary of Changes Introduced in this Version ............................................................................................... 7 1.4 CDET Documentation .................................................................................................................................. 8 1.5 Disclaimer .......................................................................................................................................................................... 9 2
less Device Evaluation Toolkit - Guide Overview ................................................................ 10 2.1 Objective .......................................................................................................................................................................... 10 2.1.1
Visa less Transit Terminal Testing ................................................................................................... 10
2.2 Audience .......................................................................................................................................................................... 11 2.3 Document Organization............................................................................................................................................. 11 2.4 CDET Components ....................................................................................................................................................... 13 2.5 Related Documents ..................................................................................................................................................... 13 2.6 CDET Usage .................................................................................................................................................................... 13 2.6.1
CDET Usage Guidelines....................................................................................................................................... 14
2.7 New CDET Versions ..................................................................................................................................................... 15 2.8 Scope of CDET Testing ............................................................................................................................................... 15 2.9 EMVCo Level 3 Framework Compliance .............................................................................................................. 16 2.9.1 3
Provision of CDET Test Card Images to Test Tool Vendors .................................................................. 16
Test Case Introduction ....................................................................................................................................... 18 3.1 Pre-requisites ................................................................................................................................................................. 18 3.1.1
Reader Capabilities ............................................................................................................................................... 18
3.1.2
Visa CA Test Public Keys ..................................................................................................................................... 18
3.1.3
Configured for Operational Use ...................................................................................................................... 19
3.1.4
Testing and Approval .......................................................................................................................................... 19
3.2 Instructions...................................................................................................................................................................... 19
31 August 2017
Visa Confidential
i
Contents
less Device Evaluation Toolkit - Guide (Version 2.3) 3.2.1
Self-istered Tool ....................................................................................................................................... 19
3.2.2
Initially Deployed Readers ................................................................................................................................. 19
3.2.3
Previously Deployed Readers ........................................................................................................................... 19
3.2.4
Changes to Reader ............................................................................................................................................... 19
3.2.5
Decline Responses vs. Other Errors ................................................................................................................ 20
3.2.6
Test Cards and Test Cases ................................................................................................................................. 20
3.2.7
Online Testing ........................................................................................................................................................ 20
3.2.8
Compliance Reporting ........................................................................................................................................ 21
3.3 Test Case Summary...................................................................................................................................................... 23 3.4 Recommendations and Test Cases Applicability .............................................................................................. 27 3.4.1 4
Applicability to Transit Terminals: ................................................................................................................... 27
Test Case Details ................................................................................................................................................. 29 4.1 Test Case 1: VS 2.0.2 Baseline Card .................................................................................................................. 31 4.2 Test Case 2: VS 2.1.x Baseline Card................................................................................................................... 33 4.3 Test Case 3: Card with a 16-byte ADF Name and other Features .............................................................. 35 4.4 Test Case 4: Card with additional Data in the GPO Response and with no Cardholder Name ...... 37 4.5 Test Case 5: Card that returns additional Data in the Select PPSE Response and containing other unique features. ....................................................................................................................................................................... 39 4.6 Test Case 6: qVSDC-only card with 19-digit PAN and CVN 18 ................................................................... 41 4.7 Test Case 7: Online-only card with an Electron AID ........................................................................................ 43 4.8 Test Case 8: Card with an Interlink AID ................................................................................................................ 45 4.9 Test Case 9: VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively .......................................................................................................................................................... 47 4.10 Test Case 10: Card with an IAD length of 23-bytes and an Unrecognized CVN .................................. 49 4.11 Test Case 11: Card with a VMPA Applet that causes a Pre-tap................................................................... 51 4.12 Test Case 12: Card with a CTQ indicating an issuer preference to switch to interface on ODA failure. ............................................................................................................................................................................... 53 4.13 Test Case 13: Card that Declines Transactions .................................................................................................. 55 4.14 Test Case 14: Card with inconsistent Data .......................................................................................................... 57 4.15 Test Case 15: Card ing qVSDC Online Transit SDA .......................................................................... 59 4.16 Test Case 16: Online-only card using the 1536-bit CA key .......................................................................... 61
ii
Visa Confidential
31 August 2017
Contents
less Device Evaluation Toolkit - Guide (Version 2.3) 4.17 Test Case 17: Card ing qVSDC Online Transit SDA, but SDA fails .............................................. 63 A
Visa CA Test Public Key for qVSDC Offline .................................................................................................. 66 A.1 1408 Bit VSDC TEST Key ............................................................................................................................................. 66 A.2 1536 Bit VSDC TEST Key ............................................................................................................................................. 67
B
Acronyms and Glossary..................................................................................................................................... 69
31 August 2017
Visa Confidential
iii
Tables
less Device Evaluation Toolkit - Guide (Version 2.3)
Tables Table 1:
CDET Documentation ......................................................................................................... 8
Table 1–1:
Document Organization .................................................................................................................... 11
Table 1–2:
Scope of CDET Testing ...................................................................................................................... 15
Table 2–1:
Test Case Summary ........................................................................................................................... 23
Table A–1:
1408 Bit VSDC Test Key .................................................................................................................... 67
Table B–1:
Acronyms ............................................................................................................................................. 69
Table B–2:
Glossary ................................................................................................................................................. 71
iv
Visa Confidential
31 August 2017
Tables
less Device Evaluation Toolkit - Guide (Version 2.3)
31 August 2017
Visa Confidential
v
less Device Evaluation Toolkit (CDET) Guide Introduction Introduction
1 less Device Evaluation Toolkit (CDET) Guide Introduction This chapter provides the following information:
Introduction to the less Device Evaluation Toolkit (CDET) Guide
Information
Summary of changes introduced in this version
CDET Documentation
Disclaimer
1.1 Introduction The Visa less Payment Specification (VS) was developed as a platform to globally interoperable less chip programs. It facilitates the creation of payment technologies that provide Visa less issuing clients with the flexibility to customize their less chip programs to meet local market needs while gaining the benefits of global interoperability. The specification also provides additional security options and enables enhanced performance for faster transaction processing. To ensure that Visa less acceptance devices deployed by acquiring clients do not contribute to interoperability issues, Visa has developed the Visa less Device Evaluation Toolkit (CDET) - a set of test card images, an accompanying guide (“this document”) and a card profile definitions document. CDET is designed to allow Visa less acquiring clients and their technical providers to validate correct configuration of their Visa less acceptance devices. The Toolkit may also be used to assist Visa less reader developers and systems integrators with development and Level 3 integration testing and to ensure that Visa requirements for card acceptance devices are being met. Oftentimes, cards issued in one country or region may experience acceptance problems when used in other countries and regions, even though both the card and reader were fully tested and approved by the payment scheme’s accredited testing laboratory. These issues may be the result of incorrect device configuration, inadequate Level 3 integration testing or misunderstandings about payment scheme’s rules and requirements. In addition to ensuring Visa less card acceptance globally, the CDET also enables interface testing of payment terminals. This step is necessary to confirm that correct prompts, error messages, application selection menus and PIN Entry messaging are being appropriately applied and readily comprehensible to the cardholder and merchant.
6
Visa Confidential
31 August 2017
less Device Evaluation Toolkit (CDET) Guide Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
1.2 Information 1.2.1 General Information and s of the CDET that require general information on the tool or with needs should Visa at [email protected].
1.2.2 Obtaining Toolkits Toolkits ing the latest CDET test cases may be obtained by ing the third-party test tool suppliers directly. Visa publishes an ongoing list of confirmed suppliers that both the card and host simulation of the CDET. This list is available by visiting the following link: https://technologypartner.visa.com/Toolkits/#orderlist In a Visa Business News article published on 6 August 2016, Visa announced the release of a new Android-based mobile app, as an alternative and convenient option for performing the latest CDET testing requirements. An updated version of the Visa Mobile CDET App ing CDET Version 2.3 requirements can be ed from the Google Play Store. Please note: since the release of the Visa Mobile CDET app, physical test cards for CDET are no longer available from the Visa fulfillment service (XPressDocs).
1.3 Summary of Changes Introduced in this Version This section provides an overview of the changes made in this document since its last publication. Section
Change
Description
Section 3.3 & Section 4
Removal
Section 4.2
Update
Converted Test Case # 2 to CVN = ‘22’ and less manual cash transactions
Section 4.10
Update
Note added to ‘Objective’ section to explain the composition of the Issuer Discretion Data (IDD)
31 August 2017
Test Case # 9 removed, and Test Cases 10, 11, 12, 13, 14 & 15 renumbered (decremented by 1)
Visa Confidential
7
less Device Evaluation Toolkit (CDET) Guide Introduction CDET Documentation
Section
Change
Description
Section 3.3: Test Case Summary
Addition
Additional test cases introduced, in of Visa less Transit Terminal testing:
Section 4: Test Case Details
Addition
Test Case #15: ing quick Visa Smart Debit / Credit (qVSDC) Online Transit SDA.
Test Case #16: Online-only card using the 1536-bit CA key.
Test Case #17: ing qVSDC Online Transit SDA with a failure of SDA
New test cases 15, 16 & 17 added
Criteria/ Validation of existing test cases updated to Transit Terminal testing
1.4 CDET Documentation CDET documentation now consists of two documents: a Card Profiles document and a Guide (this document). Table 1:
CDET Documentation
Document Name Visa less Device Evaluation Toolkit (CDET) Guide (This Document)
Visa less Device Evaluation Toolkit (CDET) Card Profiles
8
Description This document provides:
An overview of the CDET including a description of the components and usage criteria
Test cases
Appendices providing details of the Visa CA test key, Acronyms and a Glossary.
