Generate Unique EMV Payment Token from PAN

Question

i want to generate a random unique(in range of available tokens)payment token (16 digit) from PAN (16 digit) (Such as VISA Token Service Provider). PAN format is : YYYYYYXXXXXXXXXX where YYYYYY(first six digit) is unique for each bank (Bank Identification Number). every token must have a Token BIN just like PAN BIN. PAN last digit must calculate with Luhn Algorithm. a generated Token must not be equal to any Real PAN. a PAN can have multiple tokens but a single token must be mapped identically to single PAN. algorithm must be random ( pseudo-random ) to protecting system from reverse engineering . i have no idea to how to generate unique token with randomness

Answer 1

There are different methods of generating tokens from a PAN: Cryptographic methods and non-cryptographic methods. The non-cryptographic methods are straight forward, you just generate random strings of numbers and keep a table/database that will have the PAN-Token mapping. For cryptographic tokens, you need an algorithm that encrypts the original PAN to create a new token. One thing to have in mind is the BIN range as you have mentioned. There exists a family of encryption algorithms refereed to as Format Preserving Encryption (FPE) algorithms. And as the name implies, they preserve the format of any data you are encrypting. So encrypt 16-digits plain-text (PAN) and get 16-digit cipher-text (token). NIST has released a specification explaining how to use FPE algorithms, see: https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwiCqo3ej7nWAhVEIVAKHZLqCLkQFggoMAA&url=http%3A%2F%2Fnvlpubs.nist.gov%2Fnistpubs%2FSpecialPublications%2FNIST.SP.800-38G.pdf&usg=AFQjCNG77pHskWJzuLbq0HrWTnRJ29hoAQ

It is important to note that the FPE algorithms in the NIST document do not deal with luhn check digit. So a solution to this is to remove the luhn check digit from the PAN and then encrypt the rest of the digits, and then after getting the cipher-text (token), yo calculate a new luhn check digit and append it to the end of the token you generated.