0.3.1

Changes since 0.3.0:

• emv-decode tool:
  • Update to use GPLv3 license instead of LGPLv2
  • Fix error paths for argp
  • Fix process exit codes
• emv-tool tool:
  • Update to use GPLv3 license instead of LGPLv2
  • Use localtime_r() and gmtime_r() when available
  • Fix error paths for argp
  • Support Apple's PCSC.framework
  • Various other PC/SC improvements
• emv-viewer application:
  • Implement clipboard actions
  • Implement search functionality
  • Improve selection and navigation of fields
• emv and iso7816 libraries:
  • Improve memory allocation for better memory safety and platforms that have undefined behaviour for malloc(0)
  • Hardening of integer, bit shift and buffer operations
  • Fix emv_aid_get_info() for unknown scheme or product
  • Miscellaneous cleanups
• emv_strings library:
  • Stringify various contactless fields
• Build improvements:
  • Add Github Actions workflows for CodeQL analysis
  • Add build option EMV_UTILS_ENABLE_SANITIZERS for compiler sanitizers (-fsanitize)
  • Add build option EMV_UTILS_ENABLE_HARDENING for runtime security hardening (-fstack-protector-strong, _FORTIFY_SOURCE=2)
  • Use parallel builds for Github Actions
  • Remove builds for Fedora 41 and add builds for Fedora 43
  • Update all Fedora and MacOS release builds to use Qt6
• Update to latest OpenEMV common crypto submodule:
  • Clear AES KCV ciphertext on error
  • Fix random data helper functions
  • Let FetchMbedTLS.cmake use MbedTLS 3.6.5 LTS
  • Update MbedTLS patch to remove unused 3rd party components
• Update to latest libargp:
  • Fix C99 format specifiers when using MinGW
  • Add -Wall option for both Clang and AppleClang
  • Ensure that POSIX make is available
  • Reduce unnecessary reconfiguration of autotools

This is a maintenance and hardening release that includes various memory safety improvements, bug fixes, and new emv-viewer features.

Note

See README for installation instructions. MacOS users that already use Homebrew should favour using that to install this project using brew install openemv/tap/emv-utils instead of using the provided .dmg installer due to the lack of notarization.

Ubuntu release builds are provided as .deb files inside .zip files because Github mangles the file names.

This release is signed with key 4096R/27195F153817DAF955B0CF9FCA0466CD90C50572.

0.3.0

Changes since 0.2.3:

• emv-decode tool:
  • Implement --verbose option to control truncation of longer fields for easier viewing
  • Improve rendering of known ASN.1 OIDs
  • Improve rendering of identified ASN.1 objects by displaying the OID as part of the SEQUENCE and skipping over the OID field in the body of the object
• emv-tool tool:
  • Implement --txn-date and --txn-time options for specifying transaction date and time parameters
  • Implement --oda option for specifying supported Offline Data Authentication (ODA) methods
  • Let --debug-verbose option also control truncation of longer fields for easier viewing
  • Minor aesthetic improvements
• emv-viewer application:
  • Implement separate decode objects checkbox for ASN.1 object identification and rendering, independent of EMV field decoding
  • Let field value bytes be selectable with corresponding input byte highlighting
• emv library:
  • Implement RSA-based Offline Data Authentication (ODA), including:
    • CAPK lookup and validation
    • Static Data Authentication (SDA)
    • Dynamic Data Authentication (DDA)
    • Combined DDA/Application Cryptogram Generation (CDA)
  • Implement EMV Processing Restrictions
  • Implement EMV Terminal Risk Management
  • Implement EMV Card Action Analysis but default to offline decline for now
  • Improve DOL processing for all known fields including PDOL, DDOL, TDOL and CDOL1/CDOL2
  • Various other fixes, improvements and cleanups
• emv_strings library:
  • Use EMV TLV sources abstraction when stringifying EMV fields that depend on other EMV fields. This allows these fields to be fully stringified:
    • Issuer Public Key Certificate (field 90)
    • Signed Static Application Data (field 93)
    • ICC Public Key Certificate (field 9F46)
    • Signed Dynamic Application Data (field 9F4B)
    • Application Preferred Name (field 9F12) using the ISO 8859 code page specified by the most recent Issuer Code Table Index (field 9F11) in the input data
• iso8825 library:
  • Update BER implementation to latest ISO standards
  • Add basic ASN.1 support:
    • Add iso8825_strings abstraction to stringify ASN.1 types
    • Identify various ASN.1 OIDs that might be of interest to EMV transactions, for example description, streetAddress, url, and emailAddress as well as some related to cryptography like cbc, cmac, and dukpt_tdes2
• Miscellaneous:
  • Use OpenEMV common crypto submodule for generating Unpredictable Number (field 9F37) and implementing Offline Data Authentication (ODA)
  • Add pre-commit script for validating copyright headers

