30

Is the 3-digit (4-digit for those acolytes of standardization, American Express!) CVV/CSV/CVC calculated from card number and expiration date, or is it merely assigned? I know that once when I got a renewed Visa, it had the same 16-digit account number, different expiration date, and different CVV2.

I've seen some hints that CVV/CSV/CVC can be calculated, but those were in marketing collateral for a credit-card-processing appliance whose name I can't remember maybe 10 years ago. It would seem that compromising such an algorithm would be a very bad thing indeed, but the whole of the credit card industry is riddled with dumb ideas.

29

CVV is calculated:

[CVV Generate] verb generates a CVV that is based on the information that the PAN_data, the expiration_date, and the service_code parameters provide. This verb uses the Key-A and the Key-B keys to cryptographically process this information.

Source: https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.wskc.doc/wskc_r_csg.html

This calculation can only be done by the card issuer due to the use of a pair of Cryptographic keys which is known only to the card issuer.

  • 2
    Why are there only 10 bits of entropy in a cvv? – Awn May 15 '16 at 10:36
  • 5
    @Aurora: Probably for ease of use by a consumer. The risk of brute forcing is low because any attempts to guess it will be noticed and acted upon by the card issuer. For example, they may block that particular merchant and notify the cardholder that attempts have been made on their card so that the card can be reissued. If the PAN and expiry combination have been compromised, that whole card can be pretty much considered leaked and that it shouldn't be used. – SilverlightFox May 16 '16 at 9:57
  • 8
    It seems the risk of a brute force attack is not so low after all :) techxplore.com/news/2016-12-seconds-hack-credit-card.html – gabrielmaldi Dec 2 '16 at 19:45
  • Note this answer is about the CVV1 included in the track data, not the CVV2 number which is printed on the backs of cards – William Dunne Mar 12 at 14:20

protected by Community Oct 17 '18 at 9:05

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.