CVM List Parser

Structure of tag 8E

The CVM List begins with two four-byte amounts, X and Y, both in the minor units of the application currency. After those comes a sequence of two-byte rules, each pairing a cardholder verification method with the condition under which it applies.

In each rule, the first byte holds the CVM code in bits 6-1. Bit 7 is the important one: when set, it means "if this CVM fails, try the next rule". When clear, a failure of this CVM ends cardholder verification unsuccessfully, with no fallback. Bit 8 is reserved.

The second byte is the condition code, and X and Y are what conditions 06 through 09 test against.

How the terminal walks the list

Top to bottom, in order. A rule whose condition does not hold for this transaction is skipped. For the first rule whose condition does hold, the terminal checks whether it can perform the CVM according to its own Terminal Capabilities (tag 9F33). A method it cannot perform is treated as unsuccessful, the same as a method that failed, so bit 7 decides whether the walk moves on or cardholder verification fails there. That is what condition 03, "if terminal supports the CVM", is for: it turns an unsupported method into a skipped rule. If the list runs out without a success, cardholder verification fails and TVR byte 3 bit 8 gets set.

This is why the order of the list, not just its contents, determines whether you get a PIN prompt. A card that lists offline PIN before signature behaves very differently from one that lists them the other way round, on identical hardware.

Reading the result

What actually happened is recorded in tag 9F34, CVM Results, three bytes giving the method performed, the condition it matched, and whether it succeeded. Byte 3 is the one people want: 02 means successful. The linked example is offline PIN, performed because the terminal supported it, and verified by the card.

Two frequent surprises. "No CVM required" (1F) is a legitimate CVM and shows as a success, not an absence. And online PIN always reports as inconclusive at the terminal, because only the issuer can verify it. The terminal just forwards the PIN block.