🚀 go-pugleaf

There are several validation methods availale to the ATM.  A given
ATM might validate different cards in several manners. Any given card
might have several validation methods, and could actually have several
valid PINs (Personal Identification Numbers).

Remote verification is performed by when the ATM has no way of knowing
what the PIN is.  When remote verification is performed, the ATM may
validate the PIN right away by sending a special message to the network,
or it may let you go ahead and enter the transaction and get both the
transaction and PIN okayed at the same time. [ The ATM itself is a 
STATE MACHINE.  It is NOT programmed in COBOL!  Some of the newer ones
are programmed in 'C' but use some sort of State Machine design to 
get the transitions performed. ]

The PIN could be sent to the host in encrypted form, by ATM encryption,
and troops, yes it could even be sent in the clear (gadzuks!).  
Validation can be performed at the host by a data base lookup (probably with
some form of one way encryption) or by performing a manipulation based
on the information on the card image itself.

Local PIN verification is performed (Generally) by taking the 
PRIMARY ACCOUNT NUMBER which turns out to be 16 digits, even if you
have to pad it.  Running it through DES along with a bank supplied PINKEY.
This will generate a 16 hex digit number.  If you have a four digit 
PIN the first four digits will be taken.   Now no one out there has
a pin of '1D4F' so there is a translation of the numbers.  A table lookup
is performed.  While the lookup allows any digit to be converted to any
digit, usually 0-9 stays the same 'A' to 'F' goes to 0 to 5.  (See, it's
even EASIER to guess the PIN since it is weighted to those lower digits.)

This number we acheived is called the 'Natural PIN'.  If you had an
opportunity to select you own PIN, and the ATM locally validates, you
will have what is called an Offset.  By using modulo addition on each
digit, you will generate your selected PIN.  

An added comment: Some transactions will take 45 seconds to wind their way
through a network.  Since most people enter their PIN correctly why punish
them for two network waits, so the people who screw up will save the time
of having to enter their transaction?

(Note to the person who asked me about the tracks on a card: There are
three defined Track 1 contains your name and maybe your account number.
Track 2 contains your account number and mayber experation date and  
offset, it is used for online processing.  Track three contaions account information
and information which will allow you to do offline transactions at ATMs).






-Fred-
 
818-706-146

{trwrb,ihnp4}!wlbr!gins