| Reader | Form factor | Contact | Contactless | PIN entry | Connection | Best for |
| DynaFlex II PED | Countertop, PIN pad + display | ✓ | ✓ | ✓ | USB, BLE | Attended checkout that needs PIN debit |
| DynaFlex II Go | Handheld, portable, battery | ✓ | ✓ | — | USB, Bluetooth LE | Mobile, curbside, line-busting |
| DynaFlex II SCR | Compact countertop | ✓ | ✓ | — | USB | Attended checkout without PIN |
| DynaProx | Contactless reader | — | ✓ | — | USB | Tap-only, transit, access control |
| Reference Section | Information Available |
| USB | Connecting over USB, including the HID interface the reader presents. |
| WLAN | Communicate via a TCP/IP network with MMS products connected to a wireless LAN access point |
| Bluetooth LE | Pairing and connecting over Bluetooth Low Energy. |
| RS-232/UART | Connect the host to the device using a serial connection such as RS-232 UART |
| SLIP Format | For connection types that do not include error detection and correction, such as serial protocols. |
| Apple iAP2 | Information about developing an iOS app that interfaces with the device via the USB connector using iPod Accessory Protocol (iAP2) |
| Reference Section | Information Available |
| Web-based Demo Documentation | Instructions for using the browser-based MagTek Demo Applications. |
| Web-based Demos | All interactive browser-based demonstrations for MagTek devices. |
| Reference Section | Information Available |
| Connection Basics | Information on the different ways products connect to hosts. |
| EMV Acceptance | Run a contact or contactless EMV transaction end to end. |
| L3 Certification Guidelines | The certification path, and how a common kernel speeds it up. |
| Security & Key Management | DUKPT, KSNs, MAC, encryption/decryption, TR-31, and PCI requirements. |
| NFC / MIFARE | Contactless cards and tags, pass-through, and card emulation. |
| Firmware & File Operations | Updating firmware and moving files to and from a device. |
| PAN vs DPAN / Network Tokens | Telling the real account number apart from tokens. |
| Google Wallet Smart Tap | A worked integration using the reader's contactless interface for Google Wallet value-added services (VAS) transactions, including connecting the device, sending the command set, and adding a Smart Tap pass. |
| DynaCast, NFC Card Emulation, and Business Use Cases | Background on card-emulation scenarios and where they apply. |
| Reference Section | Information Available |
| USB | Connecting over USB, including the HID interface the reader presents. |
| WLAN | Communicate via a TCP/IP network with MMS products connected to a wireless LAN access point |
| Bluetooth LE | Pairing and connecting over Bluetooth Low Energy. |
| RS-232/UART | Connect the host to the device using a serial connection such as RS-232 UART |
| SLIP Format | For connection types that do not include error detection and correction, such as serial protocols. |
| Apple iAP2 | Information about developing an iOS app that interfaces with the device via the USB connector using iPod Accessory Protocol (iAP2) |
| Byte Offset | Field Name | Field Value |
|---|---|---|
| 0 | Packet Type | 0x00 = Single Packet |
| 1 | Message Length | Message length, denoted as N |
| 2..N+1 | Message | Message exactly from section 2.7 |
| N+2..63 | Padding, if needed | 0x00 |
| Byte Offset | Field Name | Field Value |
|---|---|---|
| 0 | Packet Type | 0x01 = Multi-packet Head |
| 1..4 | Message Length | Total message length before decomposing into packets, denoted as N. If 62 or less, use Single Packet Format. |
| 5..63 | Message Part | First 59 bytes of message from section 2.7 |
| Byte Offset | Field Name | Field Value |
|---|---|---|
| 0 | Packet Type | 0x02 = Multi-Packet Middle |
| 1..2 | Packet Number | 0x0001 = First Multi-Packet Middle 0x0002 = Second Multi-Packet Middle Etc. up to 0xFFFF |
| 3..63 | Message Part | Next 61 bytes of message from section 2.7 |
| Byte Offset | Field Name | Field Value |
|---|---|---|
| 0 | Packet Type | 0x03 = Multi-Packet Tail |
| 1 | Remaining Message Length | Number of bytes of the message that are being transmitted in this final packet, denoted as n. |
| 2..n+1 | Message Part | Final n bytes of message exactly as described in section 2.7 |
| n+2..63 | Padding, if needed | 0x00 |
| Byte Offset | Field Name | Field Value |
|---|---|---|
| 0 | Packet Type | 0x04 = Multi-Packet Cancel |
| 1..2 | Reason for Cancel | 0x0000 = General |
| 3..63 | Padding | 0x00 |
| Object | Description |
| EMV ARQC | The authorization request you forward to the processor. |
| EMV ARPC | The issuer response you return via Resume Transaction. |
| EMV Batch Data | Clearing/settlement data returned at completion. |
| Terminal / Processing / Entry Point Configuration | Files that control kernel behavior (see EMV Configuration). |
| CA Public Keys | Required for Offline Data Authentication (ODA). |
| American Express DRL Configuration | AmEx contactless DRL handling. |
| Command | Description |
| Start Transaction 0x1001 | The host uses this command to start a payment transaction. |
| Resume Transaction 0x1004 | The host uses this command to provide the device with additional/modified data to resume a transaction that is currently paused. |
| Cancel Transaction 0x1008 | The host can use this command to cancel a transaction in progress that it initiated using Start Transaction. |
| Report Cardholder Selection 0x1802 | The host uses this command to provide a cardholder selection to the device when the device itself does not have a display or inputs to prompt the cardholder for a selection. |
| Notification | Description |
| Transaction Information Update 0x0101 | During a transaction. |
| Transaction Operation Complete 0x0105 | Upon completion of a transaction |
| Host Action Request 0x1803 | This notification requests that the host take action during operations involving the device’s User Interface modules. |
| Type | Description |
| EMV ARQC Type | Information on how the device formats ARQC messages. |
| EMV ARPC Type | Information on how the device formats ARPC messages, |
| EMV Batch Data Type | Information on the device formats EMV batch data, such as merchant data and pre-defined EMV batch data tags. |
| Configuration Objects | All Configuration Object Types can be found in Data Types and Shared TLV Data Objects Section. |
| Guide | Description |
| Security & Key Management | This section covers how DynaFamily readers protect cardholder data and manage keys. |
| NFC / MIFARE | DynaFamily readers with a contactless interface can exchange commands directly with NFC tags and MIFARE cards through pass-through commands and can present themselves as a card to another reader through NFC card emulation. |
| L3 Certification Guidelines | Pursuing an L3 Certification (Level 3 Certification) with an EMV (Europay, Mastercard, Visa) payment processor involves several steps. |
| Reference Section | Information Available |
| DUKPT: 3DES/TDEA --> AES Migration | How DUKPT derives a unique key per transaction, and the path (and reasons) for moving from legacy 3DES/TDEA DUKPT to AES DUKPT on your devices and host. |
| Key Serial Numbers (KSN) | What a KSN is, how it's structured, and how it identifies the unique key used to encrypt a given transaction under DUKPT. |
| Message Authentication Codes (MAC) | How a MAC lets the host and device confirm a message hasn't been altered in transit, and when one is required. |
| Encryption & Decryption | How the reader encrypts data at the point of read (SRED), how to determine which key was used, and how to decrypt the output on your host. |
| TR-31 Key Blocks | The ANSI TR-31 key-block format used to transport and load keys securely into the device. |
| PCI requirements (24-hour Reset, device lock) | The operational requirements the device enforces for PCI compliance: the 24-hour automatic reset and the device lock feature. |
| Reference Section | Information Available |
| Get Challenge | Requests a random challenge from the device, used to build a secured command. |
| Send Secured Command to Device | Transmits another command to the device securely. |
| Load Key using TR-31 | Loads a key into one of the device's secure key slots. |
| Challenge Device lock State/Passcode | Change the device's lock state or its lock passcode. |
| Get Key Info | Retrieves information about a key slot and the key stored in it. |
| PCI requirements (24-hour Reset, device lock) | The operational requirements the device enforces for PCI compliance: the 24-hour automatic reset and the device lock feature. |
| Reference Section | Information Available |
| Security Operation | This non-TLV data structure consists of four or five bytes that describes a security operation, including the algorithms and methods to be used in that operation. |
| Security Parameters | This structure contains an Encrypted Signature Capture FileType specifying the operation to be performed. |
| Key Information | Identifies the key being used for operation. |
| TR-31 Key Block | The data object, its tags, and structure (in the command reference). |
| Reference Section | Information Available |
| TR-31 Key Block | The data object, its tags, and structure (in the command reference). |
| Load Key using TR-31 | Loads a key into one of the device's secure key slots. |
| Security & Key Management | DUKPT, key serial numbers (KSN), and how keys are used once loaded. |
| Rev Number | Date | Notes |
| 100 | September 24, 2024 | Initial Release |
# Introduction ## About This Document This document provides instructions to use the *DynaFlex, DynaProx Utility* software for configuring a device to accept Google Wallet Smart Tap Passes. It is part of a larger library of documents designed to assist implementers. For details, see the product Support pages on [www.magtek.com.](http://www.magtek.com/) The following documents are essential: * D998200383 DynaFlex Family Programmer’s Manual ( COMMANDS ) ## System Requirements * A Windows 10 host with available USB port * Microsoft .NET 4.6.1 and above installed on the host * Microsoft Access Database Engine 2016 Redistributable installed on the host * USB-C cable with USB Type-A or USB-C for host connection * Software *1000007406 DynaFlex, DynaProx Utility*, provided by MagTek ## How to Download, Install, and Launch the Software To download *DynaFlex, DynaProx Utility* software, follow these steps. * Download the software with the name *1000007406.zip (DynaFlex, DynaProx Utility*) from MagTek. * Extract the .zip file on the host’s hard drive. * Install the *AccessDatabaseEngine.exe* from the folder *Access Database Engine* in the extracted folder. * Download and install Microsoft .NET 4.6.1 or above from [https://dotnet.microsoft.com/download/dotnet-framework.](https://dotnet.microsoft.com/download/dotnet-framework) * Launch *DynaFlexUtility.exe*. * See the steps in the sections below to connect to a device. ## Device Requirements * For Apple VAS and Google Wallet VAS transactions, see instructions for configuration in the SDK document appendix: * D998200380 MAGTEK UNIVERSAL SDK PROGRAMMER'S MANUAL (MICROSOFT.NET) # How to Connect to Devices Using DynaFlex Utility To connect via an interface listed in the Connection Type box, follow these steps. ## How to Connect Using the USB Connection * For best results, use the cable that is included with the device. * Connect the USB-C end of the cable to DynaFlex device.
Figure - Connecting DynaFlex to a USB Host
* If you plan to route the cable out the back of the device, route the cable through the cable management clip to change its direction. Even if you are not routing out the back, you may use the cable clip for strain relief, to help stabilize the mechanical connection when cardholders or operators move the device or the cable. * Route the cable in the desired direction (e.g., out the back, left, right, or down into the countertop). * Connect the other end of the USB cable to the host’s USB port. * As soon as the device starts receiving power through USB, it automatically powers on. * Launch the DynaFlex Utility and select DynaFlex device in the Device Type list, then press the connect button.AA00
[81] [4] 0117EF04
[84] [43]
EF0481010182207DD1722EC35C25737E7776D54D638C807EFC467EAF70A1F6909C5184 20CCCEE3830217DF
EF04
[81] [1] 01
[82] [32]
7DD1722EC35C25737E7776D54D638C807EFC467EAF70A1F6909C518420CCCEE3 (AES
Key : Key 0)
[83] [2] 17DF (CRC for content of Key
0) CRC16_MCRF45X(7DD1722EC35C25737E7776D54D638C807EFC467EAF70A1F6909C
518420CCCEE3)
AA00
[81] [4] 0118EF05
[84] [150]
EF0581010182040000000183020079858180B402AA3EC2EC15DE2DCF8B06C75038DD0C BDA17C03FE6A71DBF2757A6CD050C39B99E2E190FC11C80EB07F0E6E1CA4B19A2FCEF4
D35C48E0CF545045FC5F1E5C2973A8A8A05B33EBABD1D9A8FE6CBC7E55A1083AD3CB00 B452504015A96A82E3F0F49ACE94F20622251705071B73A56E8DAD2B971CD8865ACCB6 6A169DF0BEF88602BB2E
EF05
[81] [1] 01
[82] [4] 00000001
[83] [2] 0079
[85] [128]
B402AA3EC2EC15DE2DCF8B06C75038DD0CBDA17C03FE6A71DBF2757A6CD050C39B99E2
E190FC11C80EB07F0E6E1CA4B19A2FCEF4D35C48E0CF545045FC5F1E5C2973A8A8A05B 33EBABD1D9A8FE6CBC7E55A1083AD3CB00B452504015A96A82E3F0F49ACE94F2062225
1705071B73A56E8DAD2B971CD8865ACCB66A169DF0BEF8 ( Encrypted
Key AES(Key 1) with Key 0)
[86] [2] BB2E (CRC for encrypted
key) CRC16_MCRF45X(B402AA3EC2EC15DE2DCF8B06C75038DD0CBDA17C03FE6A71DB F2757A6CD050C39B99E2E190FC11C80EB07F0E6E1CA4B19A2FCEF4D35C48E0CF545045 FC5F1E5C2973A8A8A05B33EBABD1D9A8FE6CBC7E55A1083AD3CB00B452504015A96A82 E3F0F49ACE94F20622251705071B73A56E8DAD2B971CD8865ACCB66A169DF0BEF8)
PRIVATE
Key 30770201010420826D17E50767B165B0E4D9E332F8D1D1E20224284FB4DAF1E50 A03246E70797DA00A06082A8648CE3D030107A14403420004721C978FCEBDCDF98A851 8BDC4FEDFD802B4EE4128E2513B665593375E238786014E7CBE8511915DC5337AF57DC D248F2653C7A6AAAEE6913096FD71C85BC4D7
Encrypted
LTPK B402AA3EC2EC15DE2DCF8B06C75038DD0CBDA17C03FE6A71DBF2757A6CD050C3 9B99E2E190FC11C80EB07F0E6E1CA4B19A2FCEF4D35C48E0CF545045FC5F1E5C2973A8 A8A05B33EBABD1D9A8FE6CBC7E55A1083AD3CB00B452504015A96A82E3F0F49ACE94F2 0622251705071B73A56E8DAD2B971CD8865ACCB66A169DF0BEF8
CRC for Key BB2E
AA00
[81] [4] 820AEF05
[82] [4] 00000000
[84] [8] EF05810400000001
EF05
[81] [4] 00000001
AA00
[81] [4] 0110D111
[84] [41] D11181072B06010401F6098501018919E117E115E113E111D00FDF 7C083230313830363038DF7D0103
D111
[81] [7] 2B06010401F609
[85] [1] 01
[89] [25] E117E115E113E111D00FDF7C083230313830363038DF7D0103
DF7C [08] 3230313830363038 Collector ID
DF7D [01] 03 (Type)
AA00
[81] [4] 010BD111
[84] [30]
D11181072B06010401F609850101890EE10CE10AE108E106DA0408140300
D111
[81] [7] 2B06010401F609
[85] [1] 01
[89] [14] E10CE10AE108E106DA0408140300
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| A1 | var | TLV data object A1 contains four directly nested TLV data objects: 81, 82, A3, and 84 (A1/81, A1/82, A1/A3, and A1/84). A1/82 is optional (Req = O), so the length of A1 will vary depending on whether or not A1/82 is included (Len = var). | T | R | |
| /81 | 01 | TLV data object A1/81 contains one byte and is required. It has no default value because it must be explicitly included. | B | R | |
| /82 | 03 | TLV data object A1/82 contains three bytes but is optional. If not included, the device assumes the default value 0x4D6F6D. | B | O | 0x4D6F6D |
| /A3 | 08 | TLV data object A1/A3 contains two TLV data objects: 81 and 82 (A1/A3/81 and A1/A3/82). Its length is the combined length of its two nested objects. | T | R | |
| //81 | 03 | TLV data object A1/A3/81 contains three bytes and is required. | B | R | |
| //82 | 01 | TLV data object A1/A3/82 contains one byte and is required. | B | R | |
| /84 | 03 | TLV data object A1/84 contains three bytes that represent distinct values stored directly inside A1/84 instead of separate nested TLVs. | B | R | |
| //null | (1) | Raw byte inside 84 (no TLV). Tag shown as /null, length in parentheses. | B | R | |
| //null | (1) | Another raw byte inside 84. | B | R | |
