Two factor authentication with my bank

Question

My bank requires a security dongle. Place the debit card in the card reader and enter a pin code.

An 11 digit code appears which is entered on the bank's website and access is granted.

But if I want to set up a payment they ask for all the details and then produce an 8 digit number, which includes data of the recipient. I then have to put my card back into the reader, enter my pin and then this 8 digit code.

The reader then produces a new code which has to be entered into the bank. If that is correct the action is authorised. If the reader is not communicating with the banks website how does it know how to produce the code?

Answer 1

It's hard to say how the implementation works without knowing what they are actually using. But most likely it will be something along these lines:

• The smart card has a shared secret embedded on the chip and requires a PIN
• A challenge is sent to you which includes a random generated value and often the amount which needs to be transfered and may also include a time parameter (to limit the signatures validity over time).
• You generate an output based on the parameters using your shared secret
• The output is sent to the bank and they perform the same calculation and see if it matches. When matched they are sure you signed the transaction.

Answer 2

This is done by the Time-based One-time Password Algorithm. It is an algorithm that computes a one-time password from a shared secret key and the current time.

For more technical details, please read: https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm

Answer 3

The solution uses Chip authentication program a standard to use EMV credit cards to generate OTPs and sign data.

The linked page explains the protocol in detail but basically it works by making the card perform a standard transaction, and some parts of the transaction result are displayed on the screen (which the bank can then cryptographically verify). The IAI (Issuer authentication indicator) value controls which parts of the transaction result is actually kept and displayed on screen.