EMVCo common kernel — EMVCo Kernel 8
EMVCo Kernel 8: the next-generation common contactless kernel with an elliptic-curve Secure Channel negotiated through the Kernel Qualifier (9F2B) and Card Capabilities.
Overview
Kernel 8 is EMVCo's next-generation common contactless kernel, designed to be reused across schemes. It replaces the per-scheme TTQ with a Kernel Qualifier (9F2B) and Card Capabilities Information.
Its defining feature is a Secure Channel built on elliptic-curve cryptography: the kernel and card negotiate algorithm suite indicators (ASIs) for secure-channel and certificate operations, then protect the exchange end-to-end.
Adoption is early. EMVCo opened Kernel 8 type-approval testing in October 2024, and by October 2026 implementations from Ingenico (the first, October 2024), Castles Technology (July 2026) and ID TECH (August 2026) were on its approved kernel list. No card scheme has yet set a date by which terminals must support it, so readers run Kernel 8 alongside the scheme kernels.
Transaction flow
EMVCo Kernel 8 — the next-generation common contactless kernel. It introduces a Secure Channel with ECC-based authentication, negotiated via the Kernel Qualifier (9F2B) and Card Capabilities, rather than a TTQ.
1App Selection
PPSE → AID
Entry Point selects the application and activates Kernel 8.
Kernel Qualifier (9F2B)
The 8-byte Kernel Qualifier carries the kernel Version (02 = VERSION 2), a Local-authentication-enabled flag, the selected Secure Channel ASI, and a list of Certificate ASIs the kernel supports (bytes 4–6).
Decode it live: Kernel 8 Qualifier Decoder
Cardholder verification
CVM (online PIN, on-device CVM, signature, or no CVM) is resolved over the established secure channel per the negotiated capabilities.
Key data elements
| Tag | Name | Notes |
|---|---|---|
9F2B | Kernel Qualifier | Version + local-auth flag + secure-channel / certificate ASIs. |
9F33 | Terminal Capabilities | Standard terminal capability tag. |