PVKI is the abbreviation for PIN Verification Key Index. It is located within the card's Track 1 and Track 2 data. It is used in PVV calculation. It can take values from 1 to 6. It usually takes the value 1.
PVV is calculated as follows:
(PAN + PVKI + PIN) PVKey -> PVV
- The 11 digits of the card number are taken, excluding the check digit.
- A single-digit PVKI (PIN Verification Key Index) is used. (It usually holds the value "1".)
- The 4-digit PIN value is also added.
- The resulting 16-digit value is treated as an 8-byte hex representation.
- It is encrypted using the Triple DES PIN Verification Key.
Why is PVKI necessary?
Banks may change their PIN verification keys at certain intervals for security reasons. However, there are many cards in the field whose PVV was calculated with an old key. PVKI indicates which key was used to calculate each card's PVV. This way, the bank can verify both old and new cards with the correct key even after a key change.
How is PIN verification performed?
When the cardholder enters their PIN, the issuing bank's HSM applies the following steps:
- The PVV is recalculated using the card number, the PVKI, and the entered PIN.
- The PIN verification key indicated by the PVKI is used in the calculation.
- The calculated PVV is compared with the PVV stored on the card or in the bank's database.
- If the values match, the PIN is accepted as correct.
In this method, the PIN itself is never stored anywhere.
Where is the PVV stored?
The PVV may be located within the Track data on the card's magnetic stripe, or it may be stored in the bank's own database. When a PIN change is made, the PVV is recalculated for the new PIN. For this reason, keeping the PVV in a database allows a PIN change to be made without needing to reissue the card.
