Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My bank provides me with a device similar to this:

Barlcays PinSentry

The device is essentially a PRNG, presumably based on the date/time of it's internal clock, synchronized with the bank servers.

To generate a pin the user must insert their bank card into the slot and enter their 4-digit bank card pin number using the keypad on the device. This is the same pin used to withdraw cash at an ATM.

My question is this: Without a network connection, and without the device having been configured to work with a particular bank card (I can use any other persons device with my card), how does the device verify the pin number?

The pin number must be stored in some way on the chip of the bank card itself. Even with an iterative hash function to delay brute force by 4 seconds for each attempt, the pin number is still only 4 digits long. 4 seconds * 10^4 possible pins = 11 hours to brute force the entire key space.

The card itself does have a lockout facility that will reject further access attempts after 3 incorrect tries (must be a boolean flag written into the memory of the bank card chip). Is the entire security of this authentication system resting on the assumption that somebody cannot simply reset this flag and continue their bruteforce of the tiny key space?

share|improve this question

migrated from crypto.stackexchange.com Apr 3 '13 at 11:23

This question came from our site for software developers, mathematicians and others interested in cryptography.

1  
That device is just a keyboard + screen extension for your card, the calculations are happening in the card. –  Paŭlo Ebermann Apr 2 '13 at 15:38

2 Answers 2

up vote 10 down vote accepted

First of all, the device is not a PRNG. All cryptographic functions remain securely within the chip on the card. The device is little more than a user interface. Because it's air-gapped from your browser, it can't be "hacked" by a web page or malware infected computer. And because it's your from your bank, you can trust that it's not a PIN-skimmer keypad. These are very good security attributes that make these devices powerful tools against fraud.

You enter the PIN in the device, which then sends the PIN to your card, and the card verifies it according to the ISO/IEC 7816-4 spec. The card returns only the results of the PIN verification attempt to the reader, which it then displays to you as either an 8 digit authorization code, or as an invalid PIN error. Three consecutive failed PIN verification attempts result in a card that must be reset at an ATM authorized by your bank.

As you noted, this is a tragic weakness in the protocol, but for a completely different reason than cryptography. A mugger can strike you in a private place, and demand your card and your PIN, and he can use your PINSentry on the spot to prove you're not lying. It used to be a mugger would have to drag you to the bank to verify your PIN and risk the security cameras, but now they can do it in the convenience of a dark alley. At least three murders have been committed by robbers gathering PINs.

To be more secure for the user, the device should continue merrily on its way regardless of the validity of your PIN, because the bank should be validating the PIN later on. The problem is this was all designed and decided when many small merchants were still authorizing cards offline. With almost 100% ubiquity of the Internet across the populated areas of our planet, I see little reason to continue accepting offline payments.

As far as PIN security on the chip, that's a lot stronger than the typical mugger. The chip is engineered so that it's very difficult to access the memory on it. It's not like a flash drive or old-school payphone chip, where it's simply a storage device. It's a cryptographic processor, with algorithms and keys and certificates loaded into the silicon only after verifying the signatures on the data. You can't issue a command like "set counter memory location 1234 = 0". Instead, the command to reset the PIN is part of an HMAC protocol, with cryptographic authentication that must be generated by the bank, and the MAC is verified on the chip before it will actually reset the PIN counter.

The chips are reasonably well-protected against tampering, considering they have to cost only a few pennies each. Focused ion beam microscopes have been used to read bits from the cards in the laboratory. Timing attacks have been reduced by improving the designs of the encryption algorithms. As far as I know, differential power analysis attacks can still work, but some chip designs can even withstand those.

share|improve this answer

Yes

Thats about it. EMV/Chip and Pin credit cards have a cryptographic smart card in them. It has your pin, a private cryptographic key, and a counter for failed pin attempts.

If you could reset the counter, you also could likely just read the pin (or some hash of it) and secret key off the thing. So yes the security depends on the secure smartcard in the chip being secure.

Note, hopefully the PINSentry is not itself a PRNG, it probably uses your bank card's secret key and the current date/ time to generate a one time code and the PIN number is used to unlock the card. Otherwise people with the same PIN number would get the same code or the reader could be tricked into believing a valid pin was entered when none was.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.