On the Security of the EMV Secure Messaging API (Extended Abstract)

摘要

We present new attacks against the EMV financial transaction security system (known in Europe as "Chip and PIN"), specifically on the back-end API support for sending secure messages to EMV smartcards. EMV is the new electronic payment system designed by VISA and Mastercard and widely deployed throughout Europe in the last 12 months. It aims to eventually supersede magnetic-stripe systems. Customers carry smartcards which, upon payment, engage in cryptographic protocols to authenticate themselves to their issuing bank. At the issuing bank (the "back end" for short), the Hardware Security Modules (HSMs), which are tasked with PIN storage and verification for ATM networks, have been extended to provide new EMV security functionality. The HSMs now authenticate and manage the massive card base, ensuring security in an environment particularly wary of insider attack.