BROWSER IMPLEMENTATION

Verification matrix.

Recorded 2026-11-02 · 226 passed · 0 skipped · 53 tools · Node v26.7.0.

Source files changed since this snapshot. Results need a fresh regression run. These are automated library checks, not an EMVCo certification, a security audit or a full browser interaction test.

Evidence matters: an independent known answer comes from a separate published vector or implementation. Round trips and synthetic examples are useful, but cannot establish correctness on their own. Desktop C++ results are documented separately under Help → Verification.

← All tools

Connected workflows

Key generation → KCV → TR-31 and UDK → Session → ARQC → ARPC use explicit transfers and page-local memory.

Key workspace model checks cover all six key types, authenticated TR-31 round trips, invalid-input rejection and stale-state clearing. These are workflow consistency tests, not new independent cryptographic vectors. The underlying calculators retain the evidence and limitations below.

Recorded workspace model checks

passed: key workflow preserves the exact key through KCV and TR-31 for every generated type
passed: key workflow rejects wrapping before checking and invalidates downstream data on source changes
passed: key workflow failed checks and wraps discard stale output, and clear discards all key state

Developer interaction check: npm run test:workflows checks actual page controls, explicit TDES/AES transfers, invalidation, pagehide, clear, and absence of key storage. Its result is separate from the library snapshot above.

ATR Parser & List

Needs rerun · 7 recorded checks

Supported methods

ATR HEX bytes in Parse; HEX patterns or descriptive text in Search.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

An ATR is not a unique card identifier. Contactless pseudo-ATRs and malformed data may need reader-specific interpretation.

PC/SC specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — ATR patterns support nibbles, ranges, and bounded variable tails tests/atr-catalog.test.mjs
passed — masked matches apply each byte mask, including partial nibbles tests/atr-catalog.test.mjs
passed — source parsers preserve descriptions, masks and locations tests/atr-catalog.test.mjs
passed — imported catalog is populated, deduplicated and fully attributable tests/atr-catalog.test.mjs
passed — ATR conventions, protocols and checksum tests/atr-parser.test.mjs
passed — ATR historical data and trailing bytes tests/atr-parser.test.mjs
passed — Reject malformed and truncated ATRs tests/atr-parser.test.mjs

Worked example (not necessarily independent)

In Parse, enter 3B00.

Direct convention
Historical bytes: 0
Default protocol: T=0

AID List

Needs rerun · 3 recorded checks

Supported methods

Find application identifiers and their sources.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — AID search accepts spaced bytes, mixed case, vendors and categories tests/aid-catalog.test.mjs
passed — References have valid identifiers, sources and distinct entries tests/aid-catalog.test.mjs
passed — Merged AID catalog retains both upstream sources and alternate names tests/aid-merge.test.mjs

EMV Tag Dictionary

Needs rerun · 7 recorded checks

Supported methods

Look up tags, meanings, formats, and byte lengths.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — dictionary adds exactly 33 profile tags with explicit version and reference tests/emv-tag-profiles.test.mjs
passed — dictionary renders alternate meanings, network filters, links and reset tests/emv-tag-profiles.test.mjs
passed — profile links restore scope and empty searches stay safe tests/emv-tag-profiles.test.mjs
passed — unscoped TLV parsing never assigns one network meaning to a shared tag tests/emv-tag-profiles.test.mjs
passed — follow-up tags retain only confirmed meanings and filter by profile tests/emv-tag-profiles.test.mjs
passed — Country codes preserve zeros and current currency transitions tests/references.test.mjs
passed — Languages deduplicate bibliographic and terminologic aliases tests/references.test.mjs

APDU Response Codes

Needs rerun · 1 recorded checks

Supported methods

Two-byte HEX SW1/SW2 value; meanings may depend on the application.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

A success status says the command completed; it does not identify the returned data format.

EMV specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — Status lookup handles exact codes and parameterized responses tests/apdu-status.test.mjs

Worked example (not necessarily independent)

Enter 9000.

Success

BIN Lookup

Needs rerun · 4 recorded checks

Supported methods

Look up issuer, network, type, and country.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — BIN input preserves zeros, accepts 6-20 digits and rejects malformed input tests/bin-lookup.test.mjs
passed — network rule boundaries do not mislabel adjacent ranges tests/bin-lookup.test.mjs
passed — bundled data contains the declared number of unique six-digit BINs tests/bin-lookup.test.mjs
passed — merge keeps original values and attributes added and differing BINs tests/bin-lookup.test.mjs

Magstripe & Luhn

Needs rerun · 7 recorded checks

Supported methods

Pasted track data or a number up to 19 digits for Luhn. Track checks depend on the chosen input representation.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Luhn does not verify an account. CRC16 is not the magnetic-track LRC; character parity requires encoded track bits.

ISO standards catalogue · Specification/reference, not a certification.

Recorded checks and worked example

passed — Generated numbers have the selected length and valid Luhn parity at every length tests/luhn-generator.test.mjs
passed — Generator rejects unsupported lengths tests/luhn-generator.test.mjs
passed — MagTek Track 2 example ;123? yields LRC 4 with odd parity tests/magstripe-encoding.test.mjs
passed — Track 1 alphabet and both parity dimensions tests/magstripe-encoding.test.mjs
passed — Luhn known vectors, separators and invalid input tests/magstripe.test.mjs
passed — Track decoder extracts both formats and does not retain discretionary values tests/magstripe.test.mjs
passed — Malformed and unsupported tracks do not silently pass tests/magstripe.test.mjs

Worked example (not necessarily independent)

In Luhn, enter synthetic number 4111111111111111.

Luhn: passed

AMEX SE Number

Needs rerun · 2 recorded checks

Supported methods

Ten decimal digits; select the documented AMEX method or the separate MOD 9 convention.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

The two methods are not interchangeable. A passing check digit does not establish merchant registration.

American Express merchant resources · Specification/reference, not a certification.

Recorded checks and worked example

passed — MOD9 supplied example and AMEX documented example tests/amex-se.test.mjs
passed — SE prefix exceptions and strict format tests/amex-se.test.mjs

Worked example (not necessarily independent)

Select MOD 9 and enter test value 7992739874.

Check passed

PAN Masking

Needs rerun · 2 recorded checks

Supported methods

12-19 digit PAN; first 6/last 4, first 4/last 4, or last 4 only.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Masking changes display only. It is not encryption or proof that a number identifies a real card.

PCI SSC standards · Specification/reference, not a certification.

Recorded checks and worked example

passed — PAN formats preserve requested digits and total length tests/pan-masking.test.mjs
passed — Malformed input and invalid formats do not produce a mask tests/pan-masking.test.mjs

Worked example (not necessarily independent)

Enter synthetic PAN 4111111111111111 and choose First 6 Last 4.

