🚀 go-pugleaf

In article <1992Nov6.134420.9809@schaefer.math.wisc.edu> neergaar@schaefer.math.wisc.edu (Dude) writes:
>oppedahl@panix.com (Carl Oppedahl) writes:
>
>>In <1992Nov5.184546.5854@ulysses.att.com> tom@ulysses.att.com (Tom Smith) writes:
>
>>>On another newsgroup, there is a lot of discussion about Automatic
>>>Teller Machines and the Personal Identification Number (PIN) associated
>>>with an account/card.  There is controversy about whether or not
>>>an encrypted version of the PIN is encoded onto the magnetic stripe
>>>on the card.

>>Yes, there is.  This means the ATM can match your card to the PIN
>>you entered at the ATM, even if the phone lines are cut.  Scary, huh?
>
>>Well, it means the ATM can match _if it has the key_.  Each
>>issuer has its own key.  The ATM you visit probably can match the
>>card PIN with the entered PIN only if the bank that runs it issued
>>your card.

>I read somewhere on the net that all PINs are encrypted with the *same* *key*
>so that any ATM can match any card to its PIN.  Can anyone verify or 
>disprove this?

Well I can give some general info on this subject and some pointers to people 
who are further interested in investigating mag-stripe card contents.

The following can be gleaned from ANSI X9.1-1984 "Magnetic Stripe Data
Content for Track 3":  

[Field 3: Primary Account Number] 
Purpose: To identify the card issuer to which the transaction is to be routed
and the account to which the transaction is to be applied unless specific
instructions indicate otherwise.

[Field 13: Personal Identification Control Parameters (PINPARM)] 
Purpose: To provide optional security features.
Format and Content: PINPARM shallbe issuer or system defined as necessary for
	PIN verification.
	XXXXXX = PINPARM where X equals any numeric digit or:
	SEP = separator

[Field 20: Card Security Number]
Purpose: To relate the data contained on the magnetic stripe to the physical
card.
Format and Content: The card security number shall consist of either nine
digits in the form MXXXXXXXX or SEP, where:
	M = security method identifier
	XXXXXXXX = the code that enables the relationship between data and
	card to be established.
	SEP = separator
Methods for determining the content of M and of XXXXXXXX are to be defined by
the X9 Committee.

[Field 26: Crypto Check Digits (CCD)]
Purpose: To provide a means of verifying the integrity of the data elements of
Track 3.
Format and Content: Crypto check digits (CCD) shall consist of either six 
digits or SEP.
The method for determining the content of the six digits is to be defined by
the X9 Committee.
 

Some other things which might give you some more info:
ISO 4909, Bank cards - Magnetic stripe data content for track 3 (may have
	been superseeded by the X9.1 document)
ANSI X4.16-1983, American National Standard for Financial Services - Financial
	Services - Financial Transaction Cards - Magnetic Stripe Encoding.
*ANSI X9.8-1982, American National Standard for PIN Management and Security.
ANSI/ISO 7813-1987, identification cards - financial transaction cards (This
	discusses the structure of tracks 1 and 2 (read only) which don't
	seem to have the PIN on it unless it falls under Discretionary data)
ANSI/ISO 7811/*-1985, this hierarchy contains data on tracks 1 and 2 also