3 ms·

> Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost e

> Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card. By the way, do you have any reference on this? Everywhere I've searched, chip seems synonymous with EMV.

lmilcin 9y ago
For background, I was developing those types of applications few years ago, professionally. Every chip or contactless transaction is an EMV transaction. This is by virtue of EMV being the protocol that terminal uses to communicate with the card. EMV allows for different types of transactions with different level of security. For example, if the transaction can be done offline (gas pump unattended terminal situation) AND executing CVM rules (both terminal and issuer have their own rules) points to the possibilty of exchanging encrypted PIN, the PIN can be sent safely encrypted to the card for verification. If the card or the terminal does not support encrypted verification then the PIN can be sent in the clear and vulnerable to skimming.
- throwaway613834 9y ago
  Okay then I'm extremely confused. You say: > Every chip or contactless transaction is an EMV transaction. But the parent comment I was replying to says: > Just because you are using the chip doesn't mean you are doing an EMV transaction. I presume you're saying he's wrong in this? Or am I misunderstanding what you both mean? I'm also confused by the PIN thing you mention. Why is there a PIN at all, and why is there an "encrypted PIN exchange"? We're talking about the US, right? The US is chip & signature, and there is no PIN involved. I thought it was supposed to be that the card generates a unique one-time authorization code (public-key signatures?) and the bank validates it? Where does a PIN come into play?
  - lmilcin 9y ago
    For each transaction a set of very flexible rules is being executed with the aim to perform a number of verifications. Card Verification - no verification (just read magstripe or magstripe equivalent from chip or contactless card that does not have any more advanced verification mechanism) - static verification - for chip, card sends static signature along with the data so that the terminal can verify electronic signature - dynamic verification - for chip, card accepts challenge and generate response so that the terminal can verify the signature. This also makes it much more difficult to copy the card because it is not enough to copy the available data, you also need to copy the key that is embedded in the card. Cardholder Verification - no verification -- sometimes no cardholder verification will be performed (for example contactless under certain limit, unattended terminals without PIN capability or on a plane when there is special rules for airline terminals because people are typically verified separately) - Signature -- this is where US is stuck it seems - offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem - offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more. - online PIN -- the PIN is never exchanged with the card, it is encrypted and sent to the bank and bank decides whether it likes it or not. Transaction verification - floor limit -- sometimes the transaction can be agreed between the terminal and the card. Typically there is some information stored on the card and set of rules that decide that this is possible. The card may be decreasing a limit of funds available offline and when it hits the limit it will force you to perform full chip transaction. - online verification -- the message goes online to the bank and bank decides.
    - deleted 9y ago
      [deleted]
    - gruez 9y ago
      >- offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem >- offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more. what's the difference between the two? can't the attacker put a physical keylogger on the pin pad?
  - Amezarak 9y ago
    > The US is chip & signature, and there is no PIN involved. I'm in the US and the credit card I have through my credit union requires a PIN on chip transactions.
drzaiusapelord 9y ago
He's mostly wrong. The entire point of moving to chip is because liability stops being on the retailer if they implement EMV. Chip and EMV go hand-in-hand. Why bother upgrading your terminals for chip and not do EMV? Might as well stick with swipe then, its the same liability agreement. Its all a stopgap measure to chip and pin anyway. Once everyone is used to EMV and all the terminals have been replaced, we'll have a sunset on swipe and then move to chip and pin, which will be a minor upgrade. This will all take time. Lets remember the United States has a quarter of the world’s credit card transactions, but only 4.5% of its population. Its a very big cc market and change isn't going to come quickly.

lmilcin 9y ago

For background, I was developing those types of applications few years ago, professionally. Every chip or contactless transaction is an EMV transaction. This is by virtue of EMV being the protocol that terminal uses to communicate with the card. EMV allows for different types of transactions with different level of security. For example, if the transaction can be done offline (gas pump unattended terminal situation) AND executing CVM rules (both terminal and issuer have their own rules) points to the possibilty of exchanging encrypted PIN, the PIN can be sent safely encrypted to the card for verification. If the card or the terminal does not support encrypted verification then the PIN can be sent in the clear and vulnerable to skimming.

throwaway613834 9y ago
Okay then I'm extremely confused. You say: > Every chip or contactless transaction is an EMV transaction. But the parent comment I was replying to says: > Just because you are using the chip doesn't mean you are doing an EMV transaction. I presume you're saying he's wrong in this? Or am I misunderstanding what you both mean? I'm also confused by the PIN thing you mention. Why is there a PIN at all, and why is there an "encrypted PIN exchange"? We're talking about the US, right? The US is chip & signature, and there is no PIN involved. I thought it was supposed to be that the card generates a unique one-time authorization code (public-key signatures?) and the bank validates it? Where does a PIN come into play?
- lmilcin 9y ago
  For each transaction a set of very flexible rules is being executed with the aim to perform a number of verifications. Card Verification - no verification (just read magstripe or magstripe equivalent from chip or contactless card that does not have any more advanced verification mechanism) - static verification - for chip, card sends static signature along with the data so that the terminal can verify electronic signature - dynamic verification - for chip, card accepts challenge and generate response so that the terminal can verify the signature. This also makes it much more difficult to copy the card because it is not enough to copy the available data, you also need to copy the key that is embedded in the card. Cardholder Verification - no verification -- sometimes no cardholder verification will be performed (for example contactless under certain limit, unattended terminals without PIN capability or on a plane when there is special rules for airline terminals because people are typically verified separately) - Signature -- this is where US is stuck it seems - offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem - offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more. - online PIN -- the PIN is never exchanged with the card, it is encrypted and sent to the bank and bank decides whether it likes it or not. Transaction verification - floor limit -- sometimes the transaction can be agreed between the terminal and the card. Typically there is some information stored on the card and set of rules that decide that this is possible. The card may be decreasing a limit of funds available offline and when it hits the limit it will force you to perform full chip transaction. - online verification -- the message goes online to the bank and bank decides.
  - deleted 9y ago
    [deleted]
  - gruez 9y ago
    >- offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem >- offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more. what's the difference between the two? can't the attacker put a physical keylogger on the pin pad?
- Amezarak 9y ago
  > The US is chip & signature, and there is no PIN involved. I'm in the US and the credit card I have through my credit union requires a PIN on chip transactions.

drzaiusapelord 9y ago

He's mostly wrong. The entire point of moving to chip is because liability stops being on the retailer if they implement EMV. Chip and EMV go hand-in-hand. Why bother upgrading your terminals for chip and not do EMV? Might as well stick with swipe then, its the same liability agreement. Its all a stopgap measure to chip and pin anyway. Once everyone is used to EMV and all the terminals have been replaced, we'll have a sunset on swipe and then move to chip and pin, which will be a minor upgrade. This will all take time. Lets remember the United States has a quarter of the world’s credit card transactions, but only 4.5% of its population. Its a very big cc market and change isn't going to come quickly.