Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards for that purpose, e.g. with the following flow (note: this does not perform any transactions, as it does not go to any card issuer gateway):
- User is supposed to have a specific smartphone app installed
- User requests to log in in a website
- User is asked to present the contactless card to the phone with the app open (or app automatically gets opened upon NFC contact)
- User presents the card, and is aksed for PIN, which he types in the app
- The app has obtained a one-time challenge from the server, which it sends to the card
- The card signs the challenge
- The signed challenge, and a transformed (e.g. using bcrypt) credit card number are sent to the server
- The server matches the transformed number (which serves as identifier) to the user that has requested login from a browser, verifies the signed challenge using the public key of the card, and lets the user in.
If that doesn't sound too absurd, some follow-up questions:
- Is the key size of bank cards big enough?
- Does the EMV protocol allow for signing of a challenge in such a way (I know it does as part of a transaction flow, but there might be some caveats)
- Can a general-purpose app (android/iOS) be created, or cards have significant variations in their EMV implementations
- Do EMV keypairs have corresponding X.509 certificates issued by some CA? And can revoked certificates be checked?