| //null | (1) | Another raw byte inside 84. | B | R |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| - | - | One byte standard Start of Message constant, not in TLV format. 0xAA = Standard start of message byte. | - | - | - |
| - | - | One-byte standard API Framework Version, not TLV. Values: 0x00 = Pre-production, 0x01 = First production release, 0x02 = Second production release, etc. | - | - | - |
| 81 | var | Message Information | B | R | |
| /null | (1) | Message Type & Direction:
| B | R | |
| /null | (1) | Message Reference Number | B | R | |
| /null | (2) | Command ID — fully qualified Command number (Command Group, Command within that group). If the Request Payload contains wrappers, the host should specify the command invoked at the core after wrappers are removed. | B | R | |
| /null | (var) | Reserved | O | ||
| 84 | var | Request Payload — as documented in the message’s Request table in section Commands. | B | R | |
| 9E | var | Reserved | B | O |
| Grp | Sub | Cde | Meaning |
| 00 | 00 | 00 | All good / requested operation was successful. |
| 00 | 00 | 02 | Requested Operation Failed |
| 00 | 00 | 10 | Setting up RTC data and time failure |
| 00 | 00 | 11 | Setting up RTC alarm failure |
| 00 | 00 | 12 | Key generation failure |
| 00 | 00 | 13 | Tamper setting is locked, can’t be changed |
| 00 | 00 | 14 | Tamper setting requires system reset to continue |
| 00 | 00 | 15 | Tamper status can’t be cleared, failure |
| 00 | 00 | 16 | Device has been tampered, need attention |
| 00 | 00 | 17 | Tamper module failed for other cases |
| 00 | 00 | 18 | Setting WLAN SoftAP password failure |
| Grp | Sub | Cde | Meaning |
| 01 | 01 | 01 | Generic Failure. |
| 01 | 01 | 02 | Bad message parameter. The host has sent a message to the device that is not constructed properly. |
| 01 | 01 | 09 | Device offline, can not process messages. For example, the device returns this detail code when it does not have keys injected or has registered a tamper. |
| 01 | 01 | 10 | PIN Key Not Mapped. |
| 01 | 01 | 13 | Feature Not Available |
| Grp | Sub | Cde | Meaning |
| 02 | 00 | 00 | Reserved |
| 02 | 01 | 00 | Reserved |
| 02 | 01 | 01 | Generic Failure |
| 02 | 01 | 02 | Bad Message Parameter |
| 02 | 01 | 03 | Response Payload too big |
| 02 | 01 | 07 | Internal FW Failure |
| 02 | 01 | 0A | Image Failure |
| 02 | 01 | 19 | Key does not exist |
| 02 | 01 | 1A | Not Secured |
| 02 | 01 | 1B | Passcode validation failed |
| 02 | 01 | 1C | Device is locked |
| 02 | 01 | 1D | Device in Restricted mode |
| 02 | 02 | 00 | Reserved |
| 02 | 03 | 04 | Failed, device state issue, no transaction. |
| 02 | 03 | 05 | Failed, device state issue, cannot cancel. |
| 02 | 03 | 08 | Failed, device state, Transaction in Progress. |
| 02 | 03 | 0C | Failed, device state, Signature Not allowed |
| 02 | 03 | 0D | Failed, device state, Wrong Transaction State |
| 02 | 03 | 0E | Failed, device state, Invalid PIN Entry State |
| 02 | 03 | 0F | Failed, device state, PIN Entry in Session. |
| 02 | 03 | 11 | Failed, device state, Barcode Read in Progress. |
| 02 | 03 | 12 | Failed, device state, Pass-through command Not Activated. |
| 02 | 03 | 14 | Failed, device state, UI Settings in Progress. |
| 02 | 03 | 15 | Failed, device state, Buzzer in Progress |
| 02 | 03 | 16 | Failed, device state, Low Battery (5% or less) |
| 02 | 03 | 18 | Request is invalid while card emulation is in progress |
| 02 | 03 | 1E | Failed, device state, pass-through mode started |
| 02 | 03 | 1F | Failed, device state, pass-through mode is not started |
| 02 | 03 | 20 | Failed, device state, pass-through mode APDU is in progress |
| 02 | 04 | 13 | Failed, BCR hardware not found. |
| 02 | 05 | 01 | Invalid TR31parameter |
| 02 | 05 | 02 | Invalid AES length |
| 02 | 05 | 03 | Invalid 16-Byte Boundary |
| 02 | 05 | 04 | Invalid Length in Message |
| 02 | 05 | 05 | Invalid number of optional KBH |
| 02 | 05 | 06 | Error in conversion of data type |
| 02 | 05 | 07 | Invalid KCV algorithm |
| 02 | 05 | 08 | Invalid KCV length |
| 02 | 05 | 09 | Invalid Optional KBH ID |
| 02 | 05 | 0A | Invalid KBH ID |
| 02 | 05 | 0B | Invalid algorithm used in KBH |
| 02 | 05 | 0C | Invalid KBH usage |
| 02 | 05 | 0D | Invalid KBH length |
| 02 | 05 | 0E | Invalid version ID for key derivation |
| 02 | 05 | 0F | Invalid KBH mode of use |
| 02 | 05 | 10 | TR31 engine not installed |
| 02 | 05 | 11 | Invalid Cryptographic operation |
| 02 | 05 | 12 | MAC Verification Failed |
| 02 | 05 | 13 | Error in Decrypting Key data |
| 02 | 05 | 14 | Error in computing MAC over entire message |
| 02 | 05 | 15 | Invalid MAC length |
| 02 | 05 | 16 | KDF Error |
| 02 | 05 | 17 | Buffer Insufficient |
| 02 | 05 | 18 | Invalid Storage KPM |
| 02 | 05 | 19 | Invalid Storage Secure RAM |
| 02 | 05 | 1A | Invalid Key ID specified in option block |
| 02 | 05 | 1B | Unsupported Key ID specified in option block |
| 02 | 05 | 1C | Invalid Key ID Relationship |
| 02 | 05 | 1D | Protection Key ID not loaded |
| 02 | 05 | 1E | Invalid Data Tag MagTek Custom option block |
| 02 | 05 | 1F | Invalid Kcv |
| 02 | 05 | 20 | Invalid Data |
| 02 | 05 | 21 | Invalid DUKPT key derivation |
| 02 | 05 | 22 | Invalid Exportability |
| 02 | 05 | 23 | Invalid Key Class |
| 02 | 05 | 24 | Invalid DSN |
| 02 | 05 | 25 | Invalid Challenge |
| 02 | 05 | 26 | Key Undeletable |
| 02 | 05 | 27 | Key not present |
| 02 | 05 | 28 | Unsupported Keyset ID |
| 02 | 05 | 29 | KPM Error |
| 02 | 05 | 2A | Secure RAM Error |
| 02 | 05 | 2B | Duplicated Key |
| 02 | 05 | 2C | Invalid Key Usage Rule |
| 02 | 05 | 2D | Selftest Key Corrupted |
| 02 | 05 | 2E | Selftest System Key Bitmap Corrupted |
| 02 | 05 | 2F | Selftest System Key Missing |
| 02 | 05 | 30 | Selftest System Key Not Loaded |
| 02 | 05 | 31 | Invalid Key Storage Limit |
| 02 | 05 | 32 | Duplicated Key set |
| 02 | 05 | 33 | Key Restriction |
| 02 | 05 | 34 | Key Transported by Weaker key |
| 02 | 05 | 35 | Repeat Key Agreement |
| 02 | 05 | 36 | Security not activated |
| 02 | 05 | 37 | Selftest key relocated |
| 02 | 05 | 38 | Invalid Selftest Scanned Versus Saved Bitmap |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| - | - | One byte standard Start of Message constant, not TLV. 0xAA = Standard start of message byte. | - | - | - |
| - | - | One-byte standard API Framework Version, not TLV. Values as in requests/responses. | - | - | - |
| 81 | 4 | Message Information | B | R | |
| /null | (1) | Message Type & Direction:
| R | ||
| /null | (1) | Reserved, set to 0x00 | R | ||
| /null | (1) | Notification Source — this byte and Notification Type form the first two bytes of a six-byte Notification ID. Use this byte to look up the Notification Group in Notifications. Example values:
| R | ||
| /null | (1) | Notification Type — append to Notification Source to identify specific notification (e.g.,
| R | ||
| /null | (var) | Reserved | O | ||
| 82 | (4) | Notification Detail Code — combined with Notification Source and Notification Type to form a unique six-byte Notification ID. See Notifications for notification-specific detail codes. | B | R | |
| /null | 1 | Category — e.g., 0x00 = Power/Reset | B | R | |
| /null | 1 | Reason — e.g., 0x02 = Battery | B | R | |
| /null | 1 | Reason Detail (Subgroup) — e.g., 0x01 = Power Down Imminent | B | R | |
| /null | 1 | Reserved, set to 0x00 | B | R | |
| 83 | var | Additional Detail — see notification definition in Notifications. | O | ||
| 84 | var | Notification Payload — as documented in the notification’s table in Notifications. | B | O | |
| 9E | var | Reserved | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| - | - | One byte standard Start of Message constant, not TLV. 0xAA = Standard start of message byte. | - | - | - |
| - | - | One-byte standard API Framework Version, not TLV. Values as in requests/responses. | - | - | - |
| 81 | 08 | Message Information | B | R | |
| /null | (1) | Message Type & Direction:
| B | R | |
| /null | (1) | Message Reference Number — host value to match responses. | B | R | |
| /null | (2) | Command Number that prompted this message (see Command Group 0xD8nn - File Operations). | B | R | |
| /null | (4) | File Type — the file type as defined in File Operations - Command Group 0xD8nn. | B | R | |
| 84 | var | File Payload — as documented in About Files. | B | R |
| Tag | Len | Value / Description | Typ | Req | Default |
| 2-byte MSB message length excluding padding and CBC-MAC | |||||
| F9 | var | Container for MAC structure and generic data | T | R | |
| /DFDF54 | var | MAC KSN | B | R | |
| /DFDF55 | 01 | MAC Encryption Type See Encryption Type for a list of valid values. | B | R | |
| /DFDF25 | var | Device Serial Number (IFD Serial Number) | B | R | |
| /FA | var | Container for generic data | T | R | |
| //70 | var | Container for ARQC | T | R | |
///82 |
02 | Application Interchange Profile Available on: DynaFlex I FW Ver CA1 or newer DynaProx FW Ver A8 or newer DynaFlex II FW Ver A6 or newer |
B |
O | |
///9F6E |
var | Third Party Data
Available on: DynaFlex I FW Ver CA1 or newer DynaProx FW Ver A8 or newer DynaFlex II FW Ver A6 or newer |
B |
O | |
///DFDF53 |
01 | Fallback Indicator · 0x00 = No Fallback · 0x01 = Technical Fallback · 0x81 = MSR Fallback |
B |
R | |
///DFDF33 |
var | Masked Track 2 MSR Data If the payment method presented by the cardholder provides it |
AN |
O | |
///DFDF4D |
var | Masked Track 2 ICC Data If the payment method presented by the cardholder provides it |
AN |
O | |
///DFDF52 |
01 | Card Type · 0x00 = Other · 0x01 = Magnetic Stripe ISO/ABA Financial (MSR) · 0x02 = Magnetic Stripe AAMVA (MSR) · 0x03 = Manual Entry · 0x04 = Unknown · 0x05 = Contact Chip Card (ICC) · 0x06 = Contactless Chip Card (PICC), EMV · 0x07 = MSR Financial and Contact Chip Card (ICC) |
B |
R |
| Tag | Len | Value / Description | Typ | Req | Default |
| ///FF42 | var | Container for Selectable Encrypted Card Data Set Up OID 1.1.2.6.1.1 to enable this container. | T | O | |
| ////DFDFDF37 | var | Selectable Encrypted Data Primitive Decrypt the value of this TLV data object using the algorithm and variant specified in the Selectable Encrypted Data KSN parameter and the Selectable Encrypted Data Encryption Type parameter. See EMV ARQC (DynaPro Format) DFDFDF37 Decrypted Contents for the data structure as it should appear after decryption. (This item will be present if 0xFF42 is enabled) | B | O | |
| ////DFDFDF38 | 0C | Selectable Encrypted Data KSN (This item will be present if 0xFF42 is enabled) | B | O | |
| ////DFDFDF39 | 01 | Selectable Encrypted Data Encryption Type (This item will be present if 0xFF42 is enabled) | B | O | |
| ///DF2A | 06 | Tip Mode Sale Amount Entered | B | O | |
| ///DF2B | 06 | Tip Mode Total Amount | B | O | |
| ///DF5D | 06 | Tip Amount | B | O | |
| ///DF5E | 06 | Tax Amount | B | O | |
| ///F8 | var | Container for Encrypted Data | T | R | |
////DFDF59 |
var | Encrypted Data Primitive Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Transaction Data KSN parameter and the Encrypted Transaction Data Encryption Type parameter to read its contents. See Table for the data structure as it should appear after decryption. |
B |
R | |
| ////DFDF56 | var | Encrypted Transaction Data KSN | B | R | |
| ////DFDF57 | 01 | Encrypted Transaction Data Encryption Type See Encryption Type for a list of valid values. | B | R | |
////DFDF58 |
01 | Number of Padding Bytes Number of bytes added to DFDF59 value to force its length to a multiple of 8 bytes for TDES, or 16 bytes for AES. |
B |
R | |
| /FE | Var | VAS Data Container | T | O | |
| /FF40 | Var | Fleet Data Container (Common Kernel Only) | T | O |
| Tag | Len | Value / Description | Typ | Req | Default |
| Padding to ensure the length of data, starting with the message length at the very beginning, and ending with any additional padding, is a multiple of 8 bytes for TDES, or 16 bytes for AES. This is a requirement of using the CBC-MAC algorithm. | |||||
| Four-byte CBC-MAC. The host should calculate the CBC-MAC and verify that it matches. For details about calculating a CBC-MAC, see About Message Authentication Codes (MAC). |
| Tag | Len | Value / Description | Typ | Req | Default |
FC |
var | Decrypted Data Container Inside this container, the device inserts all EMV TLV data objects specified by the setting in Property EMV ARQC Message Tag List - 1.1.1.1.1.2. The remainder of this table shows the basic structure and content of MagTek custom tags. For definitions of all other standard EMV tags that can be included directly under container FC. |
T |
R | |
/DF29 |
08 | Only if tag DF29 is included in Property EMV ARQC Message Tag List - 1.1.1.1.1.2.
|
B |
O |
| Tag | Len | Value / Description | Typ | Req | Default |
| /F4 | var | Container for encrypted MSR data (MSR Only) | T | O | |
//DFDF36 |
01 | Encrypted Track 1 Status (MSR Only) · 0x00 = OK · 0x01 = Empty · 0x02 = Error · 0x03 = Disabled |
B |
O | |
| //DFDF37 | var | Encrypted Track 1 Data (MSR Only) | B | O | |
//DFDF38 |
01 | Encrypted Track 2 Status (MSR Only) · 0x00 = OK · 0x01 = Empty · 0x02 = Error · 0x03 = Disabled |
B |
O | |
| //DFDF39 | var | Encrypted Track 2 Data (MSR Only) | B | O | |
//DFDF3A |
01 | Encrypted Track 3 Status (MSR Only) · 0x00 = OK · 0x01 = Empty · 0x02 = Error · 0x03 = Disabled |
B |
O |
| Tag | Len | Value / Description | Typ | Req | Default |
| //DFDF3B | var | Encrypted Track 3 Data (MSR Only) | B | O | |
//DFDF3C |
var | Encrypted MagnePrint Data (MSR Only) Only included for MSR swipe transactions and when Track Data and Magneprint are using the same KSN. |
B |
O | |
//DFDF43 |
04 | MagnePrint Status Data (MSR Only) Only included for MSR swipe transactions and when Track Data and Magneprint are using the same KSN.
|
B |
O | |
//DFDF50 |
var | MSR KSN Data (MSR Only) Key Serial Number for the key the host should use to decrypt Encrypted Track 1 Data, Encrypted Track 2 Data, Encrypted Track 3 Data and Encrypted MagnePrint Data. |
B |
O | |
| //DFDF51 | 01 | MSR Encryption Type (MSR Only) See Encryption Type for a list of valid values. | B | O | |
/FF73 |
var | Container for Encrypted MagnePrint Data (MSR Only) Only included when Track Data and MagnePrint encryption keys are using different KSN |
T |
O | |
| //DFDF3C | var | Encrypted MagnePrint Data (MSR Only) Only included for MSR swipe transactions. | B | O | |
//DFDF43 |
04 | MagnePrint Status Data (MSR Only) Only included for MSR swipe transactions.
|
B |
O |
| Tag | Len | Value / Description | Typ | Req | Default |
//DFDF50 |
var | MSR KSN Data (MSR Only) Key Serial Number for the key the host should use to decrypt Encrypted MagnePrint Data. |
B |
O | |
| //DFDF51 | 01 | MSR Encryption Type (MSR Only) See Encryption Type for a list of valid values. | B | O | |
/F5 |
var | Container for Encrypted PIN Data (Touch Only) Contains ISO PIN Block formatted data in the nested Encrypted PIN Data object, plus supporting information to decrypt it. The host should use the current PIN DUKPT working key specified in the supporting information. |
T |
O | |
//DF71 |
01 | PIN Block Format (Touch Only) · 0x00 = ISO Format 0 · 0x01 = ISO Format 1 · 0x03 = ISO Format 3 · 0x04 = ISO Format 4 |
B |
O | |
| //99 | 08 | Encrypted PIN Data (Touch Only) | B | O | |
| //DFDF41 | var | PIN KSN Data (Touch Only) | B | O | |
| //DFDF42 | 01 | PIN Encryption Type (Touch Only) See Encryption Type for a list of valid values. | B | O | |
| Padding to force DFDF59 plus padding to be a multiple of 8 bytes |
| Tag | Len | Value / Description | Typ | Req | Default |
FC |
var | Decrypted Data Container Inside this container, if the data is not available for a given selected card data, the tag will still get transmitted with a length of ‘1’ and value = ‘*’. |
T |
R | |
/5F20 |
var | Only if Byte 0 – Bit 0 is set in Selectable Card Data Encryption Enable - Property 1.1.2.6.1.1.