This document provides the details required to personalize each of the CDET test cards.
Visa Confidential
Audience This document is primarily intended for s of the CDET, including acquirers, processors, merchants, and third party service providers on behalf of acquirers.
This document is intended for personalization bureaus and chip tool vendors responsible for developing CDET test cards or simulated/scripted equivalents.
31 August 2017
less Device Evaluation Toolkit (CDET) Guide Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
1.5 Disclaimer The Visa less Device Evaluation Toolkit provides a means for a Visa less acquiring client (or agent) implementing a less chip program to test its card acceptance device prior to deployment. The Visa less Device Evaluation Toolkit described herein includes test card images, a Guide and a Card Profiles document, specifically for use with Visa less readers that are compliant to the Visa less Payment Specifications (VS). The Toolkit is designed to assist Visa less acquiring clients and their merchants perform tests that help to minimize card acceptance problems. Systems Integrators and Visa less device vendors can also benefit from the use of the Toolkit, as it provides a tool to assist them during development or integration of VS-compliant readers. The tests prescribed in the guide do not supersede the requirement for readers to undergo type approval testing at a Visa accredited laboratory. Visa reserves the right to add or remove tests and test requirements in the Toolkit at any time and in its sole discretion. Visa does not warrant the Toolkit or any Toolkit test results for any purpose whatsoever, and expressly disclaims any and all warranties of merchantability, fitness for purposes, or non-infringement of third party intellectual property rights. No vendor or other third party may refer to a product, service or facility as “Visa-approved”, nor otherwise state or imply that Visa has, in whole or part, approved any aspect of a vendor or its products, services or facilities, except to the extent and subject to the and restrictions expressly set forth in a written agreement with Visa or in an approval letter provided by Visa. All other references to “Visa approval” are strictly prohibited by Visa. All references to Visa operating regulations in this document are deemed to be references to both Visa International Operating Regulations and/or Visa Europe Operating Regulations, as appropriate.
31 August 2017
Visa Confidential
9
less Device Evaluation Toolkit - Guide Overview Objective
2 less Device Evaluation Toolkit - Guide Overview This section provides an overview of the less Device Evaluation Toolkit (CDET) Guide (this document).
2.1 Objective The objective of this document and its corresponding test cases is to provide Visa less acquiring clients, merchants, system integrators and vendors with a Toolkit to confirm that their reader can accept Visa less cards during the reader development, deployment and update stages of the program.
2.1.1 Visa less Transit Terminal Testin g With the recent definition of requirements, general guidance and recommendations for the deployment of Visa less acceptance devices on transit systems, this document will assist transit agencies and equipment vendors with the testing of systems, developed to accept Visa less payment transactions directly at the point of entry to their transit networks. These include systems where the fare is known at the point of entry (‘Known Fare Transaction’) and those where the amount to be paid is determined after the travel has taken place (‘Mass Transit Transaction). Important This document assumes that Offline Data Authentication will be the method used to allow access to the transit network; that is, the ODA data provided by the card must be positively authenticated by the transit terminal before the consumer is allowed to travel. Important The test cases within this document are only relevant to transit readers operating one of the following implementations:
Known Fare Transaction (KFT): an implementation in which a less payment is made at the point of entry to the transit network (for example, at a bus ticket machine, where the fare amount is typically known)
Mass Transit Transaction (MTT): an implementation in which a less card to be used subsequently to pay for the travel is authenticated at point of entry to the transit network).
Note: Kiosks and ticket machines operating in a retail mode at which a transit ticket may be purchased using a less / card for subsequent presentation and entry to the transit network are not in scope.
10
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
2.2 Audience The audience for this Toolkit consists primarily of:
Visa less acquiring clients - deploying readers in of Visa less acceptance programs.
Visa less merchants – working with Visa less acquiring clients to deploying readers in of Visa less card acceptance.
System Integrators - working on behalf of acquiring clients or merchants in the deployment of readers in of Visa less acceptance programs.
Note: In some areas, integrators are also referred to as Value-added Resellers (VARs).
Reader vendors - developing VS-compliant reader in of Visa less acceptance programs.
This document should not be shared with or distributed to any other parties.
2.3 Document Organization This document contains the following chapters: Table 2–1:
Document Organization
Chapter
Description
1 - CDET Guide Introduction
This chapter provides background information on this CDET Guide. It also includes:
31 August 2017
Introduction to the less Device Evaluation Toolkit (CDET) Guide Information CDET Documentation Disclaimer
Visa Confidential
11
less Device Evaluation Toolkit - Guide Overview Document Organization Chapter
Description
2 - CDET Guide Overview
This chapter provides the following information: Details on the objectives of the document The audience to which the document applies A description of how the document is organized A description of the CDET components List of Related Documents CDET usage criteria Policy with respect to the introduction of new versions Scope of CDET testing Comments on future enhancements Relevance to the EMVCo Terminal Integration Taskforce Framework
3 - Test Case Introduction
4 - Test Case Details
12
This chapter introduces the CDET test cases. It includes pre-requisite information for testing, including instructions for each test case and a summary of all test cases included in this version of the toolkit. This chapter outlines each CDET test case, providing details on:
Test Case Number
Test Case Name
Objective
Regional Requirement
Business Justification
Pre-requisite
Applicable Terminal Device Type
Applicable Terminal Interface
Test Card used
Test Evidence to be submitted
Document Reference
Criteria/ Validation
A - Visa CA Test Public Key for qVSDC Offline
Provides the value of the currently active 1408-bitsand 1536-bits Visa CA Test Public Key, used for Offline Data Authentication.
B - Acronyms and Glossary
Provide a list of commonly used Acronyms and a Glossary of commonly used .
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
2.4 CDET Components The CDET consists of:
Test Card Simulators—Card Simulators containing images with specific settings that are intended to identify incorrectly coded or configured chip card acceptance devices.
Documentation—Two documents:
-
CDET Card Profiles Definitions (Separate Document)—A document that outlines the card personalization requirements for each test card that can be used by card personalization bureaus and card simulator vendors to personalize the physical test cards or to develop simulated test card scripts.
-
CDET ’s Guide (This Document)—A document that outlines each test case, a description of the test card to be used with each test case, and the expected test results. This document is used by the acquirer or acquirer’s agent to perform testing.
XML Test Card Images—Machine-readable representation of the CDET test card personalization images and behaviors, in accordance with the EMVCo Level 3 format.
2.5 Related Documents This section lists documents that may be read and/or referred to in conjunction with this document:
Visa less Payment Specifications, (latest version)
Visa International Operating Regulations (latest version)
Visa Europe Operating Regulations (latest version)
Transaction Acceptance Device Requirements (TADR)—Requirements (latest version)
Transaction Acceptance Device Guide (TADG)—Requirements and Best Practices (latest version)
2.6 CDET Usage CDET should be utilized to ensure that Visa less readers being deployed have been correctly configured. It is expected that each applicable test case will be performed to gain the full benefits of the Toolkit. If a CDET test result does not meet the expected outcome of the test, it is anticipated that the acquirer will work with their reader supplier or system integrator to resolve the issue. The acquirer must continue to work with their technical service provider until the issue is resolved and the result complies with the expected outcome. The following guidelines are intended to provide specific use cases that may govern the use of CDET. Note that this list is not exhaustive. If a situation arises that is not currently listed, the Acquirer should their Visa representative for guidance.
31 August 2017
Visa Confidential
13
less Device Evaluation Toolkit - Guide Overview CDET Usage
2.6.1 CDET Usage Guidelines In regions where the use of CDET has been mandated, it must always be used in the following cases. Where CDET’s use remains optional, it is strongly recommended to be used in these cases:
Prior to deployment of a new Visa less reader for a new or existing Visa less program
Following significant software of hardware modification or reconfiguration of an existing Visa less Reader. This includes but is not limited to changes to the following:
o
The approved Kernel
o
The payment component of the terminal application, affecting Visa less processing
o
The Cardholder Verification Method (CVM) capabilities
o o o
Language The telecommunications method (e.g. upgrade from dial-up to high-speed) ed Currency Code/Country Code
Introduction of a new model of device hardware.
Note: It is possible to have “families” of devices, which are identical from a payment’s perspective. Here a new “model” is taken to mean a change, which may affect card acceptance. This includes the interface presented to either the cardholder or merchant.
Changes to a merchant or acquirer’s network infrastructure. For example, in a case where a merchant has switched acquirers, even though their terminal configuration might remain the same.
A strong suspicion by Visa or other stakeholders of the presence of an acceptance or interoperability problem affecting the Visa less acceptance device or its connectivity to VisaNet.
Following upgrades or modifications to the reader to terminal interface or acquirer host systems, which could affect the transmission of chip data.
Addition of a new peripheral device requiring changes to the existing code, e.g. a new printer or cash dispenser module.
Change to the terminal-to-host protocol, which does affect authorization messages.
14
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
2.7 New CDET Versions The less Device Evaluation Toolkit may be expanded in the future to include additional device and/or online transaction processing tests. On release of a new version of the Toolkit, a six-month grace period will be granted to s prior the requirement to the latest version. During this grace period, testing will still be allowed with the CDET version just prior to the new release. However, on expiration of the grace period, s will be required to the latest version. In cases where CDET use is mandated, results from earlier versions of the Toolkit will no longer be accepted.
