Beruflich Dokumente
Kultur Dokumente
EMV
EMV stands for Europay, MasterCard and VISA, the global
standard for inter-operation of integrated circuit cards (IC
cards or "chip cards") and IC card capable point of sale
(POS) terminals and automated teller machines (ATMs), for
authenticating credit and debit card transactions.
It is a joint effort between Europay, MasterCard and Visa to
ensure security and global interoperability so that Visa and
MasterCard cards can continue to be accepted everywhere.
Europay International SA was absorbed into MasterCard in
2002. JCB (formerly Japan Credit Bureau) joined the
organization in December 2004, and American Express
joined in February 2009. IC card systems based on EMV are Credit card with EMV chip. The 3 by 5 mm chip embedded in
the card is shown enlarged in the inset. The contact pads on
being phased in across the world, under names such as "IC
the card enable electronic access to the chip
Credit" and "Chip and PIN".
The EMV standards define the interaction at the physical, electrical, data and application levels between IC cards
and IC card processing devices for financial transactions. There are standards based on ISO/IEC 7816 for contact
cards, and standards based on ISO/IEC 14443 for contactless cards.
The first standard for payment cards was the Carte Bancaire B0' standard deployed in France in 1989. Geldkarte in
Germany also predates EMV. EMV was designed to allow cards and terminals to be backwardly compatible with
these standards. France has since migrated all its card and terminal infrastructure to EMV.
The most widely known chip card implementations of EMV standard are:
• VSDC - VISA
• MChip - MasterCard
• AEIPS - American Express
• J Smart - JCB
Visa and MasterCard have also developed standards for using EMV cards in devices to support card-not-present
transactions over the telephone and Internet. MasterCard has the Chip Authentication Program (CAP) for secure
e-commerce. Its implementation is known as EMV-CAP and supports a number of modes. Visa has the Dynamic
Password Authentication (DPA) scheme, which is their implementation of CAP using different default values.
In February 2010 computer scientists from Cambridge University demonstrated that an implementation of EMV PIN
entry is vulnerable to a man-in-the-middle attack; however, the way PINs are processed depends on the capabilities
of the card and the terminal. This attack is not a general weakness, but it does show that attacks are possible
depending on the implementation.
In May 2010, a press release from Gemalto (a global EMV card producer) indicated that United Nations Federal
Credit Union in New York would become the first EMV card issuer in the US, offering an EMV Visa credit card to
its customers.[1]
EMV 2
EMV commands
ISO/IEC 7816-3 defines the transmission protocol between chip cards and readers. Using this protocol, data is
exchanged in application protocol data units (APDUs). This comprises sending a command to a card, the card
processing it, and sending a response. EMV uses the following commands:
• application block
• application unblock
• card block
• external authenticate (7816-4)
• generate application cryptogram
• get data (7816-4)
• get processing options
• internal authenticate (7816-4)
• PIN change / unblock
• read record (7816-4)
• select (7816-4)
• verify (7816-4)
Commands followed by "7816-4" are defined in ISO/IEC 7816-4 and are interindustry commands used for many
chip card applications such as GSM SIM cards.
EMV 3
Application selection
ISO/IEC 7816 defines a process for application selection. The intent of application selection was to allow cards to
contain completely different applications e.g. GSM and EMV. EMV however took application selection to be a way
of identifying the type of product so that all product issuers (Visa, MasterCard etc.) have to have their own
application rather than there being an "EMV" application, which would have been much simpler. The way
application selection is prescribed in EMV is far more complicated than it need be and is a frequent source of
interoperability problems between cards and terminals. Book 1 [4] of the EMV standard devotes 15 pages to
describing the application selection process.
An application identifier (AID) is used to address an application in the card. An AID consists of a registered
application provider identifier (RID) of five bytes, which is issued by the ISO/IEC 7816-5 registration authority.
This is followed by a proprietary application identifier extension (PIX) which enables the application provider to
differentiate between the different applications offered. The AID is printed on all EMV cardholder receipts.