Cardholder Name |
an |
O | |
| /5A | var | Only if Byte 0 – Bit 1 is set in Selectable Card Data Encryption Enable - Property 1.1.2.6.1.1. | n15/ n16 | O |
| Tag | Len | Value / Description | Typ | Req | Default |
Primary Account Number | |||||
/5F24 |
02/ 03 | Only if Byte 0 – Bit 2 is set in Property 1.1.2.6.1.1 Selectable Card Data Encryption Enable.
Expiration Date, YYMM or YYMMDD |
n4/ n6 |
O | |
/5F30 |
02 | Only if Byte 0 – Bit 3 is set in Property 1.1.2.6.1.1 Selectable Card Data Encryption Enable.
Service Code |
n3 |
O | |
/9F1F |
var | Only if Byte 0 – Bit 4 is set in Property 1.1.2.6.1.1 Selectable Card Data Encryption Enable.
T1 Discretionary Data |
an |
O | |
/9F20 |
var | Only if Byte 0 – Bit 5 is set in Property 1.1.2.6.1.1 Selectable Card Data Encryption Enable.
T2 Discretionary Data |
cn |
O | |
| Padding to force DFDFDF37 plus padding to be a multiple of 16 bytes for AES encryption. |
| Tag | Len | Value / Description | Typ | Req | Default |
FC |
var | Decrypted Data Container This contains all EMV TLV data objects specified in |
T |
R | |
| /FE | Var | VAS Data Container | T | O | |
| Padding to ensure the length of data, starting with the message length at the very beginning, and ending with any additional padding, is a multiple of 8 bytes for TDES, or 16 bytes for AES. This is a requirement of using the CBC-MAC algorithm. |
| Tag | Len | Value / Description | Typ | Req | Default |
FC |
var | Decrypted Data Container Inside this container, the device inserts all EMV TLV data objects specified by the setting in EMV ARQC Message Tag List - Property 1.1.1.1.1.2. The remainder of this table shows the basic structure and content of MagTek custom tags. For definitions of all other standard EMV tags that can be included directly under container FC, see Financial Settings. |
T |
R | |
| /9F41 | 04 | Transaction Counter | B | R |
| Tag | Len | Value / Description | Typ | Req | Default |
| Starts at 00000000 each time the device powers up or resets, increments for each transaction. | |||||
/DFDF36 |
01 | MSR Track 1 Status · 0x00 = OK · 0x01 = Empty · 0x02 = Error · 0x03 = Disabled |
B |
O | |
| /DF41 | var | MSR Track 1 Clear Text | AN | O | |
/DFDF38 |
01 | MSR Track 2 Status · 0x00 = OK · 0x01 = Empty · 0x02 = Error · 0x03 = Disabled |
B |
O | |
| /DF42 | var | MSR Track 2 Clear Text | AN | O | |
/DFDF3A |
01 | MSR Track 3 Status · 0x00 = OK · 0x01 = Empty · 0x02 = Error · 0x03 = Disabled |
B |
O | |
| /DF43 | var | MSR Track 3 Clear Text | AN | O | |
/DFDF43 |
04 | MagnePrint Status The device only includes this if MSR and MagnePrint data are both included in the transaction and the device is configured to encrypt them using the same key, to avoid consuming two DUKPT keys encrypting separate containers. If the device is configured to encrypt MSR and MagnePrint data using different keys, it provides MagnePrint data in the Container for Encrypted MagnePrint Data instead.
|
B |
O |
| Tag | Len | Value / Description | Typ | Req | Default |
/DF44 |
var | MagnePrint Data The device only includes this if MSR and MagnePrint data are both included in the transaction and the device is configured to encrypt them using the same key. The host can use this data in conjunction with Magensa services to determine whether the swiped card is authentic. |
B |
O | |
| /FE | Var | VAS Data Container | T | O |
| Tag | Len | Value / Description | Typ | Req | Default |
| FC | var | Decrypted Data Container | T | R | |
/DFDF43 |
var | MagnePrint Status The device only includes this when MSR and MagnePrint data are included in the transaction, but the device is configured to encrypt them using a different key.
|
B |
R | |
/DF44 |
var | MagnePrint Data The host can use this data in conjunction with Magensa services to determine whether the swiped card is authentic. |
B |
R | |
| /DF4B | var | MSR PAN | B | R | |
| /FE | Var | VAS Data Container | T | O |
| Tag | Len | Value / Description | Typ | Req | Default |
| /FE | var | VAS Data Container | T | O | |
| //FF01 | var | Apple VAS Container Slot 1 Container | B | O | |
| ///9F27 | var | VAS Data Up to 128 bytes. | B | O | |
| ///9F2A | var | Mobile Token Up to 36 bytes. | B | O | |
| //FF02 | var | Apple VAS Container Slot 2 Container | B | O | |
| ///9F27 | var | VAS Data Up to 128 bytes. | B | O | |
| ///9F2A | var | Mobile Token Up to 36 bytes. | B | O | |
| //FF03 | var | Apple VAS Container Slot 3 Container | B | O | |
| ///9F27 | var | VAS Data Up to 128 bytes. | B | O | |
| ///9F2A | var | Mobile Token Up to 36 bytes. | B | O | |
| //FF04 | var | Apple VAS Container Slot 4 Container | B | O | |
| ///9F27 | var | VAS Data Up to 128 bytes. | B | O | |
| ///9F2A | var | Mobile Token Up to 36 bytes. | B | O | |
| //FF05 | var | Apple VAS Container Slot 5 Container | B | O | |
| ///9F27 | var | VAS Data Up to 128 bytes. | B | O | |
| ///9F2A | var | Mobile Token Up to 36 bytes. | B | O | |
| //FF06 | var | Apple VAS Container Slot 6 Container | B | O | |
| ///9F27 | var | VAS Data Up to 128 bytes. | B | O | |
| ///9F2A | var | Mobile Token Up to 36 bytes. | B | O | |
| //FF41 | var | Google Smart Tap Container | B | O | |
| ///FF01 | var | Collector ID Slot 1 Container | B | O | |
| ////DF7B | var | Service Response NDEF Record | B | O | |
| ///FF02 | var | Collector ID Slot 2 Container | B | O | |
| ////DF7B | var | Service Response NDEF Record | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
| ///FF03 | var | Collector ID Slot 3 Container | B | O | |
| ////DF7B | var | Service Response NDEF Record | B | O | |
| ///FF04 | var | Collector ID Slot 4 Container | B | O | |
| ////DF7B | var | Service Response NDEF Record | B | O | |
| ///FF05 | var | Collector ID Slot 5 Container | B | O | |
| ////DF7B | var | Service Response NDEF Record | B | O | |
| ///FF06 | var | Collector ID Slot 6 Container | B | O | |
| ////DF7B | var | Service Response NDEF Record | B | O |
| Tag | Len | Value / Description | Typ | Req | Default | |
| /FF40 | var | Fleet Data Container | T | O | ||
| //DF30 | var | Prompting | B | O | ||
| //DF32 | var | Purchase Restrictions | B | O | ||
| //DF33 | var | B | O | |||
| //DF34 | var | Chip Offline purchase Restrictions for Fuel | B | O | ||
| //DF35 | var | Chip Offline purchase Restrictions for Non-fuel | B | O | ||
| //DF36 | var | Relationship Codes | B | O | ||
| //DF37 | var | 3rd Party Reference Data Generation 2 | B | O | ||
| //DF38 | var | Loyalty ID | B | O | ||
| //DF39 | var | Purchase Device Sequence Number | B | O | ||
| //DF40 | var | Generic Tag | B | O | ||
| //DF41 | var | Vehicle/Trailer Number | B | O | ||
| //DF42 | var | Vehicle Tag | B | O | ||
| //DF43 | var | Driver ID | B | O | ||
| //DF44 | var | Driver’s License Number | B | O | ||
| //DF45 | var | Driver’s License State/Province Abbreviation | B | O | ||
| //DF46 | var | Driver’s License Name Abbreviation | B | O | ||
| //DF47 | var | Date of Birth | B | O | ||
| //DF48 | var | Zip/Postal Code | B | O | ||
//DF49 – //DF51 | var | IFSR Reserved for Future Use | B | O | ||
| //DF52 | var | Trailer Number | B | O |
| Tag | Len | Value / Description | Typ | Req | Default | |
| //DF53 | var | Employee Number | B | O | ||
| //DF54 | var | Work Order / Purchase Order Number | B | O | ||
| //DF55 | var | Additional Prompted Data 1 | B | O | ||
| //DF56 | var | Additional Prompted Data 2 | B | O | ||
| //DF57 | var | Proprietary Data | B | O | ||
| //9F5A | var | B | O | |||
| //9F0A | var | ASRPD | B | O | ||
| //9F6E | var | M/C Fleet | B | O | ||
| //9FD4 | var | B | O | |||
| //9F50 | var | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| FF74 | var | Container for non-MAC ARPC | T | R | |
| /DFDF25 | var | Device Serial Number (IFD Serial Number) | B | R | |
| /FA | var | Container for generic data | T | R | |
| //70 | var | Container for ARPC | T | R | |
| ///8A | 02 | Authorization Response Code
| AN | R | |
| ///91 | var | Issuer Authentication Data As defined in EMV Integrated Circuit Card Specifications for Payment Systems 4.3. | B | O | |
| ///71 | var | Issuer Script Template 1 As defined in EMV Integrated Circuit Card Specifications for Payment Systems 4.3. The host may include as many instances of this parameter as needed, up to a maximum length of 128 bytes including Tags and Lengths. | B | O | |
| ///72 | var | Issuer Script Template 2 As defined in EMV Integrated Circuit Card Specifications for Payment Systems 4.3. The host may include as many instances of this parameter as needed, up to a maximum length of 128 bytes including Tags and Lengths. | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 2-byte MSB message length excluding padding and CBC-MAC | |||||
| F9 | var | Container for MAC structure and generic data | T | R | |
| /DFDF54 | var | MAC KSN | B | R | |
| /DFDF55 | 01 | MAC Encryption Type See Encryption Type for a list of valid values. | B | R | |
| /DFDF25 | var | Device Serial Number (IFD Serial Number) | B | R | |
| /FA | var | Container for Generic Data | T | R | |
| //F0 | var | Transaction Results | T | R | |
| ///F1 | var | Container for Status Data | T | R | |
| ////DFDF1A | 01 | Transaction Status
| B | R | |
| ////DFDF1B | 01 | Additional Transaction Information 0x00 | B | R | |
| ///F8 | var | Container for Encrypted Data | T | R | |
| ////DFDF59 | var | Encrypted Data Primitive Decrypt the value of this TLV data object according to the Encrypted Transaction Data KSN parameter and the Encrypted Transaction Data Encryption Type parameter to read its contents. See EMV Batch Data (DynaPro Format) DFDF59 Decrypted Content for the data structure as it should appear after decryption. Use the data variant of the current MSR DUKPT working key used in the relevant transaction. | B | R | |
| ////DFDF56 | var | Encrypted Transaction Data KSN | B | R | |
| ////DFDF57 | 01 | Encrypted Transaction Data Encryption Type See Encryption Type for a list of valid values. | B | R | |
| ////DFDF58 | 01 | Number of padding bytes added to DFDF59 value to force length to a multiple of 8 bytes | B | R | |
| ///F7 | var | Merchant Data This contains an instance of Merchant Data Container. | T | R | |
| /FE | Var | VAS Data Container See VAS Data Container Payload | T | O | |
| Padding to ensure the length of data, starting with the message length at the very beginning, and ending with any additional padding, is a multiple of 8 bytes for TDES, or 16 bytes for AES. This is a requirement of using the CBC-MAC algorithm. | |||||
| Four-byte CBC-MAC. The host should calculate the CBC-MAC and verify that it matches. For details about calculating a CBC-MAC, see About Message Authentication Codes (MAC). |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| FC | var | Decrypted Data Container | T | ||
| /F2 | var | Container for Batch Data This data object contains the set of EMV TLV data objects specified in EMV Batch Data Tag List - Property 1.1.1.1.1.3. | T | ||
| //DF29 | 08 | Only if tag DF29 is included in EMV Batch Data Tag List - Property 1.1.1.1.1.3
| B | O | |
| /F3 | var | (EMV Contact Only) Container for Reversal Data, if any This data object contains the set of EMV TLV data objects specified in EMV Reversal Data Tag List - Property 1.1.1.1.1.4 . | T | O | null |
| /F4 | var | Container for encrypted MSR data (MSR Only) | T | O | |
| //DFDF36 | 01 | Encrypted Track 1 Status (MSR Only)
| B | O | |
| //DFDF37 | var | Encrypted Track 1 Data (MSR Only) | B | O | |
| //DFDF38 | 01 | Encrypted Track 2 Status (MSR Only)
| B | O | |
| //DFDF39 | var | Encrypted Track 2 Data (MSR Only) | B | O | |
| //DFDF3A | 01 | Encrypted Track 3 Status (MSR Only)
| B | O | |
| //DFDF3B | var | Encrypted Track 3 Data (MSR Only) | B | O | |
| //DFDF3C | var | Encrypted MagnePrint Data (MSR Only) Only included for MSR swipe transactions and when Track Data and Magneprint are using the same KSN. | B | O | |
| //DFDF43 | 04 | MagnePrint Status Data (MSR Only) Only included for MSR swipe transactions and when Track Data and Magneprint are using the same KSN. | B | O | |
| //DFDF50 | var | MSR KSN Data (MSR Only) | B | O | |
| //DFDF51 | 01 | MSR Encryption Type (MSR Only) See Encryption Type for a list of valid values. | B | O | |
| /FF73 | var | Container for Encrypted MagnePrint Data (MSR Only) Only included when Track Data and MagnePrint encryption keys are using different KSN | T | O | |
| //DFDF3C | var | Encrypted MagnePrint Data (MSR Only) Only included for MSR swipe transactions. | B | O | |
| //DFDF43 | 04 | MagnePrint Status Data (MSR Only) Only included for MSR swipe transactions. | B | O | |
| //DFDF50 | var | MSR KSN Data (MSR Only) Key Serial Number for the key the host should use to decrypt Encrypted MagnePrint Data. | B | O | |
| //DFDF51 | 01 | MSR Encryption Type (MSR Only) See Encryption Type for a list of valid values. | B | O | |
| /F5 | 00 | Container for Encrypted PIN Data (Touch Only) | T | O | |
| //DF71 | 00 | PIN Block Format (Touch Only)
| B | O | |
| //99 | 00 | Encrypted PIN Data (Touch Only) | B | O | |
| //DFDF41 | 00 | PIN KSN Data (Touch Only) | B | O | |
| //DFDF42 | 00 | PIN Encryption Type (Touch Only) See Encryption Type for a list of valid values. | B | O | |
| null | (var) | Padding to force DFDF59 plus padding to be a multiple of 8 bytes | B |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| FC | var | Decrypted Data Container | T | ||
| /F2 | var | Container for Batch Data This data object contains the set of EMV TLV data objects specified in EMV Batch Data Tag List - Property 1.1.1.1.1.3. | T | ||
| /F3 | var | Container for Reversal Data, if any This data object contains the set of EMV TLV data objects specified in EMV Reversal Data Tag List - Property 1.1.1.1.1.4 . | T | O | null |
| null | (var) | Padding to force DFDF59 plus padding to be a multiple of 8 bytes or 16 bytes depending on the cipher block size of the algorithm being used. | B | ||
| /FE | Var | VAS Data Container See Table – VAS Data Container Payload | T | O | /FE |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 2-byte MSB message length excluding padding and CBC-MAC | |||||
| F9 | var | Container for MAC structure and generic data | T | R | |
| /DFDF54 | var | MAC KSN | B | R | |
| /DFDF55 | 01 | MAC Encryption Type See Encryption Type for a list of valid values. | B | R | |
| /DFDF25 | var | Device Serial Number (IFD Serial Number) | B | R | |
| /FA | var | Container for Generic Data | T | R | |
| //F0 | var | Transaction Results | T | R | |
| ///F1 | var | Container for Status Data | T | R | |
| ////DFDF1A | 01 | Transaction Status
| B | R | |
| ///F8 | var | Container for Encrypted Data | T | R | |
| ////DFDF59 | var | Encrypted Data Primitive Decrypt the value of this TLV data object according to the Encrypted Transaction Data KSN parameter and the Encrypted Transaction Data Encryption Type parameter to read its contents. See Table XX for the data structure as it should appear after decryption. Use the data variant of the current MSR DUKPT working key used in the relevant transaction. | B | R | |
| ////DFDF56 | var | Encrypted Transaction Data KSN | B | R | |
| ////DFDF57 | 01 | Encrypted Transaction Data Encryption Type See Encryption Type for a list of valid values. | B | R | |
| ////DFDF58 | 01 | Number of padding bytes added to DFDF59 value to force length to a multiple of 8 bytes | B | R | |
| ///F7 | var | Merchant Data This contains an instance of Merchant Data Container. | T | R | |
| /FE | Var | VAS Data Container See Table XX – VAS Data Container Payload | T | O | |
