The EXTERNAL AUTHENTICATE command asks the application within the ICC whether it can verify the cryptogram.
The ICC returns the processing status of the command.
The components of the External Authenticate command are listed below:
What is issuer authentication?
External Authenticate is the step in which the card verifies the response from the issuing bank. This is called issuer authentication. In an online transaction, the card sends a cryptogram (ARQC) to the bank. After verifying this cryptogram, the bank generates its own cryptogram (ARPC) in its response. The card verifies this response cryptogram using the External Authenticate command.
Why is it necessary?
This step lets the card confirm that the approval response it receives genuinely came from its own bank. For example, if a fake terminal or an attacker on the network tries to produce an approval response that looks like it came from the bank, the card will not be able to verify that response. In that case, the card does not update its internal counters and status information.
If verification fails
If External Authenticate fails, the terminal sets the "issuer authentication failed" bit in byte 5 of the TVR. Depending on its own rules, the card may decline the transaction or request online authorization on the next transaction.
Current usage
In newer-generation card applications, issuer authentication can be performed within the second GENERATE AC command instead of a separate External Authenticate command. Which method is used is specified in the card's AIP value.
