🚀 go-pugleaf

On July 9 1992 I wrote:

> I recently saw an article in a Dutch newspaper (Vrij
> Nederland,13/06/92), stating that PIN codes on cash machine
> cards are not as safe as most people think or the banks would
> like us to believe. The article described a number of cases
> were money was taken from cash machines with stolen cards. In
> each case the owners of the cards were insisting that the PIN
> code was never written down and nobody else new it. In one
> case the owner did not even new the code herself. In spite of
> this, it turned out that the PIN code was typed correctly the
> first time and sometimes shortly after the card was stolen
> (after about 20 minutes).

> I do not know how reliable this information is, but is there
> anybody who can tell me if *in principle* it is possible to
> retrieve the four digit PIN code from a stolen cash machine
> card?

The reason I got interested was that from the article it
seemed that somebody was indeed able to retrieve the pincode
from the card since:

1)In one case the owner was not using the PIN code excluding
espionage of the PIN

2) The card was stolen, making it less likely that the money
was extracted from the account by people working in the bank
with access to the system.


The responses I got both via E-Mail and the net made clear
that:

1] the PIN code system is indeed not very safe. The biggest
security hole in the system is unauthorised access to cards,
codes and keys, both at the level of the user (e.g using
binoculars to get PIN codes) and the banks internal
security. Details can be found in the article by Ross
Anderson "Claims involving Electronic payment systems"

2] The pin code is not stored on the card For instance
Mark.Lomas@uk.ac.cam.cl writes:

> The PIN is not stored on the card, although something called
> the `PIN offset' is stored on the card.

> There is a cryptographic one-way hash function known to the
> ATMs and the equipment that issues PIN advice slips. A card
> issuer generates a secret number known as the master PIN key:
> this is chosen as the exclusive-or of three or more
> independently chosen random numbers so that no one individual
> knows the master PIN key.

> If you apply the hash function to the account number and the
> master PIN key then you get what is known as the `natural
> PIN' for the account.

>     natural_pin = hash(primary_account_number,
> master_pin_key)

> To obtain the actual PIN you add the PIN offset digit by
> digit to the natural PIN ignoring any carries.  For example
> if my natural PIN is 5724 and I have chosen a PIN of 1234
> then the PIN offset will be 6510.  When you insert your card
> into an ATM it repeats this calculation and compare the
> result with what you typed.  Unfortunately many banks, and
> most British banks, choose a default PIN offset of zero so
> that the natural PIN and the issued PIN are the same; since
> few people change their PINs this explains the huge number of
> phantom withdrawals in the UK at the moment.

> Neither your PIN nor any function of it is stored on your
> card, nor is it necessary for machines to know your PIN in
> advance; they calculate your PIN when they need to use it.In
> theory it is possible to break the system by key search but
> the key space to search is much larger than the 10000
> possible PINs.  If I read the stripe on my card then I can
> determine my natural PIN; I guess the master PIN key and
> apply the hashing function to my guess and my account number
> to see whether I get my natural PIN; I repeat this until I
> find a guess that matches. For any particular guess I have a
> 1/10000 chance that it will match even if the guess was
> incorrect so I verify the guess by checking it against
> another card.  If I get a guess that matches for a number of
> cards then I have probably guessed correctly and can
> determine the PIN for any other account number.

> Unfortunately there are 2^56 possible master PIN keys so I
> expect to take 2^55 guesses before I find the correct one.

This number 2^55 makes clear that from a cryptographic point
of view the system is reasonable safe

Ross.Anderson@uk.ac.cambridge.computer-lab wrote me:

> To do keysearch effectively, you need custom chips which will
> do a DES encryption, compare the result, and if no match is
> found, increment the key register and repeat.

> As you have to search on average 2^55 keyts, parallelism is
> needed. There are a number of trade-offs involved in deciding
> whether you build a million chip machine which will solve a
> key in a few hours, or a cheaper one with a few thousand
> chips which will take a year.

It is clearly a major undertaking, but it does not seem to be
impossible. However it makes retrieving PIN from the card as
a possible explanation for the above mentioned case in the
newspaper unlikely, since if somebody could do that he would
have cracked all PINs and would probably not rely any more on
stealing handbags with cards.

This leaves me with no explanation for the particular case in 
the newspaper article, a much more careful guarding of my PIN
when I type it in, and some anarchistic dreams of organizing 
the internet people to do each a little bit of the needed 
calculation to crack a master_pin_key.

Peter.
Roes@vax.oxford.ac.uk