2.8 Scope of CDET Testing Device vendors are also recommended to use the Toolkit during the reader development phase. This will help to ensure that these devices are capable of accepting a selection of diversely configured Visa less cards. Table 2–2: Scope of CDET Testing
Within Scope
Outside of Scope
Explanation
Device testing
Acquirer host certification
The Toolkit focuses on helping to ensure devices deployed in the field are configured in a way that promotes the best potential for acceptance of Visa less cards. While some of the cards in this Toolkit are to be used for online testing, this Toolkit is not specifically designated as a host certification Toolkit. Acquirers will continue to perform host system certification using the current set of test cards and scripts. Please see your Visa regional representative to obtain the test kit for acquirer host testing.
Complement to Visa/EMV Level 2 device testing
31 August 2017
Replacement of Visa/EMV Level 2 device testing
It is assumed that acquirer and/or device vendor will perform these tests on devices that have already ed EMV Level 1 testing and Visa/EMV Level 2 testing. These tests will complement Visa/EMV testing to ensure that devices have been configured correctly prior to deployment.
Visa Confidential
15
less Device Evaluation Toolkit - Guide Overview EMVCo Level 3 Framework Compliance
2.9 EMVCo Level 3 Framework Compliance Visa, along with the five other EMVCo member Payment Networks, embarked on a series of Level 3 process alignment initiatives that started back in September 2013. Under the leadership of the EMVCo Level 3 Testing Group (L3TG), various payment networks’ testing processes for the integration of EMV and less acceptance devices are currently being standardized. Recent L3TG efforts have led to the publication of the EMV Level 3 Testing Framework – Process Enhancements and the EMV Level 3 Testing Framework – Implementation Guidelines definition documents, both of which collectively define standardized methods for L3 test tool development, qualification and usage. The main impacts of these initiatives on Visa’s CDET processes will be on:
The standardized format in which the CDET Test Cases are being provided to Level 3 test tool suppliers
The L3 Card Simulator used by clients to perform CDET testing – these tools are being enhanced with a standardized L3 platform, as defined by EMVCo. This approach enables the standardized: -
Provision of Payment Networks’ test requirements in a machine-readable format
-
Presentation of an L3 Test Selection Engine (TSE) where clients define their EMV terminal configuration details. This in turn enables the Card Simulator to systematically determine and present the applicable test cases for execution
-
Determination of the L3 /Fail Results in an automated way, following test case execution, and subsequently the reporting of those results in a standardized format along with the ing Transaction Logs.
For more information on EMVCo’s L3TG efforts, or to any of the relevant documentation, please visit the EMVCo website at the following link: http://www.emvco.com/approvals.aspx?id=272
2.9.1 Provision of CDET Test Card Images to Test Tool Vendors In compliance with the EMVCo Level 3 requirements, Visa is now providing its CDET test card images to Level 3 test tool suppliers in the standardized XML format defined by the EMVCo Level 3 Testing Group (L3TG). These images, representing each of the CDET card profiles and expected behaviors, are intended for use in conjunction with EMVCo-qualified test card simulators.
16
Visa Confidential
31 August 2017
less Device Evaluation Toolkit - Guide Overview
less Device Evaluation Toolkit - Guide (Version 2.3)
31 August 2017
Visa Confidential
17
Test Case Introduction Pre-requisites
3 Test Case Introduction This chapter introduces the CDET test cases. It includes pre-requisite information for testing, including instructions for each test case and a summary of all test cases included in this version of the toolkit.
3.1 Pre-requisites Prior to running the CDET test cases, acquirers must ensure that the prerequisites in this section are fulfilled.
3.1.1 Reader Capabilities Before beginning any of the tests, it is important to understand the capabilities of your less reader. This will help you ensure you are performing the tests correctly for your specific device.
Authorization Capability—Determine if the reader will be Offline-only, Online only or Offline/Online capable. Note that while qVSDC may offline and/or online transactions, MSD transactions are online only.
Cardholder Verification Methods—Determine the cardholder verification methods that the reader s Note: Online PIN, CDCVM, and Signature are the only CVMs that may be ed for Visa less.
Offline Data Authentication—Determine if the reader s Offline Data Authentication.
The capabilities of the less acceptance device are indicated within the Terminal Transaction Qualifier (TTQ) data element, which it sends to the card.
3.1.2 Visa CA Test Public Keys Readers that Offline Data Authentication must be configured with the Visa CA Test Public Key while the Toolkit is being used. Details of this test key are located in Appendix A: Visa CA Test Public Keys for qVSDC Offline. Note: Prior to production deployment of Visa less readers, the Visa CA Test Public Key must be removed from readers and replaced with the production Visa CA Public Keys.
18
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.1.3 Configured for Operational Use With an exception for the use of the Visa test CA keys as described above, the reader under test must be configured for as close to operational use as possible. For example, readers should include the Visa AIDs, correct terminal country code, correct date/time, and floor limits, etc.
3.1.4 Testing and Approval In accordance with the Visa Operating Regulations, all Visa less acceptance devices must be successfully tested by a Visa-accredited laboratory and receive a formal Visa approval, prior to deployment.
3.2 Instructions 3.2.1 Self-istered Tool In the first instance, the CDET is a self-istered tool. s must work to fix any problems on their own or work with their technical teams for resolution. Visa assistance should only be requested for queries related to Visa less acceptance policy, rules or best practices or to provide consultation on the interpreting results.
3.2.2 Initially Deployed Readers For readers being initially deployed, the intent is for acquirers to run each applicable test and make modifications to the reader configuration until the reader meets the expected outcome of the test. Acquirers should run these tests on each reader type as well as each reader hardware and/or software configuration. After running all tests and making the appropriate reader configuration modifications, acquirers in regions where CDET is mandated should submit their results to Visa.
3.2.3 Previously Deployed Readers If Visa or the acquiring client suspects a Visa less acceptance problem at a reader that has already been deployed, it is recommended that all applicable tests specified in the CDET be performed to assist with analysis.
3.2.4 Changes to Reader If changes are made the configuration of an already deployed reader, it is recommended that the acquiring client re-run all applicable CDET tests, to provide a level of confidence in the changes made.
31 August 2017
Visa Confidential
19
Test Case Introduction Instructions
3.2.5 Decline Responses vs. Other Errors There is a difference between a declined transaction response and an error message. In some situations, a declined response on the reader may be acceptable to a test case. However, error message responses, where the reader is unable to complete the transaction, are generally unacceptable and can indicate a problem with the reader or its setting/configuration. Testers should not necessarily be alarmed by a declined response (as long as a declined response is acceptable in the Expected Results section of the test case). However, error messages (such as “Card Not Read” or the equivalent) must be investigated.
3.2.6 Test Card Images and Test Cases s must execute the test cases using the available test card images. For simplicity, a single test card image represents a single test case, and in all cases the test card image number corresponds with the test case number (e.g., for Test Case 1, the tester will use Test Card Image 1).
3.2.7 Online Testing 3.2.7.1 General In the Test Cases section, tests are now designated as Online Applicable. When an Online transaction is performed, the transaction must be sent online to VCMS or a Visa-confirmed, third party supplied host simulator for validation of the Authorization Request Cryptogram (ARQC) and/or the CVV (dCVV or iCVV) data.
3.2.7.2 Visa Acquirers Visa Acquirers are required to perform online testing by connecting their reader/terminal to their test host system and generating transactions through to the VisaNet Certification Management Service (VCMS), or a Visa-confirmed third party supplied test host, which mimics VCMS. Each test card is configured with test Data Encryption Standard (DES) keys that is also set up within VCMS, allowing it to validate and generate the online cryptograms. Successful validation of the cryptogram by VCMS helps to ensure that all the components involved in the online transaction are correctly coded and integrated. For the online tests, card authentication (the validation of the Authorization Request Cryptogram or dCVV/iCVV) shall be performed and must be successful (unless otherwise noted in the test case). NOTE: Access to the VisaNet Certification Management Service is provided to Visa Clients only.
20
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.2.8 Compliance Reporting In regions where the use of CDET has been mandated, once acquirers have completed the applicable test cases, they will need to provide evidence of CDET compliance by reporting their results. Visa provides a web-based solution, the Chip Compliance Reporting Tool (CCRT) that enables acquirers to report their CDET results online. Once results are submitted, they will be reviewed by Visa and the acquirer ed if necessary.
3.2.8.1 Chip Compliance Reporting Tool The Chip Compliance Reporting Tool (CCRT) was developed by Visa to provide acquirers with a more convenient means of completing their compliance requirements, such as the submission of CDET results following testing. As a web-based, -friendly solution, CCRT was designed as an improved alternative to the manual methods previously used for submission of Toolkit test results. With CCRT, chip acquirers or their designated processors can complete and submit the mandatory compliance reports via a globally automated online system. Hosted on the Visa Online (VOL) web portal, CCRT is designed in accordance with Visa’s three-tier architectural requirements, which provides a high-level of application and data security. CCRT allows s to:
Submit new compliance reports
Review and update draft reports
Check on the status of pending reports submitted to Visa
Track approved reports
It benefits s by:
Providing a convenient, secure online solution for CDET results reporting:
Reducing potential for errors in manual entry by guiding s to choose from applicable options and providing mandatory information requirements
Allowing the "re-use" of reports as a starting point for new reporting, reducing time spent completing the reports
ing online status review and automated management of reports submitted to Visa, expediting communication between Visa and clients
Enables the direct importation of CDET validation results performed with PC-based card simulators
31 August 2017
Visa Confidential
21
Test Case Introduction Instructions
Acquiring clients already enrolled for VOL services may request entitlement to CCRT from their VOL representative. Those not yet enrolled, must first request VOL enrollment before being able to be entitled to CCRT access. The link for VOL enrollment is as follows: https://www.visaonline.com/ For more details on CCRT, please your local Visa Representative.
