Post on 30-Jun-2015
transcript
Part 1 Card Technology
Card Era
credit cards have become part of our daily life as forms of plastic money since its first launch in 1960
a magnetic card verse a smart card
Magnetic Card
composed of a layer of magnetic material for storing information
easy to carrycan be use for authenticationwhat is its principles?
Information on Magnetic Card
the stripe is
8.5cm X 1.2cmdata is constructed
based on ISO 7811/2
maximum 3 stripescan store around 1K
bits
ISO Standards
Based on ISO 7811Track 1 is developed by International Air
Transportation Association (IATA) which contains adaptive 6-bit alphanumerical characters
Track 2 is used by American Bankers Association (ABA) which stores 4-bit numerical information containing identification number and control information.
Track 3 is originated by Thrift Industry which contains information which is intended to be updated with each transaction.
TRACK 1
TRACK 2
TRACK 3
IATA ANSI X4.16 — 1983 ISO 3554
ABA ANSI X4.16 — 1983 ISO 3554
THRIFT ANSI X4.16 — 1983 ISO 3554
0.223”
0.110”
0.110”
0.110”
Track 1
SS FC PAN FS NAME FS Additional Data ES LRCPrimary Acc.
No.(19 digits max.)
Name(26 alphanumericcharacters max.)
Exipiry Date 4 Restriction or Type 3 Offset or PVN 5 Discretionary Data
Track 2
FC
SS PAN FS Additional Data ES LRC
Primary Acc.No.
(19 digits max.)
Exipiry Date 4 Restriction or Type 3 Offset or PVN 5 Discretionary Data
SS Start Sentinel % Format Code
FS Field Seperator { ES End Sentinel ? LRC Longitudinal Redundany Code
FCSS Start Sentinel ; Format Code
FS Field Seperator = ES End Sentinel ? LRC Longitudinal Redundany Code
3.250”
FC
Magnetic stripe Content of Financial Cards
Capacity
Track Record density bits/inch Capacity
1 210 79 (7 bits/char.)
2 75 40 (5 bits/char.)
3 210 107 (5 bits/char)
Fraud card activities
Stealing — A legal card may be stolen and used in ATMs or EPOSs.
Altering and re-embossing a genuine card, that is modifying the visual features of card.
Skimming or altering the original electronic data stored on the magnetic stripe, for example the expire date or the credit limit.
Buffering or re-encoding the original data to the magnetic card. This technique is commonly used in producing card counterfeits of store-value ticket.
Copying of data from a genuine card to another in an on-line fashion “white plastic fraud”
Counterfeiting — “color plastic fraud” may be prepared by reading another legal card and encoding the same information onto another fraud card in an off-line fashion.
Valid Card
Fraud Card
Design of card protection technologies
Validation by Appearance — this is a visual mean to protect against illegal duplication of plastic card. The aim is to make the appearance of card so unique and difficult to duplicate that shopkeepers or card handlers can identify the genuine card instantly.
Verification on Access — this validation relies on the interaction with the card holder, the objective of the protection mechanism is to identify the person accessing the card is an authorized one.
Protection on Data — this is a machine readable protection to avoid data from being access and duplication illegally. The importance of stripe data protection is .to ensure the security of electronic transaction and provide an alternative verification mechanism of magnetic card.
Magnetic StripeProtection
Card Protection Technologies
Visual ProtectionTechnologies
Protection onAccess
Verification byCard Content
Protection onModification
Protection onDuplication
Holograms
Microprints
UltravioletPattern
Photocard
Signature
DNA
PIN
PVV
EmbossedInformation
CVC
Smart Card
Memory Card P Card
WatermarkSandwichMagneprintValugard
Xsec
Holomagnetic
Xshield
6.5.1 Validation by Appearance
MR. B 12/95 VISB
IN GOD WE TRUST
Authorized Signature
Logo
Hologram
Magnetic Stripe
Bar Code
Computer Chip
Printed &Embossed Data
Signatures
Fine Printings
Photo ID
But Counterfeits Still Exists!
Holograms
are the most notable marking for credit cardsproduced by a combination of photography
and laser beamsinitially counterfeit holograms were crude
and manufactured by stamping tin foilsrecently counterfeit holograms were
produced by professional technical knowledge is needed to validate the authenticity of holograms
Embossed characters
are some raised marks implemented on the plastic surface of card
the embossed information includes the user name, expiry date, card number and unique embossed symbol — VISA embossed a symbol like “CV” besides the expiry date.
However, the card material is a thermal plastic by warming the card to about 50C, it allows “debossing” of the characters and re-embossing with fraud information.
