SDA (Static Data Authentication), DDA (Dynamic Data Authentication), and CDA (Combined Dynamic Data Authentication) are offline data authentication methods.
SDA (Static Data Authentication):
When used at an ATM or POS terminal, RSA signatures that authenticate the credit card itself form the first and most basic cryptographic layer. For SDA, the smart card contains application data signed by the private key of the issuer's RSA key pair. When a card with SDA is inserted into a terminal, the card sends this signed static application data, the CA index, and the issuer certificate to the terminal (POS). The terminal verifies the issuer certificate and the digital signature by comparing them against the actual application data on the card. In short, an RSA signature provides assurance that the data is genuinely original and was created by an authorized issuer.
DDA - Dynamic Data Authentication:
Because the same static data is used in every transaction, SDA cannot prevent replay attacks. This can be improved with a DDA card that has its own unique RSA key, which signs unpredictable, transaction-dependent data and sends it to the terminal. When a card with DDA is inserted into a terminal, the card sends signed dynamic application data, the CA index, the issuer certificate, and the card certificate to the terminal. The terminal then verifies the issuer certificate, the smart card certificate, and the signed dynamic application data.
CDA (Combined Dynamic Data Authentication):
With DDA verification, the terminal can authenticate the card, but it cannot verify that the subsequent transaction was actually performed by that card.
CDA closes this gap left by DDA verification. With CDA, the card digitally signs not only the card authentication data but also all the critical transaction data, in order to verify the transaction as well.