22
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.3 Test Case Summary This section provides a brief description of each test case currently included in this version of the Toolkit. The table below includes the following information:
Test Case Number: the unique test case number
Test Case Description: a brief description of the test case
Mandatory or Conditional: whether the test case is mandatory to all devices or conditional on the features ed by the device.
Device Capability: depending on the capability of the device, the test case may either be considered “Applicable (A)” – i.e. should therefore be performed, or “Non-applicable (N/A)” and should not be performed. o
Online only: generally implies either (a) an acceptance device with a Floor Limit permanently set to zero, or (b) an acceptance device not ing a Floor Limit. Such devices also typically Offline Data Authentication (ODA)
o
Offline Capable: an acceptance device with the capability to perform Offline Data Authentication to enable Offline transaction processing.
o
Transit: an acceptance device operating in a Transit environment. This is generally limited to devices that are capable of performing ODA on a Visa less card to enable access into the Transit network.
Table 3–1: Test Case
Test Case Summary
Device Capability
Test Case Description
Number
Mandatory (M) or
Online
Offline
Conditional (C )
Only
Capable
Transit
1
VS 2.0.2 Baseline Card
M
A
A
A
2
VS 2.1.x Baseline Card with CVN = ‘22’
M
A
A
A
31 August 2017
Visa Confidential
23
Test Case Introduction Test Case Summary Test Case
Test Case Description
Number
3
Card with the following features:
a 16-byte ADF Name
A PDOL that requests a 2-byte long TTQ
No Application PAN Sequence Number
A Cardholder Name with a minimum value of “/”
Mandatory (M) or
Online
Offline
Transit
Conditional (C )
Only
Capable
M
A
A
A
M
A
A
A
M
A
A
A
A Service Code = 621 4
Multi-application card with additional data in the GPO Response and with no Cardholder Name
5
Card that:
returns additional data in its SELECT PPSE Response
returns the AIP for an MSD transaction
does not include a PVKI or PVV in Track 2 Equivalent Data 6
qVSDC-only card with a 19-digit PAN and uses CVN 18
M
A
A
A
7
Online-only card with an Electron AID
C
A
A
A
A
A
A
(on device ing the Electron AID) 8
Online-only card with an Interlink AID
C (on device ing the Interlink AID)
24
Visa Confidential
31 August 2017
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3) Test Case
Test Case Description
Number
9
VMPA Card containing “00” and “FF” Padding in the GPO and a
Mandatory (M) or
Online
Offline
Transit
Conditional (C )
Only
Capable
M
A
A
A
M
A
A
A
Read Record Responses respectively. 10
Card with an Issuer Application Data length of 23-bytes and an ‘unrecognized CVM’
11
VMPA-based card that causes a Pre-tap scenario
M
A
A
N/A
12
Card with a CTQ indicating an issuer’s preference to switch to the
C
N/A
A
A
M
A
A
A
C
N/A
A
A
N/A
N/A
A
N/A
N/A
A
interface on ODA failure
(on device having Offline capability)
13
Card set to decline the transaction, to ensure that the terminal does not attempt the transaction over another interface
14
Card having inconsistent data to force transaction termination by the terminal
(on device having Offline capability)
15
(VS 2.1.x baseline) Card ing qVSDC Online Transit SDA
C (on the device ing ODA Online, i.e. Transit Gates)
16
(VS 2.1.x baseline) Online-only card using the 1536-bit CA key
C (on the device ing ODA
31 August 2017
Visa Confidential
25
Test Case Introduction Test Case Summary Test Case
Test Case Description
Number
Mandatory (M) or
Online
Offline
Conditional (C )
Only
Capable
N/A
N/A
Transit
Online, i.e. Transit Gates) 17
(VS 2.1.x baseline) Card ing qVSDC Online Transit SDA, but SDA fails
C (on the device ing ODA Online, i.e. Transit Gates)
26
Visa Confidential
31 August 2017
A
Test Case Introduction
less Device Evaluation Toolkit - Guide (Version 2.3)
3.4 Recommendations and Test Cases Applicability Please refer to the Acronyms Glossary in Section B for the definition and usage of the Floor Limit, Reader less Floor Limit and Terminal Floor Limit. Offline Test Cases 1b, 2b, 3b, 4b, 5b, 6b, 7b, 8b, 9b, 12b, 13b and 14b do not apply if either of the following conditions exists: -
The Reader less Floor Limit is equal to zero
-
The Reader less Floor Limit is not present, and the Terminal Floor Limit is set to zero
Additionally, for Test Cases 2b, 3b, 4b, 6b, 7b, 8b, 12b. 13a, 13b and 14b to apply, the following Terminal Transaction Qualifier (TTQ) bit should not be set: -
TTQ (9F66) Byte 2 – bit 6 = 0 (( Chip) Offline PIN not ed)
3.4.1 Applicability to Transit Terminals: The following Test Cases apply to Transit Terminal testing: -
1c, 2c, 3c, 4c, 5c, 6c, 7c, 8c, 9c, 10c, 12c, 13c, 14c, 15c, 16c, 17c
31 August 2017
Visa Confidential
27
Test Case Introduction Recommendations and Test Cases Applicability
28
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4 Test Case Details This chapter outlines each CDET test case. Important: Prior to beginning the tests, be sure to read the following sections:
Section 3.1: Pre-requisites
Section 3.2: Instructions (specifically Section 3.2.7: Online Testing)
These sections contain critical information. The following information is provided with each test case:
Test Case Number—the number of the test case.
Test Case Name—the name of the test case.
Objective—the objective of the test case.
Regional Requirement—whether the test applies to all regions or is specific to sub-set of regions. (Currently, all of the tests apply to all regions).
Business Justification—the business reason for the test.
Pre-requisite—Any specific terminal conditions that apply or configuration requirements needed for the test case.
Applicable Terminal Device Type—indicates the device type that needs to be tested.
POS: Point-of-sale (retail terminal)
ATM: Automated Teller Machine
MPOS: Mobile POS device
Transit Terminal: Definition limited to the combination of equipment or individual components at the entrance to a transit network (for example, a metro gate) or vehicle that enables access, based on successful offline data authentication of the less card.
Applicable Terminal Interface—indicates the interface type that needs to be tested.
less
Test Card—A number used to uniquely identify the test card image required to execute the test. There is a one-to-one correlation between the Test Case Number and the Test Card Number (i.e., Test Case 1 uses Test Card 1).
Test Evidence to be submitted—Evidence to be submitted with results on completion of the test case.
Receipt
Card-to-terminal Interaction Log
Host Simulator Log
31 August 2017
Visa Confidential
29
Test Case Details Recommendations and Test Cases Applicability
Document Reference—References to the specification or rule that acquirers may refer to for background information on the test. This information is especially important in the event that the test fails.
Criteria/ Validation—the success criteria expected for the test case.
30
a.
Perform an Online transaction at POS, ATMs & MPOS with online capability
b.
Perform an Offline transaction at POS & MPOS with offline capability
c.