411111******1111

EMV Calculator

Needs rerun · 30 recorded checks

Supported methods

HEX master keys, PAN, PSN, ATC and exact transaction bytes. TDES and AES workflows have different rules.

Evidence

Mixed evidence: published PyEMV answers, RFC 4493 CMAC, gematik Option C primitive vectors and OpenSSL comparisons. Bulletin 162 full-block complement has a regression case; this does not certify every payment profile.

Limitations

Profile labels are presets, not certification. Select the algorithm, padding and data layout required by the card.

EMV specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — AC matches published PyEMV cryptograms tests/application-cryptogram.test.mjs
passed — both MAC paddings agree with independent OpenSSL at block boundaries tests/application-cryptogram.test.mjs
passed — AC rejects malformed input, keys and padding tests/application-cryptogram.test.mjs
passed — ICC input assembly includes AIP, ATC and optional CVR in explicit order tests/application-cryptogram.test.mjs
passed — ARPC Method 1 matches supplied Y3 example tests/arpc.test.mjs
passed — ARPC agrees with independent OpenSSL and ASCII response encoding tests/arpc.test.mjs
passed — ARPC validates key, cryptogram and response code tests/arpc.test.mjs
passed — AES CMAC matches RFC 4493 published vectors tests/emv-aes.test.mjs
passed — AES-128/192/256 EMV derivations agree with independent OpenSSL AES tests/emv-aes.test.mjs
passed — AES CMAC and EMV AC/ARPC method 2 match OpenSSL for all key lengths tests/emv-aes.test.mjs
passed — AES rejects invalid lengths, options and malformed inputs tests/emv-aes.test.mjs
passed — TDES None/Odd/Even controls preserve KCV and apply requested byte parity tests/emv-aes.test.mjs
passed — Option C matches independent gematik AES-128/256 published vectors tests/emv-aes.test.mjs
passed — Bulletin 162 complements the entire block for AES-192 and AES-256 tests/emv-aes.test.mjs
passed — EFTLab UDK and all four independent AC examples match exactly tests/emv-profiles.test.mjs
passed — EFTLab session samples preserve requested parity and match byte for byte tests/emv-profiles.test.mjs
passed — EFTLab ARPC examples match with Mastercard UDK; printed session key differs tests/emv-profiles.test.mjs
passed — separate terminal and ICC inputs validate byte boundaries before joining tests/emv-profiles.test.mjs
passed — EMV 4.4 TDES preset uses CSK and method-2 MAC matching OpenSSL tests/emv-profiles.test.mjs
passed — EMV2000 tree matches published PyEMV vector tests/session-key.test.mjs
passed — tree configurations and nonzero IV match PyEMV HSM regression vectors tests/session-key.test.mjs
passed — ARQC-based common derivation matches published common SK vector tests/session-key.test.mjs
passed — new modes reject incomplete inputs and unsupported tree settings tests/session-key.test.mjs
passed — EMV Common AC matches published PyEMV vector tests/session-key.test.mjs
passed — ATC + UN derivation agrees with independent OpenSSL encryption tests/session-key.test.mjs
passed — session key validates input and never silently ignores UN tests/session-key.test.mjs
passed — UDK matches independent published Option A and B vectors tests/udk.test.mjs
passed — KCV agrees with OpenSSL TDES and derived keys have odd parity tests/udk.test.mjs
passed — Option B falls back to A for short PANs; PSN defaults to 00 tests/udk.test.mjs
passed — UDK rejects malformed inputs tests/udk.test.mjs

Worked example (not necessarily independent)

UDK: Option A, odd parity, MDK 0123456789ABCDEFFEDCBA9876543210, PAN 4761739001010010, PSN 01.

2F02C8B0E9CBC7B05B5167F7A1CDE6E5

SDA Calculator

Needs rerun · 4 recorded checks

Supported methods

CA and issuer RSA key fields, certificate, remainder, exponent and assembled static bytes.

Evidence

Synthetic and reference chains, independent OpenSSL RSA recovery and negative cases. Trust-anchor selection and revocation are not established.

Limitations

RSA/SHA-1 checks do not establish CA trust, revocation status or physical-card authenticity. Example data are not live card credentials.

EMV specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — SDA tutorial and synthetic chain match independent OpenSSL recovery tests/sda.test.mjs
passed — SDA rejects tampering and reports optional/trust checks explicitly tests/sda.test.mjs
passed — SSAD structural validation catches bad padding even with a valid hash tests/sda.test.mjs
passed — second EFTLab SDA example recovers DAC5 and expected hash tests/sda.test.mjs

Worked example (not necessarily independent)

Load the built-in synthetic example; recover the issuer key, then use it in Verify SDA.

Static signature: verified
DAC: ABCD

DDA Calculator

Needs rerun · 3 recorded checks

Supported methods

RSA certificates, exponents, remainders, signed dynamic data and the exact DDOL input bytes.

Evidence

Synthetic and reference chains, independent OpenSSL RSA recovery and tamper cases. No physical card possession test or CA trust qualification.

Limitations

Only the supplied chain and signed bytes are checked. Terminal trust, revocation and live-card communication remain outside this tool.

EMV specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — DDA tutorial and synthetic chain match independent OpenSSL RSA recovery tests/dda.test.mjs
passed — DDA rejects mismatched inputs, expired certificates and malformed RSA values tests/dda.test.mjs
passed — DDA structural checks reject signed malformed blocks even when SHA-1 matches tests/dda.test.mjs

Worked example (not necessarily independent)

Load the built-in synthetic example and run issuer recovery, ICC recovery and signed-data verification.

Dynamic signature: verified

Mastercard Data Storage

Needs rerun · 7 recorded checks

Supported methods

Enter the HEX and decimal fields labelled on each tab. Profile-specific lengths are enforced.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

This demonstrates the first tab only. Other stages need their own profile inputs; outputs do not prove issuer authorization.

M/Chip algorithms · Specification/reference, not a certification.

Recorded checks and worked example

passed — data-storage matches supplied reference vectors tests/emv-extra.test.mjs
passed — mastercard-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — cap-token matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-hce matches supplied reference vectors tests/emv-extra.test.mjs
passed — CAP preserves bit order and uses arbitrary precision tests/emv-extra.test.mjs
passed — Input lengths, numeric DS ID, PIN and padding validation tests/emv-extra.test.mjs

Worked example (not necessarily independent)

Worked DSPK example: DS ID · packed decimal HEX: 1234567890123456

DSPK: 1844709CB418709CB4184470

Mastercard Secure Messaging

Needs rerun · 7 recorded checks

Supported methods

Enter the HEX and decimal fields labelled on each tab. Profile-specific lengths are enforced.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

This demonstrates the first tab only. Other stages need their own profile inputs; outputs do not prove issuer authorization.

