DAC is the abbreviation for Data Authentication Code.
It is a piece of data assigned by the issuer (card-issuing bank) and held by the terminal during the Signed Static Application Data verification process.
It is a 2-byte piece of data located in tag 9F45.
What is SDA?
DAC is a piece of data used in the SDA (Static Data Authentication) method. SDA is an offline verification method in which the terminal checks that the data on the card was written by the card-issuing bank and has not been altered afterward. When the card is issued, important data is signed with the bank's private key, and this signature is written to the card. The terminal verifies this signature during the transaction.
The role of DAC
The DAC is included among the signed data. After the terminal verifies the signature, it extracts the DAC value from within the signature and stores it in tag 9F45. This value can later be forwarded to the card-issuing bank, allowing the bank to additionally verify which card was used for the transaction.
Limitations of SDA
With SDA, the signature on the card is the same for every transaction. Because of this, the card data and signature can be copied to create a counterfeit chip card. Due to this weakness, card schemes have gradually phased out the use of SDA and moved to DDA (Dynamic Data Authentication) and CDA (Combined Data Authentication), which produce a different signature for each transaction.
Today
The vast majority of newly issued cards support DDA or CDA. For this reason, DAC is not encountered as often in today's transactions as it once was.