If applicable, perform transaction at a Transit Terminal (for MTT or KFT) for ODA
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.1 Test Case 1: VS 2.0.2 Baseline Card Test Case 1/Test Card 1 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
1 VS 2.0.2 Baseline Card To ensure acceptance of a VS v2.0.2-compliant Visa less card, ing the specific features described below. of VSDC Applet Version: 2.7.1 Dual Interface o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 17) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 10 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
This card is provided to validate acceptance of a commonly configured Visa less card, compliant to VS 2.0.2. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal
☐
☒less
1 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log
☒Host Simulator Log (if
(if available)
applicable)
Visa less Payment Specifications – Version 2.0.2 including published updates
Visa Confidential
31
Test Case Details Test Case 1: VS 2.0.2 Baseline Card
Test Case 1/Test Card 1 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
a
The transaction should be completed online and be approved by the VCMS
b
N/A
Offline-capable Devices: Perform an ‘above Floor Limit’ transaction. The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
Online ODA not performed (ODA data not returned by the card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
32
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.2 Test Case 2: VS 2.2 Baseline Card Test Case 2/Test Card 2 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
2 VS 2.2 Baseline Card To ensure acceptance of a VS v2.2-compliant Visa less card, ing the specific features described below. of VSDC Applet Version: 2.9 Dual Interface o MSD not ed o qVSDC s: Online without ODA (CVN = ‘22’) Online with ODA (fDDA) Offline with ODA (fDDA) Valid for domestic and international cash transactions Valid for domestic cashback o VSDC () s: DDA CVN = ‘22’ Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
This card is provided to validate acceptance of a commonly configured Visa less card, compliant to VS 2.2. For Readers ing: Resulting Tx should be: MSD 1.4.2 only No transaction – path not ed MSD 2.x only No transaction – path not ed qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
2 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.2
Visa Confidential
33
Test Case Details Test Case 2: VS 2.2 Baseline Card
Test Case 2/Test Card 2 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
34
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.3 Test Case 3: Card with a 16-byte ADF Name and other Features Test Case 3/Test Card 3 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
3 Card with a 16-byte ADF Name and other Features To ensure acceptance of a card with a 16-byte ADF Name, and the following additional features. of VSDC Applet Version: 2.8.1F1 Dual Interface card PDOL requests a 2-byte TTQ No Application PAN Sequence Number (PSN) on the card Cardholder Name has a minimum value of “ /” (space and forward slash) Service Code = 621 Mandatory in Regions where CDET use has been mandated This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with various unique features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
3 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
35
Test Case Details Test Case 3: Card with a 16-byte ADF Name and other Features
Test Case 3/Test Card 3 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Card is personalized with the Application Currency Code ‘0840’ (US Dollars)
Domestic transaction is a transaction processed by US acquirer
International transaction is a transaction processed by non-US acquirer
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction. The transaction should be completed online and be approved by the VCMS
b
N/A
Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
36
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.4 Test Case 4: Card with additional Data in the GPO Response and with no Cardholder Name Test Case 4/Test Card 4 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
4 Multi-application card with additional data in the GPO Response and with no Cardholder Name To ensure acceptance of a Multi-application card with additional data in the GPO Response and No Cardholder Name. Card features include: of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 10 Multi-application card, with: o Visa Credit = A0 00 00 00 03 10 10 01 Application Priority Indicator = 81 o Visa Debit = A0 00 00 00 03 10 10 02 Application Priority Indicator = 82 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification:
Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface:
31 August 2017
This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with some unique features included. With the card containing two applications (Visa Credit and Visa Debit), both requiring Cardholder Confirmation, and Visa less Readers not ing this feature, the intent of this test case is to ensure that the Reader correctly disregards these settings. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
Visa Confidential
37
Test Case Details Test Case 4: Card with additional Data in the GPO Response and with no Cardholder Name
Test Case 4/Test Card 4 (Mandatory and both Online and Offline Applicable) Test Card: Test Evidence to be Submitted:
4 ☒Receipt (where possible)
Document Reference: Criteria/ Validation
Visa less Payment Specifications – Version 2.1 including published updates
Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Test Case:
Online-only Devices:
Offline-capable Devices:
a
Applications shall not be displayed to the cardholder for confirmation.
Perform an ‘above Floor Limit’ transaction.
The Visa Credit application shall be selected for processing. The transaction should be completed online and be approved by the VCMS b
N/A
Applications shall not be displayed to the cardholder for confirmation. The Visa Credit application shall be selected for processing. The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. Applications shall not be displayed to the cardholder for confirmation. The Visa Credit application shall be selected for processing. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
38
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.5 Test Case 5: Card that returns additional Data in the Select PPSE Response and containing other unique features. Test Case 5/Test Card 5 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
5 Card that returns additional Data in the Select PPSE Response and containing other unique features. To ensure acceptance of a card that has the following features:
Returns additional data in the Select PPSE Response: Language Preference, Kernel ID, Issuer Identification Number, Issuer Country Code (alpha 2), and Extended Selection.
The incorrect AIP for MSD (91 81)
PVKI and PVV are not personalized in the Track 2 Equivalent Data (T2ED)
The card also features: of VSDC Applet Version: 2.7.1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 17) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 10 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card:
31 August 2017
This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. This test case is intended for readers which are not ing Extended Selection. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
5
Visa Confidential
39
Test Case Details Test Case 5: Card that returns additional Data in the Select PPSE Response and containing other unique features.
Test Case 5/Test Card 5 (Mandatory and both Online and Offline Applicable) Test Evidence to be Submitted:
☒Receipt (where possible)
Document Reference: Criteria/ Validation
Visa less Payment Specifications – Version 2.0.2 including published updates
Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
Online ODA not performed (ODA data not returned by the card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: iCVV verification is expected to fail since PVKI and PVV are not personalized in the Track 2 Equivalent Data.
40
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.6 Test Case 6: qVSDC-only card with 19-digit PAN and CVN 18 Test Case 6/Test Card 6 (Mandatory and both Online and Offline Applicable) Test Case Number: Test Case Name: Objective:
6 qVSDC-only card with 19-digit PAN and CVN 18 To ensure acceptance of a qVSDC-only card with 19-digit PAN and CVN 18. of VSDC Applet Version: 2.8.1F1 Dual Interface card o qVSDC s: Online without ODA (CVN = 18) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: DDA CVN = 18 Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only No transaction – MSD not on the card MSD 2.x only No transaction – MSD not on the card qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
6 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
41
Test Case Details Test Case 6: qVSDC-only card with 19-digit PAN and CVN 18
Test Case 6/Test Card 6 (Mandatory and both Online and Offline Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be approved Offline by the reader (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
42
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.7 Test Case 7: Online-only card with an Electron AID Test Case 7/Test Card 7 (Conditional and Online Applicable) Test Case Number: Test Case Name: Objective:
7 Online-only card with an Electron AID To ensure acceptance of an Online-only card with an Electron AID, if ed by the Reader. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Offline not ed o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Electron AID is ed) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. Reader s the Electron AID For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
☐
☒less
7 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
43
Test Case Details Test Case 7: Online-only card with an Electron AID
Test Case 7/Test Card 7 (Conditional and Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online regardless of the Reader less Floor Limit or Terminal Floor Limit and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
44
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.8 Test Case 8: Card with an Interlink AID Test Case 8/Test Card 8 (Conditional and Online Applicable) Test Case Number: Test Case Name: Objective:
8 Online-only card with an Interlink AID To ensure acceptance of a card with an Interlink AID, if ed by the Reader. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Offline not ed o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Interlink AID is ed) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. Reader s the Interlink AID For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
☐
☒less
8 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
45
Test Case Details Test Case 8: Card with an Interlink AID
Test Case 8/Test Card 8 (Conditional and Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
46
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.9 Test Case 9: VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively Test Case 9/Test Card 9 (Mandatory and Online Applicable) Test Case Number: Test Case Name: Objective:
9 VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively. To ensure acceptance of a card with the VMPA Applet and with “00” and “FF” Padding in the GPO and a Read Record Response respectively. of VMPA Applet Version: 1.4.1.5 (VMPA 1415 Core 12 121214 00.cap) Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) o VIS – not ed Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
This card is provided to validate acceptance of the Visa Mobile Payment Application – Version 1.4.1.5 and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
9 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
31 August 2017
☒less
☒Card-to-Terminal Interaction Log (if available)
☒Host Simulator Log (if applicable)
For the Reader: Visa less Payment Specifications – Version 2.1 including published updates For the Card: Visa Mobile less Payment Specification (VMS) 1.4.1
Visa Confidential
47
Test Case Details Test Case 9: VMPA Card containing “00” and “FF” Padding in the GPO and a Read Record Response Respectively
Test Case 9/Test Card 9 (Mandatory and Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be approved by the VCMS
Perform an ‘above Floor Limit’ transaction.
b
N/A
The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Perform a ‘below Floor Limit’ transaction. The transaction should be completed online regardless of the Reader less Floor Limit or the Terminal Floor Limit and be approved by the VCMS Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
48
ODA not performed (ODA not ed by this card)
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.10 Test Case 10: Card with an IAD length of 23-bytes and an Unrecognized CVN Test Case 10/Test Card 10 (Mandatory and Online Applicable) Test Case Number: Test Case Name: Objective:
10 Card with an IAD length of 23-bytes and an Unrecognized CVN To ensure acceptance of a card with an IAD length of 23-bytes and an Unrecognized CVN.
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card:
31 August 2017
of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA, CVN = 77 (unrecognized) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 77 (unrecognized)
Please note: this card image is personalized to return 16 bytes of Issuer Discretionary Data (IDD), following the 7 bytes of Issuer Application Data (IAD). The IDD consists of the following: Byte 8 = length of IDD (0F) Byte 9 = option ID (03) Bytes 10 - 14 = VLP Available Funds (variable) Bytes 15 - 19 = CTTA (variable) Bytes 20 – 23 = MAC (variable) Mandatory in Regions where CDET use has been mandated This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV MSD 2.x only MSD CVN 17 qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
10
Visa Confidential
49
Test Case Details Test Case 10: Card with an IAD length of 23-bytes and an Unrecognized CVN
Test Case 10/Test Card 10 (Mandatory and Online Applicable) Test Evidence to be Submitted:
☒Receipt (where possible)
Document Reference: Criteria/ Validation
Visa less Payment Specifications – Version 2.1 including published updates
Note: A receipt may be scanned and submitted as a .pdf file.
☒Host Simulator Log (if
☒Card-to-Terminal Interaction Log (if available)
applicable)
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be completed online and be declined by the VCMS as the CVN is unrecognized
Perform an ‘above Floor Limit’ transaction.
b c
N/A
The transaction should be completed online and be declined by the VCMS as the CVN is unrecognized N/A
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: Card Authentication Method (CAM) result will not be provided by Visa in the Field 44.8 due to CVN not ed by the VCMS.
