EMV Contactless Features: RRP, Data Storage & Mag-stripe Mode
Three cross-kernel capabilities that sit on top of the core contactless flow: the Relay Resistance Protocol that defeats relay attacks, the Data Storage containers that let issuers persist data on the card, and the legacy mag-stripe (MSD) mode with its dynamic CVC3.
Relay Resistance Protocol (RRP)
A relay attack forwards the contactless exchange between a real card and a real terminal that are far apart, making the terminal believe a distant card is present. RRP defeats this by timing a dedicated command: the reader sends an EXCHANGE RELAY RESISTANCE DATA (ERRD) command with a fresh nonce, the card replies with its own nonce and its timing estimates, and the reader checks that the round-trip time falls within the expected window. A relay adds latency and fails the check.
RRP is defined for Mastercard (Kernel 2) and the new Kernel 8 (and is referenced by Kernel 6). The timing parameters travel in a dedicated DF83xx tag family:
| Tag | Name |
|---|---|
DF8301 | Terminal Relay Resistance Entropy (reader nonce) |
DF8302 | Device Relay Resistance Entropy (card nonce) |
DF8303 | Min Time For Processing Relay Resistance APDU |
DF8304 | Max Time For Processing Relay Resistance APDU |
DF8305 | Device Estimated Transmission Time For Relay Resistance R-APDU |
DF8306 | Measured Relay Resistance Processing Time |
The reader rejects the transaction (or drops RRP) when the measured time exceeds the card's declared maximum plus an accuracy allowance — so a relayed tap, which is necessarily slower, is caught.
Data Storage (DS)
Data Storage lets an issuer (or a value-added "operator") read and write small data containers on the card during a contactless tap — used for loyalty, transit, and offline-data-storage use cases. It is most prominent in Discover Kernel 6 and Mastercard Kernel 2, and is also part of Visa Kernel 3.
The card advertises slot availability and the reader writes via a Write Data Storage Template. Key tags:
| Tag | Name |
|---|---|
9F5E | DS ID — identifies the data-storage application |
9F5F | DS Slot Availability |
9F6F | DS Slot Management Control |
9F5C | DS Requested Operator ID |
9F7D | DS Summary 1 |
DF8108 | DS AC Type |
DF8109 | DS Input (Terminal) |
BF11 | Write Data Storage Template |
Mag-stripe mode (MSD) & dynamic CVC3
Before full EMV contactless, cards supported a mag-stripe mode (MSD) that emulates a swipe over NFC. Instead of a static CVC, the card computes a dynamic CVC3 per tap so a captured track cannot be replayed. It is a legacy path — modern readers (e.g. Amex Kernel 4) are EMV-mode only — but the tags still appear in the wild.
The mechanism uses an Application Transaction Counter slice plus issuer-defined ranges:
| Tag | Name |
|---|---|
9F60 / 9F61 | CVC3 (Track 1 / Track 2) — the dynamic card verification code |
9F62 / 9F65 | PCVC3 (Track 1 / Track 2) — bit mask selecting which track digits carry the CVC3 |
9F63 / 9F67 | PUNATC / NATC — position & number of ATC digits embedded in the track |
Note 9F63 is also reused by UnionPay Kernel 7 as "Product Identification Information" — tag meaning is kernel-specific.
Related tools
EMV TLV Decoder · EMV Tag Reference · Kernel 2 (Mastercard) · Kernel 6 (Discover) · Kernel 8