Signed Static Application Data

What it is

Signed Static Application Data (SSAD) is the issuer signature over static card data used by SDAStatic Data AuthenticationOffline check where the terminal verifies a fixed issuer signature over static card data. It cannot prove the card is live, so it is vulnerable to cloning and replay.View in glossary →. The terminal recovers it with the issuer public key and compares the embedded hash against a hash of the actual card data to detect tampering. SDAStatic Data AuthenticationOffline check where the terminal verifies a fixed issuer signature over static card data. It cannot prove the card is live, so it is vulnerable to cloning and replay.View in glossary → proves the data is authentic but, unlike DDADynamic Data AuthenticationOffline check where the card signs unique, per-transaction data with its own private key — proving the chip is genuine and not a clone.View in glossary →/CDACombined DDA / Application Cryptogram generationThe strongest offline authentication: the card signs the dynamic data and the transaction cryptogram together in one step, preventing tamper (“wedge”) attacks.View in glossary →, does not prove the card is genuine.

Where it appears

Read from the card record files; verified during SDAStatic Data AuthenticationOffline check where the terminal verifies a fixed issuer signature over static card data. It cannot prove the card is live, so it is vulnerable to cloning and replay.View in glossary →.

Specification reference

Defined in: EMV 4.x Book 3 (Application Specification), Annex A — Data Element Dictionary

Decode & build this tag

Related tags