The VisaProvisioningUtils extension provides implementation support for Visa Mobile Provisioning aligned with modern MPAD/MPAC flows and Apple Wallet payload creation.This version replaces the legacy MBPAD/MBPAC naming and introduces a unified wallet payload generation with end-to-end encryption handling.
The extension is designed to work with HSM-protected keys, issuer encryption requirements, and Apple Wallet provisioning specifications.
The extension exposes four core utility methods:
CreateAuthenticationData
CreateActivationData
CreateWalletWrapperForVisa
DecryptKeyWithHSM
This updated implementation centralizes encryption logic and aligns naming with Visa MPAD / MPAC terminology.
PurposeGenerates Mobile Provisioning Authentication Data (MPAD) required by Visa during Apple Wallet provisioning initiation.
Input Parameters
PAN
Expiry Date (MMYY)
Timestamp (UTC – CCYYMMDDHHMMSS)
Key Set Identifier
Issuer Encryption Key (or HSM reference)
Process Summary
Constructs the MPAD data block using Visa-defined formatting
Applies required padding and control fields
Encrypts the data using issuer-approved encryption (HSM or secure key)
Returns MPAD in Visa-compliant structure
Output
MPAD string used in Visa provisioning requests
PurposeGenerates Mobile Provisioning Activation Data (MPAC) required to complete token activation in Apple Wallet.
Device Nonce (from Apple)
Issuer-generated Authentication Code
Combines nonce and authentication code
Applies Visa encryption block formatting
Encrypts the activation payload
Produces a Visa-compliant MPAC output
MPAC string used during Visa token activation
PurposeCreates the Apple Wallet provisioning payload, including fully encrypted data, ready to be sent to Apple’s PKAddPaymentPassRequest.
PKAddPaymentPassRequest
Key Responsibilities
Accepts MPAD and MPAC data
Performs all required Visa and Apple encryption
Wraps encrypted data into the Apple Wallet payload structure
Ensures compliance with Apple Pay In-App Provisioning specifications
Encrypted Apple Wallet payload ready for transmission to Apple
PurposeDecrypts an encrypted key using HSM-based key components, ensuring secure key handling.
HSM Key Component 1
HSM Key Component 2
HSM Key Component 3
Encrypted Value
Uses the three HSM key components to reconstruct the master key
Decrypts the provided encrypted value
Returns the clear component key securely
Clear (decrypted) cryptographic key for controlled internal use
This extension provides implementation support for the Visa Mobile Banking App–Initiated Provisioning process — a legacy approach used by issuers to enable card provisioning into Apple Wallet (and other digital wallets) using symmetric encryption (Triple-DES) and WSD zone keys.
The extension includes two main methods:
CreateAuthenticationData (MBPAD) – Generates the Provisioning Authentication Data required for initial Apple Wallet provisioning.
CreateActivationData (MBPAC) – Generates the Activation Data required to complete the token activation phase.
Both outputs are formatted according to the Visa legacy structure:
type-version-keyscheme-keysetidentifier-ephemeralkey-algorithm-encryptedinformation
The encryption logic follows Visa’s guidelines for WSD Zone Encryption Keys using Triple-DES (TDEA) in Cipher Block Chaining (CBC) mode.
MBPAD-1-FK-123456.1--TDEA-7AF291C91F3ED4EF92C1D45EFF127C1F9ABC12347E
MBPAC-1-FK-123456.1--TDEA-5BC87F9A12293F0E9C9E0FA5A394D67C7F
Purpose:Constructs the MBPAD string used in Visa’s Provisioning Authentication Data field.
Input Parameters:
PAN: Primary Account Number to be provisioned.
Expiry Date: Expiration date in MMYY format.
Date/Time: Timestamp in UTC format (CCYYMMDDHHMMSS).
Key Set Identifier: Identifier of the WSD data encryption key (e.g., 123456.1).
Ephemeral Key: Reserved for future use (currently blank).
Encryption Key: Triple-DES symmetric key used for encryption.
Process Summary:
Combines PAN, expiry date, and date/time into a structured text format.
Applies Visa encryption block formatting with control fields, length indicators, and padding.
Encrypts data using Triple-DES (CBC mode) with the specified WSD key.
Converts encrypted data into hexadecimal binary representation.
Concatenates all clear-text and encrypted components using hyphens.
Output:A formatted MBPAD string used in the Visa–Apple Wallet provisioning request.
Purpose:Constructs the MBPAC string used in Visa’s Provisioning Activation Data field.
Nonce: Device nonce (in hexadecimal) received from Apple during provisioning initiation.
Auth Code: 6-character alphanumeric activation code generated by the issuer for the specific request.
Key Set Identifier: Identifier of the WSD key used for encryption.
Combines nonce and authentication code into a structured text string.
Formats data according to Visa encryption block structure.
Encrypts using Triple-DES (CBC) with the WSD key.
Converts the encrypted result to hexadecimal binary format.
Builds the final MBPAC string with hyphen-separated components.
Output:A formatted MBPAC string used during Visa token activation with Apple Wallet.
!
The WSD key must be securely exchanged with Visa using standard key conveyance protocols (ZCMK).
Keys must not be stored, logged, or transmitted in plaintext.
Encryption operations can optionally be offloaded to an external HSM for compliance.
The generated data strings must be Base64 encoded before being sent to Apple’s PKAddPaymentPassRequest or Visa APIs.
This legacy flow is not recommended for new integrations; the Visa Developer Platform’s JWE-based provisioning is preferred.