Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
For chip cards (emv), how do I know, based on either BIN (first six digits of card numbers) or on the entire card number, if a card is SDA, DDA or CDA?
I know what it means, but without using a POS or ATM, I want to check which of those three categories my card number or its BIN number belongs it.
This is not something that's determined by the account number (BIN or otherwise). Rather, it's determined by the bank that orders the cards and has the chip "personalized" with your account information. They make the choice as to whether to simply put on a pre-computed signature (SDA), or pay the extra expense for a chip that is capable of calculating one on the fly (DDA). I believe that all DDA-capable chips can do CDA if the terminal supports it, but I'm not certain on that front.
As for why any bank might issue a SDA card instead of a DDA card, this article from 2008 still rings true:
The reason comes down to one of cost. A chip card that is capable of performing public key cryptographic processing, and therefore capable of supporting DDA, is relatively more expensive than a chip card that is not capable of performing public key cryptographic processing, and thus only capable of supporting SDA. The cost of issuing chip cards is a significant factor in the business case for a bank. Current indications from the Australian market is that the difference in price between an SDA card and a DDA card is in the range of $0.50 – $1.00.
Use https://github.com/L1L1/cardpeek/commits/master Cardpeek, it can read VISA or mastercard and then there will be flags what of the SDA, DDA or CDA are supported on this EVM chip. There will be also info about CDCVM (Apple Pay / Google pay).
The prevailing answer now may be "none of the above", at least in the US. I've just tested all the chip cards I've ever gotten (~20 or so from various US banks and over several years) with CardPeek, and was amazed to find that only one oriented specifically towards international transactions supported DDA/CDA. None of them do SDA, and only a couple support offline PINs. The trend seems to be to just force all card and PIN verification online.
Strangely, most of the cards seem to have proper RSA support and do respond correctly to an INTERNAL AUTHENTICATE command, which would imply that they could support DDA if only the data records needed to determine the ICC's public key were included.
