0. 前言
脱机数据认证，Offline Data Authentication，缩写为ODA，是终端用来验证卡片有效性的手段。ODA分为三种，SDA，DDA和CDA；准确的讲，CDA也是DDA的一种，在DDA的基础上进行了增强。
- SDA: Static Data Authentication
- DDA: Dynamic Data Authentication
- CDA: Combined DDA/Application Cryptogram Generation
1. 作用
终端使用卡片交互特征(AIP)以及终端本身的能力来决定使用哪种ODA。从优先级的角度来讲，CDA > DDA > SDA。SDA
- 终端从卡片中读取出发卡行证书及签名数据，使用CA公钥PCA恢复出发卡行公钥PI
- 终端使用恢复的发卡行公钥PI解密卡片签名数据
- 终端将解密结果与卡片静态数据进行比对，保存比对结果
DDA
- 终端从卡片取出发卡行证书及IC卡证书，使用CA公钥PCA恢复出发卡行公钥PI，使用恢复的发卡行公钥PI恢复出IC卡公钥PICC
- 终端向IC卡发送内部认证命令（INTERNAL AUTHENTICATE）请求一个动态签名；卡片连接内部认证命令中的终端数据和在IC卡动态数据中指定的卡片数据，由卡片私钥SICC对该数据进行数字签名并返回给终端
- 终端使用IC卡公钥PICC对数字签名进行验证
CDA
- 终端从卡片取出发卡行证书及IC卡证书，使用根CA公钥PCA恢复出发卡行公钥PI，使用恢复的发卡行公钥PI恢复出IC卡公钥PICC
- 终端向卡片发出应用密文命令（GENERATE AC）；卡片响应该命令
- 卡片连接终端通过另外的命令送来的数据及自己的响应数据，由卡片私钥SICC对该数据进行数字签名并返回给终端
- 验证卡片生成动态签名。这一步在联机处理过程中执行。如果验证失败，交易拒绝
2. DDA详解
由于SDA已经处于被淘汰状态中，而CDA事实上的使用并不是特别多。现在主流的认证方式还是DDA。下面对DDA做一个比较详细的解释。2.0 背景知识：公私钥体系
密钥体系有两种，对称密钥（如DES，AES等）和非对称密钥（如RSA，ECC等）。所谓的对称密钥，就是加密方和解密方使用同样的密钥，或者很容易由一个密钥推导出另一个密钥。显而易见，这里任意一方发生密钥泄漏，就会轻易导致加密内容泄漏。另外，在多方加密会话中，密钥管理复杂性显而易见。如果有ABC三方，想要保持两两私密通信，则需要AB，AC，BC三组密钥，且密钥的传输必须通过另外的安全通道。
而非对称密钥可以解决这个问题。根据定义，每个参与方产生自己的公私钥对，私钥自己安全保留，公钥则可以通过公开渠道散发出去。公钥加密的信息只能用对应的私钥解密，反之亦然。
- 用途一，加密：在上面的情况下，A、B、C各自产生自己的公钥和私钥。私钥自己保留，公钥发布出去。如果A要跟B通信，则用B的公钥进行加密，B收到密文后用自己的私钥解密即可。
- 用途二，签名：如果A想要让大家都相信这段信息确实是自己发的，不是别人伪造的，它可以用自己的私钥加密某段数据，并把明文一起发送出去。B收到加密数据后，用A的公钥解密，然后与原文进行比对是否一致，即可证明
2.1 密钥体系
公私钥
一共存在三组公私钥，分别属于ICC，Issuer，CA。在卡中存储IC卡私钥。终端可以通过终端管理系统获得CA的公钥。
证书
在卡中存储- 经CA公钥签名的发卡行证书
- 经发卡行公钥签名的IC卡证书
2.2 交易流程
- 1. 恢复PICC： 终端从卡片取出发卡行证书及IC卡证书，使用CA公钥PCA恢复出发卡行公钥PI，然后使用恢复出的PI恢复出IC卡公钥PICC
- 2. 请求动态签名： 终端向IC卡发送内部认证命令（INTERNAL AUTHENTICATE）请求一个动态签名；卡片拼接内部认证命令中的终端数据和在IC卡动态数据中指定的卡片数据，由卡片私钥SICC对该数据进行数字签名并返回给终端。拼接格式参见EMV Book 2, Table 15
- 3. 验证动态签名： 终端使用IC卡公钥PICC对数字签名进行验证
2.2.1 恢复PICC
首先恢复PI；参与方CA公钥和发卡行公钥证书 [2018-08-01 14:28:58]
DDA: Issuer Public Key Recovery
****************************************
CA PK Modulus:
