2

I am currently researching best practices in designing a potential PIN management solution for a financial services application and began looking into ISO 9564 as a source of requirements.

One of the things that popped into my mind while reading this was that under the section for approved encryption algorithms they list:

  • Triple DES (weak symmetric block cipher)
  • AES (symmetric block cipher)
  • RSA (asymmetric cryptosystem)

I wondered immediately if there would be a legitimate use case for needing to ever directly decrypt cipher text of a PIN. Other requirements of the ISO standard here claim that if the PIN is forgotten or potentially compromised that a new PIN should be issued.

The question that burns in my mind (that likely has a very obvious answer that currently escapes me) is why would the standard not recommend a cryptographic hash instead? Why can't validation of a PIN entry attempt be done in much the same way that is commonly understood as best practice for password management? The salt in this case would be the customer account number which is XOR'ed into the PIN itself anyway. What am I missing here?

Improve this question
6
  • A hashed four digit pin is relatively fast to brute force even if you use a good hashing algorithm, since there are only 10 000 values to test.
    – Anders
    Jun 15, 2016 at 12:30
  • @Anders But this wouldn't be a trivial 4 digit pin hash but a hashed PIN block (64 bit representation of a PIN following either PIN block format 0, 1, 2 or 3 that is then XOR'ed against the customer account number up to 16 digits). If you are brute forcing a single account then you would have the same chance regardless of algorithm used. What about brute forcing to find the key? If I do this with a symmetric cipher then I am able to determine ALL PIN's given a set of cipher texts. I can't say the same for a hash since it is not reversible even with the key.
    – maple_shaft
    Jun 15, 2016 at 13:31
  • @maple_shaft seemingly your hashed-pin has already been contemplated people.scs.carleton.ca/~mmannan/publications/saltedpin-cose.pdf
    – Little Code
    Jun 15, 2016 at 14:19
  • 1
    @maple_shaft I would hazard a guess that the reason PINs are stored in reversible format is to facilitate migration between (potentially incompatible) banking systems without having to (potentially) re-issue PINs for your entire customer base.
    – Little Code
    Jun 15, 2016 at 14:23
  • @LittleCode That is a damn good guess actually. LOB in some places look at a PIN as the second factor of authentication in their system "something they have" as opposed to "something they know". I would argue the latter and say that a pin is just another thing that you know. There is a tangible cost in issuing new PIN's though and it can be problematic for many bank customers to be issued a new PIN. Cost of running the PIN mailer, postage, etc... I know that the project I am working on now the business cares VERY DEEPLY that migrating the system does not entail new pins be generated.
    – maple_shaft
    Jun 15, 2016 at 14:31

1 Answer 1

Reset to default
3

The reason ISO PIN blocks are used instead of a hash is related to the structure of the payments industry.

PIN Flow Diagram

The diagram above shows the simplified data flows for a PIN transaction. The ISO PIN block is sent to the Merchant Acquirer bank. The Merchant acquirer bank decrypts the PIN block and forwards it to the card association, which in turn forwards it to card issuing bank.

In order to use hash based authentication, the merchant acquirer bank would need to know the plaintext PIN. The merchant acquirer bank would then hash the PIN (and any associated salt and metadata) and compare the results with the value received from the merchant.

The problem with the above approach is the the merchant acquirer bank would need to know the PIN codes associated with every card it could possibly process. The card issuing banks are willing to confirm if a given PIN is valid, but do not want to share their entire PIN database with every merchant acquirer bank.

It would also be possible to send the hashed PIN to all the way to the card issuer bank. However, there would need to be some way to authenticate that the PIN block was generated by a particular PIN entry terminal at a particular merchant. Without authentication, an attacker could replace a merchant pin pad with a counterfeit device that emitted the raw PIN. The attacker could then hash the PIN and send it on for processing.

Any authentication solution would require a mechanism to authenticate the keys used for authentication. Secret MAC keys are not used since it is impractical to share every PIN terminal key with every acquiring bank. Asymmetric signing keys could be used as part of a PKI, but PKI technology was not widely used in the 1980s when encrypted digital payments first become common. Adding a PKI to the existing data flows would require substantial changes in the end-to-end data flows. Since the benefits of changing are marginal at best, the industry is unlikely to transition to any hash based authentication scheme.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .