Is Plaintext offline PIN verification on EMV card by Micro USB OTG reader?

Question

I have n88 micro USB OTG EMV card Reader. I used below application to read card data

https://play.google.com/store/apps/details?id=sasc.android.smartcard

When I see in the log, plaintext offline PIN verification is not listed as rule in CVM list.

smart card app results

My question is if I try to verify PIN after "read record" phase, will the card accept verify command ? Till now I am getting command invalid response for verify command. So is plaintext PIN verification possible if there is no rule in CVM list ?

Answer 1

Actually you sholdn't perform verification metod which is not supported in CVM. But if you want force perform plaintext Verify command ( plaintext offline PIN verification ) the result will be depend of specific payment card. For example for Visa card you can always perform plaintext, but MasterCard may not allow plaintext in own application control bytes.

In your case, it seems card does not support Offline Pin at all.

Answer 2

You can send Verify PIN command immediately because after Read Record Commands there is no other command that need to be send to card. Terminal start to check "Processing restrictions" and then "Offline data authentication".

CVM is negotiated and chosen according to terminal and card parameters. If CVM list does not include PIN of course terminal will not ask PIN(or other methods such signature).

I did not see kernel code of a card but if you ask card to perform PIN of course card would check the possible CVM methods before performing. So we can say yes, CVM List must include PIN.