First, have a look at [this question].
Based on that question, my understanding of bank cards is that the chip card puts it's own accNumber+PIN into a signed message encrypted for the bank's server (probably with some challenge data from the POS to avoid replay attacks) and asks the Point-of-sale (POS) terminal to send this on its behalf. The POS terminal can't read the message, but can send it off to the bank. The bank validates the message, checks the signature, and compares it to the accNumber+PIN in it's database and returns a YES/NO to the POS terminal. (disclaimer: this is how I imagine it could work, I don't know if this is how it actually does work.)
There are other challenge-question-based approaches commonly used in the security industry (for example, for ID badges to get into your office building). They work as follows: when you hold the card up to the reader on the wall the chip card, the card reader, and the database have the following exchange:
- Chip Card to Reader: "I am
John Smith and my public key is
- Reader to Database: "Does
pub_key belong to
- Database to Reader: "Yes."
- Reader to Chip Card: "To prove you have the matching private key, sign this message:
- Chip Card to Reader:
enc_msg = encrypt(rand_32bit_msg, priv_key), "Here's
- Reader: does
decrypt(enc_msg, pub_key) == rand_32bit_msg? "Ok, I believe you own the private key, in you come!"
Presumably you can buy a set of chip cards and readers from various manufacturers, but I have no idea if this is within the budget of a hobby project.