EMV Tech Talk

Transcript

1. EMV tech talk William Chen 9/4/2014
2. interesting FACTS • Card Go/No Go • Card Microprocessor • Store and Forward / Preauth • Speed??
3. agenda • Goals • Terminology • Crypto Review • Payment Card Evolution • EMV Transaction Flow • Breaches
4. Not covered • Liability Shift • Contactless • Online Transactions • Mobile Payments • PCI
5. Themes • Understand the 4 party model • Payments - not a “technical” problem • EMV is a complete rearchitecture • EMV is a technology, not a product
6. Terms 1 • 4 Party Model • Card Brands • Payment Product • Floor Limit
7. Terms 2 • Primary Account Number (PAN) • Risk Management • Application ID (AID) • Stand In
8. Terms 3 • Static Protection / Security • Dynamic Protection / Security • Online / Offline
9. Crypto • Confidentiality • Authentication • Integrity • Non Repudiation
10. Confidentiality • Encryption / Decryption Key Message
 “Hello World” Encrypt f(x) Encrypted Msg “47ef93aa456” Message
 “Hello World” Decrypt f’(x) Encrypted Msg “47ef93aa456” Key Key
11. Authentication • Message Authentication Code (MAC) • Shared Secret Key (or Public/Private) • Hash Message
 “Hello World” MAC f(x) Digest “01 22 11” Key
12. Integrity • Hash: One Way • Calculate before & after transmission • Ex: Checksum, MD5, SHA-1 Message
 “Hello World” Hash f(x) Digest “01 22 11”
13. TYPES • Symmetric (TDES) • Asymmetric (RSA, PKI, CA)
14. Payment CardS • Embossed • Mag Stripe • EMV • NFC/Contactless
15. Embossed • PAN / Expiry
16. Mag Stripe • Above, plus: • CVV • Track Data • Track 1: Alphanumeric text (inc. PAN, etc.) • Track 2: PAN, expiry, service code • Track 3: Not used for payments
17. EMV • Above, plus: • Smart Card (Secure Element) • Microcontroller + OS • 1 or more AID • Secret Keys
18. NFC • Above, plus: • Antenna
19. Mag Stripe Flow 1. Swipe Card 2. Forward to Gateway 3. Receive Response 4. Completion
20. EMV Flow 1. Insert Card 2. Choose Application 3. Offline Data Authentication 4. Processing Restrictions 5. Cardholder Verification 6. Terminal Risk Management 7. Terminal Decision 8. Card Risk Management 9. Online Processing 10. Issuer Scripting 11. Completion
21. Start • Insert Card • Choose Application
22. Offline • Static Data Authentication (SDA) 1. Get CA Public Key (stored in Terminal) 2. Get Issuer Public Key from Card 3. Verify Issuer Public Key Certificate 4. Verify signed static card data
23. Offline 2 • Dynamic Data Authentication 1. Get CA Public Key 2. Verify Issuer Public Key (from Card) 3. Verify Card Public Key Certificate (from Card) 4. Send Terminal Unpredictable Number to Card 5. Card Signs Data with Private Key 6. Terminal Verifies with Card’s Public Key
24. Offline 3 • Combined DDA / Generate AC (CDA) 1. Verify Issuer & Card Public Key with CA Public 2. Use “Generate Application Cryptogram” cmd 3. Card Signs Data with Private Key 4. Terminal Verifies with Card’s Public Key
25. Restrictions • Application expiry • Activation date • Version comparison (terminal/card) • Environment (ATM only, etc.)
26. Cardholder • Cardholder Verification according to CVM list in chip • PIN • Signature • No CVM • Other Methods (reserved for future)
27. Terminal risk • Application expiry • Activation date • Version comparison (terminal/card) • Environment (ATM only, etc.)
28. Term Decision • Terminal Verdict • Decline • Approve Offline • Go Online • Sends verdict to card
29. Card Risk Man • Card Verdict • Agreement • Require more stringent method • Returns appropriate cryptogram
30. Online • Similar to Mag Stripe • Issuer validates ARQC • Issuer returns ARPC • Go Online • Sends verdict to card
31. Issuer Scripting • Similar to Mag Stripe • Issuer validates ARQC • Issuer returns ARPC • Go Online • Sends verdict to card
32. Completion • Offline • Card makes determination based on history / stored values • Shows transaction results • Prints Receipt • Online • Card Verifies ARPC • Sends verdict to terminal (signed by Card Private Key)
33. Themes • Understand the 4 party model • Payments - not a “technical” problem • EMV is a complete rearchitecture • EMV is a technology, not a product
34. Questions?