Note

See README for installation instructions. MacOS users that already use Homebrew should favour using that to install this project using brew install openemv/tap/emv-utils instead of using the provided .dmg installer due to the lack of notarization.

Ubuntu release builds are provided as .deb files inside .zip files because Github mangles the file names.

This release is signed with key 4096R/27195F153817DAF955B0CF9FCA0466CD90C50572.

0.2.3

Changes since 0.2.1:

• Identify various EMV fields related to Offline Data Authentication (ODA)
• Minor parsing improvements during Application Selection and Get Processing Options (GPO)
• Fix identification of ODA records and proprietary application records during Read Application Data
• Various documentation improvements
• Better support for older versions of CMake, like CMake-3.16 on Ubuntu 20.04
• Use a docker image for Ubuntu 20.04 release builds because Github deprecated the Ubuntu 20.04 runner
• Remove builds for Fedora 40 and add builds for Fedora 42
• Use Qt's MinGW toolchain to build Windows releases. See 89f5ed7 for details.

NOTE: See README for installation instructions. MacOS users that already use Homebrew should favour using that to install this project using brew install openemv/tap/emv-utils instead of using the provided .dmg installer due to the lack of notarization.

NOTE2: This release replaces 0.2.2 due to toolchain and packaging issues for Windows in that release.

0.2.2

Deprecated. Use 0.2.3 or newer instead.

0.2.1

Changes since 0.2.0:

• Decode various ambiguous EMV contactless fields that different kernels use for different purposes
• Allow --ber and --tlv options of emv-viewer to take input from stdin
• Set binary mode for stdin on Windows. This fixes a bug whereby Windows would attempt to translate binary data being piped to emv-decode or emv-viewer.
• Implement Remember input data checkbox for emv-viewer
• Various aesthetic improvements

NOTE: See README for installation instructions. MacOS users that already use Homebrew should favour using that to install this project instead of using the provided .dmg installer due to the lack of notarization.

0.2.0

Changes since 0.1.0:

