Financial Cryptography and Data Security
Financial Cryptography and Data Security
复制标题
金融密码学与数据安全
DOI：
10.1007/978-3-642-39884-1_26
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Emms M
中科院分区：
文献类型：
--
作者：
Emms M
非接触式卡支付正在世界各地推出，允许客户使用卡支付小额购买，只需将卡放在销售终端点。非接触式交易不需要验证持卡人的PIN。然而，我们的研究发现，冗余验证PIN功能存在于目前在英国流通的最常见的非接触式信用卡和借记卡上。本文提出了一种合理的攻击方案，利用非接触式验证PIN给无限的尝试猜测持卡人的PIN，而他们的知识。它还提供了实验数据来证明攻击的实际可行性，以及参考文献来支持我们的论点，即非接触式验证PIN是冗余的功能，这会损害支付卡和持卡人的安全性。
Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder’s PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder’s PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.
DOI：
10.1007/978-3-319-42019-6_10
发表时间：
2016-07
期刊：
--
影响因子：
--
作者：
Bill Marino;A. Juels
通讯作者：
Bill Marino;A. Juels