Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:10:56
Martin Grap (mgrap@concord-eracom.de)
Fri, 7 Aug 1998 11:24:48 +0100
Hello,
I do not claim that I'm an expert for ATM technology and therefore
I have not read the various national and international standards
concerning the issue. If these standards offer the possibility to
store the encrypted PIN on the mag stripe so be it. But it is
not *necessary* to store any encrypted information on the mag
stripe in order to "only" perform a PIN verification. Of course
it can be done that way and some organizations may even prefer
this solution. But even the ability to perform an offline PIN verification
can be implemented without storing the (encrypted) PIN on the mag
stripe (The PIN is derived from a MAC which has been calculated by the ATM
over the data stored on the card).
Perhaps I should have said instead:
"It is possible to implement PIN verification schemes which do
not require the explicit storage of the PIN in any form on the magstripe
of the ATM card and these schemes are widely used at least in Europe."
Martin
--------
Martin Grap, Concord-Eracom Computer Security GmbH
Talstrasse 11, D-72218 Wildberg, Germany
Tel. : {+49} (0)7054-9267-0, Fax: {+49} (0)7054-1837
e-mail: mgrap@concord-eracom.de, CE-homepage: http://www.concord-eracom.de
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:10:56