PyEMV · Specification/reference, not a certification.

Recorded checks and worked example

passed — data-storage matches supplied reference vectors tests/emv-extra.test.mjs
passed — mastercard-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — cap-token matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-hce matches supplied reference vectors tests/emv-extra.test.mjs
passed — CAP preserves bit order and uses arbitrary precision tests/emv-extra.test.mjs
passed — Input lengths, numeric DS ID, PIN and padding validation tests/emv-extra.test.mjs

Worked example (not necessarily independent)

Worked Session keys example: UDK-SMI · HEX, 16 bytes: 0123456789ABCDEFFEDCBA9876543210; UDK-SMC · HEX, 16 bytes: 0123456789ABCDEFFEDCBA9876543210; Application cryptogram · HEX, 8 bytes: 0102030405060708

Diversification value: 0102030405060708
SK-SMI: 72069E08CAC5BC2A1E06947B7B12B20E
SMI KCV: DF2591
SK-SMC: 72069E08CAC5BC2A1E06947B7B12B20E
SMC KCV: DF2591

Visa Secure Messaging

Needs rerun · 7 recorded checks

Supported methods

Enter the HEX and decimal fields labelled on each tab. Profile-specific lengths are enforced.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

This demonstrates the first tab only. Other stages need their own profile inputs; outputs do not prove issuer authorization.

PyEMV · Specification/reference, not a certification.

Recorded checks and worked example

passed — data-storage matches supplied reference vectors tests/emv-extra.test.mjs
passed — mastercard-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — cap-token matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-hce matches supplied reference vectors tests/emv-extra.test.mjs
passed — CAP preserves bit order and uses arbitrary precision tests/emv-extra.test.mjs
passed — Input lengths, numeric DS ID, PIN and padding validation tests/emv-extra.test.mjs

Worked example (not necessarily independent)

Worked Session key example: UDK · HEX, 16 bytes: 0123456789ABCDEFFEDCBA9876543210; ATC · HEX, 2 bytes: 0001

Session key: 0123456789ABCDEEFEDCBA987654CDEE
KCV: 2CE56C

CAP Token Computation

Needs rerun · 7 recorded checks

Supported methods

Enter the HEX and decimal fields labelled on each tab. Profile-specific lengths are enforced.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

This demonstrates the first tab only. Other stages need their own profile inputs; outputs do not prove issuer authorization.

CAP compression reference · Specification/reference, not a certification.

Recorded checks and worked example

passed — data-storage matches supplied reference vectors tests/emv-extra.test.mjs
passed — mastercard-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — cap-token matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-hce matches supplied reference vectors tests/emv-extra.test.mjs
passed — CAP preserves bit order and uses arbitrary precision tests/emv-extra.test.mjs
passed — Input lengths, numeric DS ID, PIN and padding validation tests/emv-extra.test.mjs

Worked example (not necessarily independent)

Worked CAP token example: Token data · HEX: AB; IPB · HEX: AA

Binary token data: 10101011
Binary IPB: 10101010
Compressed data: 1111
Token: 15

Visa HCE

Needs rerun · 9 recorded checks

Supported methods

Enter the HEX and decimal fields labelled on each tab. Profile-specific lengths are enforced.

Evidence

LUK block construction compared with independent OpenSSL; other exposed stages have reference examples. Hidden MSD and legacy ICC Dynamic Number are not verified.

Limitations

This demonstrates the first tab only. Other stages need their own profile inputs; outputs do not prove issuer authorization.

Visa specification library · Specification/reference, not a certification.

Recorded checks and worked example

passed — data-storage matches supplied reference vectors tests/emv-extra.test.mjs
passed — mastercard-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-secure-messaging matches supplied reference vectors tests/emv-extra.test.mjs
passed — cap-token matches supplied reference vectors tests/emv-extra.test.mjs
passed — visa-hce matches supplied reference vectors tests/emv-extra.test.mjs
passed — CAP preserves bit order and uses arbitrary precision tests/emv-extra.test.mjs
passed — Input lengths, numeric DS ID, PIN and padding validation tests/emv-extra.test.mjs
passed — LUK matches patent block construction and independent OpenSSL encryption tests/hce-luk.test.mjs
passed — LUK rejects ambiguous dates and incomplete fields tests/hce-luk.test.mjs

Worked example (not necessarily independent)

Worked UDK example: MDK · HEX, 16 bytes: 0123456789ABCDEFFEDCBA9876543210; PAN · decimal digits: 4111111111111111; PAN sequence number · 2 digits: 00

UDK: 31089464674C73EC851A6E0737029D19
KCV: 9595D5

TR-34 Key Block

Needs rerun · 6 recorded checks

Supported methods

Parse, verify and create two-pass RSA key transport blocks.

Evidence

Independent Python cryptography AES/TDES fixtures, round trips and tamper checks. Two-pass profile only.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — TR-34 verifies and decrypts independent Python AES/TDES fixtures tests/tr34.test.mjs
passed — TR-34 create recovers the key for both envelope ciphers and all wrapped key sizes tests/tr34.test.mjs
passed — TR-34 distinguishes unauthenticated inspection from signature verification and decryption tests/tr34.test.mjs
passed — TR-34 rejects wrong signing certificate, recipient key, nonce, signature and digest tests/tr34.test.mjs
passed — TR-34 malformed structures and unsupported profiles fail explicitly tests/tr34.test.mjs
passed — TR-34 accepts Base64 and PEM textual transport representations tests/tr34.test.mjs

Thales Key Block

Needs rerun · 4 recorded checks

Supported methods

Parse, create and authenticate version 1 AES key blocks.

Evidence

Fixed AES-128/256 type-1 vectors and authentication tamper checks; not all payShield formats.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — Thales type 1 matches published AES-128/256 creation and decode vectors tests/thales-key-block.test.mjs
passed — Thales refuses every modified header/ciphertext/authenticator character tests/thales-key-block.test.mjs
passed — Thales all AES KBPK sizes preserve authenticated LMK ID and optional blocks tests/thales-key-block.test.mjs
passed — Thales screen retains TR-31 A-D compatibility and scheme prefix validation tests/thales-key-block.test.mjs

TR-31 Key Block

Needs rerun · 5 recorded checks

Supported methods

Parse, create and authenticate A-D symmetric key blocks.