50
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.11 Test Case 11: Card with a VMPA Applet that causes a Pre-tap Test Case 11/Test Card 11 (Mandatory and Applicable to both Online Only and Offline-capable devices) Test Case Number: Test Case Name: Objective:
11 Card with a VMPA Applet that causes a Pre-tap To ensure the Reader displays the correct response message and performs the correct behavior when presented with a card containing the VMPA Applet that causes a Pre-tap. of VMPA Applet Version: 1.4.1.5 (VMPA 1415 Core 12 121214 00.cap) Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) o VIS – not ed Mandatory in Regions where CDET use has been mandated
Regional Requirement: Business Justification:
Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card:
31 August 2017
Although a standard qVSDC transaction is typically completed with a single “tap” of the less payment card, the concept of a “Pre-Tap” is introduced for Mobile consumer devices. Pre-Tap is defined as the first presentation of the Mobile consumer device to the less payment reader in a situation where some consumer interaction is required to complete the transaction (e.g. consumer device CVM), and the cardholder has not completed that interaction prior to presenting the consumer device for payment. After the consumer interaction has been completed, the consumer device can be re-presented to the less payment reader to perform a “1st Tap” payment transaction. Although the VMPA applet is presented here in ID-1 card form, its intent is to emulate a consumer device that has experienced an exception condition (i.e. CDCVM is required but not performed). The intent of this test case is to ensure that the Reader displays the correct response message to this condition and performs the correct behavior. For Readers ing: Resulting Tx should be: MSD 1.4.2 only Pre-tap MSD 2.x only Pre-tap qVSDC only Pre-tap Both qVSDC and MSD 2.x Pre-tap ☒POS ☒ATM ☒MPOS ☒Transit Terminal ☐
☒less
11
Visa Confidential
51
Test Case Details Test Case 11: Card with a VMPA Applet that causes a Pre-tap
Test Case 11/Test Card 11 (Mandatory and Applicable to both Online Only and Offline-capable devices) Test Evidence to be Submitted:
☒Receipt (where possible)
Document Reference:
Note: A receipt may be scanned and submitted as a .pdf file.
Criteria/ Validation
☒Card-to-Terminal Interaction Log (if available)
applicable)
For the Reader: Visa less Payment Specifications – Version 2.1 including published updates For the Card: Visa Mobile less Payment Specification (VMS) 1.4.1 Test Case:
Online-only Devices:
Offline-capable Devices:
a
The Reader should display a message to the cardholder instructing them to ‘refer to their payment device for further instructions’, briefly power down the less interface before returning to Discovery Processing.
The Reader regardless of the Reader less Floor Limit or the Terminal Floor Limit should display a message to the cardholder instructing them to ‘refer to their payment device for further instructions’, briefly power down the less interface before returning to Discovery Processing.
Test Case is considered successfully completed if the Reader displays the correct response message (like “Please refer to you mobile device”) and briefly power down the less interface before returning to Discovery Processing.
52
☐Host Simulator Log (if
b
N/A
c
N/A
Test Case is considered successfully completed if the Reader displays the correct response message (like “Please refer to you mobile device”) and briefly power down the less interface before returning to Discovery Processing. N/A
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.12 Test Case 12: Card with a CTQ indicating an issuer preference to switch to interface on ODA failure. Test Case 12/Test Card 12 (Conditional and Not Online Applicable) Test Case Number: Test Case Name: Objective:
12 Card with a CTQ indicating an issuer preference to switch to interface on ODA failure. To ensure correct Reader behavior for a card with a CTQ indicating an issuer preference to switch to interface on ODA failure. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Reader is dualinterface, Offline-capable and s ODA) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. Reader s Offline Data Authentication (ODA) For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV (but test case would not be executed) MSD 2.x only MSD CVN 17 (but test case would not be executed) qVSDC only qVSDC Both qVSDC and MSD 2.x qVSDC Reader s EMV chip ☒POS ☐ATM ☒MPOS ☒Transit Terminal
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
☒
☒less
12 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
53
Test Case Details Test Case 12: Card with a CTQ indicating an issuer preference to switch to interface on ODA failure.
Test Case 12/Test Card 12 (Conditional and Not Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
a
N/A
b
N/A
Offline-capable Devices: N/A Perform a ‘below Floor Limit’ transaction. The transaction is declined offline due to the ODA failure. The Reader shall indicate that a switch to the interface is required following the ODA failure (qVSDC only). is not required to submit chip transaction online. Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA fails
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA fails
Transit Gate access not permitted
Note: This test case does not applicable to devices ing ODA for Online Authorizations.
54
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.13 Test Case 13: Card that Declines Transactions Test Case 13/Test Card 13 (Mandatory and Not Online Applicable) Test Case Number: Test Case Name: Objective:
13 Card that Declines Transactions. To ensure terminal does not allow the transaction to be completed over another interface, with a card that declines Transactions. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Reader is dualinterface) This card is provided to validate acceptance of a Visa less card, compliant to the most recent version of the VS specifications and with specific features included. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV (but test case would not be executed) MSD 2.x only MSD CVN 17 (but test case would not be executed) qVSDC only qVSDC decline Both qVSDC and MSD 2.x qVSDC decline
Regional Requirement: Business Justification: Pre-requisite:
Reader s EMV chip
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted:
☒POS
Document Reference:
Visa less Payment Specifications – Version 2.1 including published updates
31 August 2017
☒ATM
☒
☒MPOS
☒Transit Terminal
☒less
13 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
Visa Confidential
☐Host Simulator Log (if applicable)
55
Test Case Details Test Case 13: Card that Declines Transactions
Test Case 13/Test Card 13 (Mandatory and Not Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
The transaction should be declined Offline (qVSDC only).
Perform an ‘above Floor Limit’ transaction.
The Reader shall not indicate that a switch to the interface is required (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
b
N/A
The transaction should be declined Offline (qVSDC only). The Reader shall not indicate that a switch to the interface is required (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability Perform a ‘below Floor Limit’ transaction. The transaction should be declined Offline (qVSDC only). The Reader shall not indicate that a switch to the interface is required (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: transaction is subsequently Declined in Deferred Authorization (international transactions disallowed)
56
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.14 Test Case 14: Card with inconsistent Data Test Case 14/Test Card 14 (Conditional and Not Online Applicable) Test Case Number: Test Case Name: Objective:
14 Card having inconsistent data to force transaction termination by the terminal. To ensure correct Reader behavior for a card with inconsistent data, when Offline Data Authentication is being performed. of VSDC Applet Version: 2.8.1F1 Dual Interface card o MSD s: Legacy with dCVV CVN 17 o qVSDC s: Online without ODA (CVN = 10) Online with ODA (fDDA) Offline with ODA (fDDA) o VSDC () s: CVN = 10 Conditional in Regions where CDET use has been mandated (i.e. if the Reader is Offlinecapable and s ODA) To ensure compliance with VS 2.1 – Updates List 3 requirements.
Regional Requirement: Business Justification: Pre-requisite:
Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Reader s Offline transactions and an Offline transaction is attempted. For Readers ing: Resulting Tx should be: MSD 1.4.2 only MSD dCVV (but test case would not be executed) MSD 2.x only MSD CVN 17 (but test case would not be executed) qVSDC only Transaction terminated Both qVSDC and MSD 2.x Transaction terminated ☒POS ☐ATM ☒MPOS ☒Transit Terminal
☐
☒less
14 ☒Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
57
Test Case Details Test Case 14: Card with inconsistent Data
Test Case 14/Test Card 14 (Conditional and Not Online Applicable) Criteria/ Validation
Test Case:
Online-only Devices:
a
N/A
b
N/A
Offline-capable Devices: N/A Perform a ‘below Floor Limit’ transaction. The transaction should be terminated Offline due to inconsistent data (qVSDC only). Note: See section 2.4: Recommendations and Test Cases Applicability
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
ODA successfully performed (ODA data returned by the card)
Transit Gate access permitted
Note: transaction is subsequently Declined in Deferred Authorization (data mismatch)
58
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.15 Test Case 15: Card ing qVSDC Online Transit SDA Test Case 15/Test Card 15 (Conditional on Transit Terminal ) Test Case Number: Test Case Name: Objective:
15 Card ing qVSDC Online Transit SDA. To ensure correct Reader behavior for a card ing qVSDC Online Transit SDA.
of VSDC Applet Version: 2.9
less only card: o
MSD not ed
o
qVSDC ed:
o Regional Requirement: Business Justification: Pre-requisite: Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Online without ODA (CVN = 10)
Online with ODA (Transit SDA)
VSDC () not ed
Conditional on the intended deployment on Transit terminals, in of regional Transit-related projects. To ensure compliance with VS 2.1 – Updates List 3 requirements. Reader s Online with ODA. ☐POS ☐ATM ☐MPOS ☒Transit Terminal ☐
☒less
15 ☐Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
59
Test Case Details Test Case 15: Card ing qVSDC Online Transit SDA
Test Case 15/Test Card 15 (Conditional on Transit Terminal ) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
N/A
N/A
b
N/A
N/A
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
60
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.16 Test Case 16: Online-only card using the 1536-bit CA key Test Case 16/Test Card 16 (Conditional on Transit Terminal ) Test Case Number: Test Case Name: Objective:
16 Card using the 1536-bit CA key To ensure correct Reader behavior for an Online-only card using the 1536-bit CA key.
of VSDC Applet Version: 2.8.1F1
less only card: o
MSD not ed
o
qVSDC ed:
o Regional Requirement: Business Justification: Pre-requisite: Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Online without ODA (CVN = 18)
Online with ODA (fDDA)
Offline with ODA (fDDA)
VSDC () not ed
Conditional on the intended deployment on Transit terminals, in of regional Transit-related projects. To ensure compliance with VS 2.1 – Updates List 3 requirements. Reader s Online with ODA. ☐POS ☐ATM ☐MPOS ☒Transit Terminal ☐
☒less
16 ☐Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
61
Test Case Details Test Case 16: Online-only card using the 1536-bit CA key
Test Case 16/Test Card 16 (Conditional on Transit Terminal ) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
N/A
N/A
b
N/A
N/A
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
62
SDA successfully performed (SDA data returned by the card)
Transit Gate access permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
4.17 Test Case 17: Card ing qVSDC Online Transit SDA, but SDA fails Test Case 17/Test Card 17 (Conditional on Transit Terminal ) Test Case Number: Test Case Name: Objective:
17 Card ing qVSDC Online Transit SDA, but SDA fails To ensure correct Reader behavior for an Online-only card when Transit SDA fails.
