ISO 8583 Parser
πŸ”’ Premium Β· Advanced Β· ~12 min read

EMV Chip & DE55 Deep Dive: ARQC / TVR / CVM

Preview: magstripe data is static and clonable; an EMV chip generates a unique dynamic cryptogram for every transaction β€” that's the core reason it's safer. This piece breaks down the EMV data carried in DE55, where the ARQC cryptogram comes from, and how TVR/CVM decide online-vs-offline and approve-vs-decline.

What's inside DE55

DE55 carries chip data as BER-TLV (Tag-Length-Value), a sequence of tags. The most important ones:

TagMeaning
9F26Application Cryptogram (ARQC/TC/AAC)
9F27Cryptogram Information Data (CID)
9F36Application Transaction Counter (ATC)
95Terminal Verification Results (TVR)
9F34CVM Results
82Application Interchange Profile (AIP)

The parser tool on this site already decodes DE55 tag by tag and bit-decodes TVR (95), AIP (82), CID (9F27) and CVM (9F34). Below we cover the logic behind those bits.

Where the ARQC comes from

Using a key known only to the card and the issuer, the card computes a cryptographic MAC over key transaction data (amount, currency, unpredictable number, ATC, TVR …) to produce the ARQC. The issuer recomputes it with the same key to verify β€” a match is required for approval. Because it includes the ATC (incrementing) and a random number, every cryptogram is unique and cannot be replayed.

πŸ”’

Subscribe to read the full article

The rest covers: every TVR bit and "why it went online", how the CVM list picks the verification method (PIN/signature/no-CVM), offline data authentication (SDA/DDA/CDA), issuer scripts 71/72, and a full DE55 walkthrough on a real message.

Subscriptions coming soon β€” stay tuned