Security - MAC & PIN Blocks Quiz

1. What is the fundamental difference between ANSI X9.9 and ANSI X9.19 MAC algorithms?

Select one answer.

X9.9 uses single DES throughout, X9.19 adds a final triple-DES step X9.9 uses CBC mode, X9.19 uses ECB mode X9.9 is for PIN encryption, X9.19 is for message authentication X9.9 uses 8-byte blocks, X9.19 uses 16-byte blocks

2. Two cards share the same rightmost twelve PAN digits excluding the check digit and use the same PIN in ISO-0. Does PAN mixing guarantee distinct clear PIN blocks?

Select one answer.

No; those inputs produce the same mixed block Yes; ISO-0 always adds random bytes Yes; every full PAN is hashed Yes; the check digit is included

3. A message carries DE53=0102010000000000. What is needed to interpret its subfields?

Select one answer.

The PAN check digit The authorization response code The applicable profile's DE53 definition Only the field number, since all profiles agree

4. Why is it critical to use constant-time comparison (subtle.ConstantTimeCompare) when verifying MACs?

Select one answer.

It prevents memory leaks during comparison It prevents timing attacks that could reveal MAC bytes It handles different byte orders correctly It's faster than regular comparison

5. Two key check values match. What does that establish?

Select one answer.

The keys are mathematically guaranteed distinct from all other keys The messages are authenticated A useful consistency check, not proof of key provenance or a collision-free identity The full keys are publicly revealed

6. Where does the MAC typically appear in an ISO8583 message?

Select one answer.

At the beginning of the message, before the MTI In DE64 (primary) or DE128 (secondary) In DE53 as security control information In DE52 as encrypted data

7. In the key hierarchy, what is the relationship between ZMK and ZPK?

Select one answer.

ZMK is used to securely transmit ZPK between parties ZPK is the master key that protects ZMK They are the same key with different names ZMK encrypts transaction data, ZPK encrypts PINs

8. For PIN '5678' and PAN '4111111111111111', what are the first 4 nibbles of the clear ISO-0 PIN block (before XOR)?

Select one answer.

0478 4567 0456 5678

9. Users report incorrect-PIN responses. Which evidence should guide diagnosis?

Select one answer.

The approved test vectors, format, key identity, and profile mapping Log clear PINs to compare them Disable PIN checks until the errors disappear Assume key mismatch is the only possible cause

10. What is PIN translation and why does it occur?

Select one answer.

Validating that the PIN matches the stored hash Decrypting and re-encrypting a PIN block under a different key at each hop Changing the PIN format from ISO-0 to ISO-1 for compatibility Converting the PIN to a different language for international transactions

11. Peers rotate keys five minutes apart and MAC failures occur. What must a rollover design specify?

Select one answer.

Use whichever key validates without tracking a version Skip verification near midnight Accept every old key indefinitely Authenticated key versions, activation timing, and any explicitly permitted overlap

12. What 12 digits from PAN '6011123456789123' are used in the ISO-0 PAN field?

Select one answer.

011123456789 (positions 2-13) 234567891230 (rightmost 12 including check) 112345678912 (excluding check digit, rightmost 12) 601112345678 (leftmost 12)

13. Why does an HSM never export the LMK (Local Master Key)?

Select one answer.

LMK is a hardware component, not a cryptographic key LMK is only used during HSM manufacturing LMK is too large to transmit over network connections LMK protects all other keys; if compromised, all keys are compromised

14. MAC inputs differ in length by eight bytes. What does this establish?

Select one answer.

The encryption keys must be identical The authenticated byte sequences differ; inspect coverage and serialization rules The exact missing field is proved to be DE64 One side definitely used ASCII instead of BCD

15. What is the main advantage of ISO Format 4 PIN blocks over ISO Format 0?

Select one answer.

Format 4 doesn't require the PAN for encoding Format 4 is faster to compute Format 4 supports longer PINs (up to 16 digits) Format 4 uses AES (128-bit blocks) instead of DES (64-bit blocks)