PAR and encrypted card data

Card numbers are never sent to Aera in clear text. Encrypt each card number with Aera's public key, and send the encrypted value with the masked number. This applies to everyone who sends cards to the Identity Services API: loyalty programs, and terminal providers that look up or enrol cards from their own terminals.

📘
Using Aera terminals with your ECR?
Then you don't need this page. The Aera terminal reads the card, and your ECR only gets the masked card number and a card reference. This page is for loyalty programs that send cards to Aera, and for providers of other terminals.

Requirements

Requirement	Description
Algorithm	RSA-OAEP with SHA-256 and MGF1 padding (`RSA/ECB/OAEPWITHSHA256ANDMGF1PADDING`)
Key	Aera's public key certificate, one for test and one for production
Output	The encrypted card number, Base64-encoded, in `encryptedValue`
Key ID	The key you used, in `encryptionKey.keyId`, with `encryptionType` = `RSAOAEP`

Get the certificates

Email [email protected] for the test and production certificates. Aera tells you in advance when a key is replaced, so you can switch in a controlled way. Keep your own private keys secure.

Send an encrypted card

Example: ID lookup with an encrypted card

{
  "identifier": {
    "identifierType": "PAY_CARD",
    "identifierValue": "************2987",
    "bin": "512345",
    "cardScheme": "MASTERCARD",
    "encryptionKey": {
      "keyId": "0",
      "encryptionType": "RSAOAEP"
    },
    "encryptedValue": "Ak0icpDJPRIs62v9cfJlt...Ped9auQ==",
    "paymentAccountReference": "512381d9f8e0629211e3949a08002"
  }
}

Example: encrypt a card number in Java

// Uses the Bouncy Castle provider
Security.addProvider(new BouncyCastleProvider());

String pem = publicKeyString
    .replace("-----BEGIN PUBLIC KEY-----", "")
    .replace("-----END PUBLIC KEY-----", "");
byte[] keySpec = Base64.getMimeDecoder().decode(pem);
PublicKey publicKey = KeyFactory.getInstance("RSA", "BC")
    .generatePublic(new X509EncodedKeySpec(keySpec));

Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPWITHSHA256ANDMGF1PADDING", "BC");
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
String encryptedValue = Base64.getEncoder()
    .encodeToString(cipher.doFinal(pan.getBytes(StandardCharsets.UTF_8)));

Include the payment account reference (PAR)

The PAR links a physical card and the same card in a mobile wallet, such as BankAxept in Apple Pay. With it, a member is recognised whichever way they pay.

Read the PAR from EMV tag 9F24 whenever the card has it, physical or in a wallet, for all EMV transactions, contact and contactless.
Send it in paymentAccountReference in ID lookup and enrolment calls. The field is optional: leave it out when the card has no PAR.

Test and go live.

Using Aera terminals with your ECR?

Requirements

Get the certificates

Send an encrypted card

Include the payment account reference (PAR)

Next