Photocards
are introduced by CitiBank Corporation the effectiveness of photocard on marketing
purposes seems to be greater than that on security
it is not an effective mean to stop card fraud because counterfeiters had the ability to imitate laser engraved photographs and signatures in rather low cost using a photomachine of around US$ 5000.
Ultra-violet dove, bank identifying number (BIN) and micro-printings
can also be duplicated under the existing technology
technical knowledge is needed to recognize a counterfeit card from a genuine one
most card reading terminals contain no visual detector to validate these visual protection features while human eyes are not a reliable mean of verification
difficult to validate a genuine card
Protection on Card Access
the card holder is requested to prove his identity or the authorized user will be acknowledged about the transaction
methods: signature biometrices PIN
Signature
Signature is the most popular way of verification.
When a transaction is made, the card holder is requested to sign and the signature will be verified visually.
this method is simple not useful in protection against “color
plastic fraud” where the criminal can sign their own signature in the fraud card.
Biometrics
biometrics features were developed such as speed of writing, fingerprint or iris pattern
implementation cost is hightheir accuracy is questionable
Personal identifying number (PIN)
PIN is a unique number given by the bank to each user which is effectively fixed by the customer account number and the cryptographic key used in the derived PIN computation.
PIN offset or password is a value that relates a derived PIN to actual PIN value.
When a card holder transfer or withdraw his money from a bank account, a 6-digits password is inputted before transaction processed.
The password will be validated by comparing with the one stored inside the magnetic card by offset or in a centralized database in the bank.
The security of password is relied on the encryption algorithm of PIN, the PIN management scheme and the secrecy of password.
PIN does not provides defense against data copied from another card which contains the correct card verification value.
Moreover, the encryption algorithm adopted in validation codes may be tampered and decoded by professional hackers with some insider information.
Protection on Data
the major magnetic card protection techniques have included Watermark Magnetic Print Valugard Xsec-Jitter Macaps
Smart Card
Integrated Circuit - chip
originated from France
invented in 70 and matured in 90
Magnetic Card replacement
Types of Smart Card
Memory CardMPU IC cardCrypto-
processor cardContactless card
Memory CardMemory Card
Primitive typecomposed of
EEPROM/PROMsimple functionas prepay card
Cypto-processor IC CardsCypto-processor IC Cards
composed of cypto-processor & PROM
a powerful MPUcan recognise
illegal signal and security features
MPU IC Smart CardMPU IC Smart Card
Composed of MCU/MPC
software drivenhave flexibility and
primitive intelligence
some security features
Contactless Smart CardContactless Smart Card
similar to contact smart card
with RF transceiver to increase robustness and security
Advantages of Smart Card
Large storage capacitymore security featuresmultiple functionsflexibility in use - intelligent, lower power
consumption, effective packagingas access card, electronic purse, debit/credit
cards, ID card etc. - particular off-line applications
Hardware Technologies
new memory technologies - EEPROM and flash-EPROM
new silicon technologies - 1.3 m to 0.65 or even 0.18m for more storage and security, lower power consumption
new packaging technologies - against breakage, rubbing and bending
Smart Card Software
Intelligent Chip Operating System -COSEncryption techniques - RSA & DESMultiple Application OS (MAOS)
Mondex, EMV, GSM, Loyalty
New requirements hot list, trust key management
6.6.4 Smart Card Worldwide
Use Distribution 40% Western Europe, 25% Asia, 15% North America, 8% South America and 12% others
Major user is France over 130M cardsGermany 80 M health insuranceover 20 countries use GSM and electronic
purse
Smart Card Project Worldwide
Mondex - UKBarclay/Mercury one-2-one project (UK)Detemobil Toll Collection (UK)Advantages Card in RSAID card in TaiwanMastercard &Visa + Netscape and
Microsoft - COS projectCredit Card in USA
Some Difficulties Worldwide
Bank card project cancellation - TaiwanMondex tampering slow down bank sector
development - RSA and New ZealandMastercard - year 2000 delay of massive
launchingVisa - adoption of magnetic card in RSA
debit card project Major concern - COST EFFECTIVENESS
Smart Card in Hong Kong
MondexVisa CashCity SmartOctopus - smart travelling cardJockey Club -pre-pay cardNew airport - access control cardHKT - telephone cardParking Meter - prepay card project
Smart Card in Electronic Commerce
Electronic Data Interchange (EDI)TradelinkElectronic PurchasingHome BankingInternet Shopping
New Technologies Required
Data Storage Management - information protection
authentication process - biometric: fingerprint, facial features, iris
