For EMV ARQC and EMV Batch Data, the device encrypts data using TDES in CBC-like chaining without an Initial Vector:
The device begins by TDES encrypting the first 8 bytes of clear text data. The 8-byte result is placed in an encrypted data buffer.
Continue using TDES CBC method with the encrypted 8 bytes XORed with the next 8 bytes of clear text; encrypt that result and place it into the encrypted data buffer.
Repeat until all clear text bytes have been encrypted.
If the final block of clear text contains fewer than 8 bytes, the device pads the end of the block to make 8 bytes.
After the final clear text block is XORed with the prior 8 bytes of encrypted data, the device encrypts it and places it in the encrypted data value.
No Initial Vector is used.
The host must decrypt the data in 8-byte blocks, ignoring any final unused bytes in the last block. When a value consists of more than one block, use the CBC method to decrypt the data by following these steps:
Start decryption on the last block of 8 bytes (call it block N) using the key.
XOR the result of the decryption with the next-last block of 8 bytes (block N-1).
Repeat until reaching the first block.
When the device and the host are using TDES DUKPT key and the device is encrypting data, the host software must generate a key (the “derived key”) to use for decryption.
The lookup methods the host software uses depend on the overall solution architecture and are outside the scope of this document. Most solutions do this in one of two ways, both of which use the Initial Key Serial Number that arrives with the encrypted data:
Look up the value of the Base Derivation Key using the Initial KSN portion of the current KSN as an index value, then use TDES DUKPT algorithms to calculate the value of the Initial Key; or
Look up the value of the Initial Key directly, using the Initial KSN portion of the current KSN as an index value.
For and , the device encrypts data using TDES in CBC-like chaining without an Initial Vector:
The device begins by TDES encrypting the first 8 bytes of clear text data. The 8-byte result is placed in an encrypted data buffer.
Continue using TDES CBC method with the encrypted 8 bytes XORed with the next 8 bytes of clear text; encrypt that result and place it into the encrypted data buffer.
Repeat until all clear text bytes have been encrypted.
The host must decrypt the data in 8-byte blocks, ignoring any final unused bytes in the last block. When a value consists of more than one block, use the CBC method to decrypt the data by following these steps:
Start decryption on the last block of 8 bytes (call it block N) using the key.
XOR the result of the decryption with the next-last block of 8 bytes (block N-1).
Repeat until reaching the first block.
Determine which variant of the current key the device used to encrypt. The variants are defined in ANS X9.24-1:2009 Annex A. Which variant the host should use depends on the type of data the host is decrypting. The encrypted portions of EMV ARQC and EMV Batch Data both use the Data Encryption, Request or Both Ways variant.
After the final clear text block is XORed with the prior 8 bytes of encrypted data, the device encrypts it and places it in the encrypted data value.
No Initial Vector is used.
Need Help?
For additional support, please contact MagTek Support:
Technical Support:
📧 Email: support@magtek.com
📞 Phone: 1-800-788-6835 (US) | +1-562-546-6616 (International)
🕐 Hours: Monday-Friday, 6:00 AM - 5:00 PM PST
Online Resources:
🌐 Official Site:
💬 Developer Forum:
Documentation Feedback:
Help us improve this documentation!