| Padding to ensure the length of data, starting with the message length at the very beginning, and ending with any additional padding, is a multiple of 8 bytes for TDES, or 16 bytes for AES. This is a requirement of using the CBC-MAC algorithm. | |||||
| Four-byte CBC-MAC. The host should calculate the CBC-MAC and verify that it matches. For details about calculating a CBC-MAC, see About Message Authentication Codes (MAC). |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| File Type Version | One byte indicating the version of the file type format being used. | 0xAA | |||
| SHA-1 Hash | 20-byte hash of all values that follow. | ||||
| 9F1A | 02 | Terminal Country Code | B | R | 08 40 |
| DF79 | 01 | Cardholder Confirmation | B | R | 01 |
| 9F35 | 01 | Terminal Type | B | R | 21 |
| DF0A | 01 | EMV Contact Supported | B | R | 01 |
| 9F33 | 03 | Terminal Capabilities | B | R | E0 28 C8 |
| 9F40 | 05 | Additional Terminal Capabilities | B | R | EF 80 F0 A0 01 |
| DF55 | 01 | EMV Contactless Supported | B | R | 01 |
| DF0B | 01 | Magnetic Stripe Supported | B | R | 01 |
| DF27 | 01 | Time allocated to enter a PIN | B | R | 0A |
| DF06 | 01 | Batch / Online Data Capture managed | B | R | 01 |
| DF08 | 00 | Advice Managed | B | R | 00 |
| DF7A | 01 | PSE Supported | B | R | 01 |
| DF0D | 00 | AutoRun Mode | B | R | 00 |
| DF10 | 03 | Predefined amount for AutoRun mode | B | R | 00 00 00 |
| DF7B | 01 | PIN Bypass Supported | B | R | 00 |
| DF07 | 01 | Referral Managed | B | R | 01 |
| DF09 | 01 | Default TAC supported when regular TACs are not present | B | R | 01 |
| DF73 | 05 | Default TAC default | B | R | 00 00 00 00 00 |
| DF74 | 05 | Default TAC denial | B | R | 00 00 00 00 00 |
| DF75 | 05 | Default TAC online | B | R | 00 00 00 00 00 |
| DF53 | 01 | Random Transaction Selection not supported | B | R | 00 |
| DF54 | 01 | Velocity Checking not supported | B | R | 00 |
| DF7C | 01 | CDA Mode | B | R | 01 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| /9F01 | 06 | Payment Brand Identifier This serves as supporting information to clarify whether this instance of the AID Delimiter Container is for Contact or Contactless. Byte 1 upper nibble must be set to a value flagging that it corresponds to a Contactless AID, generally by using 0xC0 or 0xF0. For Contact AID, the value of Byte 1 is 00. Byte 1 lower nibble:
Bytes 2..5 Reserved for future use | B | R | F2 00 00 00 00 00 |
| /4F | 0..16 | Application Identifier (AID) | B | R | A0 00 00 00 04 10 10 |
| /DF7E | 01 | ASI | B | R | 01 |
| /9F09 | 02 | Application Version Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 |
| /DF11 | 01 | Skip TAC/IAC default supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF12 | 01 | Random transaction selection supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF13 | 01 | Velocity checking supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF14 | 01 | Floor limit checking supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF15 | 01 | TAC supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF20 | 05 | TAC default Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 00 00 00 |
| /DF21 | 05 | TAC denial Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 00 00 00 |
| /DF22 | 05 | TAC online Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 00 00 00 |
| /9F1B | 04 | Floor limit Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 00 00 |
| /DF70 | 01 | Target percentage Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF6E | 03 | Threshold value Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 00 |
| /DF6F | 01 | Maximum target percentage Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF01 | 01 | Default DDOL supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF71 | 0..FC | DDOL Only applies when Payment Brand Identifier indicates Contact. | B | R | |
| /DF02 | 01 | Default TDOL supported Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| /DF72 | 0..252 | TDOL Only applies when Payment Brand Identifier indicates Contact. | B | R | |
| /5F2A | 02 | Currency Code Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 00 |
| /5F36 | 01 | Transaction currency exponent Only applies when Payment Brand Identifier indicates Contact. | B | R | 00 |
| Additional instances of the AID Delimiter Container parameter, one per Application Identifier (AID) the device should support. |
| Tag | Value (hex) | Description |
|---|---|---|
| File Type Version | One byte indicating the version of the file type format being used. | 0xAA |
| SHA-1 Hash | 20-byte hash of all values that follow | |
| One or more instances of the following entry point tables for supported contactless payment brands. The host should include an Entry Point Table for each transaction type to be supported by each contactless payment brand AID listed in the loaded EMV Processing Configuration File Type. |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 02 01 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F1A | 02 | Terminal Country Code | B | R | 08 40 |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F40 | 05 | Additional Terminal Capabilities | B | R | 00 00 00 00 00 |
| //9F7E | 01 | Mobile Support Indicator | B | R | 01 |
| //DF0C | 01 | Kernel ID | B | R | 02 |
| //DF1B | 01 | Kernel Configuration
| B | R | 20 |
| //DF2D | 03 | Message Hold Time (100 of ms) | B | R | 00 00 0D |
| //9F6D | 02 | Magnetic Stripe Application Version Number This value only applies when the Kernel Configuration parameter is set to support MSD. The device ignores this value. | B | R | 00 01 |
| //DF1A | 03 | Magnetic Stripe Default UDOL This value only applies when the Kernel Configuration parameter is set to support MSD. The device ignores this value. | B | R | 9F 6A 04 |
| //DF1E | 01 | CVM Capability - CVM Required This value only applies when the Kernel Configuration parameter is set to support MSD. The device ignores this value. | B | R | 00 |
| //DF2C | 01 | CVM Capability - No CVM Required This value only applies when the Kernel Configuration parameter is set to support MSD. The device ignores this value. | B | R | 00 |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 02 |
| //DF03 | 01 | Security Capabilities
| B | R | 08 |
| //DF17 | 01 | Card Data Input Capabilities
| B | R | 60 |
| //DF18 | 01 | CVM Capability - CVM Required
| B | R | 28 |
| //DF19 | 01 | CVM Capability - No CVM Required
| B | R | 08 |
| //DF1C | 02 | Max Lifetime Torn Transaction(s) | B | R | 01 2C |
| //DF1D | 01 | Max Number Torn Transaction | B | R | 00 |
| //DF20 | 05 | Terminal Action Code - Default | B | R | 00 00 00 00 00 |
| //DF21 | 05 | Terminal Action Code - Denial | B | R | 00 00 00 00 00 |
| //DF22 | 05 | Terminal Action Code - Online | B | R | 00 00 00 00 00 |
| //DF04 | 0 | Balance Read Before GenAC | B | R | |
| //DF05 | 0 | Balance Read After GenAC | B | R | |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 01 00 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit (No On-Device CVM) | B | R | 00 00 00 03 00 00 |
| //DF25 | 06 | Reader Contactless Transaction Limit (On-Device CVM) | B | R | 00 00 00 05 00 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 00 10 00 |
| //DF27 | 02 | Timeout Value (ms) | B | R | 13 88 |
| //DF30 | 01 | Hold time value before field off (100 of ms) | B | R | 0D |
| //DF32 | 02 | Minimum Relay Resistance Grace Period (100 of micro sec) | B | R | 00 14 |
| //DF33 | 02 | Maximum Relay Resistance Grace Period (100 of micro seconds) | B | R | 00 32 |
| //DF34 | 02 | Terminal Expected Transmission Time for Relay Resistance C-APDU (100 of micro seconds) | B | R | 00 12 |
| //DF35 | 02 | Terminal Expected Transmission Time for Relay Resistance R-APDU (100 of micro seconds) | B | R | 00 18 |
| //DF36 | 02 | Relay Resistance Accuracy Threshold (100 of micro seconds) | B | R | 01 2C |
| //DF37 | 01 | Relay Resistance Transmission Time Mismatch Threshold (%) | B | R | 32 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 03 05 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F1A | 02 | Terminal Country Code | B | R | 08 40 |
| //9F33 | 03 | Terminal Capabilities | B | R | 00 00 00 |
| //9F40 | 05 | Additional Terminal Capabilities | B | R | 00 00 00 00 00 |
| //9F66 | 04 | Terminal Transaction Qualifier | B | R | 22 00 40 00 |
| //DF1B | 03 | Kernel Configuration Byte 1 and further bytes as documented. | B | R | 00 00 06 |
| //DF2D | 03 | Message Hold Time (100 of ms) | B | R | 00 00 0F |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 01 |
| //DF30 | 01 | Bitmap Entry Point
| B | R | F8 |
| //DF32 | 01 | Status Zero Amount Allowed Flag
| B | R | 02 |
| //9F1B | 04 | Terminal Floor Limit | B | R | 00 00 00 00 |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 00 20 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 00 50 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 00 10 00 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 04 04 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 01 |
| //9F1A | 02 | Terminal Country Code | B | R | 08 40 |
| //9F33 | 03 | Terminal Capabilities | B | R | 60 28 00 |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F40 | 05 | Additional Terminal Capabilities | B | R | 00 00 00 00 00 |
| //9F6D | 01 | Contactless Reader Capability Bits 8..7
Bits 6..1 = 0 (Reserved, not to be configured) | B | R | C0 |
| //DF1B | 06 | Kernel Configuration (detailed bit definitions) | B | R | 31 01 00 00 00 00 |
| //DF27 | 01 | Timeout, Field off request (100 of ms) | B | R | 20 |
| //DF2D | 03 | Message Hold Time (100 of ms) | B | R | 00 00 0F |
| //DF30 | 01 | Bitmap Entry Point | B | R | F8 |
| //DF32 | 01 | Status Zero Amount Allowed | B | R | 01 |
| //DF20 | 05 | Terminal Action Code - Default | B | R | 00 00 00 00 00 |
| //DF21 | 05 | Terminal Action Code - Denial | B | R | 00 00 00 00 00 |
| //DF22 | 05 | Terminal Action Code - Online | B | R | 00 00 00 00 00 |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 00 20 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 01 00 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 01 00 00 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 06 06 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 01 |
| //9F1A | 02 | Terminal Country Code | B | R | 08 40 |
| //9F33 | 03 | Terminal Capabilities | B | R | 00 00 00 |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F66 | 04 | Terminal Transaction Qualifier | B | R | B6 00 C0 00 |
| //DF1B | 01 | Kernel Configuration (bit definitions) | B | R | 60 |
| //DF1B | 02 | Kernel Configuration (Common Kernel Only) | B | R | 60 00 |
| //DF30 | 02 | Bitmap Entry Point | B | R | F8 |
| //DF32 | 01 | Status Zero Amount Allowed Flag | B | R | 01 |
| //9F1B | 06 | Terminal Floor Limit | B | R | 00 00 00 00 |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 01 50 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 03 00 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 00 20 00 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 07 05 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 30 |
| //9F1A | 02 | Terminal Country Code | B | R | 01 56 |
| //9F33 | 03 | Terminal Capabilities | B | R | 60 08 00 |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F66 | 04 | Terminal Transaction Qualifier | B | R | 36 00 00 80 |
| //DF1B | 02 | Kernel Configuration Byte1 and Byte2 (bit definitions) | B | R | 00 00 |
| //DF20 | 05 | Terminal Action Code - Default | B | R | 00 00 00 00 00 |
| //DF21 | 05 | Terminal Action Code - Denial | B | R | 00 00 00 00 00 |
| //DF22 | 05 | Terminal Action Code - Online | B | R | 00 00 00 00 00 |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 01 50 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 03 00 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 01 20 00 |
| //DF30 | 01 | Bitmap Entry Point | B | R | 78 |
| 9F1B | 04 | Terminal Floor Limit | B | R | 00 00 3a 98 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 05 06 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F01 | 06 | Acquirer Identifier | B | R | 00 00 00 00 00 01 |
| //9F15 | 02 | Merchant Category Code | B | R | 70 32 |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 01 |
| //9F1A | 02 | Terminal Country Code | B | R | 03 92 |
| //9F33 | 03 | Terminal Capability | B | R | 60 68 08 |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F4E | var | Merchant Name and Location | B | R | (example hex provided) |
| //DF1B | 03 | Kernel Configuration Byte1..Byte3 (bit definitions) | B | R | 7B 00 80 |
| //DF20 | 05 | Terminal Action Code - Default | B | R | 90 40 20 80 20 |
| //DF21 | 05 | Terminal Action Code - Denial | B | R | 04 10 20 20 20 |
| //DF22 | 05 | Terminal Action Code - Online | B | R | 90 60 20 90 20 |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 01 50 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 03 00 00 |
| //DF25 | 06 | On Device CVM Contactless Transaction Limit | B | R | 00 00 00 02 50 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 01 20 00 |
| //9F1B | 04 | Terminal Floor Limit | B | R | 00 00 3a 98 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF35 | var | AID Delimiter Container There can be multiple instances of this in sequence. The contents of the first instance are loaded into Entry Point Table Slot 1, the contents of the second are loaded into Entry Point Table Slot 2, etc. | T | R | |
| /DF0E | 03 | Kernel ID, Processing Slot, Transaction Type Byte 1 Kernel ID
Byte 2 Processing Slot to Use See the AID Delimiter Container parameter in EMV Processing Configuration File Type for information about how to identify slots. Byte 3 Transaction Type
| B | R | 41 05 00 |
| /DF0F | var | Payload Delimiter Container Include only one of these containers inside each AID Delimiter Container. | T | R | |
| //9F09 | 02 | EMV Application Version Number | B | R | 00 02 |
| //9F1A | 02 | Terminal Country Code | B | R | 01 24 |
| //9F33 | 03 | Terminal Capabilities | B | R | 60 68 08 |
| //9F35 | 01 | Terminal Type | B | R | 21 |
| //9F40 | 05 | Additional Terminal Capabilities | B | R | E0 00 E0 F0 01 |
| //9F58 | 01 | Merchant Type Indicator | B | R | 03 |
| //9F5D | 06 | Receipt Limit | B | R | 00 00 00 00 50 00 |
| //9F5E | 02 | Terminal Option Status Byte1/Byte2 (bit definitions) | B | R | E0 00 |
| //9F5F | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 01 00 00 |
| //DF1B | 02 | Kernel Configuration Byte1/Byte2 (bit definitions) | B | R | 02 34 |
| //DF20 | 05 | Terminal Action Code - Default | B | R | 00 00 00 00 00 |
| //DF21 | 05 | Terminal Action Code - Denial | B | R | 00 00 00 00 00 |
| //DF22 | 05 | Terminal Action Code - Online | B | R | 00 00 00 00 00 |
| //9F1B | 04 | Terminal Floor Limit | B | R | 00 00 1F 40 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| DFDF79 | 05 | Registered Application ID (RID) | B | R | A0 00 00 00 04 |
| DFDF7A | 01 | CA Public Key Index | B | R | 05 |
| DFDF7B | var | CA Public key Modulus | B | R | B8 04 8A … D5 97 |
| DFDF7C | 01 or 03 | CA Public Key Exponent | B | R | 03 |
| DFDF7D | 14 | CA Public Key Checksum | B | R | EB FA 0D 5D 06 D8 CE 70 2D A3 EA E8 90 70 1D 45 E2 74 C8 45 |
Exponent Length (1 Byte)
- 0x01
- 0x03
Exponent (1 or 3 Bytes)
- 0x03
- 0x010001
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 00 15 00 |
| DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 00 05 00 |
| DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 00 10 00 |
| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
File Type Version One byte indicating the version of the file type format being used.
