FPE Decipher (CSNBFPED)

Edit online

The FPE Decipher verb is used to decrypt payment card data for the Visa Data Secure Platform (VDSP) processing.

The FPE Decipher verb uses the TDES (Triple-DES) algorithm with cipher block chaining (CBC). It supports two options:

  • The standard encryption option.
  • TheVisa Format Preserving Encryption (VFPE) option.

If the standard encryption option was selected, the plain text data was formatted into blocks and then encrypted with triple-DES encryption with a static TDES key or a DUKPT double length data encryption key. For the decryption operation, the data blocks must be decrypted and unblocked to produce the plaintext. If the data was encrypted with the VFPE option, the data was encrypted in place without changing the data type or length of the field and DUKPT key management is used.

The verb can be used to decipher one or all of the following fields:

  • the primary account number (PAN),
  • the cardholder name,
  • the Track 1 Discretionary Data,
  • the Track 2 Discretionary Data.

Also refer to Visa Format-Preserving Encryption supporting information.

The CSNBFPED verb returns the enciphered fields and optionally the DUKPT PIN key, if DUKPT key management is selected.

Terminology: The VDSP specification speaks of two key management methods: DUKPT (derived unique key per transaction) and Zone Encryption Keys. The process for deriving these keys is documented in ANS X9.24 Part 1. Zone Encryption Keys are called static keys in CCA. Static keys are presented for use and are not derived during verb processing. They are double length TDES keys for this service which are called static TDES keys in this document.
Note: This verb supports PCI-HSM 2016 compliant-tagged key tokens.