Digital Cash: Secure wallets for online and offline payments

When we think of “electronic payments”, there are a lot of different interpretations: bank cards, credit cards, mobile money, QR codes, and more. Lately, many central banks – including the European Central Bank – have started investigating or piloting digital currencies (CBDC) to introduce yet another way to pay electronically. The wish list for CBDC is long: it should support online & offline payments, work as usual at the point of sale, be accessible to users without bank accounts, … At the centre of these design discussions are wallets, powered by secure hardware.

In this talk, I give an overview over the current CBDC ecosystem, explain some novel techniques that could help to implement wallets at scale, and give a perspective regarding standardisation.

Transcript

1. Digital Cash Secure wallets for online and offline payments Lars Hupel Java Card Forum Webinar 2024-12-09
3. Digital Cash • What is it? • How do wallets work? • Where is it used? • How can I pay?
4. Central Bank Digital Currency CBDC Banknotes Bank deposits and e-money Issued by the central bank Digital money
5. The move towards CBDC is gaining momentum 94% of central banks worldwide are actively engaged in CBDC work are developing proof-of- concept technology 54% 31% are deploying pilot projects Source: Bank for International Settlements, 2023-24
6. More than 13 million adults in the EU face financial exclusion More than 13 million adults in the EU face financial exclusion
10. Modelling digital cash after physical cash Feel of paper Watermark Hologram Private/public keypair
11. Wallet form factors
12. Now, where is my money? Custodial wallet Bearer wallet
14. Hardware wallet requirements Secure Element (eSE/eSIM/SIM/ external) NFC Bluetooth (LE) Companion app
15. A simple payment Date: 2024-11-06 Time: 10:15 CET Payer: 014ca3 Payee: me Amount: 20 € Token transported via E2E-encrypted channel (SCP) Public Key: 0xCAFE Amount: 20 € Public key (without metadata) for integrity check Date: 2024-11-06 Time: 10:15 CET Payer: me Payee: 023ab5 Amount: 20 € Metadata kept in both wallets; shared on demand Wallet ID = pseudonym; KYC managed by intermediary
17. Payer identity Payee identity Authenticity Ownership
18. Security requirements of (digital) money Payer identity Authenticity Ownership Non-repudiation No double spending No tracing Payee identity
19. A security architecture with three lines of defence Strong hardware security Secure payment protocols & channels Central Bank as the final authority 50€
20. Designs that create confidence
21. Reference projects
22. Mobile app integration
25. How would payments work in practice?
29. “The EMV applications on the smart cards were not appropriate for storing offline balances … Therefore, we developed a new application that could store offline balances on the smart cards. This new application was not based on EMV standards so we also needed to deploy a new kernel …”
30. Application selection (Offline) CBDC registered with dedicated AID Prioritization handled by terminal or customer device
31. Traditional user journey Issuing bank Acquiring bank Card network Terminal Customer 1. Present device 2. App. Selection 3. Online payment 4. Clearing and settlement
32. Offline user journey Issuing bank Acquiring bank Terminal Customer 1. Present device 2. App. Selection 4. Redemption/reconciliation 3. Funds transfer 0. Top-up
33. Application Selection Offline transfer of funds Reconciliation
35. TC 68/SC 2/WG 13 ISO/CD 13133 BSI TR-03179-2
36. Questions? Answers! Lars Hupel https://lars.hupel.info lars.hupel@gi-de.com