Evidence

18 independent A-D decode vectors and psec 1.3.0 creation fixtures across 11 protection-key profiles.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — TR-31 creation matches independent psec 1.3.0 output for all 11 protection-key profiles tests/tr31.test.mjs
passed — TR-31 decodes 18 independent published A-D vectors tests/tr31.test.mjs
passed — TR-31 rejects altered header, ciphertext, MAC and wrong protection key tests/tr31.test.mjs
passed — TR-31 creation round-trips every protection-key size and extended optional data tests/tr31.test.mjs
passed — TR-31 malformed inputs fail without producing a key tests/tr31.test.mjs

DUKPT (AES)

Needs rerun · 6 recorded checks

Supported methods

AES-128/192/256; BDK or IK; 8-byte initial ID or 12-byte KSN. PIN: 16-byte fields; MAC: AES-CMAC; data: ECB/CBC without padding.

Evidence

ASC X9 / OpenEMV fixture comparisons; derivation and usage operations are tested.

Limitations

Host calculation only; no device state, update keys or TDES working keys. Counter zero returns only IK. Full ISO-4 requires a PAN field.

ASC X9 published test vectors · Specification/reference, not a certification.

Recorded checks and worked example

passed — X9 AES-128 IK, transaction keys, sparse/high counters and initial-key path tests/dukpt-aes.test.mjs
passed — X9 AES-256 BDK with AES-256 and AES-128 working keys tests/dukpt-aes.test.mjs
passed — AES-192 derivation blocks independently encrypted using OpenSSL tests/dukpt-aes.test.mjs
passed — X9 Format 4 PIN example and inverse; raw AES distinctly supported tests/dukpt-aes.test.mjs
passed — NIST CMAC known answers and independent ECB/CBC at every AES size tests/dukpt-aes.test.mjs
passed — reject invalid KSN, counter, key length, partial blocks and over-limit data tests/dukpt-aes.test.mjs

Worked example (not necessarily independent)

BDK FEDCBA9876543210F1F1F1F1F1F1F1F1, KSN 123456789012345600000001, AES-128.

PIN key: AF8CB133A78F8DC2D1359F18527593FB

DUKPT (TDES)

Needs rerun · 3 recorded checks

Supported methods

16-byte starting key and 10-byte KSN. PIN blocks use 8 bytes; data supports ECB/CBC with whole blocks.

Evidence

OpenEMV published transaction-key, PIN, MAC and data fixtures, plus OpenSSL comparisons.

Limitations

This is the TDES profile, not AES DUKPT. The calculator does not manage terminal key erasure or transaction counters.

OpenEMV ANSI test vectors · Specification/reference, not a certification.

Recorded checks and worked example

passed — 21 ANSI transactions: IPEK, BDK/IPEK derivation, PIN, request/response MAC, CBC data tests/dukpt-tdes.test.mjs
passed — data variants, ECB/CBC and PIN variant match independent OpenSSL encryption tests/dukpt-tdes.test.mjs
passed — PAN XOR inverse, zero counter and invalid inputs tests/dukpt-tdes.test.mjs

Worked example (not necessarily independent)

BDK 0123456789ABCDEFFEDCBA9876543210, KSN FFFF9876543210E00001.

IPEK: 6AC292FAA1315B4D858AB3A3D7D5933A
Current key: 042666B49184CFA368DE9628D0397BC9

Key Encryption

Needs rerun · 4 recorded checks

Supported methods

TDES-ECB or AES-ECB; AES also supports RFC 3394 Key Wrap. Key and KEK are HEX.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

AES wrap checks integrity. ECB has no integrity check. Outputs are not TR-31 blocks.

RFC 3394 · Specification/reference, not a certification.

Recorded checks and worked example

passed — RFC3394 vectors with 128/192/256 bit KEKs tests/key-encryption.test.mjs
passed — AES wrap all supported sizes against OpenSSL tests/key-encryption.test.mjs
passed — ECB interop and inverse tests/key-encryption.test.mjs
passed — bad lengths and methods rejected tests/key-encryption.test.mjs

Worked example (not necessarily independent)

Select AES Key Wrap. KEK: 000102030405060708090A0B0C0D0E0F. Key: 00112233445566778899AABBCCDDEEFF.

1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5

Parity Enforcement

Needs rerun · 4 recorded checks

Supported methods

8/16/24/32-byte HEX key and Odd or Even target.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

DES effective key bits are preserved. Applying parity changes to AES changes the key.

DES specification (historical FIPS 46-3) · Specification/reference, not a certification.

Recorded checks and worked example

passed — all 256 byte values, both targets, preserve high bits and are idempotent tests/key-parity.test.mjs
passed — parity detection and changed positions tests/key-parity.test.mjs
passed — effective DES keys and KCVs preserved for all DES sizes tests/key-parity.test.mjs
passed — validation and formatted input tests/key-parity.test.mjs

Worked example (not necessarily independent)

Enter 0000000000000000 and select Odd.

0101010101010101

Key Validation

Needs rerun · 17 recorded checks

Supported methods

8/16/24/32-byte HEX key. Analysis includes all eight KCV variants when the key length permits them.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Length does not identify an algorithm or certify strength. This is not exhaustive weak-key screening.

KCV method conventions · Specification/reference, not a certification.

Recorded checks and worked example

passed — DES aliases 8 tests/kcv.test.mjs
passed — SHA256 8 tests/kcv.test.mjs
passed — DES aliases 16 tests/kcv.test.mjs
passed — AES and CMAC 16 tests/kcv.test.mjs
passed — TDEA CMAC 16 tests/kcv.test.mjs
passed — SHA256 16 tests/kcv.test.mjs
passed — DES aliases 24 tests/kcv.test.mjs
passed — AES and CMAC 24 tests/kcv.test.mjs
passed — TDEA CMAC 24 tests/kcv.test.mjs
passed — SHA256 24 tests/kcv.test.mjs
passed — AES and CMAC 32 tests/kcv.test.mjs
passed — SHA256 32 tests/kcv.test.mjs
passed — published EFTLab example and input validation tests/kcv.test.mjs
passed — odd, even and mixed parity tests/key-validation.test.mjs
passed — DES component equality ignores parity tests/key-validation.test.mjs
passed — KCV applicability and published DES vector tests/key-validation.test.mjs
passed — malformed inputs rejected, spaces accepted tests/key-validation.test.mjs

Worked example (not necessarily independent)

Enter 0101010101010101.

8 bytes / 64 stored bits
Parity: Odd
Distinct byte values: 1
DES KCV: 8CA64D

KCV Calculator

Needs rerun · 13 recorded checks

Supported methods

HEX keys of 8, 16, 24 or 32 bytes; the selected KCV method determines accepted sizes.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Eight named methods are available. Equal KCVs do not guarantee equal keys; DES, VISA and ATALLA share the stated zero-block convention.