| |||||
| SHA-1 Hash 20 byte hash of all values that follow | |||||
| FF37 | var | DRL Configuration Container | T | R | |
| /FF36 | var | DRL Set Container | T | R | |
| //DF23 | 06 | Reader Contactless Floor Limit | B | R | 00 00 00 00 15 00 |
| //DF24 | 06 | Reader Contactless Transaction Limit | B | R | 00 00 00 00 05 00 |
| //DF26 | 06 | Reader CVM Required Limit | B | R | 00 00 00 00 10 00 |
| Additional instances of DRL Set Container as needed |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 81 | 08 | Signature Window Width and Height Bytes 0..1 = Left edge (minimum value of all X coordinates) Bytes 2..3 = Right edge (maximum value of all X coordinates) Bytes 4..5 = Top edge (minimum value of all Y coordinates) Bytes 6..7 = Bottom edge (maximum value of all Y coordinates) | B | R | 0000 00FD 0000 0078 (landscape) 0000 00C8 0000 00B9 (portrait) |
| 82 | var | Signature Coordinate Values List This is a blob that consists of a raw list of point coordinates representing the signature. Each coordinate is 4 bytes long, where the first 2 bytes are the X coordinate of that point and the second 2 bytes are the Y coordinate of that point. | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| F9 | var | Container for MAC structure and generic data, length excludes MAC padding and MAC checksum | T | R | |
| /DFDF54 | var | MAC KSN | B | R | |
| /DFDF55 | var | MAC Encryption Type | B | R | |
| /F8 | var | Container for Encrypted Data | T | R | |
| //DFDF59 | var | Encrypted Data Primitive ( length includes padding) Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encryption Type parameter below to read its contents. | B | R | |
| //DFDF56 | var | Encrypted Data KSN | B | R | |
| //DFDF57 | 01 | Encrypted Data Encryption Type See Encryption Type for a list of valid values. | B | R | |
| PKCS7 padding for MAC calculation, maximum 16 bytes, minimum 1 byte | |||||
| Four-byte MAC checksum. The host should calculate the MAC and verify that it matches. |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| F9 | var | Container for MAC structure and generic data, length excludes MAC padding and MAC checksum | T | R | |
| /DFDF55 | var | MAC Encryption Type | B | R | |
| /F8 | var | Container for Encrypted Data | T | R | |
| //DFDF59 | var | Encrypted Data Primitive, length includes padding | T | R | |
| ///FC | var | Decrypted Data Container, length excludes padding | T | R | |
| ////A1 | var | Signature file container, maximum 4,000 bytes | T | R | |
| /////81 | 08 | Signature Window Width and Height, refer to Table SCF-1 - Signature Capture File Type. | B | R | |
| /////82 | var | Signature Coordinate Values List, refer to Table SCF-1 - Signature Capture File Type. | B | R | |
| ////81 | 04 | Real Time Clock, Epoch Time in seconds, unsigned 32 bits. The date and time shall be Universal Time Coordinated (UTC). | B | R | |
| ////82 | 04 | Device Serial Number | B | R | |
| ////A3 | var | User data parameters for item #0 to item #3. The maximum total size of 0xA3 TLV is 4,000 bytes. | T | O | |
| /////81 | var | User data item #0, optional | B | O | |
| /////82 | var | User data item #1, optional | B | O | |
| /////83 | var | User data item #2, optional | B | O | |
| /////84 | var | User data item #3, optional | B | O | |
| PKCS7 padding for encryption, maximum 16 bytes, minimum 1 byte | |||||
| //DFDF56 | var | Encrypted Data KSN | B | R | |
| //DFDF57 | 01 | Encrypted Data Encryption Type See Encryption Type for a list of valid values. | B | R | |
| PKCS7 padding for MAC calculation, maximum 16 bytes, minimum 1 byte | |||||
| Four-byte MAC checksum. The host should calculate the MAC and verify that it matches. |
| Offset | Description | Typ | Req | Default |
|---|---|---|---|---|
| 0 | Operation Type
| B | R | |
| 1 | Operation Algorithm If Operation Type is Key Agreement type:
If Operation Type is a Signature type:
If Operation Type is a MAC type:
If Operation Type is an Encryption type:
| B | R | |
| 2 | Operation Curve/Mode/Hash/Cipher If Operation Type is a Key Agreement type, this specifies the Curve:
If Operation Type is a Signature type, this specifies the Hash:
If Operation Type is a MAC type, this specifies the Encryption Algorithm:
If Operation Type is an Encryption type, this specifies the Mode:
| B | R | |
| 3 | KDF/Curve/Padding If Operation Type is a Key Agreement type, this specifies the KDF:
If Operation Type is a Signature type, this specifies the Curve:
If Operation Type is a MAC type, this specifies the Padding:
If Operation Type is an Encryption type, this specifies the Padding:
| B | R | |
| 4 | MAC Block Size If Operation Type is a MAC type, this specifies the data to be MACed must be padded to a multiple of this many bytes. For all other Operation Types, do not include this byte. | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 81 | var | Operation This contains an instance of a - Encrypted Signature Capture FileType structure specifying the operation to be performed. | B | R | |
| 84 | var | Data Reserved for future use. Do not include this parameter. It is reserved for Initialization Vector or nonce, if needed. | B | O | |
| 85 | var | Extra Data Item Reserved for future use. Do not include. | B | O | |
| A8 | var | Key Information This specifies the key used in the operation. Populate with a Key Information Type TLV data object. For ECDSA operations, do not include this parameter. | T | O | |
| A9 | var | Second Key Information (Reserved, do not include) This specifies a second key used in the operation. If needed, populate with a Key Information Type TLV data object. | T | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 81 | 02 | Key Slot ID Identifies the key being used for operation. See Table 59 -Key Slot IDs. | B | R | |
| 82 | var | Key Label The label that indicates the key type. For example, DEVTK. | AN | O | |
| 86 | var | Key Derivation Details Use Key Serial Number (KSN) in requests, Key Derivation Information in responses. | B | O | |
| 88 | var | Additional Information Reserved for future use. Do not include. | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| DFDFDF40 | var | MIFARE Card Data in ASCII terminated with NULL character | B | O | |
| DFDFDF41 | var | MIFARE Card Data in Binary | O |
| Header | Header (optional) | Key Length | Key | Key Padding | Block Padding | MAC |
|---|---|---|---|---|---|---|
| <----------- | Encrypted | -------------- | ------------> | |||
| <-------- | ------------ | MAC | -------------- | -------------- | ------------> |
| Offset | Name | Fixed Value | Variable |
|---|---|---|---|
| 0 | Key Block V ID | ‘D’ | |
| 1..4 | Key Block Length | Calculated (in decimal, e.g. 138 bytes shown as ‘0138’ | |
| 5..6 | Usage | Look up the desired Key Type in Table TKB-2 below and select this value from the Usage column. | |
| 7 | Algorithm | Look up the desired Key Type in Table TKB-2 below and select this value from the Algorithm column. | |
| 8 | Mode of Use | Look up the desired Key Typein Table TKB-2 below and select this value from the Mode of Usecolumn. | |
| 9..10 | Key Version # | ‘00’ | Always ‘00’ |
| 11 | Exportability | ‘N’ | Always no export allowed |
| 12..13 | # option blocks | Calculated | |
| 14..15 | Reserved | ‘00’ |
| Key Type | Usage | Algorithm AES/TDEA | Mode of Use (Both, To, From) |
|---|---|---|---|
| Transport (KBPK) | ‘K1’ | ‘A’ / ‘T’ | ‘D’ |
| Initial DUKPT Key | ‘B1’ | ‘A’ / ‘T’ | ‘X’ |
| Fixed MAC (CMAC) | ‘M6’ | ‘A’ / ‘T’ | (‘C’, ’G’, ’V’) |
| Fixed Encrypt | ‘D0’ | ‘A’ / ‘T’ | (‘B’, ‘E’, ‘D’) |
| ID | Purpose |
|---|---|
| ‘IK’ | DUKPT KSID |
| ‘KS’ | Key Set Identifier (e.g. data used by host to find and/or derive this key). |
| ‘KC’ | Key Check Value (KCV) (Legacy or CMAC) |
| ‘PB’ | Padding Field |
| ‘TS’ | Current Time Stamp (optional) see description in previous section. |
| ‘KP’ | KCV of KBPK that created this Key Block (optional-preferred) |
| ‘21’ | MagTek Additional Key Info From Table - MagTek Custom TR-31 Small Optional Block |
| Offset | Name | Value | Variable |
|---|---|---|---|
| 0.1 | Block ID | '21' | MagTek Added Key Info Block |
| 2..3 | Block Length | var | ASCII Hex (Length 01-FF from offset 0) |
| 4..7 | Owner Tag | ‘MGTK’ | Avoid collision with others using Block ID ‘21’ |
| 8..9 | Data Tag | ‘10’ | Field ID |
| 10..11 | Data Len | ‘01’ | Field Length (ASCII Hex 00-FF) |
| 12 | Data | ‘T’,’P’, or ‘0’ | Field Data for Key Environment
|
| 13… | Added elements | More Fields (Tags, Lengths, and Data) | |
| Field ID | Length | Purpose |
|---|---|---|
| ‘10’ | ‘01’ | Key Environment
|
| ‘11’ | ‘04’ | Key Slot ID See Table 59 - Key Slot ID. |
| ‘12’ | ‘04’ | Key Slot ID of Transport Key |
| ‘20’ | -- | Reserved |
| ‘21’ | ‘04’ | DUKPT Data Type Restriction Bitmask This is for Transport Keys and DUKPT keys. Default to 0. |
| ‘31’ | ‘07’ | Device Serial Number |
| ‘32’ | ‘10’ | Challenge Token 10h = 16 characters |
| ‘33’ | ‘10’ ..‘18’ | Expiration Date/Time This is in UTC format, use short form if possible. Reserved. |
| ID | Label | Description | Load Transport Key | TR31-F |
|---|---|---|---|---|
| 10xx | Transport Keys (KBPK) | |||
| 1000 | TMPTK | Temporary KBPK | Key agreement process from Command 0xF017 - Establish Ephemeral KBPK | N/A |
| 1001 | MTK | Master Transport Key | TMPTK | K1AD |
| 1002 | DEVTK | Device Master Transport Key | MTK | K1AD |
| 1003 | FINTK | Financial Master Transport Key | MTK | K1AD |
| SRED Data ID | OID | OID Size |
| 0: Not assigned | N/A | N/A |
| 1: PIN-TDES (supported on PED devices Only) | 0x010102040101 | 3 |
| 2: Account Data | 0x010102040102 | 3 |
| 3: MAC | 0x010102040103 | 3 |
| 4: Magneprint (supported on devices with MSR Only) | 0x010102040104 | 3 |
| 5: MagTek Token | 0x010102040105 | 3 |
| 6: User Data 1 | 0x010102040106 | 3 |
| 7: PIN-AES (supported on PED devices Only) | 0x010102040107 | 3 |
| Transformation ID # | Usage Name | Type | Data for calculation |
| 0 | Reserved | ||
| 1 | PIN Encryption | Legacy | 00 00 00 00 00 00 00 FF |
| 2 | MAC Generate/Verify | Legacy | 00 00 00 00 00 00 FF 00 |
| 3 | MAC Verify | Legacy | 00 00 00 00 FF 00 00 00 |
| 4 | Data Enc/Decryption | Legacy | 00 00 00 00 00 FF 00 00 |
| 5 | Data Encryption | Legacy | 00 00 00 FF 00 00 00 00 |
| 6 | Reserved | ||
| 7 | PIN Encryption | AES | 0x1000 |
| 8 | MAC Generate | AES | 0x2000 |
| 9 | MAC Verify | AES | 0x2001 |
| A | MAC Generate/Verify | AES | 0x2002 |
| B | Data Encryption | AES | 0x3000 |
| C | Data Decryption | AES | 0x3001 |
| D | Data Enc/Decryption | AES | 0x3002 |
| SRED Data ID | Data Type (Working Key Purpose) | Allowed Legacy DUKPT Transforms | Allowed AES DUKPT Transforms |
|---|---|---|---|
| 0 | Not assigned | - | - |
| 1 | PIN-TDES (supported on PED devices Only) | 01 | Not allowed |
| 2 | Account Data | 01, 04, 05 | 0B, 0D |
| 3 | Transaction MAC | 02 | 08, 0A |
| 4 | MagnePrint (supported on devices with MSR Only) | 01, 04, 05 | 0B, 0D |
| 5 | MagTek Token (RFU) | RFU | RFU |
| 6 | User Data #1 (RFU) | RFU | RFU |
| 7 | PIN-AES (supported on PED devices Only) | Not allowed | 07 |
| … | RFU | - | - |
Figure 1 - Configuration Usage Values
# DUKPT Key Mapping ## **Terms and Definitions** * DUKPT – Derived Unique Key Per Transaction * OID – Object Identifier * SRED - Secure Reading and Exchange of Data There are 7 OIDs defined for these 7 SRED Data IDs. Each OID value contains a two-byte DUKPT slot ID and a one-byte transformation ID. ## SRED Data IDs and OIDs| SRED Data ID | OID | OID Size |
| 0: Not assigned | N/A | N/A |
| 1: PIN-TDES (supported on PED devices Only) | 0x010102040101 | 3 |
| 2: Account Data | 0x010102040102 | 3 |
| 3: MAC | 0x010102040103 | 3 |
| 4: Magneprint (supported on devices with MSR Only) | 0x010102040104 | 3 |
| 5: MagTek Token | 0x010102040105 | 3 |
| 6: User Data 1 | 0x010102040106 | 3 |
| 7: PIN-AES (supported on PED devices Only) | 0x010102040107 | 3 |
Transformation ID # | Usage Name | Type | Data for calculation |
| 0 | Reserved | ||
| 1 | PIN Encryption | Legacy | 00 00 00 00 00 00 00 FF |
| 2 | MAC Generate/Verify | Legacy | 00 00 00 00 00 00 FF 00 |
| 3 | MAC Verify | Legacy | 00 00 00 00 FF 00 00 00 |
| 4 | Data Enc/Decryption | Legacy | 00 00 00 00 00 FF 00 00 |
| 5 | Data Encryption | Legacy | 00 00 00 FF 00 00 00 00 |
| 6 | Reserved | ||
| 7 | PIN Encryption | AES | 0x1000 |
| 8 | MAC Generate | AES | 0x2000 |
| 9 | MAC Verify | AES | 0x2001 |
| A | MAC Generate/Verify | AES | 0x2002 |
| B | Data Encryption | AES | 0x3000 |
| C | Data Decryption | AES | 0x3001 |
| D | Data Enc/Decryption | AES | 0x3002 |
| Bit # | 5 | 4 | 3 | 2 | 1 | 0 |
| Data Type | User Data (RFU) | Token (RFU) | Magneprint | MAC | Account Data | PIN |
| DUKPT Slot ID | Key Type | Restrictions |
| DKPTM0-2000 | TDES | 0x3E |
| DKPTM2-2002 | AES-128 | 0x3F |
| DKPTM3-2003 | AES-256 | 0x3F |
| DKPTM7-2007 | TDES | 0x3F |
SRED Data ID | Data Type (Working Key Purpose) | Allowed Legacy DUKPT Transforms | Allowed AES DUKPT Transforms |
| 0 | Not assigned | - | - |
| 1 | PIN-TDES (supported on PED devices Only) | 01 | Not allowed |
| 2 | Account Data | 01, 04, 05 | 0B, 0D |
| 3 | Transaction MAC | 02 | 08, 0A |
| 4 | MagnePrint (supported on devices with MSR Only) | 01, 04, 05 | 0B, 0D |
| 5 | MagTek Token (RFU) | RFU | RFU |
| 6 | User Data #1 (RFU) | RFU | RFU |
| 7 | PIN-AES (supported on PED devices Only) | Not allowed | 07 |
| … | RFU | - | - |
Figure 1 - Configuration Usage Values
# Miniature Certificate Type ## **Miniature Certificate Type**| Tag | Len | Value / Description | Typ | Req | Example |
|---|---|---|---|---|---|
| FF01= Start Of Miniature Certificate Marker | |||||
| 81 | 08 | Miniature Certificate Info and ID | B | R | 81 08 50 01 01 00 C2 C2 C2 C2 |
| 83 | 02 | Public Key Info | B | R | 83 02 10 04 |
| 84 | 40 | Public Key, 64 bytes for ECDSA Curve P-256 | B | R | 84 40 then 64 bytes |
| 86 | 00 | Reserved for RSA cipher | B | O | 86 00 |
| 90 | 04 | Signing Miniature Certificate ID Signed by Base Miniature Certificate | B | R | 90 04 CA CA CA CA |
| 91 | 01 | Signing Algorithm SHA-256, ECDSA Curve P-256 | B | R | 91 01 01 |
| 9E | 40 | Signature (64 bytes for ECDSA P-256) | B | R | 9E 40 then 64 bytes |
| Padding Pad with 0xCA to make the total length of the data object 512 bytes. |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| MGTKAP10= Start Of File Marker | |||||
| C1 | 4 | File Type See Table 206 | B | R | N/A |
| CE | var | File Payload See the “File Type” subsections of section - Data Types andShared TLV Data Objects. | B | R | N/A |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| — wrappers — | Beginning of any wrappers, at minimum including Request Message | ||||
| 1001 | Start Transaction - Command 0x1001 | ||||
| 81 | 01 | Reserved | O | ||
| 82 | 01 | Transaction Timeout, in seconds. This parameter defines how long the device waits for the cardholder to take action on any cardholder input, for example, when waiting for the cardholder to present payment after the host starts the transaction.
| B | R | |
| A3 | var | Reader Options. The parameters inside this TLV data object allow the host to enable and disable the various payment method interfaces. | T | O | |
| /82 | 01 | Contact Reader Mode (EMV Contact Only)
| B | O | 0x01 |
| /83 | 01 | Contactless Reader Mode (EMV Contactless Only)
| B | O | 0x01 |
| /84 | 03 | Manual Entry Mode (Touch Only). Populate this parameter to enable manual card entry. When using this feature, all other Reader Mode parameters must be set to Disabled.