of VSDC Applet Version: 2.9
less only card: o
MSD not ed
o
qVSDC ed:
o Regional Requirement: Business Justification: Pre-requisite: Applicable Terminal Device Type: Applicable Terminal Interface: Test Card: Test Evidence to be Submitted: Document Reference:
31 August 2017
Online without ODA (CVN = 10)
Online with ODA (Transit SDA)
VSDC () not ed
Conditional on the intended deployment on Transit terminals, in of regional Transit-related projects. To ensure compliance with VS 2.1 – Updates List 3 requirements. Reader s Online with ODA. ☐POS ☐ATM ☐MPOS ☒Transit Terminal ☐
☒less
17 ☐Receipt (where possible) Note: A receipt may be scanned and submitted as a .pdf file.
☒Card-to-Terminal Interaction Log (if available)
☐Host Simulator Log (if applicable)
Visa less Payment Specifications – Version 2.1 including published updates
Visa Confidential
63
Test Case Details Test Case 17: Card ing qVSDC Online Transit SDA, but SDA fails
Test Case 17/Test Card 17 (Conditional on Transit Terminal ) Criteria/ Validation
Test Case:
Online-only Devices:
Offline-capable Devices:
a
N/A
N/A
b
N/A
N/A
c
If Transaction Amount is zero (e.g. from an MTT Transit Terminal):
SDA fails
Transit Gate access not permitted
If Transaction Amount is non-zero (e.g. from an KFT Transit Terminal):
64
SDA fails
Transit Gate access not permitted
Visa Confidential
31 August 2017
Test Case Details
less Device Evaluation Toolkit - Guide (Version 2.3)
31 August 2017
Visa Confidential
65
Visa CA Test Public Key for qVSDC Offline and transit 1408 Bit VSDC TEST Key
A
Visa CA Test Public Key for qVSDC Offline and transit
For devices that Offline Data Authentication (ODA), this test key must be loaded into the terminal to the test cases associated with Offline Data Authentication. Note: An expiration date has not been defined for test CA Public Key, and it should not be assumed that a test key has the same expiry date as the live key of the same length. If your Terminal Management System requires expiry dates to be provided for CAPKs then please set the expiry date to 31 December 2025 for this test key. Important: Prior to deployment, this test key must be removed from the terminal and replaced with the Visa CA production keys.
A.1
1408 Bit VSDC TEST Key
This key is the Visa CA Public 1408-bit TEST key: Table A–1:
1408 Bit VSDC Test Key
Component
Value
ed Application Provider Identifier (RID) Index Modulus
A0 00 00 00 03
Exponent Secure Hash Algorithm-1 Hash Comments:
66
92 99 6A F5 6F 56 91 87 D0 92 93 C1 48 10 45 0E D8 EE 33 57 39 7B 18 A2 45 8E FA A9 2D A3 B6 DF 65 14 EC 06 01 95 31 8F D4 3B E9 B8 F0 CC 66 9E 3F 84 40 57 CB DD F8 BD A1 91 BB 64 47 3B C8 DC 9A 73 0D B8 F6 B4 ED E3 92 41 86 FF D9 B8 C7 73 57 89 C2 3A 36 BA 0B 8A F6 53 72 EB 57 EA 5D 89 E7 D1 4E 9C 7B 6B 55 74 60 F1 08 85 DA 16 AC 92 3F 15 AF 37 58 F0 F0 3E BD 3C 5C 2C 94 9C BA 30 6D B4 4E 6A 2C 07 6C 5F 67 E2 81 D7 EF 56 78 5D C4 D7 59 45 E4 91 F0 19 18 80 0A 9E 2D C6 6F 60 08 05 66 CE 0D AF 8D 17 EA D4 6A D8 E3 0A 24 7C 9F 03 42 9C 95 4A 38 59 CE F9 12 95 F6 63 C9 63 E5 82 ED 6E B2 53 The expiration date for certificates issued using Visa’s 1408-bit Test CA public key is December 31, 2019.
Visa Confidential
31 August 2017
Visa CA Test Public Key for qVSDC Offline and transit
less Device Evaluation Toolkit - Guide (Version 2.3)
A.2 1536 Bit VSDC TEST Key This key is the Visa CA Public 1536-bit TEST key: Table A–2: 1536 Bit VSDC Test Key Component
Value
ed Application Provider Identifier (RID) Index Modulus
A0 00 00 00 03
Exponent Secure Hash Algorithm-1 Hash Comments:
31 August 2017
89 E5 E1 95 70 5C E6 1A 06 72 B8 36 7E 7A 51 71 39 27 A0 42 89 EA 30 83 28 FA D2 80 71 EC EA E8 89 B3 C4 F2 9A C3 BD E4 67 72 B0 0D 42 FD 05 F2 72 28 82 0F 26 93 99 0F 81 B0 F6 92 8E 24 0D 95 7E C4 48 43 54 CD 5E 5C A9 09 2B 44 47 41 A0 39 4D 34 76 65 12 32 47 4A 9B 87 A9 61 DA 8D D9 6D 90 F0 36 E9 B3 C5 2F B0 97 66 BD A4 D6 BC 3B DA DB C8 91 22 B7 40 68 F8 FA 04 02 6C 5F A8 EF 39 8B C3 AB 39 92 A8 7F 6A 78 5C C7 79 BA 99 F1 70 95 66 23 D6 7A 18 EB 83 24 26 3D 62 6B E8 5B FF 77 B8 B9 81 C0 A3 F7 84 9C 4F 3D 8E 20 54 29 55 D1 91 28 19 85 47 B4 7A E3 4D F6 7F 28 BE 43 3F 33 03 71 70 85 0B 97 F8 39 52 04 5C F9 CA 8B 76 12 DF EB 69 E9 EF The expiration date for certificates issued using Visa’s 1536-bit Test CA public key is December 31, 2023.
Visa Confidential
67
Visa CA Test Public Key for qVSDC Offline and transit 1536 Bit VSDC TEST Key
68
Visa Confidential
31 August 2017
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3)
B
Acronyms and Glossary
This appendix provides a list of acronyms used in this document and in EMV as well as a glossary of . Table B–1:
Acronyms
Acronym
Meaning
a AAC AAR ADA ADF ADVT AEF AFL AID AIP an ans APDU API ARPC ARQC ATC ATM AUC b BIN CA CAM CAT CDA CDOL CID cn CSV CVK CVM CVR CVV DDA DDF DDOL
alpha Application Authentication Cryptogram Application Authentication Referral Application Default Action Application Definition File Acquirer Device Validation Toolkit Application Elementary File Application File Locator Application Identifier Application Interchange Profile alphanumeric alphanumeric special Application Protocol Data Unit Application Priority Identifier Application Response Cryptogram Application Request Cryptogram Application Transaction Counter Automated Teller Machine Application Usage Control binary Bank Identification Number Certificate Authority Card Authentication Method Cardholder Activated Device Combined Dynamic Data Authentication Card Risk Management Data Object List Cryptogram Information Data compressed numeric Comma-Separated Values Card Verification Key Cardholder Verification Method Card Verification Result Card Verification Value Dynamic Data Authentication Directory Definition File Dynamic Data Authentication Data Object List
31 August 2017
Visa Confidential
69
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3)
70
Acronym
Meaning
DEA DES DGI DKI EMV FCI GPO hex. IAC ICVV IFM KFT L3TG MCC MDK MPOS MTT N/A n PAN PDOL PIN PIX PK PKI PKI POS PSE PSTN PVK PVV RFU RID RSA RRN SAD SAM SDA STIP TAC TC TDOL TITF
Data Encryption Algorithm Data Encryption Standard Data Group Identifier (used by the Card Personalizer only) Derivation Key Index Europay, MasterCard & Visa File Control Information Get Processing Options Hexadecimal Issuer Action Code Alternate Card Verification Value Interface Module Known Fare Transaction Level 3 Testing Group Merchant Category Code Master Derivation Key Mobile Point of Sale Device Mass Transit Transaction Not Applicable numeric Primary Number Processing Options Data Object List Personal Identification Number Proprietary Application Identifier Extension Public Key Public Key Infrastructure Public Key Index Point of Sale Payment Systems Environment Public Switched Telephone Network PIN Verification Key PIN Verification Value Reserved For Future Use ed Application Provider Identifier Rivest, Shamir, Adleman Retrieval Reference Number Signed Static Application Data Secure Access Module Static Data Authentication Stand-In Processing Terminal Action Code Transaction Certificate Transaction Certificate Data Object List Terminal Integration Task Force
Visa Confidential
31 August 2017
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Acronym
Meaning
TLV TSI TVR UAT UCAT UDK var. VCMS VIP VLP VMTS VSDC VTS XML XSD
Tag-Length-Value Transaction Status Information Terminal Verification Result Unattended Acceptance Device Unattended Cardholder Acceptance Device Unique Derived Key variable Visa Certification Management Service VisaNet Integrated Payment Visa Low-value Payment Visa Member Test System Visa Smart Debit/Credit VisaNet Test System Extensible Mark-up Language XML Schema Definition
Table B–2: Glossary Term
Application Protocol Data Unit (APDU Automated Teller Machine (ATM) Card Acceptor Terminal Card/Terminal Log Card/Terminal Log Validation Cardholder Activated Device Certification
Chip-Capable Chip-Enabled
Definition
The communication format used between the chip card and the payment application on a card acceptance device. This format is defined in ISO specification 7816. An unattended device that has electronic capability to send transactions online for authorization, accepts PINs, and disburses currency. See “Terminal.” A capture of the interaction between the card/card simulator and the device. Typically provided in Application Protocol Data Unit (APDU) format. A Test Plan-defined description of the requirements for elements and content of the card/terminal log to be validated during terminal integration testing. An unattended device, such as an automated dispensing machine, self-service device, or limited amount device that is not an ATM. Validation that the format, function, and content of authorization messages executed from a defined test plan adheres to a provided specification and set of business rules. A transaction acceptance device that is designed and constructed to facilitate the addition of a chip reader/writer. For chip cards, this describes the state in which the card has already been personalized with both cardholder and Brand-specific data in preparation for use. For terminals, this describes the state in which the terminal has already been equipped with a chip reader/writer and has been configured with Brand-specific data and is ready for use in accepting chip cards.