ACD2B12302EE644F3F835ABD1FC7A6F62CCE48FFEC622AA8EF062BEF6FB8BA8BC68BBF6AB5870EED579BC3973E121303D34841A796D6DCBC41DBF9E52C4609795C0CCF7EE86FA1D5CB041071ED2C51D2202F63F1156C58A92D38BC60BDF424E1776E2BC9648078A03B36FB554375FC53D57C73F5160EA59F3AFC5398EC7B67758D65C9BFF7828B6B82D4BE124A416AB7301914311EA462C19F771F31B3B57336000DFF732D3B83DE07052D730354D297BEC72871DCCF0E193F171ABA27EE464C6A97690943D59BDABB2A27EB71CEEBDAFA1176046478FD62FEC452D5CA393296530AA3F41927ADFE434A2DF2AE3054F8840657A26E0FC617
Issuer's Public Key Certificate:
0C39FBBD8BFA33AEBD8E209518DD33E7046AC4CDFDA8DED4D439677F87B125868B83BBCF2B616F2DA735536AA55C24BC3A95738734CF88C9DA44B9827924FCAFEEC188858E294ED2F5C21554EF630D925B40876C64EF9994487B1B75CF0BE0CA9A8F5074E295061344247EB90837207AAA586A0DB362DB9E0BCBD8932B2C73D4A2CECB088BA4CDC6467E0BC323C89E300AF5185F0F3398F10C5DC08CCF695648A11779A02EB6701A3FE61C32E6E7AC4D0B3C1D7F4D00D71442871DBC0862CA8D9636DF31DFBBFEE35C18AA0E3D9FE04A142FF351E07A1D9C1325F6F5EF6121F8047D8E10FC946833599085B65BB934C79C591E6C434285FF
----------------------------------------
Recovered Data: 6A02421329FF12270375D40101F801CF69881AA8DD782588F5EA595D5646C2417A0F9847212945BD84CCFECB48DA15B3B0751AD83118FD0DB270D7CF006BB6DDBCAAC530421C892D6D5582C121AE2B056A96A36B7481799E3D82CD57724C7E22CD97A0459BFD44E9E138158813CF66A9A15AD6461B25F462535EE0137864B029827403E04D1229DDDA9710F47CD97EFC366D5640F5A4860E4EE98B52FA8AC662C96486355FE6774D393BD43D018FB5DB139341E95D6BAAB409D0028AF8026F2B93DAB5710053BA3EFDBD6227264D1C89C854CCE054986AF0D9FCDB47C541AFA0D6AA48CB7BF652505218360B8619901FB7052D2C0703C8BC
Data Header: 6A
Data Format: 02
Issuer Identifier: 421329FF
Certificate Expiration Date: 1227
Certificate Serial Number: 0375D4
Hash Algorithm Indicator: 01
Issuer Public Key Algorithm Indicator: 01
Issuer Public Key Length: F8
Issuer Public Key Exponent Length: 01
Issuer Public Key: CF69881AA8DD782588F5EA595D5646C2417A0F9847212945BD84CCFECB48DA15B3B0751AD83118FD0DB270D7CF006BB6DDBCAAC530421C892D6D5582C121AE2B056A96A36B7481799E3D82CD57724C7E22CD97A0459BFD44E9E138158813CF66A9A15AD6461B25F462535EE0137864B029827403E04D1229DDDA9710F47CD97EFC366D5640F5A4860E4EE98B52FA8AC662C96486355FE6774D393BD43D018FB5DB139341E95D6BAAB409D0028AF8026F2B93DAB5710053BA3EFDBD6227264D1C89C854CCE054986AF0D9FCDB47C541AFA0D6AA48
