Credit Cards/Chip and Pin/ATM withdrawls

Presumably the till limit was cumulative.

What's to stop a Fraudster replacing the chip with one that always says "Yes"? Or creating a card with such a chip onboard?

Mark

Because it doesn't say "yes" in plain text, it is encrypted. There is no way a fraudster could forge a "yes" without also knowing the encrypted PIN which the genuine chip knows.

I rather think it doesn't say "Yes" as simply as that, but returns an encrypted packet in reply to another encrypted packet.

To all intents and purposes,it is the old spy recognition exchange,"Can I have a light?" "I only have a lighter". "Not to worry, I don't smoke". "No problem, my lighter is out of fuel". Only the "phrases" are rather more "random" to an outside observer..

Exactly the same thing that prevents fraudsters from printing off

1000's of £50 notes - it is technologically difficult to achieve. Making a counterfeit C&P card is *way* more difficult than making a counterfeit £50 note.

To design such a chip needs access to a system where the cost of the software can run into 7 figures. Then you need to get the chip manufactured - which costs a 6 figure sum just for a couple of prototype wafers. And you cannot even start until you somehow reverse-engineer both the C&P hardware *and* its associated software.

er, no you just use a regular few dollar programmable smart card, of course you still need to reverse engineer the encryption so you can return an appropriately encrypted yes answer, but the cost of the equipment or cards is not a barrier.

Jim.

At 10:58:45 on 05/01/2006, Mark delighted uk.finance by announcing:

The lack of knowledge of the bank's private key.

"Alex" wrote

Do all till terminals know every bank's private key? I'd have hoped not, but...

If they do, then are there potentially many thousands of terminals out there which could be "cracked" by a fraudster??

If they don't, then how do they authenticate an "offline" transaction?

At 13:08:19 on 05/01/2006, Tim delighted uk.finance by announcing:

Of course not.

They know the public key part.

Cynic wrote: ...

But surely you don't do that at all? Were I in the business, I'd be looking at creating some sort of ICE - the card would just be a dummy with contacts and a nice bit of flexible ribbon tape connecting to a box in my pocket. Still non-trivial, I'll grant; but way simpler than making a chip.

Are the various protocols not published? So the problem reduces to finding the various encryption keys. Agreed, still non-trivial :-)

Just because you're not sure doesn't mean it doesnt work!

I never said it don't, but I wanted to know how it does do it like.

The machine does not reveal the typed PIN to the card, otherwise the card could act as a PIN collector. (Thief could steal your card and replace it with a "collector" card, then you'd try to use the card (which wouldn't work because it's not "real", but it would note the PINs and offer them up to the thief when he steals it back).

The machine encrypts the PIN, and sends the result to the card. The card doesn't decrypt it, it simply compares it with an already encrypted copy of the correct PIN it already has.

This doesn't happen either, for the reason you state. What probably happens is that the card further encrypts the message the machine sent it, but using a different code, and the machine knows what the result should look like if it means "yes".

At 18:06:00 on 05/01/2006, Ronald Raygun delighted uk.finance by announcing:

Wrong.

This wouldn't work unless you also used a dodgy terminal. The customer would be right on to the bank when all the transactions start getting declined; and that's assuming the terminal even authenticates the card correctly.

It doesn't need to, of course, since it's in plain text.

At 16:46:01 on 05/01/2006, Peter Hucker delighted uk.finance by announcing:

The terminal knows it's talking to a valid card because it's authenticated it before getting anywhere near the PIN stage.

Actually if it was me I'd assume I'd forgotten the pin again (I'm still trying to get all my cards to have the same pin....)

We're now all being watched as possible PIN-hackers.....

At 19:25:39 on 05/01/2006, Peter Hucker delighted uk.finance by announcing:

Even with the "PIN OK" message?