27C3: Chip and Pin is broken

Smart cards have gradually replaced magnetic strip cards for point-of-sale and ATM transactions in many countries. Customers authorize a credit or debit card transaction by inserting their card and entering a PIN into a point-of-sale terminal; the PIN is typically verified by the smart card chip, which is in turn authenticated to the terminal by a digital certificate. The transaction details are also authenticated by a cryptographic message authentication code (MAC), using a symmetric key shared between the payment card and the bank that issued the card to the customer (the issuer).

This talk, recently presented by Steven J. Murdoch at the 27C3 conference sponsored by the Chaos Communications Congress in Berlin, Germany, demonstrates how criminals can use stolen “Chip and PIN” smart cards (of the EMV variety common in Europe (named after Europay, MasterCard, and Visa) without knowing the PIN.