Issuers of EMV card (or their specialised service providers) always securely store on their server (Hardware Security Modules) a copy of the secret keys which are hidden inside each individual EMV smart chip. However, do they always store also the associated PIN, or are there instances whereby the PIN is known only to the smart chip itself? for example, what do VISA and MasterCard do with their cards PIN?
1
-
Side note: issuers don't necessarily need to store keys belonging to each card, if they can derive them. HSM space is expensive, and large databases make them harder to secure - if you only store one master key, you can use a dedicated chip, but any reasonably sized issuer would need an actual drive (slower, more prone to failure, etc).– Clockwork-MuseFeb 5, 2019 at 23:51
Add a comment
|
1 Answer
There’s 3 types of cardholder verification methods (at least when I was playing with EMV 3 years back)
- PIN (both offline and online)
- Signature
- No verification (this is possible under some circumstances).
Note these verification methods are used only for physical transactions or ‘card present’ scenarios.
For PIN transactions there’s two flavors, and Offline PIN and an Online PIN.
Online PIN is straightforward, it’s when a PIN is verified by the issuer in an online transaction. Online here means the card terminal has connectivity to the issuer and has sent the transaction and PIN onto the issuer for verification.
For online PIN, obviously the issuer has the PIN -- otherwise it wouldn't be able to verify it.
For offline PIN, the PIN isn’t sent over the wire, but rather sent to the chip on the card, and the chip then verifies the PIN directly, providing the response back to the terminal.
In this case it is possible that the issuer wouldn’t know the PIN as it is stored on the chip. But, I’m guessing an issuer must be able to reissue a PIN to the customer should the customer forget it, hence somewhere deep in their data center lies a server or HSM that knows it :)
Whether or not your card supports Online PIN or Offline PIN (or both) depends on the issuer and country of issue. But I Guess in both situations an issuer will have the PIN, regardless of type.
Now reading more into the question, just because the issuer has the PIN doesn’t mean it’s going to be easy to retrieve. This isn’t something a call center agent will be able access. It’s probably locked down tightly and only retrievable via printing a PIN mailer (printed letter to the customer) or some other highly secure method.
I'm not sure what the true objective of your question is, but hopefully this answers it.
answered Feb 5, 2019 at 3:11