31 August 2017
Visa Confidential
71
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Term
Comma-Separated Values (CSV)
Transaction less Transaction Customer Activated Terminal (CAT) EMVCo LLC (EMVCo)
EMV Specifications
Floor Limit Host Authorization Message Host Authorization Message Validation Implement Interoperability Kernel
Known Fare Transaction (KFT) Level 3 Testing Group
Limited Amount Device Mass Transit Transaction (MTT)
72
Definition
A format that stores tabular data (numbers and text) in plain-text form (i.e. a sequence of characters, with no data that has to be interpreted instead, as binary numbers). A CSV file consists of any number of records, separated by line breaks of some kind; each record consists of fields, separated by some other character or string, most commonly a literal comma or tab. Usually, all records have an identical sequence of fields. An interaction between a chip application and a device using the physical electrical interface, as defined in [EMV Book 1]. An interaction between a chip application and a device using the radio frequency wireless interface, as defined in [EMV CL]. See “Cardholder Activated Device.” Industry organization that manages, maintains, and enhances the EMV Specifications. Current are American Express, JCB International, MasterCard Worldwide, UnionPay, and Visa Inc. Technical specifications developed and maintained by EMVCo to create standards and ensure global interoperability for use of chip technology in the payment industry. In order to EMV, cards and terminals must also meet the requirements described in the bulletins available on the EMVCo website. A currency amount that Visa has established for single transactions at specific types of merchants, above which online authorization is required. A description of the transaction message initiated from the device and sent online via the acquirer and network to the issuer, processor, or Brand for transaction authorization. A Test Plan-defined description of the requirements for elements and content of the Host Authorization Message to be validated during standalone or terminal integration testing. To make a card, application, or device capable of performing a functionality. Functionality that is implemented may also need to be enabled (see Chip-enabled). The ability of all card acceptance devices to accept and read all chip cards that are properly coded and personalized. EMV definition for the set of functions required to be present on every terminal implementing a specific interpreter. The kernel contains device drivers, interface routines, security and control functions, and the software for translating from the virtual machine language to the language used by the real machine. In other words, the kernel is the implementation of the virtual machine on the real machine. Transit implementation in which a less payment is made at the point of entry to the transit network, using a less payment card. EMVCo testing group into which the Terminal Integration Task Force (TITF) evolved in January 2017. Responsible for managing all aspects of the Level 3 testing initiatives and processes. An unattended device that has data capture-only capability, and accepts payment for items such as parking garage fees, road tolls, etc. Transit implementation in which a less card to be used subsequently to pay for the travel, is authenticated at the point of entry to the transit network.
Visa Confidential
31 August 2017
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Term
Mobile Point of Sale (MPOS) Offline-Capable Offline-Only Online-Capable Online-Only PAN Key Entry Criteria Criteria File Personalization Point of Sale Point-of-Sale Device Reader less Floor Limit Terminal
Terminal Configuration Terminal Floor Limit
Terminal Integration Testing
Terminal Integration Task Force (TITF)
Test Card Image Test Case
31 August 2017
Definition
A smartphone, tablet, or dedicated wireless device that performs the functions of a cash or electronic point of sale terminal (POS terminal). A transaction acceptance device that has the ability to process the transaction offline for card authentication and authorizations. A transaction acceptance device that is only able to process the transaction offline for card authentication and authorizations. A transaction acceptance device that is able to send transactions to the issuer or processor for authorizations. A transaction acceptance device that requires that all transactions be sent online for authorization. A manual procedure in which the merchant uses a device key pad to enter the PAN embossed on a card in order to process a transaction. A Test Plan-defined field that describes an expected result for a successful outcome or conclusion of a test case. The file (in CSV format) that embeds the Brand-defined criteria for each test case. For chip cards, the process of applying both cardholder and Brand-specific data to the card in preparation for its use. The physical location where a merchant or acquirer in a face-to-face environment or an unattended device completes a transaction. A device used at the POS to process transactions, including chip devices, automated dispensing machines, self-service devices, and ATMs. Indicates the less floor limit of the reader for Visa applications. If the transaction amount is greater than the Reader less Floor Limit, then the reader requires online processing for the transaction. The device used in conjunction with the chip card at the point of transaction to perform a financial transaction. The terminal incorporates the interface device and may also include other components and interfaces such as host communications. A description of the features and parameters on the acceptance device under test. For example, it might include the EMV-defined terminal types, ed interfaces, etc. Indicates the floor limit in the terminal. Terminal compares Amount, Authorized with the applicable Terminal Floor Limit if the Reader less Floor Limit is not present. A process implemented and managed by the respective Brands, aimed at providing a level of assurance that Brand-specific requirements and recommendations are being implemented in or less chip acceptance devices that will accept a Brand’s products. Task Force established by EMVCo in 2013 with the purpose of examining each of the Brand’s terminal integration processes, in order to determine the possibilities of aligning key elements of these processes. The TITF was renamed the Level 3 Testing Group (L3TG) in January 2017 An electronic representation of a physical card. A Test Plan-defined description of a test scenario, defined by a Payment Brand for execution of terminal integration or host message testing.
Visa Confidential
73
Acronyms and Glossary
less Device Evaluation Toolkit - Guide (Version 2.3) Term
Test Case Name Test Case Number Test Case Objective Test Plan
Test Procedure Test Tool Confirmation
Test Tool Qualification
Transaction Completion Transit Terminal
Unattended Cardholder Activated Terminal (UCAT) Validation Extensible Mark-up Language (XML)
74
Definition
A Test Plan-defined description of the name associated with a specific test case. A Test Plan-defined unique test case identifier. A Test Plan-defined description of the objective of performing a given test case. A Brand-developed and managed set of test criteria that defines the requirement for terminal integration or host message testing. This may either take the form of a textual document or a machine-readable file. A Test Plan-defined description of the steps required in order to execute a specific test case. The process undertaken by each Brand to provide themselves, tool vendors, and clients will a level of assurance that the tools being used by clients to execute terminal integration testing will do so in compliance with Brand requirements. Process is also referred to as “Test Tool Qualification.” The process undertaken by each Brand to provide themselves, tool vendors, and clients will a level of assurance that the tools being used by clients to execute terminal integration testing will do so in compliance with Brand requirements. Process is also referred to as “Test Tool Confirmation.” An EMV definition for the successful closing of transaction processing. The completion function is always the last function in transaction processing and must occur unless the transaction is terminated prematurely by error processing. Refers to the combination of equipment at the entrance to a transit network (for example, a metro gate) or vehicle (for example, a bus) that is collectively used to accept Visa less cards for transit network access. This equipment may be a single integrated piece of equipment or a number of separate physical components (for example, bus ticket machine, display and reader) that together form the card acceptance device. A cardholder-operated device that reads, captures, and transmits card information in an unattended environment. Also known as “Customer Activated Terminal (CAT)” or “Unattended Acceptance Device (UAT).” A Test Plan-defined description of the requirements for the /tester to validate responses from the device under test. A mark-up language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable.
Visa Confidential
31 August 2017
Related Documents 3m3m1z
Cdet Guide V2 3 296214
November 2019 185
Sdts Guide V2 0 473e12
December 2019 60
Scarlett 2i2 Guide V2 536wy
December 2019 54
Youcam 3 Guide 6v6f9
November 2019 50
Opera 3 Guide 583p52
October 2019 79
Mainstage 3 Guide 101e1t
October 2019 145More Documents from "Aleksandar" 5u1i48
Carprog Mcu Reflash Step By Stepg 94i3a
November 2019 117
Mathcad-mechanical Engineers Making Better Decisions Faster 3o2kt
November 2021 0
Llt Guide 5o6e5v
October 2019 128
Roberto-savijano-gomora-pdf.pdf 3o1y71
May 2020 23
Milioner Kviz 686v5e
August 2021 0