Abstract
The Chip Authentication Programme (CAP) has been introduced by banks in Europe to deal with the soaring losses due to online banking fraud. A handheld reader is used together with the customer's debit card to generate one-time codes for both login and transaction authentication. The CAP protocol is not public, and was rolled out without any public scrutiny. We reverse engineered the UK variant of card readers and smart cards and here provide the first public description of the protocol. We found numerous weaknesses that are due to design errors such as reusing authentication tokens, overloading data semantics, and failing to ensure freshness of responses. The overall strategic error was excessive optimisation. There are also policy implications. The move from signature to PIN for authorising point-of-sale transactions shifted liability from banks to customers; CAP introduces the same problem for online banking. It may also expose customers to physical harm.
Original language | English |
---|---|
Title of host publication | Financial Cryptography and Data Security |
Subtitle of host publication | 13th International Conference, FC 2009, Accra Beach, Barbados, February 23-26, 2009. Revised Selected Papers |
Editors | Roger Dingledine, Philippe Golle |
Place of Publication | Berlin, Heidelberg |
Publisher | Springer |
Pages | 184-200 |
Number of pages | 17 |
ISBN (Electronic) | 978-3-642-03549-4 |
ISBN (Print) | 978-3-642-03548-7 |
DOIs | |
Publication status | Published - 21 Jul 2009 |
Event | 13th International Conference on Financial Cryptography and Data Security 2009 - , Barbados Duration: 23 Feb 2009 → 26 Feb 2009 Conference number: 13 https://ifca.ai/fc09/index.html |
Publication series
Name | Lecture Notes in Computer Science |
---|---|
Publisher | Springer, Berlin, Heidelberg |
Volume | 5628 |
ISSN (Print) | 0302-9743 |
ISSN (Electronic) | 1611-3349 |
Conference
Conference | 13th International Conference on Financial Cryptography and Data Security 2009 |
---|---|
Abbreviated title | FC 2009 |
Country/Territory | Barbados |
Period | 23/02/09 → 26/02/09 |
Internet address |