Byte 2 User Interface Sequence
Byte 3 Beeper Feedback
| B | O | |
| /85 | 02 | Barcode Reader Mode (BCR Only). Populate this parameter to enable the device’s barcode reader. This feature can be enabled alongside all other reader modes except Manual Entry Mode.
Byte 2 Encrypt Non-EMV Barcode Data
| B | O | 0x0000 |
| A4 | var | Tip and Tax Options | B | O | |
| /81 | 1F | Byte 1 Tip Mode
Other bytes define display modes and values for up to 6 buttons. See Tip Mode (Touch Only) - Property 1.1.1.1.2.2 for suggested defaults. | B | O | |
| /82 | 06 | Tax or Surcharge Amount to Display. See Display Tax or Surcharge (Touch Only) - Property 1.1.1.1.2.4 to configure display Tax or Surcharge. | B | O | |
| A5 | var | Customer Options. | |||
| /81 | 2 | Transact transaction flow. Do not configure this tag if the Host wants to run NFC passthrough commands. Byte 1 Transaction Mode bits:
Byte 2 Read Data Mode
| B | O | 0x0000 |
| 84 | 02 | Bitmask that sets device behaviors affecting transaction flow and result reporting. Details include Apple/Google VAS modes, wallet modes, protocol mode, and transaction flow control (e.g., Quick Chip). See table content for full bit definitions. Byte 1 Apple VAS Mode (Apple / Google VAS Only, set to 0 if not supported) Bits 0, 1 • 0x00 = Apple/Google VAS Support Disabled • 0x01 = VAS App OR Payment Mode (Single Mode). The device reads only Apple/Google VAS data from a tapped smartphone, or reads EMV payment data from a tapped card. When the device sends ARQC to conclude the transaction, it only includes either EMV payment data in container FC for cards, or includes VAS data in container FE for smartphones • 0x02 = VAS App and Payment Mode (Dual Mode). The device reads both Apple/Google VAS data and EMV payment data from a tapped smartphone, or reads EMV payment data from a tapped card. When device sends ARQC to the host to conclude the transaction, it includes EMV payment data in container FC and includes VAS data, if available, in container FE • 0x03 = VAS App Only Mode (VAS Mode). The device reads only Apple/Google VAS data from a tapped smartphone, and does not read data from a tapped card. If the tapped smartphone does not support VAS, the device does not detect or read from the smartphone. When the device send ARQC to conclude the transaction, it includes VAS data in container FE and does not include EMV payment data in container FC • 0x04 = Payment Only Mode (Payment Mode). The device operates the same as EMV mode (01). It reads only EMV payment data from a tapped smartphone or a tapped card. When the device sends ARQC to conclude the transaction, it includes EMV payment data in container FC and does not include VAS data in container FE. Bits 4, 5, 6 Wallet Mode 4 -Apple 5 - Google 6 - Reserved • 0x000 = Wallet Support Disabled • 0x001 = Apple VAS Enable • 0x002 = Google VAS Enabled • 0x003 = –Apple and Google VAS Enabled Bit 7 Apple VAS Protocol Mode o Value 0 – URL VAS Protocol o Value 1 – FULL VAS Protocol Byte 2 Transaction Flow Control • Bit 0 Transaction Flow o Value 1 = Quick Chip Transaction Flow o Value 0 = EMV Transaction Flow • Bit 1 Response Format o Value 1 = DynaPro Response Format. For sending ARQC data and batch data, the device uses EMV ARQC (DynaPro Format) Type and EMV Batch Data (DynaPro Format) Type. o Value 0 = Reserved. • Bit 3 Display Amount for Quick Chip Transaction Flow o Value 1 = Display Amount o Value 0 = Do not Display Amount | B | O | 0x0003 |
| 85 | var | Apple ECP2 frame from Byte 2 to Byte N (Min N = 4, Max N = 19). By default Byte 2-N = 0xC3020003FFFF. Host can configure this parameter to set Apple ECP2 frame. See Apple ECP2.0 spec. | B | O | |
| 86 | var | Transaction TLV. A list of TLV data objects defining basic transaction parameters. May contain EMV tags; at minimum must contain 9C and 9F02 (and 9F03 if cash back). Optional for Manual Entry; include 9F02 and 5F2A to show transaction amount for Manual Entry. Common tags:
| B | R/O | |
| AC | var | User Interface Options | T | O | null |
| /81 | 00 | Suppress Thank You Message. By default devices with a display show “THANK YOU,” then “WELCOME.” Include this to suppress “THANK YOU” for this transaction. | T | O | null |
| /82 | 01 | Override Final Transaction Message. Choose a Display String ID (see section 4.3 Display Strings). Overrides idle page behavior until next transaction, power cycle, or similar state change. | B | O | null |
| /83 | 02 | Functional button Right option. String ID = enable the present card page with a green functional Right button (label is a String ID, ~15 chars). When user presses this button, device sends notification to host: User Interface Host Action Request - Notification 0x1803. If host wants to disable this button, do not include this tag. | B | O | null |
| — wrappers — | End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| — wrappers — | Beginning of any wrappers, at minimum including Request Message | ||||
| 1001 | Start Transaction - Command 0x1001 | ||||
| — | — | No parameters. | |||
| — wrappers — | End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1004 = Resume Transaction - Command 0x1004 | |||||
| 81 | 01 | Resume Code. Indicates the pause state the transaction will resume from:
| B | R | |
| 83 | var | Reserved | B | O | |
| 84 | var | ARPC Data. This contains an EMV ARPC Type. | B | R | |
| 86 | var | Transaction TLV Update. Not applicable when Resume Code = Waiting for ARPC | B | O | |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1004 = Resume Transaction - Command 0x1004 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1008 = Command 0x1008 - Cancel Transaction | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1008 = Cancel Transaction - Command 0x1008 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1100 | Pass Through Command For NTag/MIFARE Ultralight, Type 2 - Command 0x1100 | ||||
| 81 | var | Command to Send. See Table XX – NTag Commands See Table XX – MIFARE Ultralight EV1 Commands See Table XX – MIFARE Ultralight C Commands See Table XX – MIFARE Ultralight AES Commands | B | R | |
| 82 | 01 | 00 – No Encrypt 01 - Encrypt | B | R | |
| 83 | 01 | 00 – Expect More Commands 01 – FF (Last Command). If the pass-through command is the last successful command, the device will end the transaction with a single beep, indicating success. If an error arises, the device will end the transaction but will sound two beeps to indicate the error. The user should then remove the card. | B | R | |
| End of any wrappers, at minimum including Request Message |
| Command | Length | Field Value |
|---|---|---|
| Get Version | 1 | The GET_VERSION command is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x. Byte 0 = 0x60 |
| Read | 2-3 | The READ command requires a start page address, and returns the 16 bytes of four NTAG21x pages. For example, if address is 03h then pages 03h, 04h, 05h, 06h are returned. Special conditions apply if the READ command address is near the end of the accessible memory area. The special conditions also apply if at least part of the addressed pages is within a password protected area. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address |
| Fast Read | 3 | The FAST_READ command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address |
| Write | 6 | The WRITE command requires a block address, and writes 4 bytes of data into the addressed NTAG21x page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write |
| Compatibility Write | 18 | The COMPATIBILITY_WRITE command is implemented to guarantee interoperability with the established MIFARE Classic PCD infrastructure, in case of coexistence of ticketing and NFC applications. Even though 16 bytes are transferred to NTAG21x, only the least significant 4 bytes (bytes 0 to 3) are written to the specified address. Set all the remaining bytes, 04h to 0Fh, to logic 00h. Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle |
| READ_CNT | 2 | The READ_CNT command is used to read out the current value of the NFC one-way counter of the NTAG213, NTAG215 and NTAG216. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. If the NFC_CNT_PWD_PROT bit is set to 1b the counter is password protected and can only be read with the READ_CNT command after a previous valid password authentication Byte 0 = 0x39 Byte 1 = 0x02 (NFC Counter Address) |
| PWD_AUTH | 5 | A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible. Byte 0 = 0x1B Byte 1..4 = password (4 bytes) |
| READ_SIG | 2 | The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. Byte 0 = 0x3C Byte 1 = 0x00, RFU |
| Command | Length | Field Value |
|---|---|---|
| Get Version | 1 | The GET_VERSION command is used to retrieve information on the MIFARE family, product version, storage size and other product data required to identify the MF0ULx1. Byte 0 = 0x60 |
| Read | 2-3 | The READ command requires a start page address, and returns the 16 bytes of four MIFARE Ultralight pages. For example if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. A rollover mechanism is implemented if the READ command address is near the end of the accessible memory area. This rollover mechanism is also used when at least part of the addressed pages is within a password protected area. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address |
| Fast Read | 3 | The FAST_READ command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address |
| Write | 6 | The WRITE command requires a block address, and writes 4 bytes of data into the addressed MIFARE Ultralight EV1 page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write |
| Compatibility Write | 18 | The COMPATIBILITY_WRITE command is implemented to accommodate the established MIFARE Classic PCD infrastructure. Even though 16 bytes are transferred to the MF0ULx1, only the least significant 4 bytes (bytes 0 to 3) are written to the specified address. Set all the remaining bytes, 04h to 0Fh, to logic 00h Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle |
| READ_CNT | 2 | The READ_CNT command is used to read out the current value of one of the 3 one-way counters of the MF0ULx1. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. The counters are always readable, independent on the password protection settings. Byte 0 = 0x39 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) |
| INCR_CNT | 6 | The INCR_CNT command is used to increment one of the 3 one-way counters of the MF0ULx1. The two arguments are the counter number and the increment value. Byte 0 = 0xA5 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) Byte 2 to 5 = 4 bytes increment value (only the 3 least significant bytes are relevant) |
| PWD_AUTH | 5 | A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/ write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible. Byte 0 = 0x1B Byte 1..4 = password (4 bytes) |
| READ_SIG | 2 | The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. Byte 0 = 0x3C Byte 1 = 0x00, RFU |
| CHECK TEARING_EVENT | 2 | The CHECK_TEARING_EVENT command enables the application to identify if a tearing event happened on a specified counter element. It takes the counter number as single argument and returns a specified valid flag for this counter. If the returned valid flag is not equal to the predefined value, a tearing event happened. Note, although a tearing event might have happened on the counter, a valid value corresponding to the last valid counter status is still available using the READ_CNT command. Byte 0 = 0x3E Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) |
| VCSL | 21 | The VCSL command is used to enable a unique identification and selection process across different MIFARE product-based cards and card implementations on mobile devices. The command requires a 16-byte installation identifier IID and a 4-byte PCD capability value as parameters. The parameters are present to support compatibility to other MIFARE product-based devices but are not used or checked inside the MF0ULx1. Nevertheless, the number of bytes is checked for correctness. The answer to the VCSL command is the virtual card type identifier VCTID. This identifier indicates the type of card or ticket. Using this information, the reader can decide whether the ticket belongs to the installation or not. Byte 0 = 0x4B Byte 1 to 16 = 16-byte IID (installation identifier, can be any number) Byte 17 to 20 = 4-byte PCDCAPS (PCD capabilities, can be any number) |
| Command | Length | Field Value |
|---|---|---|
| Read | 2-3 | The READ command takes the page address as a parameter. Only addresses 00h to 2Bh are decoded. For higher addresses the MF0ICU2 returns a NAK. The MF0ICU2 responds to the READ command by sending 16 bytes starting from the page address defined in the command (e.g. if ADR is 03h, pages 03h, 04h, 05h, 06h are returned) A roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached. For example, reading from address 29h on a MF0ICU2 results in pages 29h, 2Ah, 2Bh and 00h being returned. The following conditions apply if part of the memory is protected by the 3DES authentication for read access:
The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address |
| Write | 6 | The WRITE command is used to program the lock bytes in page 02h, the OTP bytes in page 03h, data bytes in pages 04h to 27h, configuration data from page 28h to 2B and keys from page 2Ch to 2Fh. A WRITE command is performed page-wise, programming 4 bytes in a page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write |
| Compatibility Write | 18 | The COMPATIBILITY_WRITE command was implemented to accommodate the established MIFARE PCD infrastructure. Even though 16 bytes are transferred to the MF0ICU2, only the least significant 4 bytes (bytes 0 to 3) will be written to the specified address. It is recommended to set the remaining bytes 4 to 15 to all 0. Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle
|
| AUTHENTICATE | 2 | The AUTHENTICATE command is used to authenticate the MF0ICU2 using 2 keys 3DES encryption in Cipher-Block Chaining (CBC) mode as described in ISO/IEC 10116.
• A2 2C 07 06 05 04 • A2 2D 03 02 01 00 • A2 2E 0F 0E 0D 0C • A2 2F 0B 0A 09 08
Byte 0 = 0x1A Byte 1 = 0x00 |
| Command | Length | Field Value |
|---|---|---|
| Get Version | 1 | The GET_VERSION command is used to retrieve information on the MIFARE family, product version, storage size and other product data required to identify the MIFARE Ultralight AES. Byte 0 = 0x60 |
| Read | 2-3 | The READ command requires a start page address, and returns the 16 bytes of four pages. For example, if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. So called roll-over mechanism (described later) applies if the READ command address is near the end of the accessible memory area. Same mechanism applies if at least part of the addressed pages is within an authentication protected area. In the default state of MIFARE Ultralight AES, all memory pages in the range from 00h to 3Bh are allowed as Addr parameter to the READ command. Addressing a memory page above the limit results in a NAK response. A roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached if at least first addressed page is within allowed limit. Remark: AES key values can never be directly read out of the memory. When reading from the pages holding key values, all 00h bytes are returned. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address |
| Fast Read | 3 | The FAST_READ command requires a start page address and an end page address and returns bytes of addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h, and 07h are returned. If either start or end address is outside accessible area, then MIFARE Ultralight AES replies with a NAK. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address |
| Write | 6 | The WRITE command requires a block address, and writes 4 bytes of data into the addressed MIFARE Ultralight AES page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write |
| READ_CNT | 2 | The READ_CNT command is used to read out the current value of one of the 3 one-way counters of MIFARE Ultralight AES. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. Counters are always readable, except in case of the counter "0x02" with the optional AES authentication protection enabled. In that case, the counter 0x02 is readable only in the AUTHENTICATE state. Byte 0 = 0x39 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) |
| INCR_CNT | 6 | The INCR_CNT command is used to increment one of the 3x one-way counters of the MIFARE Ultralight AES. Two arguments are the counter number and the increment value. Counters are always incrementable, except in case of the counter "0x02" with the optional AES authentication protection enabled. In that case, the counter 0x02 can be incremented only in the AUTHENTICATE state. Byte 0 = 0xA5 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) |
| READ_SIG | 2 | The READ_SIG command returns an IC-specific, 48-byte ECC signature. The originality signature can be changed if it has been unlocked with the LOCK_SIG command. Byte 0 = 0x3C Byte 1 = 0x00, RFU |
| WRITE_SIG | 6 | The WRITE_SIG command allows the writing of a customized originality signature into the dedicated originality signature memory. The WRITE_SIG command requires an originality signature block address, and writes 4 bytes of data into the addressed originality signature block. In the initial state of MIFARE Ultralight AES, the following originality signature blocks 00h to 0Bh are valid Addr parameters to the WRITE_SIG command. Addressing a memory block beyond the limits above results in a NAK response from MIFARE Ultralight AES. If the originality signature is locked or permanently locked, a WRITE_SIG command results in a NAK response from the MIFARE Ultralight AES.
Byte 0 = 0xA9 Byte 1 = signature block address Byte 2 to 5 = signature bytes to be written |
| LOCK_SIG | 2 | The LOCK_SIG command allows the user to unlock, lock or permanently lock the dedicated originality signature memory. The originality signature can only be unlocked, if the originality signature is not permanently locked. There is no command to unlock the originality signature, if the originality signature is permanently locked.
Byte 0 = 0xAC Byte 1 = lock option
|
| VCSL | 21 | The VCSL command is used to enable a unique identification and selection process across different physical MIFARE product-based cards and virtual MIFARE implementations. The command requires a 16-byte installation identifier IID and a 4-byte PCD capability value as parameters. The parameters are present to support compatibility to other MIFARE product-based devices, but are not used or checked inside the MIFARE Ultralight AES. Nevertheless, the number of bytes is checked for correctness. The answer to the VCSL command is the VCTID value stored in the user configuration segment. This identifier indicates the type of card or ticket. Using this information, the contactless reader can decide whether the ticket belongs to the installation or not.