MagTek KCV conventions · Specification/reference, not a certification.

Recorded checks and worked example

passed — DES aliases 8 tests/kcv.test.mjs
passed — SHA256 8 tests/kcv.test.mjs
passed — DES aliases 16 tests/kcv.test.mjs
passed — AES and CMAC 16 tests/kcv.test.mjs
passed — TDEA CMAC 16 tests/kcv.test.mjs
passed — SHA256 16 tests/kcv.test.mjs
passed — DES aliases 24 tests/kcv.test.mjs
passed — AES and CMAC 24 tests/kcv.test.mjs
passed — TDEA CMAC 24 tests/kcv.test.mjs
passed — SHA256 24 tests/kcv.test.mjs
passed — AES and CMAC 32 tests/kcv.test.mjs
passed — SHA256 32 tests/kcv.test.mjs
passed — published EFTLab example and input validation tests/kcv.test.mjs

Worked example (not necessarily independent)

Select DES and enter test key 0123456789ABCDEFFEDCBA9876543210.

KCV: 08D7B4

Key Derivation

Needs rerun · 3 recorded checks

Supported methods

HEX or ASCII input, HEX salt, SHA-256/384/512, output length; PBKDF2 iterations or HKDF info.

Evidence

RFC 5869 HKDF known answer and platform-crypto comparisons.

Limitations

The two-iteration example is for reproducibility, not password protection. HKDF is not password stretching.

RFC 8018 · Specification/reference, not a certification.

Recorded checks and worked example

passed — PBKDF2 and HKDF match Node crypto for every supported hash tests/key-derivation.test.mjs
passed — RFC 5869 SHA-256 test vector tests/key-derivation.test.mjs
passed — empty input and validation tests/key-derivation.test.mjs

Worked example (not necessarily independent)

PBKDF2, SHA-256, ASCII password, salt HEX 73616C74, 2 iterations, 32 bytes.

AE4D0C95AF6B46D32D0ADFF928F06DD02A303F8EF3C251DFD6E2D85A95474C43

CVV/CVC Generation

Needs rerun · 2 recorded checks

Supported methods

16-byte HEX CVK, 12-19 digit PAN, four-digit expiry and service code; CVV2 fixes service code 000.

Evidence

Independent OpenSSL CBC-MAC and decimalization comparison using test keys.

Limitations

Requires the actual chosen key and byte conventions. This example uses a public test key, not issuer credentials.

EMV specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — CVV and CVV2 agree with independent OpenSSL CBC MAC tests/cvv.test.mjs
passed — Reject malformed inputs and keep leading zero results tests/cvv.test.mjs

Worked example (not necessarily independent)

Test CVK 0123456789ABCDEFFEDCBA9876543210, PAN 4111111111111111, expiry 3012 in YYMM order, service code 101.

CVV2/CVC2 Generation

Needs rerun · 2 recorded checks

Supported methods

16-byte HEX CVK, 12-19 digit PAN, four-digit expiry and service code; CVV2 fixes service code 000.

Evidence

Independent OpenSSL comparison using test keys and service code 000.

Limitations

Requires the actual chosen key and byte conventions. This example uses a public test key, not issuer credentials.

EMV specifications · Specification/reference, not a certification.

Recorded checks and worked example

passed — CVV and CVV2 agree with independent OpenSSL CBC MAC tests/cvv.test.mjs
passed — Reject malformed inputs and keep leading zero results tests/cvv.test.mjs

Worked example (not necessarily independent)

Test CVK 0123456789ABCDEFFEDCBA9876543210, PAN 4111111111111111, expiry 3012 in YYMM order, service code 000.

Key Tools

Needs rerun · 4 recorded checks

Supported methods

16-byte HEX keys; two or three XOR components. Component operations enforce odd parity.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Random components vary on every generation. KEK encryption uses ECB without an integrity check.

KCV method conventions · Specification/reference, not a certification.

Recorded checks and worked example

passed — KEK tutorial components, XOR, KCV and cryptogram match tests/key-tools.test.mjs
passed — KEK encryption matches OpenSSL and preserves all key bytes tests/key-tools.test.mjs
passed — generated components have odd parity and validation rejects malformed keys tests/key-tools.test.mjs
passed — split components preserve effective key and KCV with both counts tests/key-tools.test.mjs

Worked example (not necessarily independent)

In KCV/Combine, enter one key: 0123456789ABCDEFFEDCBA9876543210.

KCV: 08D7B4

PIN Offset (IBM 3624)

Needs rerun · 3 recorded checks

Supported methods

DES/TDES PVK, 4-12 PIN or offset digits, 16-digit decimalization table, and eight-byte validation data.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Blank validation uses the rightmost 12 PAN digits before the check digit plus FFFF. Issuer layouts vary. Check length equals PIN length; no truncated-offset recovery.

IBM PIN offset generation · Specification/reference, not a certification.

Recorded checks and worked example

passed — synthetic offset and recovery tests/pin-offset.test.mjs
passed — independent OpenSSL encryption with all key sizes, PIN lengths and custom tables tests/pin-offset.test.mjs
passed — explicit validation overrides PAN and malformed inputs fail tests/pin-offset.test.mjs

Worked example (not necessarily independent)

Key 0123456789ABCDEFFEDCBA9876543210; PAN 4111111111111111; PIN 1234; default table and validation convention.

Offset: 3104; recovered PIN: 1234

PIN Translation

Needs rerun · 3 recorded checks

Supported methods

16 HEX character encrypted block; source and destination ZPKs of 16 or 24 bytes. TDES-ECB, no padding.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Preserves format and PAN binding. No AES, key derivation, PIN validation or key integrity check. This is a local test calculator, not an HSM.

IBM PIN translation overview · Specification/reference, not a certification.

Recorded checks and worked example

passed — known PIN block translated and decrypted independently by OpenSSL tests/pin-translation.test.mjs
passed — all two-key/three-key combinations, identity and round trip tests/pin-translation.test.mjs
passed — reject malformed blocks and keys; accept whitespace tests/pin-translation.test.mjs

Worked example (not necessarily independent)

Block 1B9C1845EB993A7A; source 042666B49184CF5C68DE9628D0397B36; destination 0123456789ABCDEFFEDCBA9876543210.

C03D21CDBCB0C58B

PVV

Needs rerun · 3 recorded checks

Supported methods

PAN: 12-19 digits; PIN: four digits; PVKI: one digit; PVV key: 16 bytes HEX.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Uses two-key TDES and two-pass decimalization. Indices outside 1-6 are test options; no issuer key lookup or PIN verification is performed.