UK Domestic Maestro - Switch (debit card) A000000005 Maestro UK [5] 0001 A0000000050001
Processing restrictions
The purpose of the processing restrictions is to see if the card should be used. Three data elements read in the
previous step are checked.
• Application version number
• Application usage control (This shows whether the card is only for domestic use etc.)
• Application effective/expiration dates checking
If any of these checks fail, the card is not necessarily declined. The terminal sets the appropriate bit in the terminal
verification results (TVR), the components of which form the basis of an accept/decline decision later in the
transaction flow. This feature allows, for example, card issuers to permit their cardholders to continue to use expired
cards after their expiry date, but for all transactions made with an expired card to be performed on-line.
Cardholder verification
Cardholder verification is used to evaluate whether the person presenting the card is the legitimate cardholder. There
are many cardholder verification methods (CVMs) supported in EMV. They are:
• Signature
• Offline plaintext PIN
• Offline enciphered PIN
• Offline plaintext PIN and signature
• Offline enciphered PIN and signature
• Online PIN
• No CVM required
• Fail CVM processing
The terminal uses a CVM list read from the card to determine the type of verification to be performed. The CVM list
establishes a priority of CVMs to be used relative to the capabilities of the terminal. Different terminals support
different CVMs. ATMs generally support online PIN. POS terminals vary in their support of CVM depending on
their type and in which country they are located.
This step gives the card the opportunity to accept the terminal's action analysis or to decline a transaction or force a
transaction on-line. The card cannot return a TC when an ARQC has been asked for, but can return an ARQC when a
TC has been asked for.
Versions
First EMV standard came into view in 1995 as EMV 2.0. This was upgraded to EMV 3.0 in 1996 with later
amendments to EMV3.1.1 in 1998 This was further amended to version 4.0 in December 2000.
Version 4.0 became effective in June 2004. Version, 4.1 became effective in June 2007. version EMV 4.2 is in effect
since June 2008.
Vulnerabilities
Examples
• The Guardian, 5 September 2005, "Fraudsters show how to beat chip and pin" [11]
• BBC News Online, Poor print exposing Pin numbers [12] 25 Aug 2005
• The Guardian, 27 October 2004, "Safety in numbers? Not likely" [13]
• Chip and SPIN ! [14] (critical website)
• The Inquirer: Does he take PINs with his chips? [15] (critical editorial)
• Attack methods against Chip & PIN (EMV) [16] (academic research site)
• New Law Journal: statistical and legal analysis of claimed card fraud, 16 October 2009 [17]
EMV 8
Direct observation
Counterfeit PIN pads are sometimes used to log PINs and stripe details A Chip and PIN machine may be observed by
in systems which swipe the magnetic stripe, allowing a fraudster to other shoppers, staff, or anyone with access to
footage from security cameras (as above).
clone the card and know the PIN for use in ATMs that allow magnetic
stripe authorisation. This would not work in countries (including the
UK) where all ATMs require authorisation by chip rather than magnetic stripe.
Indirect observation
Security cameras at the cash register intended to deter shoplifters and thieves may compromise the security of Chip
and PIN by recording customers entering PINs if recordings are not dealt with securely.[18] Again, fraudulent use is
possible only in conjunction with a stolen card or cloned magnetic stripe.
Hidden pinhole camera on cash machines are sometimes used by criminals to harvest PINs, usually in conjunction
with card theft. For example, there have been instances where a customer is told by a "friendly bystander" that they
have dropped £5 after they have inserted the card and entered the PIN; when they bend down to pick it up, the card is
stolen from the machine's slot and used with the PIN obtained by pinhole camera or binocular observation from a
distance.
issuer and (c) where geographic and behavioural checking may not be carried out by the card issuer.
It was claimed that changes specified to the protocol (specifying different card verification values between the Chip
and Magnetic Stripe – the iCVV) rendered this attack ineffective. APACS (the UK payments association) stated that
such measures would be in place from January 2008, although tests on cards in February 2008 indicated this may
have been delayed.[19] However, there was a very large scale and successful attack which went on for 9 months in
2008 (see below).