identification, dynamic signature recognition, speech recognition
encryption methods - Elliptic Curve Cryptography, chaotic techniques
THE SMART CARD MARKET IN THE YEAR 2000 (in millions – Source: Philips Communication Systems)
Application France Europe Others TotalPhone cards 140.8 553.1 640.0 1334GSM cards 4.0 15.0 42.0 61Health cards 10.0 55.0 92.0 157Bank cards 25.0 85.0 75.0 185ID cards - - - -Transport tickets - - - -Pay TV cards 4.5 24.0 81.0 110Access control 1.8 3.0 5.0 10City cards /Misc 24.0 55.1 64.3 143Total 210.1 790.2 999.3 2000
Some Difficulties Worldwide
Bank card project cancellation - TaiwanCard tampering slow down bank sector
development - RSA and New ZealandMasterCard - year 2000 delay of massive
launchingVisa - adoption of magnetic card in RSA
debit card project Major concern - COST EFFECTIVENESS
Smart Card in Electronic Commerce
Electronic Data Interchange (EDI)TradelinkElectronic PurchasingHome BankingInternet Shopping
New Technologies Required
Data Storage Management - information protection
authentication process - biometric: fingerprint, facial features, iris identification,
dynamic signature recognition, speech recognition
encryption methods - Elliptic Curve Cryptography, chaotic techniques
Smart Card in Mobile Phone Applications
Wireless Application Protocol (WAP) emerges for a mobile Internet access
Research work launched in Japan indicates a good market if available.
Mobile operators will provide add on WAP gateways and WAP services to enable wireless internet services:
Banks, financial institutions, restaurants, retailers, Utilities, transit operators, hotels, entertainment and media, selling goods and information
Limitation, the SIM card inside the WAP phone cannot provide complicated the PKI authentication process thus security is an issue.
A possible solution is to introduce an additional smart card interface (either contact or contactless) to enable the authentication process. (MasterCard – dual card phone)
New technologies requirements: The development of m-PKI (mobile PKI) in the
multiple-application OS is more essential and practical
The development of high security low power card modules
A better interface to new wireless internet platform, other ancillary technologies, such as Bluetooth and Wireless Wallets are also important
Java Card
More powerful processor & memoriesAllow download of applicationsOpen software platform for code
transportabilityFor multi-function, e-purse, loyalty, health
care database and Internet/Intranet access card
Smart Card in Hong KongMondexVisa CashCampus cardOctopus - smart traveling card Jockey Club -pre-pay cardNew airport - access control cardTelephone card & SIM CardParking Meter - prepay card projectResidential access cardPossible new ID card, Road Toll Pay Card
Governing Body
The Hong Kong Monetary Authority will set rules on use of smart card for financial applications
only banks may issue general purpose cardsHKMA can authorize other non-bank issuer
core use relating to business of the issuer needs to establish a business case an non-core
uses non-core uses subject to limits determined by
HKMA
Exemptions
Risk to payment system and card holders is slight
replace an existing non-regulated payment instrument like travelers’ cheques
soundness of issuermax. of HK$1000 limits on cardonly allow 15% for non core usesuse in a limited and distinct areas
Examples
Mondex : equivalent to bank note, and no audit trail
Visa Cash: equivalent to cheques, link to accounts and have audit trails
Note : There is no clearing system for the transfer to Mondex value (in the same way as transfer of bank notes).
Notes IssuingBank
Notes IssuingBank
Other BanksOther Banks
Notes holder ANotes holder A
Notes holder BNotes holder B MerchantMerchantBank notes
Goods/Services
Adjustment tointerbank A/C
Bank notes
Adjustment tocustomer A/C Bank notes
Tran
sfer
of b
ank
note
s
Goods/Services
Bank notes
MondexOriginator
MondexOriginator
Member BanksMember Banks
Cardholder ACardholder A
Cardholder BCardholder B MerchantMerchantMondex value
Goods/Services
Adjustment tointerbank A/C
Mondex value
Adjustment tocustomer A/C Mondex value
Tran
sfer
of M
onde
x
valu
e
Goods/Services
Mondex value
Issue of Bank Notes Origination of Mondex Value
Mondex scheme
Cheques VisaCash
Note : Transfer of VisaCash value would go through a clearing system in same way as clearing for cheques.
Payment by cheque
Issue ofcheques
Presentation of cheque received from customer
Credit Merchant A/C Goods/ Services
Payment by card
Uploadingvalue onto card
Redemption of value received from cardholder
Credit Merchant A/C
Debit Customer A/C (after cheque is cleared)
Debit Customer A/C(once value is uploaded)
Goods/ Services
Bank
ChequeClearingSystem
Merchant
BankCustomer
VisaCashClearingSystem
Bank
Merchant
Cardholder
VisaCash scheme
ISO 7816 Standards
7816/1
• Specifies the physical and dimensional features of the plastic supports. Additional characteristics specified are Mechanical strength, Static electricity, Electromagnetic fields and Bending properties etc.