Byte 0 = 0x4B Byte 1 to 16 = 16-byte IID (installation identifier, can be any number) Byte 17 to 20 = 4-byte PCDCAPS (PCD capabilities, can be any number) |
| AUTHENTICATE | 2 | The AUTHENTICATE command is used to authenticate with a 3-pass mutual authentication the MIFARE Ultralight AES and PCD. The cryptographic method is based on AES in Cipher-Block chaining (CBC) mode according to NIST Special Publication 800-38A. The used key is a 128-bit AES Key. Remark: To reduce the risk on card- only side channel attack to the AES keys, a failed authentication limit (AUTH_LIM) can be set.
The key itself can be written using the WRITE with Byte 0 is always sent first. On example of AES [DataProtKey] = 000102030405060708090A0B0C0D0E0Fh, the command sequence needed for key programming with WRITE command is: • A2 30 0F 0E 0D 0C • A2 31 0B 0A 09 08 • A2 32 07 06 05 04 • A2 33 03 02 01 00 On example of AES [UIDRetrKey] = 000102030405060708090A0B0C0D0E0Fh, the command sequence needed for key programming with WRITE command is: • A2 34 0F 0E 0D 0C • A2 35 0B 0A 09 08 • A2 36 07 06 05 04 • A2 37 03 02 01 00
Byte 0 = 0x1A Byte 1 = Key option
|
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1100 | Pass Through Command For NTag/MIFARE Ultralight, Type 2 Command For NFC Tag - Command 0x1100 | ||||
| 81 | 01 | Tag Response Code 0x00 = Success 0x01 = Failed | B | R | N/A |
| 82 | var | Encryption Control. If encrypted, see Table XX - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table 94 – Unencrypted NFC/MIFARE Data. | B | O | N/A |
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| /DFDF59 | var | Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table 94 – Unencrypted NFC/MIFARE Data. | B | R | |
| /DFDF50 | var | Encrypted Data KSN | B | R | |
| /DFDF51 | 01 | Encrypted Data Encryption Type. See section 4.4 Encryption Type for a list of valid values. | B | R | |
| End of Notification Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1101 = Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2 | |||||
| 81 | var | Command to Send. See Table XX – MIFARE Classic/MINI® Commands See Table XX – MIFARE Plus EV1/EV2/SE/X SL1 (Security Level 1) Commands | B | R | |
| 82 | 01 | 00 – No Encrypt 01 - Encrypt | |||
| 83 | 01 | 00 – Expect More Commands 01 – FF (Last Command). If last command, Device will provide a single beep after receiving a successful response from tag, otherwise, device will provide a double beep. | B | R | |
| End of any wrappers, at minimum including Request Message |
| Command | Length | Field Value |
|---|---|---|
| MIFARE Read | Byte 0 – 0x30 – Read Command Byte 1 – Sector Number to Read Byte 2 – Start Block Number Byte 3 – End Block Number Byte 4 – Key Type, 0 = A, 1 = B Byte 5 to 10 = 6 Byte Key | |
| MIFARE Write | Byte 0 – 0xA0 – Write Command Byte 1 – Sector Number to Write Byte 2 – Start Block Number Byte 3 – End Block Number Byte 4 – Key Type 0 = A, 1 = B Byte 5 to 10 = 6 Byte Key Byte 11 to x = Variable length Byte Data (16 bytes per block) | |
| MIFARE Increment | Byte 0 – 0xC1 – Increment Command Byte 1 – Source Sector Number Byte 2 – Source Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key Byte 10 to 13 = 4 Byte Operand | |
| MIFARE Decrement | Byte 0 – 0xC0 – Decrement Command Byte 1 – Source Sector Number Byte 2 – Source Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key Byte 10 to 13 = 4 Byte Operand | |
| MIFARE Restore | Byte 0 – 0xC2 – Restore Command Byte 1 – Source Sector Number Byte 2 – Source Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key | |
| MIFARE Transfer | Byte 0 – 0xB0 – Write the value from the Transfer Buffer into destination block number Byte 1 – Destination Sector Number Byte 2 – Destination Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key |
| Command | Length | Field Value | EV1 | EV2 | SE | X |
|---|---|---|---|---|---|---|
| First Authenticate (part1 and part2) | 3 | First Authenticate. Use this command to switch to higher security levels. This command is behaved as the last command. Device will provide a single beep after receiving a successful response from a card, otherwise, device will provide a double beep.
| Y | Y | Y | Y |
| Following Authenticate (part 1 and part 2) | 3 | Following Authenticate. Use this command for an option to put the NFC tag in Security Level 1 AES Authenticated before sending MIFARE Classic commands. Byte 0 = 0x76 Byte 1-2 = Security Level 1 Card Authentication Key. See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key# (same key numbering as First Authenticate) | Y | Y | Y | Y |
| READ_SIG | 2 | The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature. Byte 0 = 0x3C Byte 1 = 0x00, RF | Y | Y | N | N |
| Personalize UID | 2 | Set anti-collision, selection and authentication behavior. The execution of this command requires an authentication to MF Classic sector 0 (use MIFARE Read command sector 0 from Table 96 – MIFARE Classic/MINI® Commands). Once this command has been issued and accepted by the PICC, the configuration is automatically locked. A subsequently issued ‘Personalize UID Usage’ command is not executed and fails. Byte 0 = 0x40 | Y | Y | N | N |
| CANCEL | 1 | This command is used to terminate the pass-through command session.
| Y | Y | Y | Y |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1101 = Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2 | |||||
| 81 | var | Tag Response Code
| B | R | N/A |
| 82 | var | Encryption Control. If encrypted, see Table XX - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table XX – Unencrypted NFC/MIFARE Data. | B | O | N/A |
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| /DFDF59 | var | Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table XXX. | B | R | |
| /DFDF50 | var | Encrypted Data KSN | B | R | |
| /DFDF51 | 01 | Encrypted Data Encryption Type. See Encryption Type for a list of valid values. | B | R | |
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1102 | Pass Through Command for MIFARE DESFire, Type 4 - Command 0x1102 | ||||
| 81 | var | Command to Send. See DESFire Data Sheet (MF2DLHX0). Should follow ISO 7816-4 APDU format:
| B | R | |
| 82 | 01 | 00 – No Encrypt 01 - Encrypt | |||
| 83 | 01 | 00 – Expect More Commands 01 – FF (Last Command). If last command, Device will provide a single beep after receiving a successful response from tag; otherwise, device will provide a double beep. | B | R | |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1102 | Pass Through Command for MIFARE DESFire, Type 4 - Command 0x1102 | ||||
| 81 | 02 | Tag Response (SW1 SW2). See DESFire Data Sheet (MF2DLHX0). Should follow ISO 7816-4 APDU format:
If card is not able to respond:
| B | R | N/A |
| 82 | var | Tag Data:
Encryption Control: If encrypted, see Table XXX- Payload for Encrypted NFC/MIFARE Data. If unencrypted, see Table XXX– Unencrypted NFC/MIFARE Data. | B | O | N/A |
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| /DFDF59 | var | Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table XXX. | B | R | |
| /DFDF50 | var | Encrypted Data KSN | B | R | |
| /DFDF51 | 01 | Encrypted Data Encryption Type. See Encryption Type for a list of valid values. | B | R | |
| End of Notification Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1103 = Pass Through Command for MIFARE Plus, Type 2 - Command 0x1103 – | |||||
| 81 | var | Command to Send. See Table 110 - MIFARE Plus EV1/EV2/SE/X SL0 (Security Level 0) Commands. See Table 111 – MIFARE Plus EV1/EV2/SE/X SL3 (Security Level 3) Commands | B | R | |
| 82 | 01 | 00 – No Encrypt 01 - Encrypt | |||
| 83 | 01 | 00 – Expect More Commands 01 – FF (Last Command) If this is the last command, the Device will provide a single beep after receiving a successful response from the tag, otherwise, the device will provide a double beep | B | R | |
| End of any wrappers, at minimum including Request Message |
| Command | Length | Field Value | EV1 | EV2 | SE | X |
|---|---|---|---|---|---|---|
| GET_VERSION | 1 | The GET_VERSION command is used to retrieve manufacturing related data of the MIFARE Plus EV1/EV2 cards Byte 0 = 0x60 | Y | Y | N | N |
| READ_SIG | 2 | The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature of MIFARE Plus EV1/EV2 cards. Byte 0 = 0x3C Byte 1 = 0x00, RFU | Y | Y | N | N |
| WRITE_PERSO | 19 | The WRITE_PERSO command is used to pre-personalize AES keys and data from the initial delivery configuration to a customer specific value. Byte 0 = 0xA8 Byte 1-2 = Number of Block or Key to be written to (MSB first). See NXP doc ds206234, table 113. Byte 3 to 18 = 16 bytes value of the key or data which shall be written (in plain) | Y | Y | Y | Y |
| COMMIT_PERSO | 2 | The COMMIT_PERSO command is used to finalize the personalization and switch up to security level 1 or security level 3. For MIFARE Plus EV1/EV2, the following mandatory AES keys must be written using the WRITE_PERSO command before it can be switched to security level 1 or security level 3.
For MIFARE Plus SE, the following mandatory AES keys must be written using the WRITE_PERSO command before it can be switched to security level 1 (for L1 card) or security level 3 (for L3 card).
For MIFARE Plus X, the following mandatory AES keys must be written using the WRITE_PERSO command before it can be switched to security level 1 (for L1 card) or security level 3 (for L3 card).
Byte 0 = 0xAA Byte 1 = Security Level Option for EV1 and EV2 cards
Byte 1 = 0x00 for SE and X cards. The Device will return error for other values. It is also highly recommended to change all sector AES keys as well as the data within this security level in a secure environment. This command is behaved as the last command. The Device will provide a single beep after receiving a successful response from a card, otherwise, device will provide a double beep. | Y | Y | Y | Y |
| CANCEL | 1 | This command is used to terminate the pass-through command session. Byte 0 = 0xFF | Y | Y | Y | Y |
| Command | Length | Field Value | EV1 | EV2 | SE | X |
|---|---|---|---|---|---|---|
| MIFARE Plus Authenticate commands | ||||||
| First Authenticate (part1 and part2) | 3 | First Authenticate Byte 0 = 0x70 Byte 1-2 = Key Number of the key to be authenticated (MSB first). See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key#
| Y | Y | Y | Y |
| Following Authenticate (part 1 and part 2) | 3 | Following Authenticate Byte 0 = 0x76 Byte 1-2 = Key Number of the key to be authenticated (MSB first). See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key# (same AES_Key# options as First Authenticate) | Y | Y | Y | Y |
| ResetAuth | 1 | Reset the authentication Byte 0 = 0x78 | Y | Y | Y | Y |
| READ commands | ||||||
| Read | 4 | Reading encrypted, no MAC on response, MAC on command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. A MAC is only used on the command sent to the PICC, no MAC is attached to the response. Byte 0 = 0x30 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read MACed | 4 | Reading encrypted, MAC on response, MAC on Command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. A MAC is used on the command sent to the PICC and on the response received. Byte 0 = 0x31 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read Plain | 4 | Reading in plain, no MAC on response, MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is used on the command and not on the response. Byte 0 = 0x32 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read Plain MACed | 4 | Reading in plain, MAC on response, MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is used on the command sent to the PICC as well as on the response from the PICC Byte 0 = 0x33 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read UnMACed | 4 | Reading encrypted, no MAC on response, no MAC on command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x34 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read UnMACed, Response MACed | 4 | Reading encrypted, MAC on response, no MAC on command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. A MAC is used only on the response received. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x35 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read Plain UnMACed | 4 | Reading in plain, no MAC on response, no MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is not used on the response and not on the command. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x36 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| Read Plain UnMACed, Response MACed | 4 | Reading in plain, MAC on response, no MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is used on the response and not on the command. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x37 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer. | Y | Y | Y | Y |
| WRITE commands | Y | Y | Y | Y | ||
| Write | 20/36/52 | Writing encrypted, no MAC on response, MAC on Command. This command offers the possibility to write the data to up to three blocks in an encrypted way. MAC is only used on the command sent to the PICC. Byte 0 = 0xA0 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16. | Y | Y | Y | Y |
| Write MACed | 20/36/52 | Writing encrypted, MAC on response, MAC on command. This command offers the possibility to write the data to up to three blocks in an encrypted way. A MAC is used on the command sent to the PICC and on the response received from the PICC. Byte 0 = 0xA1 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16. | Y | Y | Y | Y |
| Write Plain | 20/36/52 | Writing in plain, no MAC on response, MAC on command. This command offers the possibility to write the data to up to three blocks in plain. A MAC is only used on the command sent to the PICC. Byte 0 = 0xA2 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16. | Y | Y | Y | Y |
| Write Plain MACed | 20/36/52 | Writing in plain, MAC on response, MAC on command. This command offers the possibility to write the data to up to three blocks in plain. A MAC is used on the command sent to the PICC as well as on the response from the PICC Byte 0 = 0xA3 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16. | Y | Y | Y | Y |
| VALUE operations | ||||||
| Increment | 7 | Increment encrypted, no MAC on response, MAC on command. This command offers the possibility to increment a value block where the command is secured by a MAC calculated, but not on the response. Byte 0 = 0xB0 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be incremented in LSB order. Example for increment by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Increment MACed | 7 | Increment encrypted, MAC on response, MAC on command. Byte 0 = 0xB1 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be incremented in LSB order. Example for increment by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Decrement | 7 | Decrement encrypted, no MAC on response, MAC on command. Byte 0 = 0xB2 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Decrement MACed | 7 | Decrement encrypted, MAC on response, MAC on command. Byte 0 = 0xB3 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Transfer | 3 | Transfer, no MAC on response, MAC on command. The Transfer command stores the content of the Transfer Buffer to the specified address. The Transfer command can be applied to any block. The Transfer command can only be executed after an Increment, Decrement, IncrementTransfer, DecrementTransfer or Restore command has been successfully executed since the latest authentication. The command is secured by a MAC on a command. No MAC is calculated on the response. Byte 0 = 0xB4 Byte 1-2 = Destination Block number (MSB first). | Y | Y | Y | Y |
| Transfer MACed | 3 | Transfer, MAC on response, MAC on command. Byte 0 = 0xB5 Byte 1-2 = Destination Block number (MSB first). | Y | Y | Y | Y |
| Increment Transfer | 9 | Increment Transfer encrypted, no MAC on response, MAC on Command. Combined increment and transfer. Byte 0 = 0xB6 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be incremented in LSB order. Example for increment by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Increment Transfer MACed | 9 | Increment Transfer encrypted, MAC on response, MAC on command. Byte 0 = 0xB7 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be incremented in LSB order. | Y | Y | Y | Y |
| Decrement Transfer | 9 | Decrement Transfer encrypted, no MAC on response, MAC on command. Byte 0 = 0xB8 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Decrement Transfer MACed | 9 | Decrement Transfer encrypted, MAC on response, MAC on command. Byte 0 = 0xB9 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00 | Y | Y | Y | Y |
| Restore | 3 | Restore encrypted, no MAC on response, MAC on command. The Restore command copies the Content found in the Value Block at the given address to the Transfer Buffer. The Restore command can only be applied to value blocks. Byte 0 = 0xC2 Byte 1-2 = Source Block number (MSB first). | Y | Y | Y | Y |
| Restore MACed | 3 | Restore encrypted, MAC on response, MAC on command. Byte 0 = 0xC3 Byte 1-2 = Source Block number (MSB first). | Y | Y | Y | Y |
| Others | ||||||
| GET_VERSION | 1 | The GET_VERSION command is used to retrieve manufacturing related data of the MIFARE Plus EV1/EV2 cards. This command can be sent before Read/Write/Value commands. Byte 0 = 0x60 | Y | Y | N | N |
| READ_SIG | 2 | The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature of MIFARE Plus EV1/EV2 cards. This command can be sent before Read/Write/Value commands. Byte 0 = 0x3C Byte 1 = 0x00, RFU | Y | Y | N | N |
| CANCEL | 1 | This command is used to terminate the pass-through command session. Byte 0 = 0xFF | Y | Y | Y | Y |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1103 = Command 0x1103 – Pass Through Command for MIFARE Plus, Type 2 | |||||
| 81 | 01 | Tag Response Code 0x00 = Success 0x01 = Failed | B | R | N/A |
| 82 | Var | Encryption Control If encrypted, see Table 93 - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table 94 – Unencrypted NFC/MIFARE Data. | B | O | N/A |
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| /DFDF59 | var | Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table 360. | B | R | |
| /DFDF50 | var | Encrypted Data KSN | B | R | |
| /DFDF51 | 01 | Encrypted Data Encryption Type. See Encryption Type for a list of valid values. | B | R | |
| End of Notification Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1801 = Request Cardholder Signature (Touch Only) - Command 0x1801 | |||||
| 81 | 01 | Timeout — Timeout in seconds that the device should wait for the cardholder to sign and confirm completion. | B | R | |
| 82 | 01 | Encryption on signature and user data. 0=disabled, 1=enabled. | B | O | 0 |
| A3 | var | User data parameters for item #0 to item #3. The maximum total size of 0xA3 TLV is 4,000 bytes. This TLV may be present only if encryption is enabled. | T | O | |
| /81 | var | User data item #0, optional | B | O | |
| /82 | var | User data item #1, optional | B | O | |
| /83 | var | User data item #2, optional | B | O | |
| /84 | var | User data item #3, optional | B | O | |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1801 = Request Cardholder Signature (Touch Only) - Command 0x1801 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 1802 | Report Cardholder Selection = Command 0x1802 | ||||
| 81 | 01 | Cardholder Selection Request Status - 0x00 = Cardholder Selection Request completed, see Selection Result parameter. - 0x01 = Cardholder Selection Request canceled by cardholder, Transaction Aborted. - 0x02 = Cardholder Selection Request timed out, Transaction Aborted. | B | R | |
| 82 | 01 | Selection Result — Menu item index the cardholder selected. If the cardholder made no selection or the operation terminated abnormally, the device does not include this parameter. | B | O | |
| End of any wrappers, at minimum including Request Message. |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 1802 | Report Cardholder Selection - Command 0x1802 | ||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message. |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1803 = Display Message (Display Only) - Command 0x1803 | |||||
| 81 | 01 | Timeout - 0x00 = Infinite. Device leaves the requested message on the display until the host initiates a change. | B | O | 0x00 |
| - All other values = Timeout in seconds for the device to display the message. | |||||
| 82 | 01 | Message ID. Specify a Display String ID from Display Strings. | B | O | 0x14 |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1803 = Display Message (Display Only) - Command 0x1803 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1804 = Command 0x1804 - | |||||
| 81 | 01 | Enable - 0x00 = Disable. The device disables the barcode reader. In this case, the device ignores all other parameters. - 0x01 = Enable. The device enables the barcode reader. | B | R | 0x00 |
| 82 | 01 | Timeout - 0x00 = Infinite. The device leaves the barcode reader enabled until it reads a barcode, or until the host sends this command again to disable the barcode reader. - All other values = Timeout in seconds for the device to leave the barcode reader enabled without reading a barcode. | B | O | 0x00 |
| 83 | 01 | Encrypt Barcode Data - 0x00 = Do Not Encrypt. The device does not encrypt the barcode data when it sends User Interface Operation Complete. - Notification 0x1805 - 0x01 = Encrypt. The device encrypts the barcode data when it sends User Interface Operation Complete. - Notification 0x1805 | B | O | 0x00 |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1804 = Read Barcode (BCR Only) - Command 0x1804 | No parameters. | ||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1805 = Command 0x1805 | |||||
| 81 | N*4 | N = Number of tones
4 = 4 bytes data parameter for each tone in the sequence Byte0-Byte1 – Frequency in units of 1 Hz
Byte 2-Byte3 – Duration of tone in units of 1 millisecond | B | R | |
| |||||
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1805 = Buzzer - Command 0x1805 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1806 = Command 0x1806 – Personal Info Entry | |||||
| 81 | 01 | Capture Type 0x01 = Phone Number: Capture the phone number 0x03 = Zip code: Capture the zip code | B | R | |
| 82 | 01 | Encryption for user data (Optional) 01 - Encrypt | B | R | |
| Beginning of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1807 = LED Control - Command 0x1807 – | |||||
| 81 bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 02 | Byte 1 - User Control LED
Byte 2 – Duration in unit of second
| B | R | |
| 82 | 02 | Byte 1 - LED number
Where the LEDs are numbered 1, 2, 3, 4 counting from the left. Example: 0x01 = LED 1, 0x03 = LED 1 and LED 2.
