Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wrote some code that does PIN encryption/decryption according to rules in X9.24. It works great with examples provided in ANSI doc, but doesn't work with actual device from the client.

Where can I find more sample data to run my code through, to make sure that my code is correct?

Is it possible that some device manufacturers do not follow ANSI to a T?

share|improve this question

Well, it's always possible for a device manufacturer to not follow the specification. There was a question on Stackoverflow asking how to implement the standard ( ) and they pointed to jPos: It appears to contain test data.

share|improve this answer

Our vendor gave us sample code that works with their equipment. I was a little surprised to notice they left out a step from the ANSI 9.24-1 standard. I read though that document hundreds of times, and I can't believe I missed it saying that it was optional, but I had to decrypt what they were sending so I left the step out, and we are decrypting just fine.

Specifically, on page 49 of ANS X9.24-1:2009, it says:

4) XOR the Key Register with hexadecimal “0000 0000 0000 00FF 0000 0000 0000 00FF”. (This will produce a variant of the key.)

Our new vendor left this out. Interestingly, our old vendor left it in. I don’t make the rules, I just write code that works.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.