Hash Result: CB7BF652505218360B8619901FB7052D2C0703C8
Data Trailer: BC
Decoded Data Length: 248
----------------------------------------
Recovered Data validation:
----------------------------------------
Step 1: CA PK Modulus and Issuer's Public Key Certificate having the same size: Passed
Step 2: Recovered Data Trailer check: Passed
Step 3: Recovered Data Header check (0x6A): Passed
Step 4: Certificate Format check (0x02): Passed
Step 5: Hash Input Data: 02421329FF12270375D40101F801CF69881AA8DD782588F5EA595D5646C2417A0F9847212945BD84CCFECB48DA15B3B0751AD83118FD0DB270D7CF006BB6DDBCAAC530421C892D6D5582C121AE2B056A96A36B7481799E3D82CD57724C7E22CD97A0459BFD44E9E138158813CF66A9A15AD6461B25F462535EE0137864B029827403E04D1229DDDA9710F47CD97EFC366D5640F5A4860E4EE98B52FA8AC662C96486355FE6774D393BD43D018FB5DB139341E95D6BAAB409D0028AF8026F2B93DAB5710053BA3EFDBD6227264D1C89C854CCE054986AF0D9FCDB47C541AFA0D6AA486DCCF886E00029C08CD05FF28C3397ABE271B0E5148AD2C97992B60A08691370C4FC075703
Step 6: Hashing Result: CB7BF652505218360B8619901FB7052D2C0703C8
Step 7: Hash Result Comparison: Passed
Step 8: Issuer Identifier check: Skipped (DIY)
Step 9: Certificate Expiry Date check: Passed
Step 10: RID revocation check: Skipped (optional DIY)
Step 11: PK Algorithm Indicator check: Passed
Step 12: Issuer Public Key Modulus: CF69881AA8DD782588F5EA595D5646C2417A0F9847212945BD84CCFECB48DA15B3B0751AD83118FD0DB270D7CF006BB6DDBCAAC530421C892D6D5582C121AE2B056A96A36B7481799E3D82CD57724C7E22CD97A0459BFD44E9E138158813CF66A9A15AD6461B25F462535EE0137864B029827403E04D1229DDDA9710F47CD97EFC366D5640F5A4860E4EE98B52FA8AC662C96486355FE6774D393BD43D018FB5DB139341E95D6BAAB409D0028AF8026F2B93DAB5710053BA3EFDBD6227264D1C89C854CCE054986AF0D9FCDB47C541AFA0D6AA486DCCF886E00029C08CD05FF28C3397ABE271B0E5148AD2C97992B60A08691370C4FC0757
----------------------------------------
Issuer's Public Key Module Recovery succeeded.