7816/2
Specifies the meaning and location of the contacts.
This part defines eight contact referred to as C1 to C8. The contacts are located as shown in figure below.
Pin Assignment
Cont
act
No.
Assignment Contact
No.
Assignment
C1 VCC (supply voltage) C5 GND (ground)
C2 RST (reset signal) C6 VPP (Programming
voltage)
C3 CLK (clock signal) C7 I/O (Data input/output
C4 Reserved to ISO/IEC JTC
1/SC 17 for future use
C8 Reserved to ISO/IEC
JTC 1/SC 17 for future
use
7816/3
Specifies electronics signals and transmission protocols that the DC electrical characteristics, the character format and the command protocol for the Smart Card.
This ISO standard describes two types of data transfer between Smart Card and card Reader/Writer: asynchronous protocol with two data coding
conventions synchronous protocol
Asynchronous protocol
Character format:Each character (described in figure below)
is composed of: one start bit 8 bits of data one even parity bit guardtime slot including two stop bits
The data speed transmission depends on the clock signal frequency input into the Smart Card on the CLK contact.
The nominal bit duration sent on the I/O line is called the "elementary time unit" "etu" by the ISO standard.
This bit duration is directly proportional to the input clock during the "answer to reset", but may be requested to be modified (by the Smart Card) for the following data exchange. The parameters of this modification are given during the "answer to reset".
I/O Line management:
The I/O line (Input/output line) is used to exchange data in input mode (reception mode) or in output mode (transmission mode). This line must have two states: stand-by state or high level state working state or low level state:
Furthermore, the I/O line (as shown in figure below) is used to generate or to detect data parity errors in reception or transmission The transmitter must sample the I/O line during the guardtime duration. The transmission is presumed valid if the I/O line stays
at a high level during the guardtime slot The transmission is wrong if the I/O line is pulled
down during at least one etu (two etu max) during the guardtime slot.
The receiver, in order to signal a reception error, must pull down the I/O line.
Data coding
The ISO 7816 - 3 standard gives the possibility of two kinds of data coding. The direct convention or inverse convention. The type of convention is fixed by the Smart Card and is declared in the first character of the "answer to reset'.
In direct convention, the logical "l " level is 5 Volt and the least significant bit (LSB) is transmitted first.
In inverse convention, the logical "1" level is 0 Volt and the most significant bit (MSB) is transmitted first.
Synchronous protocol
In synchronous protocol, successions of bits are sent on the I/O line, synchronized with the clock signal on CLK pin. In synchronous protocol, the data frame format described previously is not available.
7816/4
Specifies the inter-industry command for interchange include:
The content of the message, commands and responses, transmitted by the interface device to the card and conversely.
The structure and content of the historical bytes sent by the card during the answer to reset.
The structure of files and data, as seen at the interface when processing inter-industry commands for interchange.
Access methods to files and data in the card.A security architecture defining access rights
to files and data in the card.Methods for secure messaging.
APDU (application protocol data unit) message structure
A step in an application protocol consists of sending a command, processing it in the receiving entity and sending back the response. Therefore a specific response corresponds to a specific command,
referred to as a command-response pair.
An application protocol data unit (APDU) contains either a command message or a response message, sent from the interface device to the card or conversely.
In a command-response pair, the command message and the response message may contain data, thus inducing four cases, which are summarized by table below.
Command-response pair
Case Command data Expected response data
1 No data No data
2 No data Data
3 Data No data
4 Data Data
Command APDU structure
Header Body
CLA INS P1 P2 (Lc field) (Data field) (Le field)
CLA - Class byteINS - Instruction byteP1, P2 - Parameter byteLc field - number of bytes present in the data fieldLe field - maximum number of bytes expected in the data field of the response APDU
Response APDU structure
The response APDU consists of Conditional body of variable length. Mandatory trailer of 2 byte.
Body Trailer
Data field SW1 SW2
Status Codes of response APDU trailer.
Part 2 Card Security
Simple security
Random Number Generator for dynamic key generation
Cipher Engine for data protection: Block Stream Choatic Function
Random Number Generator
For generation of session keysDigital approach can only generate pseudo
random number based on
Xi =(a Xi-1 + b) mod c
Other use analogue approaches like VCO, white noise generator etc.