IBM PVV generation · Specification/reference, not a certification.

Recorded checks and worked example

passed — PVV synthetic example and independent OpenSSL encryption for every index tests/pvv.test.mjs
passed — decimalization second pass and leading zero preservation tests/pvv.test.mjs
passed — PAN check digit excluded, malformed input rejected without truncation tests/pvv.test.mjs

Worked example (not necessarily independent)

PAN 4111111111111111, PIN 1234, PVKI 1, key 0123456789ABCDEFFEDCBA9876543210.

PIN Block Formats

Needs rerun · 6 recorded checks

Supported methods

Select a format, enter the allowed PIN length, and supply PAN, padding or sequence only when required. ISO-4 optionally accepts an AES key.

Evidence

Mixed evidence: fixed examples, CEN ECI-3 rules, IBM equipment documentation and independent OpenSSL ISO-4 encipherment. Not every legacy alias has an authoritative cryptogram.

Limitations

Most results are clear fields. ISO-4 encrypts only when an AES key is supplied. Randomized formats vary on each run.

ISO-4 implementation guidance · Specification/reference, not a certification.

Recorded checks and worked example

passed — published deterministic legacy examples and aliases tests/pin-formats.test.mjs
passed — random field layouts, all 21 choices and explicit ECI-3 convention tests/pin-formats.test.mjs
passed — ISO-4 includes full PAN and matches independent AES encrypt-XOR-encrypt tests/pin-formats.test.mjs
passed — reject invalid lengths, sequence, delimiter and key; flag custom ISO padding tests/pin-formats.test.mjs
passed — CEN ECI-3 fills directly after the PIN; VISA-2 retains its zero-filled slot tests/pin-formats.test.mjs
passed — IBM EPP/3624 boundary layouts and nonzero sequence numbers tests/pin-formats.test.mjs

Worked example (not necessarily independent)

ISO-2, PIN 1234. No PAN or key is needed.

241234FFFFFFFFFF

PIN Block

Needs rerun · 3 recorded checks

Supported methods

4-12 decimal PIN digits, 12-19 PAN digits, and F padding. Reverse accepts an 8-byte HEX block.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Custom padding is non-standard. This tool does not decrypt encrypted blocks or verify a cardholder PIN.

Format 0 layout · Specification/reference, not a certification.

Recorded checks and worked example

passed — ANSI published PIN block example tests/pin-block.test.mjs
passed — lengths, leading zeros and all custom padding choices tests/pin-block.test.mjs
passed — malformed PIN, PAN and blocks rejected tests/pin-block.test.mjs

Worked example (not necessarily independent)

PIN 1234, PAN 4012345678909, padding F.

PIN block: 041274EDCBA9876F
Reverse result: 1234

DES/3DES Encrypt/Decrypt

Needs rerun · 3 recorded checks

Supported methods

8/16/24-byte keys; ECB, CBC, CFB-8/64, OFB-8/64, and selectable padding.

Evidence

OpenSSL mode/key-size comparisons, feedback and padding checks.

Limitations

DES/TDEA are legacy ciphers. Padding and feedback size must match the other implementation.

Historical DES specification · Specification/reference, not a certification.

Recorded checks and worked example

passed — all key sizes and native modes match OpenSSL tests/des-cipher.test.mjs
passed — OFB-8 matches independent OpenSSL block feedback for all keys tests/des-cipher.test.mjs
passed — padding boundaries and validation tests/des-cipher.test.mjs

Worked example (not necessarily independent)

DES, ECB, no padding. Key: 133457799BBCDFF1. Data: 0123456789ABCDEF.

85E813540F0AB405

RSA DER Public Key

Needs rerun · 2 recorded checks

Supported methods

HEX modulus and exponent, or a DER sequence containing two INTEGER values.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

This toy key is not secure. The decoder expects PKCS#1, not a SubjectPublicKeyInfo wrapper.

RFC 8017 · Specification/reference, not a certification.

Recorded checks and worked example

passed — provided example is byte-exact and accepted by OpenSSL tests/rsa-der.test.mjs
passed — strict DER lengths and signed integer handling tests/rsa-der.test.mjs

Worked example (not necessarily independent)

Encode toy modulus 0CA1 and exponent 11.

300702020CA1020111

RSA

Needs rerun · 4 recorded checks

Supported methods

PEM keys; 1024/2048/4096-bit generation. OAEP, PKCS#1 v1.5 and raw encryption; SHA-256 signatures.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Keys and OAEP ciphertext are random; exact ciphertext changes. Encryption has modulus-dependent length limits. Raw RSA is provided for inspection.

RFC 8017 · Specification/reference, not a certification.

Recorded checks and worked example

passed — RSA OAEP interoperates with Node and accepts PKCS1 PEM tests/rsa-tool.test.mjs
passed — legacy encryption and raw RSA interoperate tests/rsa-tool.test.mjs
passed — signature generation and verification use Web Crypto and match Node tests/rsa-tool.test.mjs
passed — invalid inputs rejected tests/rsa-tool.test.mjs

Worked example (not necessarily independent)

Generate a 2048-bit pair. Encrypt ASCII Hello using OAEP SHA-256, then decrypt with the generated private key.

Recovered HEX: 48656C6C6F

ECC (Elliptic Curve)

Needs rerun · 2 recorded checks

Supported methods

P-256, P-384, P-521 or secp256k1; HEX private scalars and SEC1 public keys; HEX or ASCII messages.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Key generation is random. Signature encoding and the curve-specific hash must match the verifier.

noble-curves documentation · Specification/reference, not a certification.

Recorded checks and worked example

passed — all curves and signature formats interoperate with OpenSSL tests/ecc-tool.test.mjs
passed — key and signature validation; empty messages tests/ecc-tool.test.mjs

Worked example (not necessarily independent)

Generate a P-256 pair, sign ASCII Hello, then verify using its public key and the unchanged message.

Signature verification: valid
Change message to Hello!: invalid

Diffie-Hellman (DH & ECDH)

Needs rerun · 3 recorded checks

Supported methods

Classic DH groups 14/15/16, or ECDH on P-256/P-384/P-521/secp256k1.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

The tiny private value is for demonstration only. Raw secrets need a KDF; DH alone does not authenticate peers.

RFC 3526 · Specification/reference, not a certification.

Recorded checks and worked example

passed — RFC groups match OpenSSL and two parties agree tests/dh-tool.test.mjs
passed — ECDH all curves agree with OpenSSL and each other tests/dh-tool.test.mjs
passed — reject invalid groups, private keys and peer points tests/dh-tool.test.mjs

Worked example (not necessarily independent)

Classic DH group 14: private key 02, peer public key 04.

