Re: PIN Numbers and ATM Session Keys

Antonomasia (ant@notatla.demon.co.uk)
Sat, 22 Aug 1998 00:28:09 +0100

• Next message: steven.soroka@mts.mb.ca: "RE: Encryption is like a locked suitcase."
• Previous message: David Honig: "Re: Encryption is like a locked suitcase"
• In reply to: Dan Todd: "Re: Encryption is like a locked suitcase"

coryking@azalea.com:

> I was thinking about the whole thread a while back about PIN numbers /
> Authentication / Key exchange on ATM machines and was wondering if the
> system I am about to present would work very well...
>
> It's actually quite simple:
>
> 1. User Enters PIN ## and proceeds to use ATM
> 2. User completes transaction, ATM now attempts to verify..
> 3. ATM calls "home base" and sends the account number to the server
> 4. Server looks up a hash of the users PIN number in database.
> 5. ATM also generates the hash based on the PIN number the user entered
>
> - From this point forward the server would expect the transaction
> to be encrypted using the hash as a key..
> - From this point forward the ATM would encrypt the traffic using
> the hash it just generated from the users PIN number..
>
> If the user did not enter the right pin number, then the encryption key
> would be wrong, the traffic would be gibberish, and the server could not
> process/authenticate the user.
>
> The only weak point I could see is Hacker X somehow acquiring the PIN
> number database on the server. I'm sure I'm missing more problems, so
> flame away!

Well it all kind of lacks detail ...

In the hash at steps 4 and 5 what additional secret data
keeps this hash from being quessed as easily as a PIN ?

What prevents replays of captured traffic if the same account is
always debited with the same key ?

If you are relying on 'the traffic would be gibberish' without explicit
checks, you may have other problems - all depends on the message format.

There seems to be no attempt to give the server only what it needs -
the ability to check the messages from the ATM without the ability
to forge them. If the bank could possibly be employing dishonest
people this is a desirable property.

--
##############################################################
# Antonomasia   ant@notatla.demon.co.uk                      #
# See http://www.notatla.demon.co.uk/                        #
##############################################################

• Next message: steven.soroka@mts.mb.ca: "RE: Encryption is like a locked suitcase."
• Previous message: David Honig: "Re: Encryption is like a locked suitcase"
• In reply to: Dan Todd: "Re: Encryption is like a locked suitcase"