Byte 2 - LED Status
| B | R | |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
| Beginning of any wrappers, at minimum including Response Message | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1821 = Show Image (Display Only) - Command 0x1821 | |||||
| 81 | 01 | Custom Idle Page Image Number
| B | R | |
| 82 | 01 | Display Option
| B | O | 0 |
| 83 | 01 | Display Time
| B | O | 0 |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1821 = Show Image (Display Only) - Command 0x1821 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message. | |||||
| 1822 = Show QR Code (Display Only) - Command 0x1822 | |||||
| 81 | 01 | Display Time - 0x00 = Indefinite - 0x01 to 0xFF = 1 to 255 seconds | B | O | 0x00 |
| 82 | var | Data to Encode — See ISO/IEC 18004:2015 | B | R | |
| 83 | 01 | Error Correction - 0x00 = Low - 0x01 = Medium - 0x02 = Quartile - 0x03 = High See ISO/IEC 18004:2015 | B | O | 0x00 |
| 84 | 01 | Mask Pattern - 0x00 to 0x07 = Mask Pattern - 0xFF = Device Select Optimal Mask Pattern — See ISO/IEC 18004:2015 | B | O | 0xFF |
| 85 | 01 | Minimum Version — Must be less than or equal to Maximum Version - 0x01 to 0x28 = Version 1 to Version 40 — See ISO/IEC 18004:2015 | B | O | 0x01 |
| 86 | 01 | Maximum Version — Must be greater than or equal to Minimum Version See ISO/IEC 18004:2015 | B | O | 0x28 |
| 87 | 03 | Block Color — Use RRGGBB format. | B | O | 0x000000 (Black) |
| 88 | 03 | Background Color — Use RRGGBB format. | B | O | 0xFFFFFF (White) |
| 89 | var | Prompt Text for the device to display below the QR code. Because the device shows the Prompt using a proportional font, the maximum length that fits the display depends on the text and the device’s orientation set by Property 1.2.3.1.1.2 Custom Idle Page Image Device Locked (Display Only). In Landscape orientation, the upper limit is approximately 30 characters. In Portrait orientation, the limit is approximately 22 characters. | B | ) | No prompt |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message. | |||||
| 1822 = Show QR Code (Display Only) - Command 0x1822 | |||||
| No parameters | |||||
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message (see message wrapper definition) | |||||
| 1806 = Personal Info Entry - Command 0x1806 | |||||
| 81 | 01 | Capture Type: 0x01 = Phone Number; 0x02 = Social; 0x03 = Zip code; 0x04 = Employee ID; 0x05 = Birth Date (USA format); 0xFF = Cancel Capture | B | R | |
| Beginning of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message (see message wrapper definition) | |||||
| 1806 = Personal Info Entry - Command 0x1806 | |||||
| No parameters. | |||||
| Beginning of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1823 = Show Bitmap Image (Display Only) - Command 0x1823 | |||||
| 81 | 01 | Display Time: 0x00 = Indefinite; 0x01 to 0xFF = 1 to 255 seconds | B | O | 0x00 |
| 82 | 03 | Background Color. Use RRGGBB format. | B | O | N/A |
| 83 | 02 | X Position. The device places the left edge of the image at this pixel position relative to the left edge of the display, which is position 0x0000. This parameter plus the pixel width of the image must be less than the pixel width of the display. The display’s pixel width depends on the device’s orientation set by Custom Idle Page Image Device Locked (Display Only) - Property 1.2.3.1.1.2. For information about the resolution of the display, see the specifications in the device’s Installation and Operation Manual. | B | O | Centered |
| 84 | 02 | Y Position. The device places the top edge of the image at this pixel position relative to the top edge of the display, which is position 0x0000. This parameter plus the pixel height of the image must be less than the pixel height of the display. The display’s pixel height depends on the device’s orientation set by Custom Idle Page Image Device Locked (Display Only) - Property 1.2.3.1.1.2. For information about the resolution of the display, see the specifications in the device’s Installation and Operation Manual. | B | O | Centered |
| 85 | var | Bitmap Image encoded in full BMP file format as defined by Microsoft (e.g., starting with “BM”) or Magtek signed image file format | B | R | |
| 86 | 01 | Display Option:
| B | O | 0 |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1823 = Show Bitmap Image (Display Only) - Command 0x1823 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| 1830 = Display Flexible UI Pages (Display Only) - Command 0x1830 | |||||
| 81 | 01 | Display Time
| B | R | |
| 82 | 01 | UI page option
| B | R |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1830 = Display Flexible UI Pages (Display Only) - Command 0x1830 | |||||
| 81 | 01 | Display Time
| B | R | |
| 82 | 01 | UI page option
| B | R | |
| 83 | 02 | Text String ID for a tile of UI page option: 0x01, 0x02, 0x03 See Table 361 – Default User Interface String IDs and Strings If host wants to disable this title, do not include this tag. | B | O |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| A1 | var | Text string parameters for UI page option: 0x00 The parameter in this TLV data object allow the host to enable and disable the data base for UI page option 0x00 | B | O | |
| /81 | var | Text string (<= 30 characters) for line 1, end with NULL char. If host wants to disable this line, do not include this tag. | B | O | |
| /82 | var | Text string (<= 30 characters) for line 2, end with NULL char. If host wants to disable this line, do not include this tag. | B | O | |
| /83 | var | Text string (<= 30 characters) for line 3, end with NULL char. If host wants to disable this line, do not include this tag. | B | O | |
| /84 | var | Text string (<= 30 characters) for line 4, end with NULL char. If host wants to disable this line, do not include this tag. | B | O | |
| /85 | var | Text string (<= 30 characters) for line 5, end with NULL char. If host wants to disable this line, do not include this tag. | B | O | |
| /86 | 02 | Function button Middle option. String ID = Enable functional button Middle with a String ID associated with a configured String message. See Table XXX – Default User Interface String IDs and Strings When user presses this button, device sends notification to the host to indicate the functional button Middle is pressed. See User Interface Host Action Request - Notification 0x1803 If host wants to disable this button, do not include this tag | B | O | |
| A2 | var | Button text String ID parameters for UI page option: 0x01 and 0x02. The parameter in this TLV data object allows the host to enable and disable the data base. When user presses any button, device sends notification to the host to indicate which button is pressed. See User Interface Host Action Request - Notification 0x1803 | B | O | |
| /81 | 02 | Text String ID for button 1. See Table XXX – Default User Interface String IDs and Strings. If host wants to disable this button, don’t include this tag. | B | O | |
| /82 | 02 | Text String ID for button 2. See Table XXX – Default User Interface String IDs and Strings. If host wants to disable this button, don’t include this tag. | B | O | |
| /83 | 02 | Text String ID for button 3. See Table XXX – Default User Interface String IDs and Strings. If host wants to disable this button, don’t include this tag. | B | O | |
| /84 | 02 | Text String ID for button 4. See Table XXX – Default User Interface String IDs and Strings. If host wants to disable this button, don’t include this tag. | B | O | |
| /85 | 02 | Text String ID for button 5. See Table XXX – Default User Interface String IDs and Strings. If host wants to disable this button, don’t include this tag. | B | O | |
| /86 | 02 | Text String ID for button 6. See Table XXX – Default User Interface String IDs and Strings. If host wants to disable this button, don’t include this tag. | B | O | |
| A3 | var | Button $Amount parameters for UI page option: 0x01, 0x02 The parameter in this TLV data object allows the host to enable and disable the data base for UI page option 0x01 and 0x02 When user presses any button, device sends notification to the host to indicate which amount button is pressed. See User Interface Host Action Request - Notification 0x1803 | B | O | |
| /81 | 04 | Value $Amount for button 1. If host wants to disable this button, don’t include this tag. | B | O | |
| /82 | 04 | Value $Amount for button 2. If host wants to disable this button, don’t include this tag. | B | O | |
| /83 | 04 | Value $Amount for button 3. If host wants to disable this button, don’t include this tag. | B | O | |
| /84 | 04 | Value $Amount for button 4. If host wants to disable this button, don’t include this tag. | B | O | |
| /85 | 04 | Value $Amount for button 5. If host wants to disable this button, don’t include this tag. | B | O | |
| /86 | 04 | Value $Amount for button 6. If host wants to disable this button, don’t include this tag. | B | O | |
| A4 | var | Functional buttons parameters for UI page option: 0x01 and 0x02. The parameter in this TLV data object allows the host to enable and disable the data base. When user presses any button, the device sends notification to the host to indicate which functional button is pressed. See User Interface Host Action Request - Notification 0x1803 | B | O | |
| /81 | 03 | Text String ID and color option for functional button Left. See Table XXX – Default User Interface String IDs and Strings. Byte 0-1: String ID Byte 2: color option 0x00 = red 0x01 = green 0x02 = yellow If host wants to disable this button, don’t include this tag. | B | O | |
| /82 | 03 | Text String ID and color option for functional button Middle. See Table XXX – Default User Interface String IDs and Strings. Byte 0-1: String ID Byte 2: color option 0x00 = red 0x01 = green 0x02 = yellow If host wants to disable this button, don’t include this tag. | B | O | |
| /83 | 03 | Text String ID and color option for functional button Right. See Table XXX – Default User Interface String IDs and Strings. Byte 0-1: String ID Byte 2: color option 0x00 = red 0x01 = green 0x02 = yellow If host wants to disable this button, don’t include this tag. | B | O | |
| A5 | var | Parameters for UI page option 0x03 The parameter in this TLV data object allow the host to enable and disable the data base | B | O | |
| /81 | 02 | Text String ID for green functional button Right. See Table XXX – Default User Interface String IDs and Strings. When user presses this button, device sends notification to the host to indicate the functional button Right is pressed. See User Interface Host Action Request - Notification 0x1803 If host wants to disable this button, don’t include this tag. | B | O | |
| /82 | 02 | X Position. If host wants device to display the image in the center of the loading image area, don’t include this tag. | B | O | |
| /83 | 02 | Y Position. If host want device to display the image in the center of the loading image area, don’t include this tag Note: Y pos >= 50px Y pos + Image Height <= 190px Landscape Screen Orientation Y pos + Image Height <= 270px Portrait Screen Orientation | B | O | |
| /84 | var | Bitmap Image encoded in full BMP file format as defined by Microsoft (e.g, starting with “BM”) Image Width Max = 320px Landscape Screen Orientation Image Height Max = 140px Landscape Screen Orientation Image Width Max = 240px Portrait Screen Orientation Image Height Max = 220px Portrait Screen Orientation | B | O | |
| /85 | var | Bottom left corner option Byte 0 = option
Byte 1 = length of the text, should be less than 16 characters. Byte 2..N = text string value. | B | 0 | |
| A8 | Var | Parameters for UI page option 0x06 | B | O | |
| /81 | 2 | Image X position (omit for default centered position) | B | O | |
| /82 | 2 | Image Y position (omit for default centered position) | B | O | |
| /83 | 1 | Image ID (for image stored on device). Value is 0-3 for the 4 available image ‘slots’. Must be signed image for touch notifications to be sent. Cannot be used in the same command as /84. | B | O | |
| /84 | var | Image data. Image encoded in full BMP file format as defined by Microsoft (e.g, starting with “BM”) OR contents of .bin file for Magtek signed image file. Must be signed .bin data for touch notifications to be sent. Cannot be used in the same command as /83. | B | O | |
| End of any wrappers, at minimum Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1830 = Display Flexible UI Pages (Display Only) - Command 0x1830 | |||||
| No parameters | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Req | Default |
|---|---|---|---|---|
| /81 | 01 | Start/Cancel
| R | |
| /82 | 01 | Timeout in seconds
| O | 0x00 |
| /83 | <= 254 | URL URL to use as card data. Required when starting card emulation. Optional and ignored if canceling emulation. Example: https://www.magtek.com/ | O/R |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1F01 = Reset Device - Command 0x1F01 | |||||
| 81 | 01 | Power Off Option
Power off only works while a device is running on its battery. If a device is powered off while it is powered by USB, the device will immediately turn back on. | B | O | 0x00 |
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1F01 = Reset Device - Command 0x1F01 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Request Message | |||||
| 1F02 = Set Notification Subscriptions - Command 0x1F02 | |||||
| 81 | 01 | Subscribe
| B | O | 0x01 |
| 82 | 01 | Notifications Affected
| B | O | 0x01 |
| 83 | var | Notification Message ID List List of two-byte Notification Message IDs (MSB first) from section 7 Notifications to be subscribed / unsubscribed by this command. For example, to subscribe to Notification 0x0105 - Transaction Operation Complete on the interface being used to send this command, the host would include 0x0105 as two bytes in the list. The device ignores any Notification Message IDs in the list that do not exist. | B | O | Null |
| A4 | var | Interfaces List of interfaces this command should change the subscription settings for. If the host does not specify any interfaces here, the command applies only to the interface the host is using to send the command. | B | ) | Null |
| /81 | 00 | Apply changes to the USB interface | O | ||
| /82 | 00 | Apply changes to the WLAN interface | O | ||
| /83 | 00 | Apply changes to the Bluetooth® LE interface | O | ||
| /84 | 00 | Apply changes to the UART interface | O | ||
| End of any wrappers, at minimum including Request Message |
| Tag | Len | Value / Description | Typ | Req | Default |
|---|---|---|---|---|---|
| Beginning of any wrappers, at minimum including Response Message | |||||
| 1F02 = Set Notification Subscriptions - Command 0x1F02 | |||||
| No parameters. | |||||
| End of any wrappers, at minimum including Response Message |