2

Asymmetric encryption and digital certificates are used all over in the IT world to verify authenticity and prevent forgeries. And it works great.

Why do credit cards not use some form of public/private key to verify authenticity? Is the reason logistical, or is there some other business motive?

3 Answers 3

4

Some credit cards using EMV (at least in the UK) do use public key cryptography behind the scenes. More information about how this protocol works for payment (and what's wrong with it) can be found in a paper by Murdoch et al.. However, this is used to verify the authenticity of the card rather than the card holder.

If you were suggesting that the card holder might be authenticated by holding a private key and having some kind of certificate, there are several practical issues. The private key has to be held and used by a device, not a person, so for in-person payment you immediately go back to the EMV model mentioned previously. For online shopping, however, you could potentially store keys and certificates on your PC or phone to authenticate the user. Unfortunately experience suggests that certificate management has usability issues (see this classic paper) which would make life difficult for the end user.

In practice, public key infrastructures tend to be quite good for authenticating devices but relatively bad for authenticating people. Exceptions to this rule tend to be in corporate environments where dedicated IT departments exist to support the system and people are required to comply to company policies.

2
  • And authenticating people is the real part of the problem. A token can always be stolen and all the certificates in the world don't know that. May 25, 2012 at 2:47
  • (Unless you're using some sort of biometric system, you're always going to authenticate a device anyway.) Some smartcards/hardware tokens will require a pin to be entered to make use of the private key and the terminal can't trick the card into thinking the valid PIN was used.
    – Bruno
    May 25, 2012 at 10:35
3

Mostly logistical - but also about lowering the bar to use the card to buy things online; things like verified by visa and other solutions are catching on though, but in most cases [I have seen] they are not mandatory.

It has been seen (by the cc companies) making it easy to use (not using "too much" security) means that everyone and their mom can use it, and if there is a problem - reimburse the person and if possible freeze the transaction to the seller.

Also as long as things as paying via the phone etc is possible using a cc then that makes a solution with keys a lot harder to implement.

The fact that a cc company will reimburse is also one of the security measures for the end users, they know that they will get the money back if the cc number is stolen - as for instance Schneier says in the book "digital security", he gives a example of buying a palm plot and the fact that the name of the payment site was different from the store.

1
  • I'd say "card-not-present" transactions are completely out of scope of this question. No authentication is performed at all in these cases.
    – Bruno
    May 25, 2012 at 11:01
2

There are two main reasons: (1) business reasons, and (2) legacy issues.

I guess I should elaborate. By business reasons, I mean that credit card companies are leary of any changes that might make it harder for people to use their credit cards. The losses due to fraud are outweighed by the losses that would be incurred if a new security system made it harder for people to use their credit cards (presumably causing them to use their credit card less). So here is a situation where it is cheaper to accept losses due to credit card fraud than it is to roll out a new security infrastructure: the new security infrastructure would do more harm than good.

By legacy issues, I mean that there is a large deployed infrastructure of credit card readers. It would be very expensive to replace all of them to deal with a totally new credit card standard.

(My comments here relate to the situation in the US. I know that the situation in Europe is different.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .