Question: What is the relationship between the **EMV** **ODA**, **CA** and issuer certificate during the transaction?

Answer: 
Offline data authentication is the process to verify the cards authenticity.
Terminals are loaded with CA Public key.

* SDA(Static Data Authentication) can assure you the card data has not
been altered after the issuance. SDA card contains Signed Static
Application Data and Issuer Public Key certificate. CA Public key in
the terminal is used to verify the Issuer Public key certificate and issuer Public key is used to verify the signed static application data in
the card.
* DDA(Dynamic Data Authentication) can assure the card data has not
been altered and that the card as a whole is not cloned. DDA Card
Contains ICC Private Key, ICC Public key certificate and Issuer Public Key Certificate. CA Public Key in terminal is used to verify the  

Issuer Public Key certificate. Issuer Public key used to validate the
ICC Public Key certificate. ICC Public key used to verify the dynamic
signature generated by the card using its ICC Private key.
* CDA/AC(Combined Data Authentication with Cryptogram generation) -
Same as DDA card, only difference being Cryptogram Generation
and Dynamic signature happens together assuring that
Cryptogram came from a valid card.
ODA = Offline Data Authentication, ODA ( SDA/DDA/CDA) concept uses RSA cryptography therefore CA and issuer come into this place.

```
you can understand connection between CA and issuer with help of below figure:-

```

SDA - SDA ensures the authenticity of ICC data. After SDA it is sure that the data from the ICC is real and hasn't changed by anyone.
But SDA doesn't assure the uniqueness of ICC data. You can see the diagram of SDA is like,

[![SDA FLOW:](https://i.stack.imgur.com/cdGV8.png)](https://i.stack.imgur.com/cdGV8.png)

Here you can see two RSA Pair is using during SDA,  

(1) - IssuerRSA

(2) - CA\_RSA

this diagram is very descriptive and clear to understand the flow of SDA. Also you can check [EMV BOOK 2](https://www.emvco.com/specifications.aspx?id=155) for more description about SDA. while DDA flow is like ,

[![DDA FLOW](https://i.stack.imgur.com/G3T9w.png)](https://i.stack.imgur.com/G3T9w.png)

here you can see 3 RSA Pair is using in DDA,

1 - IssuerRSA

2- CA\_RSA

3 - ICC RSA ( new RSA key which is unique in all card, Each card generate this RSA pair during personalization of card so this RSA Pair will be different for each card) 

SDA guarantees that data on cards is valid because we trust a high level certification authority which signs the data. But an attacker can record a card session and build for example a new virtuel card because same data is used here for all session.

But in DDA flow - we can say it is checking SDA + giving random data to card by Terminal to sign and here this part makes cloning of card impossible because each session use different random number so recording a card session will not work in next card session.

Hope it helps you to know about ODA and connection between CA and issuer. more can you read from [SDA](http://www.openscdp.org/scripts/tutorial/emv/SDA.html) and [DDA](http://www.openscdp.org/scripts/tutorial/emv/dda.html) , [Gemalto](http://www.gemalto.com/emv/dda)