ASSI
-
Security Strength 101: AES-128 vs AES-256, RSA-2048 vs ECC
.
I want to share something that I wish someone explained to me earlier in my career. In the payments world and even in normal software engineering work, people love to ask which one is better AES-128 or AES-256? RSA-2048 or ECC? And most of the time, the conversation becomes too academic or too full of…
-
Cryptoperiods Explained: How Long Should Keys Live and Why It Matters
.
There are some topics in security that sound very deep and complicated at first. Cryptoperiods is one of those. The first time I encountered this in a real project, I honestly thought it was something only big banks cared about. Later on, when I got more involved with HSMs, RKI processes, and PCI requirements, I…
-
Understanding Cryptographic Keys: The Beginner Friendly Breakdown
.
Whenever I talk to people who are new in security or payments, one thing always surprises me. The moment I say the word keys they immediately think it is something complicated or something only seniors can understand. I get that feeling because I used to be the same. When I first touched topics like symmetric…
-
What is NIST SP 800-57? A Practical Guide for Payments, Fintech, and Security Teams
.
I want to share something that honestly took me years to fully understand. If you work in fintech, in payments, or anywhere near security and compliance, you will eventually hear this one document again and again. It is called NIST SP 800 57. To be honest, the first time I saw it, it felt like…
-
EMV Cryptograms Explained: ARQC, TC, and AAC Made Simple
.
I want to talk to you about something that confused me a lot back when I first started working with EMV transactions. If you are like me, when you hear the word cryptogram, it feels like something advanced or very deep. But once I actually saw how this is used in real payment flows, I…
-
TVR, TSI and IAC: The Brains Behind EMV Logic
.
When I first started working on EMV transaction processing, I remember feeling completely lost looking at those cryptic acronyms such as TVR, TSI and IAC. They looked like random three-letter codes, but every time something went wrong in an EMV transaction, those were the first places I had to check. If you’ve ever debugged an…
-
How EMV Makes Decisions: Processing Restrictions & Terminal Action
.
I’ve spent a good part of my career dealing with EMV transactions. When I first got into this space, I thought EMV was just about encrypting card data and making sure the chip was harder to copy than a magnetic stripe. But the more I worked with terminals, kernels, and card profiles, the more I…
-
Cardholder Verification Explained: PIN, Signature, and More
.
When I first started working on EMV transactions, one of the things that confused me the most was cardholder verification. I was so focused on getting the terminal to talk properly to the card, sending the right APDUs, and parsing the responses that I didn’t pay much attention to what comes next, how the system…
-
Reading EMV Records: How Terminals Get What They Need
.
I want to share something with you today that brought me a lot of headaches when I was working on my first contactless EMV implementation. If you’re diving into EMV transactions, especially building or testing somethink like a SoftPOS or EMV kernel, you’ll eventually bump into a critical question: “How does the terminal know what…
-
What Happens When You Tap or Insert? A Look at GPO and AFL
.
When I first started working with EMV transactions, I used to wonder: what really happens the moment you tap or insert your card? On the surface it looks so simple, the card is near the terminal, something blinks, and then the screen shows “Processing”. But inside, a lot of things are happening between the card…