输入：IC卡证书，发卡行公钥，静态数据以及AIP。其中静态数据参与项由AFL指定
[2018-08-01 14:41:14]
DDA: ICC Public Key Recovery
****************************************
Issuer PK Modulus:
CF69881AA8DD782588F5EA595D5646C2417A0F9847212945BD84CCFECB48DA15B3B0751AD83118FD0DB270D7CF006BB6DDBCAAC530421C892D6D5582C121AE2B056A96A36B7481799E3D82CD57724C7E22CD97A0459BFD44E9E138158813CF66A9A15AD6461B25F462535EE0137864B029827403E04D1229DDDA9710F47CD97EFC366D5640F5A4860E4EE98B52FA8AC662C96486355FE6774D393BD43D018FB5DB139341E95D6BAAB409D0028AF8026F2B93DAB5710053BA3EFDBD6227264D1C89C854CCE054986AF0D9FCDB47C541AFA0D6AA486DCCF886E00029C08CD05FF28C3397ABE271B0E5148AD2C97992B60A08691370C4FC0757
ICC's Public Key Certificate:
BFDF53A181242769883034AF4A8757CCC11BC976DA16ADB934D3536825489A865BCAAF7A00B8DD9CA94EAB349954B7FB2FBB24168C69FD3C3D011B19DFFC3EBB90E3880399A2E423C55CE9DB2FCC1688FD09851C2F34CBEF4194AC2977EBF62B416228992B62A5649C448CDFCD68B8A253FB80F6FCB07A524C93544E666EA738A07031B684CC2909D00F66F44A66FB9EC55A67B0316DA5E496DC88125E9EB536E74963D64ADA2E463A7FC74698FB62E8731CA17FD64C22BEA051B5209868181DFCEDB2B80468FB2D9B69D09309AA03833E6A51914998D96A0FB76CABA310AD80B95A37A6DA77252BF80A0808D80497DE5039C777DC2133A3
----------------------------------------
Recovered Data: 6A044213291056350226FFFF122700192B01018001D6BFB6B18A7FC25CE73D93BFC4816142E008AA5952EC506317835ACA64F9EA7FE210200BAA4829977BAEE5219B02002EEB4006B585B1D5729F1445FE7A79A8FB1FD6B74D56573BE87464DF859D0DDA2D25A8C48A8EB88E99440637D414B6046AAE702169A86141D16116DA97129AEFD7D73EDF4A1ACC42E8B5FBC1A3C3589839BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB06B1113F2DDB23FC16A3B526EC42E2B608CF1169BC
Data Header: 6A
Data Format: 04
Issuer Identifier: 42132910
Certificate Expiration Date: 1227
Certificate Serial Number: 00192B
Hash Algorithm Indicator: 01
ICC Public Key Algorithm Indicator: 01
ICC Public Key Length: 80
ICC Public Key Exponent Length: 01
ICC Public Key: D6BFB6B18A7FC25CE73D93BFC4816142E008AA5952EC506317835ACA64F9EA7FE210200BAA4829977BAEE5219B02002EEB4006B585B1D5729F1445FE7A79A8FB1FD6B74D56573BE87464DF859D0DDA2D25A8C48A8EB88E99440637D414B6046AAE702169A86141D16116DA97129AEFD7D73EDF4A1ACC42E8B5FBC1A3C3589839BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Hash Result: 06B1113F2DDB23FC16A3B526EC42E2B608CF1169
Data Trailer: BC
Decoded Data Length: 248
----------------------------------------
Recovered Data validation:
----------------------------------------
Step 1: Issuer's PK Modulus and ICC Public Key Certificate having the same size: Passed
Step 2: Recovered Data Trailer check: Passed
Step 3: Recovered Data Header check (0x6A): Passed
Step 4: Certificate Format check (0x04): Passed
Step 5: Hash Input Data: 044213291056350226FFFF122700192B01018001D6BFB6B18A7FC25CE73D93BFC4816142E008AA5952EC506317835ACA64F9EA7FE210200BAA4829977BAEE5219B02002EEB4006B585B1D5729F1445FE7A79A8FB1FD6B74D56573BE87464DF859D0DDA2D25A8C48A8EB88E99440637D414B6046AAE702169A86141D16116DA97129AEFD7D73EDF4A1ACC42E8B5FBC1A3C3589839BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB035F24032306305A0842132910563502269F0D05A8884488009F0E0510101800009F0F05A8C8C498008E0E000000000000000042035E031F025F280207105F25031806019F0702AB809F4A01829F080200963C00
Step 6: Hashing Result: 06B1113F2DDB23FC16A3B526EC42E2B608CF1169
Step 7: Hash Result Comparison: Passed
Step 8: Issuer Identifier check: Skipped (DIY)
Step 9: Certificate Expiry Date check: Passed
Step 10: PK Algorithm Indicator check: Passed
Step 11: ICC Public Key Modulus: D6BFB6B18A7FC25CE73D93BFC4816142E008AA5952EC506317835ACA64F9EA7FE210200BAA4829977BAEE5219B02002EEB4006B585B1D5729F1445FE7A79A8FB1FD6B74D56573BE87464DF859D0DDA2D25A8C48A8EB88E99440637D414B6046AAE702169A86141D16116DA97129AEFD7D73EDF4A1ACC42E8B5FBC1A3C3589839BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
----------------------------------------
ICC's Public Key Module Recovery succeeded.