Within the UK and Ireland, plaintext offline PIN is the standard mode of operation and cards which support
encrypted offline PIN are rare, despite being common in other countries. Permitting magstripe fallback transactions
to take place is a risk known to card issuers; it is usually permitted when fraud levels are low, in order to increase
profits and avoid antagonising cardholders by allowing transactions which could not otherwise have taken place.
When magstripe fallback fraud levels grow, this processing option is disallowed.
Geographic and behavioural fraud analysis tools are in use by many card issuers to track and decline transactions
considered suspicious—for example, an EMV card-present transaction at a UK ATM, followed hours later by a
magstripe fallback transaction in the Far East.
Successful attacks
Conversation-capturing is the form of attack which was reported to have taken place against Shell terminals in May
2006, when they were forced to disable all EMV authentication in their petrol stations after more than £1 million was
stolen from customers.[20]
In October 2008 it was reported that hundreds of Chip and PIN readers for use in Britain, Ireland, the Netherlands,
Denmark, and Belgium had been expertly tampered with in China during or shortly after manufacture so that details
and PINs of credit and debit cards were sent during the 9 months before over mobile phone networks to criminals in
Lahore, Pakistan. US National Counterintelligence Executive Joel Brenner said "Previously only a nation state's
intelligence service would have been capable of pulling off this type of operation. It's scary". Data were typically
used a couple of months after the card transactions to make it harder for investigators to pin down the vulnerability.
After the fraud was discovered it was found that tampered-with terminals could be identified as the additional
circuitry increased their weight by about 100 g. Tens of millions of pounds sterling are believed to have been
stolen.[21] This vulnerability spurred efforts to implement better control of electronic POS devices over their entire
life cycle, a practice endorsed by electronic payment security standards like those being developed by the SPVA.[22]
Demonstration of PIN harvesting and stripe cloning
Cambridge University researchers Steven Murdoch and Saar Drimer demonstrated in a February 2008 BBC
Newsnight programme one example attack, to illustrate that Chip and PIN is not secure enough to justify passing the
liability to prove fraud from the banks onto customers.[23] [24] The Cambridge University exploit allowed the
experimenters to obtain both card data to create a magnetic stripe and the PIN.
APACS, the UK payments association, disagreed with the majority of the report, saying: "The types of attack on PIN
entry devices detailed in this report are difficult to undertake and not currently economically viable for a fraudster to
carry out."[25] They also said that changes to the protocol (specifying different card verification values between the
Chip and Magnetic Stripe – the iCVV) would make this attack ineffective from January 2008. The fraud reported in
October 2008 to have operated for 9 months (see above) was probably in operation at the time, but was not
discovered for many months.
EMV 10
See also
• Supply chain attack
References
[1] United Nations Federal Credit Union Selects Gemalto for First U.S. Issued Globally Compliant Payment Card (http:/ / www. gemalto. com/
php/ pr_view. php?id=749), Gemalto NV,
[2] Chip and PIN liability Shift (http:/ / www. chipandpin. co. uk/ business/ card_payments/ means/ shift_liability. html), The UK Cards
Association,
[3] http:/ / www. emvx. co. uk/ flow_chart. aspx
[4] http:/ / www. emvco. com/ download_agreement. aspx?id=4
[5] http:/ / www. maestrocard. co. uk