Shared secret: 10, left-padded with zeros to 256 bytes

AES Encrypt/Decrypt

Needs rerun · 3 recorded checks

Supported methods

128/192/256-bit HEX keys; ECB, CBC, CFB, OFB or GCM. IV, padding and authentication fields depend on mode.

Evidence

OpenSSL mode/key-size comparisons, NIST GCM zero vector, padding and tamper checks.

Limitations

This fixed input is a test vector. GCM requires correct nonce and tag handling; ECB does not authenticate data.

FIPS 197 · Specification/reference, not a certification.

Recorded checks and worked example

passed — AES modes and key sizes agree with OpenSSL, including partial stream blocks tests/aes-cipher.test.mjs
passed — padding round trips and malformed padding rejection tests/aes-cipher.test.mjs
passed — GCM NIST zero vector, AAD and tampering tests/aes-cipher.test.mjs

Worked example (not necessarily independent)

AES-128, ECB, no padding. Key and plaintext are each 16 zero bytes.

66E94BD4EF8A2C3B884CFA59CA342B2E

Post-Quantum Crypto

Needs rerun · 9 recorded checks

Supported methods

ML-DSA 44/65/87, ML-KEM 512/768/1024, SLH-DSA SHA2 128f/192f/256f; raw HEX keys and signatures.

Evidence

Library-backed generation, sign/verify or encapsulate/decapsulate round trips and tamper checks. No external NIST known-answer suite is claimed.

Limitations

Generated values are random. ML-KEM decapsulation uses implicit rejection; it is not a peer-authentication check.

NIST FIPS 203 · Specification/reference, not a certification.

Recorded checks and worked example

passed — ML-DSA-44 operations and tamper checks tests/pq-tool.test.mjs
passed — ML-DSA-65 operations and tamper checks tests/pq-tool.test.mjs
passed — ML-DSA-87 operations and tamper checks tests/pq-tool.test.mjs
passed — ML-KEM-512 operations and tamper checks tests/pq-tool.test.mjs
passed — ML-KEM-768 operations and tamper checks tests/pq-tool.test.mjs
passed — ML-KEM-1024 operations and tamper checks tests/pq-tool.test.mjs
passed — SLH-DSA-SHA2-128f operations and tamper checks tests/pq-tool.test.mjs
passed — SLH-DSA-SHA2-192f operations and tamper checks tests/pq-tool.test.mjs
passed — SLH-DSA-SHA2-256f operations and tamper checks tests/pq-tool.test.mjs

Worked example (not necessarily independent)

Choose ML-KEM-768. Generate a pair, encapsulate using its public key, then decapsulate using its secret key.

Both parties obtain the same 32-byte shared secret.

Hashes

Needs rerun · 4 recorded checks

Supported methods

HEX or ASCII input; MD5, SHA-1/2/3, RIPEMD-160 and BLAKE families. Multi-hash and file modes are available.

Evidence

Platform-crypto comparisons and official BLAKE3 known answers.

Limitations

MD5 and SHA-1 are legacy algorithms. A plain hash does not authenticate who supplied the data.

FIPS 180-4 · Specification/reference, not a certification.

Recorded checks and worked example

passed — thirteen algorithms agree with OpenSSL for empty and binary data tests/hashes.test.mjs
passed — BLAKE3 official empty and abc vectors tests/hashes.test.mjs
passed — chunked file hashes match byte hashes, including empty files tests/hashes.test.mjs
passed — input parsing and comparison are strict tests/hashes.test.mjs

Worked example (not necessarily independent)

Choose SHA-256 and ASCII. Enter Hello with no trailing newline.

185F8DB32271FE25F561A6FC938B2E264306EC304EDA518007D1764826381969

HMAC

Needs rerun · 3 recorded checks

Supported methods

HEX key, HEX or ASCII data; MD5, SHA-1, SHA-256, SHA-384 or SHA-512.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

The output is the full HMAC. Sender and verifier must use the same key, input bytes and hash.

RFC 4231 · Specification/reference, not a certification.

Recorded checks and worked example

passed — HMAC matches RFC 2202 and RFC 4231 samples tests/hmac.test.mjs
passed — HMAC handles empty and long keys and binary data independently tests/hmac.test.mjs
passed — HMAC rejects malformed keys and input tests/hmac.test.mjs

Worked example (not necessarily independent)

HMAC-SHA-256, key HEX 0B repeated 20 times, ASCII data Hi There.

B0344C61D8DB38535CA8AFCEAF0BF12B881DC200C9833DA726E9376C2E32CFF7

Checksum

Needs rerun · 5 recorded checks

Supported methods

HEX or ASCII data; selectable CRC16 variants, CRC32 and Adler-32.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

CRC16 is a family of algorithms; polynomial, initial value and reflection must match your protocol. Checksums are not authentication.

RFC 1952 · Specification/reference, not a certification.

Recorded checks and worked example

passed — standard checksum check strings tests/checksum.test.mjs
passed — binary CRC32 and Adler32 match zlib independently tests/checksum.test.mjs
passed — checksum rejects invalid formats and supports high bytes tests/checksum.test.mjs
passed — CRC-16 catalogue check vectors tests/crc16.test.mjs
passed — Track CRC includes sentinels and excludes inter-track whitespace tests/crc16.test.mjs

Worked example (not necessarily independent)

Select CRC32 and enter ASCII 123456789.

CBF43926

AES-CMAC

Needs rerun · 6 recorded checks

Supported methods

16-byte HEX key; HEX or ASCII message, including empty input; maximum 65,536 bytes.

Evidence

All four RFC 4493 known-answer vectors (empty, 16, 40 and 64 bytes), ASCII/HEX equivalence and invalid-input checks.

Limitations

Full 128-bit tag only. No message encryption, key storage or sender identity validation.

RFC 4493 — The AES-CMAC Algorithm · Specification/reference, not a certification.

Recorded checks and worked example

passed — RFC 4493: 0-byte message tests/cmac.test.mjs
passed — RFC 4493: 16-byte message tests/cmac.test.mjs
passed — RFC 4493: 40-byte message tests/cmac.test.mjs
passed — RFC 4493: 64-byte message tests/cmac.test.mjs
passed — CMAC ASCII/HEX equivalence and spaced hex tests/cmac.test.mjs
passed — CMAC rejects incorrect keys, malformed data and oversized messages tests/cmac.test.mjs

Worked example (not necessarily independent)

Load RFC 4493 Example 1: key 2B7E151628AED2A6ABF7158809CF4F3C; empty message.