2.2.2 请求动态签名
[APDU Command]->[Card]:
Card Command : 00 88 00 00 04
Input Data : 95 D8 19 B0 // Terminal Data
Output Data :
Card Status : 61 83
[APDU Command]->[Card]:
Card Command : 00 C0 00 00 83
Input Data :
Output Data : 80 81 80 81 31 F1 6B 9F 48 CE 6E 04 A2 CC E4 95 D5 6F 4F CA D4 9E 04 26 BD 68 BA
2E B3 37 97 20 39 45 91 38 D7 BA B8 13 9D 90 7A A6 FB A0 40 EA 04 B1 CF 1A 3B 9F
F0 3D C0 2F D2 81 0F 36 73 92 AF 58 8F 97 BA 0B E2 5B 55 DD 2F E5 F6 5A F7 3D 0E
59 0D EA 58 DC 6E 35 41 10 E1 DA 66 BA F2 9E 2C 10 18 78 B8 49 91 F3 4C 20 44 13
43 61 E2 11 74 AD 66 6F C9 A8 CA 71 0C DC 1B 9A 17 5E DF A1 94 D1 E7
Card Status : 90 00
2.2.3 验证动态签名
DDA: Signed Dynamic Application Data Verification
****************************************
ICC PK Modulus:
D6BFB6B18A7FC25CE73D93BFC4816142E008AA5952EC506317835ACA64F9EA7FE210200BAA4829977BAEE5219B02002EEB4006B585B1D5729F1445FE7A79A8FB1FD6B74D56573BE87464DF859D0DDA2D25A8C48A8EB88E99440637D414B6046AAE702169A86141D16116DA97129AEFD7D73EDF4A1ACC42E8B5FBC1A3C3589839
Signed Dynamic Application Data:
8131F16B9F48CE6E04A2CCE495D56F4FCAD49E0426BD68BA2EB337972039459138D7BAB8139D907AA6FBA040EA04B1CF1A3B9FF03DC02FD2810F367392AF588F97BA0BE25B55DD2FE5F65AF73D0E590DEA58DC6E354110E1DA66BAF29E2C101878B84991F34C2044134361E21174AD666FC9A8CA710CDC1B9A175EDFA194D1E7
----------------------------------------
Recovered Data: 6A050103020003BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB0EBD39864696D0B0798B12370A11009D3BE89122BC
Data Header: 6A
Signed Data Format: 05
Hash Algorithm Indicator: 01
Dynamic Data length: 03
ICC Dynamic Data: 020003 //此处是ATC，唯一的动态数据
Pad Pattern: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Hash Result: 0EBD39864696D0B0798B12370A11009D3BE89122
Data Trailer: BC
----------------------------------------
Recovered Data validation:
----------------------------------------
Step 1: Issuer PK Modulus and Signed Static Application Data having the same length: Passed
Step 2: Recovered Data Trailer check: Passed
Step 3: Recovered Data Header check (0x6A): Passed
Step 4: Certificate Format check (0x03): Passed
Step 5: Hash Input Data: 050103020003BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB95D819B0
Step 6: Hashing Result: 0EBD39864696D0B0798B12370A11009D3BE89122
Step 7: Hash Result Comparison: Passed
----------------------------------------
DDA Validation Succeed.
DDA与CDA的异同
CAM 不同点 SDA 无需协处理器；不能防克隆 DDA 需要协处理器；可以检测克隆卡，但是不能防止中间人攻击 CDA 需要协处理器；在DDA的基础上，增加一次校验来防止中间人攻击 fDDA 用于非接的快速认证
Written with StackEdit.