[6] http:/ / www. emvco. org
[7] SPVA Launch Presentation (http:/ / www. spva. org/ Files/ SPVA Press Conference and Customer Meeting CDO final version . ppt#306,11),
Secure POS Vendor Alliance, 2009,
[8] http:/ / www. emvco. com/ download_agreement. aspx?id=5
[9] http:/ / www. emvco. com/ download_agreement. aspx?id=11
[10] http:/ / www. emvco. com/ download_agreement. aspx?id=7
[11] http:/ / money. guardian. co. uk/ scamsandfraud/ story/ 0,13802,1562682,00. html
[12] http:/ / news. bbc. co. uk/ 1/ hi/ technology/ 4183330. stm
[13] http:/ / money. guardian. co. uk/ creditanddebt/ creditcards/ story/ 0,1456,1336619,00. html
[14] http:/ / www. chipandspin. co. uk/
[15] http:/ / www. theinquirer. net/ ?article=27304
[16] http:/ / www. cl. cam. ac. uk/ research/ security/ banking/
[17] http:/ / www. newlawjournal. co. uk/ nlj/ content/ chip-pin-fallacies
[18] http:/ / boakes. org/ chip-pin-camera
[19] http:/ / www. cl. cam. ac. uk/ research/ security/ banking/ ped/
[20] *[http://news.bbc.co.uk/1/hi/england/4980190.stm Petrol firm suspends chip-and-pin], BBC News, 6 May 2006 (http:/ / news. bbc. co. uk/ 1/
hi/ england/ 4980190. stm)
[21] Organized crime tampers with European card swipe devices, The Register, 10th October 2008, http:/ / www. theregister. co. uk/ 2008/ 10/
10/ organized_crime_doctors_chip_and_pin_machines/
[22] Technical Working Groups, Secure POS Vendor Alliance, 2009, http:/ / www. spva. org/ technicalWorking. aspx/
[23] "Is Chip and Pin really secure?" (http:/ / news. bbc. co. uk/ 1/ hi/ programmes/ newsnight/ 7265437. stm). BBC News. 26 February 2008. .
Retrieved 2 May 2010.
[24] http:/ / www. bbc. co. uk/ consumer/ tv_and_radio/ watchdog/ reports/ insurance_and_finance/ insurance_20070206. shtml
[25] http:/ / www. channelregister. co. uk/ 2008/ 02/ 27/ credit_card_reader_security_pants/
[26] EMV PIN verification "wedge" vulnerability (http:/ / www. cl. cam. ac. uk/ research/ security/ banking/ nopin/ ), Computer Laboratory,
University of Cambridge, , retrieved 2010-02-12
[27] BBC: New flaws in chip and pin system revealed, 11 February 2010 (http:/ / www. bbc. co. uk/ blogs/ newsnight/ susanwatts/ 2010/ 02/
new_flaws_in_chip_and_pin_syst. html)
[28] Response from EMVCo to the Cambridge University Report on Chip and PIN vulnerabilities ('Chip and PIN is Broken' - February 2010)
(http:/ / www. emvco. com/ documents/ EMVCo_response_to_Cambridge_Report. pdf), EMVCo, , retrieved 2010-03-26
[29] Telegraph - Card fraud: banks now have to prove your guilt, 12 February 2010 (http:/ / www. telegraph. co. uk/ finance/ personalfinance/
consumertips/ banking/ 6338659/ Bank-payments-13-months-to-dispute-suspicious-transactions. html)
[30] Failures of Tamper-Proofing in PIN Entry Devices, Drimer, Murdoch, and Anderson, IEEE Security and Privacy, November/December
2009 (http:/ / www. cl. cam. ac. uk/ ~sjm217/ papers/ ieeesp09tamper. pdf)
EMV 12
External links
• EMVCo (http://www.emvco.com), the organisation responsible for developing and maintaining the standard
• Chip and PIN (http://www.chipandpin.co.uk/), site run by the Association For Payment Clearing Services
(APACS), the UK's central coordinating authority for the implementation of EMV
• Chip and SPIN (http://www.chipandspin.co.uk/), discussion of some security aspects of EMV, from members
of the University of Cambridge Security Group
• What is EMV? (http://www.emvx.co.uk/emv_guide.aspx), a technical guide to EMV transactions, complete
with a glossary of terms a flowchart showing the stages of a typical transaction
• Selected list of EMV data TAGs (http://cheef.ru/docs/HowTo/TAG.info) Smartcard Type-length-value
TAGs, samples, TLV decoder.
Article Sources and Contributors 13
License
Creative Commons Attribution-Share Alike 3.0 Unported
http:/ / creativecommons. org/ licenses/ by-sa/ 3. 0/