# UK online bank card reader identification entropy

In the UK it's common to use a smart card and reader to log in to online banking. You insert the card, enter the PIN and get back an 8-digit code from the reader to enter into the online bank website. Note that it's not seeded in anyway from the bank, all you need is the card and the PIN.

I'd always thought that the 8-digit code returned wasn't very random (in particular the first two digits were the same), so I started keeping track. Basically the 8-digit code is monotonically increasing by about 60,000 to 90,000 each time.

This doesn't seem right based on how I understood this to work. Obviously there's very low entropy in seeding the identification algorithm (only uses an internal counter on the card if I understand things right) but I thought the 3DES on the card would result in a noise-like sequence of 8 digit codes.

Is this really how the system is supposed to work?

• It might not matter very much - you usually get a very limited number of attempts to enter the correct value, so even if it increased by a random value between 1 and 100, it would be difficult for an attacker to guess the correct value, since they'd be locked out after 3 tries. Commented Jun 30, 2017 at 11:06
• I agree it's not likely in practice, but the chances of guessing should be 1 in 100 million as implied by the 8-digits, not the ~1 in 20,000 it appears to be Commented Jun 30, 2017 at 11:18