Block Cipher
K1: Master Key of length 16-bit
K2: Card ID of length 16-bit
Block Cipher8-bit
K1 : 16-bit K2 : 16-bit
DataIn DataOut
8-bit
Block Cipher8-bit
K1 : 16-bit K2 : 16-bit
DataOut DataIn
8-bit
Block Cipher Method – Write to Memory
Block Cipher Method – Read from Memory
K1 and K2 act as the key parameters to the block cipher
The block cipher constructs a one-to-one mapping For different combination of K1 and K2, different
mapping can be obtainedExhaustive search through 28=256 combinations,
the mapping can be obtained without revealing the key parameters
To reveal the key parameters, exhaustive search of 2^16*2^16=2^32 combination is required
If the Card ID is known, a search of 2^16 combinations can reveal the Master Key
Stream Cipher The Stream Cipher can be
viewed as a state machine with K1K2 as the initial state
It generates a pseudorandom number sequences which are XOR with the Input Data to form the Output Data
The data must be in sequence in order to encode and decode correctly
Not suitable
Stream Cipher
K1 : 16-bit
DataOut
8-bit8-bit
DataIn
K2 : 16-bit
Chaotic Function
8-bit
8-bitNN
8-bitNN
8-bitNN
8-bitNN
8-bit
K1 : 16-bit
8-bit 8-bit
K2 : 16-bit
2-bit 2-bit 2-bit 2-bit
Neural Network
DataOut
8-bit8-bit
DataIn
8-bit
K2 : 16-bitK1 : 16-bit
The neural network construct a mapping for 32-bit input and 8-bit output
The 8-bit output for the Neural Network is XORed with the Input Data to from the Output Data
For different K1 & K2, the same output of Neural Network will be obtained, collision occurs
Knowing a pair of Data input and Data Output will recover the output from the Neural Network
As collision occurs, knowing K1, exhaustive search through K2, different K2 will result the same output, hence increase difficulty in searching K2
Using a 8-bit Artificial Neural Network to generate Chaotic Function
8-bit
8-bitNN
2-bit
8-bit
Layer1
8-bit
Layer2
8-bit
8-to-2 Table
2-bit
Advance Data Protection - Encryption
Encryption Encryption will modify data into irregular form
for security storage and transmission. The reconstruction is achieved by using a set of relevant Keys.
Two cryptosystems are currently being used, i.e. symmetric (DES/FEAL) and asymmetric (RSA, ECC). Symmetric cryptosystem requires only one common key for encryption and decryption whereas asymmetric system requires two keys, i.e. private/user key and public/system key.
Common Encryption Techniques
Three algorithms will be introduced DES (Data Encryption Standard) RSA (Rivet, Shamir, Adleman) ECC (Elliptic Curve Cryptography)
DES
DES the most well-known symmetric system being
used by banking sector and computer security. the technique was originated from IBM and
certified by National Bureau of Standards in 1977.
an official unclassified data encryption method.
widely been used by Banking sectors
64 Bit Plaintext
Initial Permutation
32 Bit L0 32 Bit R0
F(R0,K1)+
32 Bit L1 32 Bit R1
32 Bit L15 32 Bit R15
F(R15,K16)+
32 Bit L16 32 Bit R16
Final Permutation
64 Bit Ciphertext
Encryption ProcessDES System
64 Bit Key
Permutation Choice 1
56 Bit Key
28 Bit C0 28 Bit D0
Left Shift Right Shift
C1 D1
BuildingBlock
PermutedChoice 2
K1(48 bits)
C16 D16
PermutedChoice 2
Key Schedule
Li-1
32 bitsRi-1 32 bits
ExpansionPermutation 48 bits
S-BoxSubstitution
choice 32 bits
P-box Permutation
Li
32 bitsRi
32 bits
56 bits KeyPermuted Choice
48 bits
Function f
DES Substitution Boxes Operation
Operation Tables of DES (IP, IP-1, E and P)
RSA
RSA developed by 3 researchers at MIT in 1977 based on two prime numbers (p & q) to generate
the keys most popular is RSA 129 where p x q gives a
129 bit number highly security and has once been proposed to
replace DES in banking application report cipheranalysed by a group of 600
specialist in May 1994 through internet
RSA Steps
Select two large prime p& qGenerate n = pqGenerate f(n) = (p-1)(q-1)Select e (encryption/public key) and d
(decryption/secret) as ed = 1 (mod(f(n))
Encrption by C =(Me, mod n) where M is the message
Decrypt by M =(Cd, mod n)
ECC
ECC a new elliptic curve cryptosystem method for
public key applications developed by Neil Koblitz (Washington
University) and Victor Miller (IBM, Yorktown Heights) in 1985
using points in the elliptic curve as the elements for encryption
will become IEEE standard in 1997/8 (99?)
Elliptic Curve Groups over Real Numbers
An elliptic curve over real numbers may be defined as the set of points (x,y) which satisfy an elliptic curve equation of the form:
y2 = x3 + ax + b, where x, y, a and b are real numbers.
Each choice of the numbers a and b yields a different elliptic curve.
For example, a = -4 and b = 0.67 gives the elliptic curve with equation y2 = x3 - 4x + 0.67; the graph of this curve is shown below:
If x3 + ax + b contains no repeated factors, or equivalently if 4a3 + 27b2 is not 0, then the elliptic curve y2 = x3 + ax + b
Can be used to form a group. An elliptic curve group over real numbers consists of the points on the corresponding elliptic curve, together with a special point O called the point at infinity.
P + Q = R is the additive property defined geometrically.
Elliptic Curve Addition: A Geometric Approach
Elliptic curve groups are additive groups; that is, their basic function is addition. The addition of two points in an elliptic curve is defined geometrically.
The negative of a point P = (xP,yP) is its reflection in the x-axis: the point -P is (xP,-yP). Notice that for each point P on an elliptic curve, the point -P is also on the curve.
Adding distinct points P and Q
Suppose that P and Q are two distinct points on an elliptic curve, and the P is not -Q. To add the points P and Q, a line is drawn through the two points. This line will intersect the elliptic curve in exactly one more point, call -R. The point -R is reflected in the x-axis to the point R. The law for addition in an elliptic curve group is P + Q = R. For example:
Adding the points P and -P
The line through P and -P is a vertical line which does not intersect the elliptic curve at a third point; thus the points P and -P cannot be added as previously.
It is for this reason that the elliptic curve group includes the point at infinity O.
By definition, P + (-P) = O. As a result of this equation, P + O = P in the elliptic curve group . O is called the additive identity of the elliptic curve group; all elliptic curves have an additive identity.
Doubling the point P
To add a point P to itself, a tangent line to the curve is drawn at the point P. If yP is not 0, then the tangent line intersects the elliptic curve at exactly one other point, -R. -R is reflected in the x-axis to R. This operation is called doubling the point P; the law for doubling a point on an elliptic curve group is defined by:
P + P = 2P = R. The tangent from P is always vertical if
yP = 0.
Doubling the point P if yP = 0
If a point P is such that yP = 0, then the tangent line to the elliptic curve at P is vertical and does not intersect the elliptic curve at any other point.
By definition, 2P = O for such a point P.
If one wanted to find 3P in this situation, one can add 2P + P. This becomes P + O = P Thus 3P = P.
3P = P, 4P = O, 5P = P, 6P = O, 7P = P, etc.
Elliptic Curve Addition: An Algebraic Approach
Geometrical approach is not practical
Adding distinct points P and Q
When P = (xP,yP) and Q = (xQ,yQ) are not negative of each other,P + Q = R where
s = (yP - yQ) / (xP - xQ)xR = s2 - xP - xQ and yR = -yP + s(xP - xR)
Note that s is the slope of the line through P and Q
Doubling the point P
When yP is not 0,
2P = R where
s = (3xP2 + a) / (2yP )
xR = s2 - 2xP and yR = -yP + s(xP - xR)
Recall that a is one of the parameters chosen with the elliptic curve and that s is the tangent on the point P.
Elliptic Curve Groups over Fp
Calculations over the real numbers are slow and inaccurate due to round-off error. Cryptographic applications require fast and precise arithmetic; thus elliptic curve groups over the finite fields of Fp and F2m are used in practice.
Recall that the field Fp uses the numbers from 0 to p - 1, and computations end by taking the remainder on division by p. For example, in F23 the field is composed of integers from 0 to 22, and any operation within this field will result in an integer also between 0 and 22.
An elliptic curve with the underlying field of Fp can formed by choosing the variables a and b within the field of Fp. The elliptic curve includes all points (x,y) which satisfy the elliptic curve equation modulo p (where x and y are numbers in Fp).For example: y2 mod p = x3 + ax + b mod p has an underlying field of Fp if a and b are in Fp.
If x3 + ax + b contains no repeating factors (or, equivalently, if 4a3 + 27b2 mod p is not 0), then the elliptic curve can be used to form a group. An elliptic curve group over Fp consists of the points on the corresponding elliptic curve, together with a special point O called the point at infinity. There are finitely many points on such an elliptic curve.
