1

I am trying to get information about cloning of EMV credit cards (chip cards). I have a good understanding of the cryptology behind it and know that it is impossible to clone it "from the outside" like a magentic card. The question I want to get answered if there are any attempts to clone it (get the private keys out of the card) when having full access to it. Multiple week where the chip can be opened up. My intuition says that this should be far from impossible. But when I try to google this, the only information I get is successful downgrade attempts and how it is impossible for criminals to skim these cards but that is not what I'm interested in.

  • 1
    How hard did you look. From the first hit when searching for "clone emv" I get Cambridge boffins: Chip and PIN cards CAN be cloned – here's how which relies on insecure implementations. Without such implementation weaknesses cloning EMV should be practically impossible today. But I recommend to look for research on cloning smart cards instead of EMV only because EMV is essentially a smart card. – Steffen Ullrich Jun 4 '17 at 9:37
  • @SteffenUllrich This is the exact type of article I am getting and am not interested in. "The cryptographic flaw – the result of mistakes by both banks and card manufacturers in implementing the EMV* protocol". What I want to know is basically if you can get the private key out of the card. Not exploit a vulnerability in how the protocol is implemented. – Lindell Jun 4 '17 at 9:42
  • 1
    To cite myself in case you did not read the second part of the comment: Without such implementation weaknesses cloning EMV should be practically impossible today. But I recommend to look for research on cloning smart cards instead of EMV only because EMV is essentially a smart card. – Steffen Ullrich Jun 4 '17 at 10:12
2

Cost efficiency

There are known methods that would work to extract data from EMV cards, namely, decapping the chip and analyzing its contents with various microscopy and probing techniques; just as for other chips. For example, here's a PhD thesis on how it can be done for SIM cards. However, the issue is that it's not practical - you need full access to the original chip (not temporary access as in skimming scenarios), the analysis is destructive (you break down the chip mechanically and/or with solvents), and it requires highly specialized equipment and skills, doing such an analysis costs much more than you could hope to earn by cloning a single card. This means that it's not considered a serious risk, as there's no practical motivation for criminals to do so, and it can be mitigated by various transaction limits and the expectation that a physically missing card will be detected and blocked soon.

protected by Community Dec 25 '18 at 3:19

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.