2

Lately, most banks (at least in Germany) are promoting the photoTAN procedure as the most modern and secure way of authorizing transactions in online banking, see for example here. However, searching online I have not been able to find any explanation of how it actually works: I can only find very detailed explanations on how to use it.

When a user wants to make a transaction, the online banking interface generates a photoTAN image which contains an encrypted message with the transaction details, and shows it on the computer screen. The user scans the image with the bank's app on his smartphone, which "generates" a transaction authorization number (TAN) when reading the image. Then the user enters the TAN on the computer to authorize the transaction.

The simplest idea that comes to mind is having the TAN be part of the message that is encrypted in the image. Is this really how it works? What kind of cryptography scheme is used in these two processes (generation of image and generation of TAN from image)?

5
  • The german wikipedia has some information about photoTAN. According to them, the TAN is encrypted and then decrypted on the device. I'll see for better primary sources.
    – MechMK1
    Aug 17 '19 at 19:44
  • There is not much information available on how photoTAN works, which in itself is not a good thing. Nevertheless, photoTAN most likely works like its predecessors. A private key is stored securely on a smart card or embedded in the generator. The photoTAN image contains parameters of the transaction to be authorized, upon scanning the device signs this information and displays a digital signature (encrypted hash) in the form of a TAN. The bank can then verify the digital signature using the public key and authorize the transaction, knowing that the user is in the posession of the private key.
    – markusju
    Feb 16 '20 at 21:16
  • I'm looking for details on how to decode the colored dots :-) I stumbled on this paper: cs1.tf.fau.de/research/system-security-group/appauth They describe a successful attack on the banking app, which seems to utilise photoTAN "under the hood". Haven't read it (yet), perhaps you find more details there.
    – Skyr
    Oct 13 '20 at 10:44
  • @Skyr thanks for the link! Unfortunately, they just perform a man-in-the-middle attack and do not explain how the decoding of the colored dots works... At least I learned that photoTAN was developed by Cronto. But I could not find a paper by Cronto that explains the technical details. They do seem to be using obscurity here...
    – wimi
    Oct 15 '20 at 7:11
  • @wimi ...and no info on decoding the photo :-( But then they must have managed it in some way in order to present a different code to the user's app?
    – Skyr
    Oct 16 '20 at 19:07
2

There is more information available by now.

See the Onespan (Vasco aquired Cronto and renamed itself) Community for the Integration Guide. It explains how to use their software to both GenerateCrontoSign/GenerateDynamicCrontoImage to generate Challenge graphics and QRCodeScannerSDKActivity/QRCodeScannerSDKViewController to scan and decode Graphics on Android/iOS.

https://community.onespan.com/documentation/mobile-security-suite/guides/integration-guides

Cronto is encoding Challenges and Tokens in a Colored Dot Matrix. Please see the Colored QR Codes whitepapers listed on the Wikipedia article for details on the information storage/extraction from the graphics or returned when searching for "decode color qr code"

Decoding Algorithm for color QR code: A Mobile Scanner Application Nivedan Bhardwaj, et al. https://www.researchgate.net/publication/309041301_Decoding_algorithm_for_color_QR_code_A_mobile_scanner_application

Robust and Fast Decoding of High-Capacity Color QR Codes for Mobile Applications Zhibo Yang, et al. https://arxiv.org/pdf/1704.06447.pdf

This in a way is the communication between the Bank and your OTP Token Generator. The secret is exchanged using two activation graphics, ie. the first sent via letter from your bank to you and a second (probably containing the secret) scanned during the activation process step2.

Using this secret the Cronto device will generate a OTP password after showing you the information given in the image. As I have not analysed the implementation of the QRCodeScanner I have my doubts whether it also includes the information into generating the photoTAN.

I have been able to use the secret for other OTP challenge/response in multiple OTP generators, ie. the Smartphone App of comdirect claims to support upto eight different bank accounts and therefor secrets. Hence it is possible the eavesdrop on the secret in the instance when it is visually handed over to the Cronto device (most likely step 2 of the activation process).

I just checked the Cronto I got some hours ago and it always generates the same TAN number, hence it is clearly not using any timing code.

Looking into the Image Scanner SDK available from the OneSpan / Cronto Website there are two main components to the Android AAR (QRCodeScannerSDK.aar):

  1. an API contained in classes.jar, this is a mostly obfuscated Wrapper that deals with some Image preprocessing
  2. a precompiled Linux ELF image libQRCronto.so, which contains the zxing matrix code library plus some cryptographic routines.

Image Scanner SDK https://community.onespan.com/products/mobile-security-suite/sdks

I have not bothered decompiling it, but it should be possible to find the crypto scheme out in case someone wants to:

$ strings libQRCronto.so | less _ZN5zxing11ResultPointC1Eii ... _ZN16DataStoreAccount6getKeyERPKhRiRK10ByteBuffer _ZN16DataStoreAccount9getKeyHexERK10ByteBufferPcRi _ZN16DataStoreAccount9setKeyHexER10ByteBufferPKc _ZN16DataStoreAccount9setKeyHexER10ByteBufferPKci ... _ZN13KeyDerivation11deriveBytesEPKhiS1_iS1_iPhi _ZN13KeyDerivation7iencodeEiiPh _ZN13KeyDerivation9deriveIntEPKhiS1_iS1_iiRi

The following lab article has some details on creating a secure channel using the Mobile App instead of the standalone device I have.

Secure Offline Transaction Signing using MAS https://vie-labs.com/secure-offline-transaction-signing-using-mas/

The device I have has been modified from the Stock OneSpan Cronto by my bank. It is sporting a Bank logo on the power up screen and will refuse activation codes from other banks.

Entris Banking - Login with CrontoSign Swiss https://www.netbanking.ch/index.php?id=489&L=3&id=489

Cronto Activation from Entris Banking

1
  • The photoTAN codes do not seem to be standard colored QR codes, as they do not have the three tell-tale squares at the corners. I guess that, by now (one year after asking the question), I can assume that the cryptographic algorithm of OneSpan's photoTAN codes is not public...
    – wimi
    Nov 13 '20 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.