SDA Validator

Recover the issuer public key, then verify signed static application data.

Both tabs not yet verified

Inputs

CA public key

Obtain the trusted CA modulus and exponent from the payment network. Select the key using the application RID and CA key index (8F).

Static data

Assemble the bytes in AFL order, using each entry’s offline-authentication record count. For SFI 1-10, include the record’s 70 template value; for SFI 11-30, include the complete record. Exclude APDU status bytes.

If the SDA Tag List (9F4A) requests 82, append the AIP value. Do not paste an unordered TLV dump. This page verifies the bytes you provide; it does not assemble records.

What a pass means

The RSA recovery and SHA-1 checks match the supplied key and data. PAN and certificate expiry are checked when provided. CA trust, key selection and revocation require separate verification.

Direct SSAD verification does not validate the issuer certificate chain. SDA does not prove that a physical card is genuine or uncloned.

Supported profile

Classic EMV RSA/SHA-1 SDA, exponents 03 or 010001, modulus up to 248 bytes. No DDA, CDA or ECC.

EMV Book 2, §§5.3-5.4 (EMVCo specifications) ↗

Calculator reference

Verification evidence and limitations →

What it calculates

Recovers an issuer public key and verifies Signed Static Application Data.

Inputs and methods

CA and issuer RSA key fields, certificate, remainder, exponent and assembled static bytes.

Worked example

Load the built-in synthetic example; recover the issuer key, then use it in Verify SDA.

Static signature: verified
DAC: ABCD

Specification and limits

RSA/SHA-1 checks do not establish CA trust, revocation status or physical-card authenticity. Example data are not live card credentials.

EMV specifications ↗