openemv / dukpt Goto Github PK

I possibly found a bug in pinblock format 4 generation.

First command is to show the transaction key that will be used to encrypt the pin. In this case, the transaction key is the same as the ik because ksn is zero (for simplicity).
Second command is to encipher the pin using pinblock format 4, using the derived transaction key (11111111111111111111111111111111).

# ./dukpt-tool --mode=AES --key-type=AES128 --ik=11111111111111111111111111111111 --ksn=000000000000000000000000 --derive-txn-key 
11111111111111111111111111111111
# ./dukpt-tool --mode=AES --key-type=AES128 --ik=11111111111111111111111111111111 --ksn=000000000000000000000000 --pan=1234123412341234 --pinblock-format=4 --encrypt-pin=1234
A5345078DE652954CAFE125E9495D8F5

Then when trying to decipher the generated pinblock using python psec library, I encounter an error related to control field :

>>> from psec.pinblock import decipher_pinblock_iso_4
>>> decipher_pinblock_iso_4(key=bytes.fromhex("11111111111111111111111111111111"), pin_block=bytes.fromhex("A5345078DE652954CAFE125E9495D8F5"), pan="1234123412341234")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/python3.10/site-packages/psec/pinblock.py", line 625, in decipher_pinblock_iso_4
    return decode_pin_field_iso_4(pin_field)
  File "/python3.10/site-packages/psec/pinblock.py", line 555, in decode_pin_field_iso_4
    raise ValueError(
ValueError: PIN block is not ISO format 4: control field `B`

EDIT: The transaction key is actually not the key used for pin encryption. (It is a pin encryption key, which is derived from the transaction key)