• New emv-viewer application providing:
  • GUI interface (using Qt) for decoding BER encoded EMV data, including lookup of ISO 639 language code, ISO 3166-1 country code, ISO 4217 currency code and ISO 18245 Merchant Category Code (MCC) fields
  • Support for --ber and --tlv command line options to specify the input data in the same manner as for the emv-decode command line tool
  • Qt bundling for MacOS and Windows release packages
  • MacOS bundle creation and signing
  • Windows NSIS installer
• iso7816 library:
  • Improve parsing and EMV validation of Answer-To-Reset (ATR)
  • Improve decoding of various commands including SELECT, READ RECORD and PUT DATA
• iso8859 library:
  • ISO 8859 implementation can be selected at build time using the CMake ISO8859_IMPL option. It allows these values:
    • boost (default): Uses Boost.Locale, is supported on most platforms, is forgiving of unassigned code points, but requires C++
    • iconv: Uses GNU iconv, is not supported on some platforms, is less forgiving of unassigned code points, but doesn't require C++
    • simple: Only supports ISO 8859-1, has no dependencies and doesn't require C++
• emv library:
  • Update to EMV 4.4
  • Provide error and outcome enums that align with the standard messages in EMV 4.4 Book 4, 11.2 or EMV Contactless Book A v2.10, 9.4
  • Improve EMV Data Object List (DOL) processing with a focus on PDOL processing
  • Add high level EMV library interface:
    • EMV processing context object
    • Implement EMV candidate list discovery
    • Implement EMV application selection
    • Implement EMV initiate application processing
    • Implement EMV Read Application Data
  • Many logging improvements
• emv_strings library:
  • Add and improve decoding of many EMV fields
  • Add decoding of Issuer Authentication Data (field 91). Publicly available information about this field is very limited and in the absence of the Application PAN (field 5A) and Issuer Application Data (field 9F10), some guessing is required to partially decode this field.
• emv-decode command line tool:
  • Implement --ignore-padding option:
    • Invalid data is assumed to be padding if it is either less than 8 bytes when the total data length is a multiple of 8 bytes (for example DES) or if it is less than 16 bytes when the total data length is a multiple of 16 bytes (for example AES). Note that this option will also apply to nested constructed fields that contain padded cleartext data intended for encryption.
• emv-tool command line tool:
  • Refactor to use newly implemented high level EMV interface provided by emv library
  • Implement proper cardholder application selection loop
  • Retrieve and decode PC/SC feature and property lists
  • Identify and reject contactless cards for now to avoid decoding their artificial PC/SC ATRs. Eventually this project will grow to support contactless cards and implement further PC/SC contactless functionality.
• Misc improvements:
  • Many CMake improvements
  • Various C11 compatibility improvements for MinGW and Clang compilers
  • PC/SC compatibility improvements for non-PCSCLite builds
  • Update to latest libargp to fix build warnings on MacOS
  • Update Github Actions for Fedora 40/41 and MacOS 13
  • Update Github Actions to remove 32-bit builds from Windows workflow. MSYS2 has deprecated many 32-bit packages.

NOTE: See README for installation instructions. MacOS users that already use Homebrew should favour using that to install this project instead of using the provided .dmg installer due to the lack of notarization.

0.1.0

Initial release:

• emv library providing:
  • Many EMV tag identifiers
  • Processing functions for various EMV field formats (ans, n, etc)
  • Various bitmasks to interpret EMV binary fields
  • Iterators for various EMV binary fields such as Application File Locator (AFL), Cardholder Verification Method (CVM) List and Data Object List (DOL)
  • EMV TLV abstraction
  • Terminal Transport Layer (TTL) abstraction
  • Terminal Application Layer (TAL) abstraction
  • EMV application abstraction
  • Debug logging mechanism
• emv_strings library providing:
  • String converter functions for various EMV formats (cn, n, amount, etc)
  • Stringify functions for many EMV binary fields
  • Lookup functions for ISO 639 language codes
  • Lookup functions for ISO 3166-1 country codes
  • Lookup functions for ISO 4217 currency codes
  • Lookup functions for ISO 18245 Merchant Category Code (MCC)
• Ancillary abstractions to facilitate embedded use of the emv library:
  • ISO 7816 Answer-To-Reset (ATR), SW1-SW2 and COMPACT-TLV parser
  • ISO 8825 Basic Encoding Rules (BER) parser
  • ISO 8859 to UTF-8 converter
• emv-decode command line tool (see emv-decode --help for details) providing:
  • ISO 7816 Answer-To-Reset (ATR) decoding
  • ISO 7816 Status bytes (SW1-SW2) decoding
  • EMV TLV decoding
  • EMV Data Object List (DOL) decoding
  • Decoding of individual EMV fields
  • ISO 639 language lookup
  • ISO 3166-1 country lookup
  • ISO 4217 currency lookup
  • ISO 18245 Merchant Category Code (MCC) lookup
• emv-tool command line tool (see emv-tool --help for details) providing basic EMV processing up to Read Application Data. This tool, and the emv library, are still very far from full EMV processing but will grow towards it in future.

NOTE: See README for installation instructions.