- Joined
- Jan 23, 2026
- Messages
- 1,027
- Reaction score
- 34,631
Steps for ARQC GenerationThere are four basic steps to ARQC generation:
Card Key Derivation Session Key Derivation Preparation of Input Data in ARQC CalculationEncryption/ Hashing
(the final step that gives the ARQC)Restating the above list,
the first step is to derive the card key and then use the card key to derive a session key. In parallel,
we need to prepare some data and then encrypt that data with the session key derived in the previous step.
Exact details vary from one chip program to another!
Step 1 and 2: Card and Session Key DerivationWhen a card is out in the field, it already contains Issuer Master Key.
But to create an ARQC for a particular transaction, two new keys are required:
the first key is called Card Key and the second key is called Session Key.
Each EMV scheme (such as M/Chip and Visa) has its own algorithm for generation of the card key and/ or the session key.
Some of these algorithms are standardized and part of the EMV specification while some others are proprietary with the vendor.
The Card Key is unique to the card and the Session Key is unique to the transaction.
It's Session Key which is used for the final encryption in step 4.
Step 3: Data PreparationIn parallel to the key derivation as described above,
An important step of ARQC generation is “preparation of input data”, mentioned as point #3 in the list above. Once again,
which EMV tags are concatenated to prepare this input data is EMV scheme specific.
Step 4: ARQC Generation Finally, once the Session Key and Input Data are ready, the Input
Data is encrypted using the Session Key to give the ARQC.
Card Key Derivation Session Key Derivation Preparation of Input Data in ARQC CalculationEncryption/ Hashing
(the final step that gives the ARQC)Restating the above list,
the first step is to derive the card key and then use the card key to derive a session key. In parallel,
we need to prepare some data and then encrypt that data with the session key derived in the previous step.
Exact details vary from one chip program to another!
Step 1 and 2: Card and Session Key DerivationWhen a card is out in the field, it already contains Issuer Master Key.
But to create an ARQC for a particular transaction, two new keys are required:
the first key is called Card Key and the second key is called Session Key.
Each EMV scheme (such as M/Chip and Visa) has its own algorithm for generation of the card key and/ or the session key.
Some of these algorithms are standardized and part of the EMV specification while some others are proprietary with the vendor.
The Card Key is unique to the card and the Session Key is unique to the transaction.
It's Session Key which is used for the final encryption in step 4.
Step 3: Data PreparationIn parallel to the key derivation as described above,
An important step of ARQC generation is “preparation of input data”, mentioned as point #3 in the list above. Once again,
which EMV tags are concatenated to prepare this input data is EMV scheme specific.
Step 4: ARQC Generation Finally, once the Session Key and Input Data are ready, the Input
Data is encrypted using the Session Key to give the ARQC.
𝗨𝗦𝗔 , 𝗘𝗥𝗢𝗨𝗣𝗘 & 𝗔𝗦𝗜𝗔 . 𝗝𝘂𝘀𝘁 𝗳𝗶𝗻𝗱 𝗮 𝗻𝗲𝗮𝗿𝗯𝘆 𝗔𝗧𝗠 𝗮𝗻𝗱 𝗵𝗼𝗹𝗹𝗮 𝗮𝘁 𝗺𝗲 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗰𝗹𝗼𝗻𝗲 𝗰𝗮𝗿𝗱