BB1D6929E95937287FA37D129B756746

MAC ANSI X9.9/X9.19

Needs rerun · 3 recorded checks

Supported methods

Algorithm 1 uses an 8-byte DES key; Algorithm 3 uses a 16-byte TDES key. HEX input and mode-specific padding.

Evidence

Independent OpenSSL comparison across algorithms and padding boundaries.

Limitations

The example is ASCII “Now is the time for all ” including its final space. Input padding changes the result.

ISO 9797-1 catalogue · Specification/reference, not a certification.

Recorded checks and worked example

passed — DES MAC agrees with independent OpenSSL for both algorithms and padding boundaries tests/des-mac.test.mjs
passed — retail MAC example and ANSI equivalence tests/des-mac.test.mjs
passed — padding and input validation are explicit tests/des-mac.test.mjs

Worked example (not necessarily independent)

Select X9.19, key 0123456789ABCDEFFEDCBA9876543210, data HEX 4E6F77206973207468652074696D6520666F7220616C6C20.

A1C72E74EA3FA9B6

MAC ISO 9797-1

Needs rerun · 3 recorded checks

Supported methods

Algorithm 1 uses an 8-byte DES key; Algorithm 3 uses a 16-byte TDES key. HEX input and mode-specific padding.

Evidence

Independent OpenSSL comparison across algorithms and padding boundaries.

Limitations

The example is ASCII “Now is the time for all ” including its final space. Input padding changes the result.

ISO 9797-1 catalogue · Specification/reference, not a certification.

Recorded checks and worked example

passed — DES MAC agrees with independent OpenSSL for both algorithms and padding boundaries tests/des-mac.test.mjs
passed — retail MAC example and ANSI equivalence tests/des-mac.test.mjs
passed — padding and input validation are explicit tests/des-mac.test.mjs

Worked example (not necessarily independent)

Select Algorithm 3, Method 1, key 0123456789ABCDEFFEDCBA9876543210, data HEX 4E6F77206973207468652074696D6520666F7220616C6C20.

A1C72E74EA3FA9B6

ISO 8583 Parser & Builder

Needs rerun · 5 recorded checks

Supported methods

pyiso8583 4.0.1 ASCII and mixed ASCII/binary profiles. Four ASCII MTI digits; HEX or ASCII wire input; fixed, LLVAR and LLLVAR fields up to DE 128.

Evidence

358 independent pyiso8583 4.0.1 wire encode/decode fixtures cover both named profiles, every supported field, length boundaries and secondary bitmaps. Additional tests check truncation at every byte, malformed input, significant spaces and field 55 TLV. This does not establish compatibility with a particular host.

Limitations

No transport framing, tertiary bitmap, BCD/EBCDIC, custom schemas, network-required-field checks, semantic field validation or MAC verification. Field 55 TLV failures are separate from wire parsing.

pyiso8583 sample profiles · Specification/reference, not a certification.

Recorded checks and worked example

passed — ISO 8583 wire encoding and decoding match 358 independent pyiso8583 4.0.1 cases tests/iso8583.test.mjs
passed — ISO 8583 secondary bitmaps, field offsets and field 55 TLV preserve exact bytes tests/iso8583.test.mjs
passed — ISO 8583 rejects truncation at every byte, trailing input, malformed bitmaps and length prefixes tests/iso8583.test.mjs
passed — ISO 8583 builder rejects duplicates, bitmap fields, bad MTI, encodings, size and profile tests/iso8583.test.mjs
passed — ISO 8583 preserves significant spaces and zero-length variable data; malformed field 55 is a separate error tests/iso8583.test.mjs

Worked example (not necessarily independent)

Choose ASCII input and paste 02000000000000000000.

MTI: 0200
Primary bitmap: 0000000000000000
20 bytes; no data elements.

TLV Parser

Needs rerun · 6 recorded checks

Supported methods

Parse nested EMV tags, lengths and values.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — ASN.1 DER example decodes integer, RSA OID, UTF8 and offsets tests/structure-decoders.test.mjs
passed — ASN.1 BER nested indefinite containers close at the correct boundary tests/structure-decoders.test.mjs
passed — ASN.1 PEM input decodes a real generated X.509 certificate tests/structure-decoders.test.mjs
passed — EMV nested tags retain names, values and unknown objects tests/structure-decoders.test.mjs
passed — Truncated data, primitive indefinite, unexpected EOC and limits are rejected tests/structure-decoders.test.mjs
passed — ASN.1 flags invalid primitive contents without claiming schema validation tests/structure-decoders.test.mjs

ASN.1 Decoder

Needs rerun · 6 recorded checks

Supported methods

Decode DER/BER structures from HEX or PEM.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — ASN.1 DER example decodes integer, RSA OID, UTF8 and offsets tests/structure-decoders.test.mjs
passed — ASN.1 BER nested indefinite containers close at the correct boundary tests/structure-decoders.test.mjs
passed — ASN.1 PEM input decodes a real generated X.509 certificate tests/structure-decoders.test.mjs
passed — EMV nested tags retain names, values and unknown objects tests/structure-decoders.test.mjs
passed — Truncated data, primitive indefinite, unexpected EOC and limits are rejected tests/structure-decoders.test.mjs
passed — ASN.1 flags invalid primitive contents without claiming schema validation tests/structure-decoders.test.mjs

Data Converter

Needs rerun · 4 recorded checks

Supported methods

HEX, ASCII, binary, decimal, octal, Base64 and Base94.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Encoding is reversible and provides no encryption. Base94 conventions are not universal.

RFC 4648 · Specification/reference, not a certification.

Recorded checks and worked example

passed — all seven formats round-trip Hello tests/data-converter.test.mjs
passed — preserves all bytes and leading zeros without inventing ASCII tests/data-converter.test.mjs
passed — rejects malformed and out-of-range data tests/data-converter.test.mjs
passed — Base94 alphabet boundaries, leading zeros and limits tests/data-converter.test.mjs

Worked example (not necessarily independent)

Select ASCII and enter Hello.

HEX: 48656C6C6F
Base64: SGVsbG8=

Country List

Needs rerun · 2 recorded checks

Supported methods

Country codes and currencies.

Evidence

Regression examples, boundary checks and/or round trips are listed below. A specification link alone is not evidence of an independent known-answer vector.

Limitations

Reference and parser checks cover the tested data and cases. Catalog accuracy and external coverage are not guaranteed.

Recorded checks and worked example

passed — Country codes preserve zeros and current currency transitions tests/references.test.mjs
passed — Languages deduplicate bibliographic and terminologic aliases tests/references.test.mjs