Verifone terminals are PCI 3.x compliant. They are capable of 3DES encryption, Master Key/Session Key, and Derived Unique Key per Transaction (DUKPT) key management. They also incorporate VeriShield file authentication and tampering safeguards. The device allows manual card data entry, magnetic card swipes, smart card chip reads and contactless card data entry. Standard payment applications are available from VeriFone to interface with most electronic cash registers (ECRs).

The device vendor supports a software development ecosystem for remote application downloads.

This page is for Verifone devices running Verifone Integrated Payment Application (VIPA) v. 6.x. VIPA software handle ensures PCI 2.x compliance.

The client sends a sequence of bytes (message) to the VIPA and gets the sequence of bytes in responses. The most common request message structure for VIPA commands is as follows (fields in [square brackets] are not mandatory):

CLA INS P1 P2 [Lc Data…] [Le] LRC

• CLA is class byte. Values in the range ‘D0’ to ‘FE’ are used for functionality beyond the scope of ISO7816-4
• INS is instruction byte
• P1 and P2 are parameter bytes.Some commands can optionally include Data. In this case
• Lc is one byte length of included data.
• Le indicates expected length of data in response. This byte is omitted, if no response is expected.
• LRC is a longitudinal redundancy check (LRC) byte.

VIPA responds to the command with the list of tags in TLV (Tag-Length-Value) format in no particular order. See table below for some important tags.

📘

What is TLV?

Tag-length-value (TLV) is a data encoding scheme. Values are appended to a string in triplets. The first field in the triplet is the "type" or "tag" of data being processed, the second field specifies the "length" of the value, the third field contains a "length" amount of data representing the value for the "type". Tag can consist one or more bytes.If bites 1-5 of tag are set to 1, it indicates that one more byte is included to the tag. If bit 8 is set to 1, this is the last byte of tag. Length field can be 1 or more bytes in length.

Multiple pieces of data can be transmitted in the same string by appending more triplets to a previously existing string.

VIPA uses several "template" tags, where a tag value itself is TLV-string of two or more tags

VIPA Tags

Getting Device Serial Number

In order to obtain Device Serial Number client sends Reset Device command to the attached device:

D0 00 00 01

Device responds with the list of tags, that includes 9F1C, one or more EE templates, series of EF templates.

Below is the sample response (truncated for clarity):

9F1C083333353130393938EE7F9F1E09323735313630373233DF81080C417263686974656374757265DF810904562F4F53...

This data is parsed as follows:

Getting Encrypted Data

VIPA device will return encrypted data in response to VSP Manual PAN Entry, Start Transaction and Continue Transaction request messages. Template tag FF7F includes all tags for decryptx call: KSN, IV, encrypted data. If configured, device response will include template tag FF7E with data to decrypt card number: PAN KSN, PAN IV, PAN encrypted data.

Below is the sample request and device response.

Start Transaction Request:

DED1000032E0309F02060000000050009A030401019C01009F21030101019F410200015F2A020826...

This data is parsed as follows:

Response:

E282013AFF7F66DFDF12088F97E634600DE405DFDF110AFFFF0002280009800026DFDF1040356BED7D61992CF40F0118B2EB6D17E802336A9B566066E19E06AD82514B6E71A9BB2AC163EB3A94A3B574F82EE9571D2F9D514390E9AF6F428D4514343C2F87DFDB0F0400000000FF7E3EDFDF1508C167A04BA8FD61FFDFDF140AFFFF0002280009800027DFDF131816F849491A06767A66933946E9897F8DF3C1106BFA961D69DFDB160400000000500A4D6173746572436172645713541333AAAAAA4111D2512201AAAAAAAAAAAAAA5A08541333AAAAAA4111...

This data is parsed as follows:

Parsing Decryptx Data

In order to decrypt data post to decryptx Device Serial Number (tag 9F1E) and FF7F tag's values: encrypted data (tag DFDF10), KSN (tag DFDF11) and IV (tag DFDF12).

Decrypted data may be padded by zero bytes to make cipher text to be on proper byte edge: 8 bytes for 3DES encryption and 16 bytes for AES encryption. Those bytes should be removed.

Depending on configuration decrypted data can include the following TLV tags:

Examples

Manually Entered Data

dfdb01085413330089604111dfdb02043938393880000000

This data is parsed as follows:

Swiped Card

dfdb05322542353431353234343434343434343434345e544553542f424c554546494e5e323231323130313132333435363738393f3f8000

This data is parsed as follows:

EMV Contact Data Entry

5a08541333008960411157135413330089604111d25122010123409172029f9f1f18202020202020202020202020202020202020202020202020800000000000

This data is parsed as follows:

EMV Contactless Data Entry

5a08541333008960411157135413330089604111d25122010123409172029f80

This data is parsed as follows: