Not That Smart Cards

[John Young <jya@pipeline.com>]

   New Scientist, 12 October 1996, p. 21.


   Smart, but not that smart

   By Mark Ward


   Credit card companies are turning to smartcards to help
   them fight fraud. But manufacturing problems may mean
   that they are no more secure than existing cards.

   Conventional credit cards hold information in a magnetic
   strip that typically holds about 200 bytes of information
   -- enough for the card and version number, expiry date
   and owner's name. Smartcards have a built-in
   microprocessor that can handle several kilobytes of data,
   equivalent to pages of information.

   Having the tiny computer on board means that each card
   can have a unique identity, and this ought to help to
   protect the information held on it. But to give a card an
   individual electronic signature, its built-in processor
   has to do a long calculation. This is a time-consuming
   process, so some card manufacturers intend to issue cards
   with one of several thousand preprogrammed identities.
   Each card will therefore have thousands of duplicates,
   all of which will be vulnerable if a criminal cracks the
   code for any one of them.

   In 1994 the credit card companies Europay, Mastercard and
   Visa got together to draw up a common specification for
   smartcards, known as EMV The cards will rely for security
   on the RSA encryption algorithm. This uses two very large
   numbers, called keys. One is passed around in public and
   the other remains hidden in the card's memory. The keys
   are 155-digit prime numbers which are multiplied together
   to make an even larger number which is then used to code
   and decode the data on the card.

   The problem for card manufacturers is working out the
   large prime numbers in the first place. "Companies making
   smartcards turn one out every 15 seconds," says Dmitri
   Markikis, a security analyst at Mondex, a London-based
   company that is experimenting with smartcards as
   electronic purses. "But it takes longer -- estimates
   range from 6 to 30 seconds -- for the card to generate
   its RSA keys." To speed things up some manufacturers are
   considering generating 10,000 preset keys and inserting
   one as each card is made.

   Louis Guillou, a researcher at France Telecom's
   Commercial Centre for the Study of Television and
   Telecommunications highlighted the problem this summer at
   the Crypto 96 conference in California. The three EMV
   partners circulate over 800 million credit cards between
   them, yet are likely to use a limited population of keys.
   "Trying to reuse the keys several times is very
   dangerous," says Guillou.

   Card manufacturers say the problem will be solved as
   smartcards become more powerful. "Soon the processing
   power of a smartcard will be such that it will be able to
   overcome that kind of issue," says Cyril Annarella, a
   technical consultant for the French company Gemplus,
   which makes cards for the EMV members.

   [End]