4 ms·

I believe credit card chips are examples of PUFs. CC terminals do a challenge-response through the chip in order to verify it, and the only way to pass the chal

I believe credit card chips are examples of PUFs. CC terminals do a challenge-response through the chip in order to verify it, and the only way to pass the challenges would be with a perfect copy of the embedded chip (which is presumably difficult to physically steal). This is why chips+pin is an improvement on the CC swipe: because anybody can steal a magstripe code.

nickpsecurity 11y ago
Nah, a good example of PUF in that space is that company making stuff that fingerprints the magnetic strips. The manufacturing leaves impurities that vary on a device by device basis. Each has different magnetic properties. Developing a stripe with exact same properties might be quite difficult. Hence, it's a PUF. Whereas, chips get cloned all the time. Sometimes, they do it down to the transistors.
- deleted 11y ago
  [deleted]
- dTal 11y ago
  In fact magnetic stripe cards are simply digital data and easily copied (and have been for decades). "Chip and pin" was introduced specifically to combat this, and is indeed an example of an attempt at implementing a PUF.
  - nickpsecurity 11y ago
    I think you're missing the concept. PUF's are ususlly based on electrical or other physical properties of underlying hardware. For credit cards, the data is stored on a stripe and easy to copy. The stripe itself has certain magnetic properties due to manufacturing variances and impurities that can be fingerprinted. Readers, upon inserting card, both read data and profile stripe itself then send both for authentication. See magnetic topic here: https://en.m.wikipedia.org/wiki/Types_of_Physical_unclonable_function https://en.m.wikipedia.org/wiki/Types_of_Physical_unclonable... Survey of other techniques here: https://www.google.com/url?sa=t&source=web&rct=j&url=http://digital.csic.es/bitstream/10261/96029/1/Using%2520Physical.pdf&ved=0ahUKEwj_77qK0_3KAhWLuB4KHci6AykQFggnMAE&usg=AFQjCNFnC7vuH1pHCYuWJBpjfCYCJEVlwA&sig2=_tNNuLOacl3QOhb3QP5yUQ https://www.google.com/url?sa=t&source=web&rct=j&url=http://...

nickpsecurity 11y ago

Nah, a good example of PUF in that space is that company making stuff that fingerprints the magnetic strips. The manufacturing leaves impurities that vary on a device by device basis. Each has different magnetic properties. Developing a stripe with exact same properties might be quite difficult. Hence, it's a PUF. Whereas, chips get cloned all the time. Sometimes, they do it down to the transistors.

deleted 11y ago
[deleted]
dTal 11y ago
In fact magnetic stripe cards are simply digital data and easily copied (and have been for decades). "Chip and pin" was introduced specifically to combat this, and is indeed an example of an attempt at implementing a PUF.
- nickpsecurity 11y ago
  I think you're missing the concept. PUF's are ususlly based on electrical or other physical properties of underlying hardware. For credit cards, the data is stored on a stripe and easy to copy. The stripe itself has certain magnetic properties due to manufacturing variances and impurities that can be fingerprinted. Readers, upon inserting card, both read data and profile stripe itself then send both for authentication. See magnetic topic here: https://en.m.wikipedia.org/wiki/Types_of_Physical_unclonable_function https://en.m.wikipedia.org/wiki/Types_of_Physical_unclonable... Survey of other techniques here: https://www.google.com/url?sa=t&source=web&rct=j&url=http://digital.csic.es/bitstream/10261/96029/1/Using%2520Physical.pdf&ved=0ahUKEwj_77qK0_3KAhWLuB4KHci6AykQFggnMAE&usg=AFQjCNFnC7vuH1pHCYuWJBpjfCYCJEVlwA&sig2=_tNNuLOacl3QOhb3QP5yUQ https://www.google.com/url?sa=t&source=web&rct=j&url=http://...