Example of an Elliptic Curve Group over Fp As a very small example, consider an elliptic curve over the
field F23. With a = 1 and b = 0, the elliptic curve equation is y2 = x3 + x. The point (9,5) satisfies this equation since:
y2 mod p = x3 + x mod p
52 mod 23 = 93 + 9 mod 23
25 mod 23 = 738 mod 23
2 = 2
The 23 points which satisfy this equation are:
(0,0) (1,5) (1,18) (9,5) (9,18) (11,10) (11,13) (13,5)
(13,18) (15,3) (15,20) (16,8) (16,15) (17,10) (17,13) (18,10)
(18,13) (19,1) (19,22) (20,4) (20,19) (21,6) (21,17)
These points may be graphed as below:
Arithmetic in an Elliptic Curve Group over Fp
There are several major differences between elliptic curve groups over Fp and over real numbers.
Elliptic curve groups over Fp have a finite number of points, which is a desirable property for cryptographic purposes. Since these curves consist of a few discrete points, it is not clear how to "connect the dots" to make their graph look like a curve. It is not clear how geometric relationships can be applied.
As a result, the geometry used in elliptic curve groups over real numbers cannot be used for elliptic curve groups over Fp. However, the algebraic rules for the arithmetic can be adapted for elliptic curves over Fp. Unlike elliptic curves over real numbers, computations over the field of Fp involve no round off error - an essential property required for a cryptosystem.
Adding distinct points P and Q
The negative of the point P = (xP, yP) is the point -P = (xP, -yP mod p). If P and Q are distinct points such that P is not -Q, then
P + Q = R where
s = (yP - yQ) / (xP - xQ) mod p
xR = s2 - xP - xQ mod p and yR = -yP + s(xP - xR) mod p
Note that s is the slope of the line through P and Q.
Doubling the point P
Provided that yP is not 0,
2P = R where
s = (3xP2 + a) / (2yP ) mod p
xR = s2 - 2xP mod p and yR = -yP + s(xP - xR) mod p
Recall that a is one of the parameters chosen with the elliptic curve and that s is the slope of the line through P and Q.
Elliptic Curve groups and the Discrete Logarithm Problem
At the foundation of every cryptosystem is a hard mathematical problem that is computationally infeasible to solve. The discrete logarithm problem is the basis for the security of many cryptosystems including the Elliptic Curve Cryptosystem. More specifically, the ECC relies upon the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP).
Recall that we examined two geometrically defined operations over certain elliptic curve groups. These two operations were point addition and point doubling. By selecting a point in a elliptic curve group, one can double it to obtain the point 2P. After that, one can add the point P to the point 2P to obtain the point 3P. The determination of a point nP in this manner is referred to as Scalar Multiplication of a point. The ECDLP is based upon the intractability of scalar multiplication products
The Elliptic Curve Discrete Logarithm Problem
In the multiplicative group Zp*, the discrete logarithm problem is: given elements r and q of the group, and a prime p, find a number k such that r = qk mod p. If the elliptic curve groups is described using multiplicative notation, then the elliptic curve discrete logarithm problem is: given points P and Q in the group, find a number that Pk = Q; k is called the discrete logarithm of Q to the base P. When the elliptic curve group is described using additive notation, the elliptic curve discrete logarithm problem is: given points P and Q in the group, find a number k such that Pk = Q
Example:
In the elliptic curve group defined by
y2 = x3 + 9x + 17 over F23,
What is the discrete logarithm k of Q = (4,5) to the base P = (16,5)?
One way to find k is to compute multiples of P until Q is found. The first few multiples of P are:
P = (16,5) 2P = (20,20) 3P = (14,14) 4P = (19,20) 5P = (13,10) 6P = (7,3) 7P = (8,7) 8P = (12,17) 9P = (4,5)
Since 9P = (4,5) = Q, the discrete logarithm of Q to the base P is k = 9.
In a real application, k would be large enough such that it would be infeasible to determine k in this manner.
ECC - key generation
Select an elliptic curveGenerate the coordinate pairs which satisfy the
conditions of modulo n and select starting point PKey generation:
select a random integer d (secret key) in the interval [2, n-2]
compute point Q = dP make Q public
ECC Encryption
Encryption select a random integer k in the interval [2, n-2] compute (x1,y1) = kP and (x2,y2) = kQ generate a mask Y from secret as f(x2) and
compute C = YM where M is the message send the encrypted ciphertext EM as
concatenated [x1, y1, C]
ECC Decryption
Decryption extract (x1,y1) from ciphertext EM compute (x2,y2) from d(x1,y1) compute mask Y as f(x2) recover message by M = CY
Encryption and Decryption :
Actions perform by Party B
Encryption :
Actions perform by Party A
Decryption Process
1. Looks up A public key : Q =
(xQ,yQ)
= ( ,0)
2. Select a random integer k = 2 in the
interval [2, n -2 ] - the private key
for
the one - time key pair
3. Computes the point (x1,y1) = kP =
2(5, 11) = ( , ) = ((1100),(1100))
- the public key for one - time key
pair
4. Computes the point (x2,y2) = kQ =
2( , ) = (5, 11) = ((1010),(1110))
x2 is the secret value.
