EMVCo common kernel — EMVCo Kernel 8
EMVCo Kernel 8: the next-generation common contactless kernel with an elliptic-curve Secure Channel negotiated through the Kernel Qualifier (9F2B) and Card Capabilities.
Overview
Kernel 8 is EMVCo's next-generation common contactless kernel, designed to be reused across schemes. It replaces the per-scheme TTQ with a Kernel Qualifier (9F2B) and Card Capabilities Information.
Its defining feature is a Secure Channel built on elliptic-curve cryptography: the kernel and card negotiate algorithm suite indicators (ASIs) for secure-channel and certificate operations, then protect the exchange end-to-end.
Transaction flow
EMVCo Kernel 8 — the next-generation common contactless kernel. It introduces a Secure Channel with ECC-based authentication, negotiated via the Kernel Qualifier (9F2B) and Card Capabilities, rather than a TTQ.
1App Selection
PPSE → AID
Entry Point selects the application and activates Kernel 8.
Kernel Qualifier (9F2B)
The 8-byte Kernel Qualifier carries the kernel Version (02 = VERSION 2), a Local-authentication-enabled flag, the selected Secure Channel ASI, and a list of Certificate ASIs the kernel supports (bytes 4–6).
Decode it live: Kernel 8 Qualifier Decoder
Cardholder verification
CVM (online PIN, on-device CVM, signature, or no CVM) is resolved over the established secure channel per the negotiated capabilities.
Key data elements
| Tag | Name | Notes |
|---|---|---|
9F2B | Kernel Qualifier | Version + local-auth flag + secure-channel / certificate ASIs. |
9F33 | Terminal Capabilities | Standard terminal capability tag. |