0

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards for that purpose, e.g. with the following flow (note: this does not perform any transactions, as it does not go to any card issuer gateway):

  1. User is supposed to have a specific smartphone app installed
  2. User requests to log in in a website
  3. User is asked to present the contactless card to the phone with the app open (or app automatically gets opened upon NFC contact)
  4. User presents the card, and is aksed for PIN, which he types in the app
  5. The app has obtained a one-time challenge from the server, which it sends to the card
  6. The card signs the challenge
  7. The signed challenge, and a transformed (e.g. using bcrypt) credit card number are sent to the server
  8. The server matches the transformed number (which serves as identifier) to the user that has requested login from a browser, verifies the signed challenge using the public key of the card, and lets the user in.

If that doesn't sound too absurd, some follow-up questions:

  1. Is the key size of bank cards big enough?
  2. Does the EMV protocol allow for signing of a challenge in such a way (I know it does as part of a transaction flow, but there might be some caveats)
  3. Can a general-purpose app (android/iOS) be created, or cards have significant variations in their EMV implementations
  4. Do EMV keypairs have corresponding X.509 certificates issued by some CA? And can revoked certificates be checked?
Improve this question
9
  • 1
    Personally I would be looking for a new job if my employer asked me to present my bank card to sign in, nevermind a third party. If you want 2FA without the expense of tokens, what's wrong with Google Authenticate?
    – symcbean
    Nov 18, 2017 at 18:57
  • Google Authenticator doesn't utilize a secure signature creation device (i.e. a smartcard) that protects the secret key physically. That's a very desirable feature in some cases.
    – Bozho
    Nov 18, 2017 at 22:19
  • 1
    What if the user doesn't have a NFC card? I don't. Also, what is your threat model? What would you gain from doing this over a standard smartphone 2FA app such as Google or Steam use?
    – Bobson
    Nov 18, 2017 at 22:55
  • 1
    In theory I guess, you can read the PAN and expiry from nfc and that could be your key, typically they are 16 digits plus 4 for expiry so it's not exactly a long key. Any nfc enabled mobile device is capable of reading a bank card though not everyone is equipped nor does everyone have nfc cards. There are significant security & privacy issues, you effectively are collecting financial data. There is zero chance i would sign up to a service that implemented this.
    – iainpb
    Nov 19, 2017 at 18:28
  • 1
    "The card signs the challenge" - if you have researched a way to make the card fulfill signing requests coming from you instead from it's mother network (eg. VISA/Mastercard) then please share it with us.
    – Agent_L
    Nov 23, 2017 at 8:40

1 Answer 1

Reset to default
1

The only thing available to you via a contactless bank card is an ID number (of the card). To get more, you have to follow the appropriate guidelines and security of the contactless cards.

This means that, while you can get the ID of the card, you cannot make further assumptions. It certainly doesn't provide a lot of security.

Having said that, there are plenty of applications that do use this method. The most common being "follow-me" printing and room booking systems (the ones that have screens outside the rooms). Both of these types of system common use the minimal data from the card. You register your card against your user id. This is fine since the risks of compromise are very low.

As always, this comes down to a risk analysis.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .