I do only banking with my "PostFinance" debit card. The sign-in protocol works like this:
- Enter user name and password into web form.
- Get a 9 digit challenge number on website.
- Type the challenge number into an offline standalone card reader with the debit card inserted.
- Enter PIN into card reader.
- Get a response 9 digit number from the card reader.
- Type response number into web form.
I assumed this was some kind of asymmetric cryptography, with the card containing a private key unlocked with the pin, "signing" the challenge number and the bank verifying the signature with a "public" (not actually public) key.
But then I was idly wondering what the first thing would be that an attacker / security researcher would try and entered the challenge "1" multiple times. The answer was different each time:
The first 3 digits seam to increase monotonically in small steps (~10 samples). The other 6 digits didn't follow a pattern I picked up, i.e. they seemed random.
Does anyone know how this works?