5. Generates a mask Y of length 6
with the mask generation function
used, Y will vary. For the purposes
in this example, let Y = 011010.
6. Computes C = Y M = (011010)
(010100) = (001110)
7. Computes the encrypted message
by concatenating (x1,y1) and C,
and transmit (11001100001110) to
A.
1.Ciphertext EM = (11001100001110)
received from B
2. Uses the first 8 bits of the string for
one
- time public key : ((1100),(1100)).
The rest of EM will be stored in C
3. Computes the point (x2,y2) = d
( x1,y1) = 3 (1100,1100) = 3(, ) =
(5, 11)= ( (1010),(1110)). X2 is the
secret value.
4. Using the same mask generation
function as B, A generate from x2 the
mask Y = 011010.
5. Recover the message M by XORing
all
but the first 8 bits of EM with the
mask Y: M : C Y = (001110)
(011010) = (010100)
Security of Smart Card
Possible attacks tracking: based on the protocol exchange
between the terminal and the card to track the sequence of commands
EM analysis: use electron microscope to inspect the internal structure of the mask
confusion: disturb the power supply during PIN verification to confuse the accurate enter of PIN and allow access to the protected memory
UV or X-ray inspection: use high efficiency UV or X-ray to inspect the memory areas to extract important information like PIN, secret key and public key
Other possible attracts: attract on DES like differentiate methodsattract on RSA using cyclic properties
Trusted System Evaluation Criteria – USA(DoD)
D: Minimal protection No protection
C1: Discretionary Security Protection Use control acess
C2: Controlled Access Protection Use accountability/auditing
B1: Labelled Security Protection Use sensitivity (classification) labels
B2: Structured Protection Use formal security policy more resistant to
penetrate
B3: Security domain Highly resistant to penetration. Use security
administrator, auditing events and system recovery process
A1: Verified protection Highly assure of penetration. Use formal
specification and verification approaches.
Information Technology Security Evaluation Criteria (ITSEC) - Europe
EAL1 – functional testedEAL2 – structurally testedEAL3 – methodologically tested and checkedEAL4 - methodologically designed, tested and
reviewedEAL5 – semiformally designed and tested EAL6 - semiformally verified designed and tested EAL7 -formally verified designed and tested
Security requirements
Cryptographic modulesmodule interfacerole and servicesfinite state machine modelphysical securityEnvironmental Failure Protection/Testing
(EFT/EFP)Software security
Operation securitycryptographic key managementcryptographic algorithmEMI/EMCself tests
Security Assessment
USA Federal Information Processing Standard Publications 140-2 (FIPS PUB 1401-2): Specifications for security requirements for cryptographic modules
The specifications define 4 levels security: SL 1 to SL 4 where SL 1 is the lowest
Type SL1 SL2 SL3 SL4
1 CryptographicModules
Define interfacing, H/W, S/W, Firmware & Module SecurityPolicy
2 ModuleInterface
Define require and backupinterface, define path formatfor interface and internalcircuit
Dta port is an important issueand must be isolate fromother information links
3 Role andservices
Logicseparate therole andservices
Must applyrole basedauthentication
Apply Identity basedauthentication
4 Finite statemachine model
Define model, state and state transitional diagram and thestate transitional conditions
5 Physicalsecurity
Manufacturerclassificationlayers
Provide lockandmodificationevidents
Detection ofillegalmodificationsand responsefor coversand doors
Detection ofillegalmodificationsand responseenvelope foraccess
6 EFP/EFT Not required Temperature and voltage
7 S/w security S/W must be tested byfinite state machine model
H/L language Formal model
8 O/S Security Executecode,authentication and accesscontrol forsinglemachine/user
Read/writeprotection inC2 level
Indicateprotection in B1level with areliablecommunicationpath
Structural protection in B2level
9 Cryptographic Keymanagement
Use FIPS endorsed creationand distribution methods
Use encryption or split knowledge methods toinput/output keys
10 Cryptographic algorithms
Use FIPS endorsed non-classified document encryption algorithms
11 EMI/EMC FCC Part 15 J class A orequivalent
FCC Part 15 J class B or equivalent
12 Self test Provide power up tests and conditional tests
*** END ***