Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Asymmetric encryption and digital certificates are used all over in the IT world to verify authenticity and prevent forgeries. And it works great.

Why do credit cards not use some form of public/private key to verify authenticity? Is the reason logistical, or is there some other business motive?

share|improve this question
add comment

3 Answers

Some credit cards using EMV (at least in the UK) do use public key cryptography behind the scenes. More information about how this protocol works for payment (and what's wrong with it) can be found in a paper by Murdoch et al.. However, this is used to verify the authenticity of the card rather than the card holder.

If you were suggesting that the card holder might be authenticated by holding a private key and having some kind of certificate, there are several practical issues. The private key has to be held and used by a device, not a person, so for in-person payment you immediately go back to the EMV model mentioned previously. For online shopping, however, you could potentially store keys and certificates on your PC or phone to authenticate the user. Unfortunately experience suggests that certificate management has usability issues (see this classic paper) which would make life difficult for the end user.

In practice, public key infrastructures tend to be quite good for authenticating devices but relatively bad for authenticating people. Exceptions to this rule tend to be in corporate environments where dedicated IT departments exist to support the system and people are required to comply to company policies.

share|improve this answer
    
And authenticating people is the real part of the problem. A token can always be stolen and all the certificates in the world don't know that. –  Fiasco Labs May 25 '12 at 2:47
    
(Unless you're using some sort of biometric system, you're always going to authenticate a device anyway.) Some smartcards/hardware tokens will require a pin to be entered to make use of the private key and the terminal can't trick the card into thinking the valid PIN was used. –  Bruno May 25 '12 at 10:35
add comment

Mostly logistical - but also about lowering the bar to use the card to buy things online; things like verified by visa and other solutions are catching on though, but in most cases [I have seen] they are not mandatory.

It has been seen (by the cc companies) making it easy to use (not using "too much" security) means that everyone and their mom can use it, and if there is a problem - reimburse the person and if possible freeze the transaction to the seller.

Also as long as things as paying via the phone etc is possible using a cc then that makes a solution with keys a lot harder to implement.

The fact that a cc company will reimburse is also one of the security measures for the end users, they know that they will get the money back if the cc number is stolen - as for instance Schneier says in the book "digital security", he gives a example of buying a palm plot and the fact that the name of the payment site was different from the store.

share|improve this answer
    
I'd say "card-not-present" transactions are completely out of scope of this question. No authentication is performed at all in these cases. –  Bruno May 25 '12 at 11:01
add comment

There are two main reasons: (1) business reasons, and (2) legacy issues.

I guess I should elaborate. By business reasons, I mean that credit card companies are leary of any changes that might make it harder for people to use their credit cards. The losses due to fraud are outweighed by the losses that would be incurred if a new security system made it harder for people to use their credit cards (presumably causing them to use their credit card less). So here is a situation where it is cheaper to accept losses due to credit card fraud than it is to roll out a new security infrastructure: the new security infrastructure would do more harm than good.

By legacy issues, I mean that there is a large deployed infrastructure of credit card readers. It would be very expensive to replace all of them to deal with a totally new credit card standard.

(My comments here relate to the situation in the US. I know that the situation in Europe is different.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.