Implementing Electronic Card Payment Systems (Artech House Computer Security Series)

463 Pages·2002·1.18 MB·English

by  Cristian Radu

Implementing Electronic Card
Payment Systems
Forquitealongtime,computersecuritywasarathernarrowfieldofstudythatwaspopu-
latedmainlybytheoreticalcomputerscientists,electricalengineers,andappliedmathema-
ticians.Withtheproliferationofopensystemsingeneral,andoftheInternetandtheWorld
Wide Web (WWW) in particular, this situation has changed fundamentally. Today, com-
puter and network practitioners are equally interested in computer security, since they
require technologies and solutions that can be used to secure applications related to elec-
tronic commerce. Against this background, the field of computer security has become very
broadandincludesmanytopicsofinterest.Theaimofthisseriesistopublishstate-of-the-
art,highstandardtechnicalbooksontopicsrelatedtocomputersecurity.Furtherinforma-
tion about the series can be found on the WWW at the following URL:
http://www.esecurity.ch/serieseditor.html
Also, if you’d like to contribute to the series by writing a book about a topic related to
computersecurity,feelfreetocontacteithertheCommissioningEditorortheSeriesEditor
at Artech House.
Recent Titles in the Artech House
Computer Security Series
Rolf Oppliger, Series Editor
Computer Forensics and Privacy, Michael A. Caloyannides
Demystifying the IPsec Puzzle, Sheila Frankel
Developing Secure Distributed Systems with CORBA, Ulrich Lang and Rudolf Schreiner
Implementing Electronic Card Payment Systems, Cristian Radu
Implementing Security for ATM Networks, Thomas Tarman and Edward Witzke
Information Hiding Techniques for Steganography and Digital Watermarking,
Stefan Katzenbeisser and Fabien A. P. Petitcolas, editors
Internet and Intranet Security, Second Edition, Rolf Oppliger
Non-repudiation in Electronic Commerce, Jianying Zhou
Secure Messaging with PGP and S/MIME, Rolf Oppliger
Security Fundamentals for E-Commerce, Vesna Hassler
Security Technologies for the World Wide Web, Second Edition, Rolf Oppliger
Software Verification and Validation for Practitioners and Managers, Second Edition,
Steven R. Rakitin
ForalistingofrecenttitlesintheArtechHouse
ComputingLibrary,turntothebackofthisbook.
Implementing Electronic Card
Payment Systems
Cristian Radu
Artech House
Boston (cid:127) London
www.artechhouse.com
LibraryofCongressCataloging-in-PublicationData
Radu,Cristian.
Implementingelectroniccardpaymentsystems/CristianRadu.
p.cm.—(ArtechHousecomputersecurityseries)
Includesbibliographicalreferencesandindex.
ISBN1-58053-305-1(alk.paper)
1.Electronicfundstransfers. 2.Creditcards. 3.Debitcards. 4.Payment—Dataprocessing.
5.Electromagneticcompatibility. I.Title. II.Series.
HG1710.R332003
658.8'8—dc21 2002033224
BritishLibraryCataloguinginPublicationData
Radu,Cristian
Implementingelectroniccardpaymentsystems.—(ArtechHousecomputersecurityseries)
1.Electroniccommerce—Securitymeasures 2.Electronicfundstransfers 3.Smartcards
I.Title
005.8'2
ISBN 1-58053-305-1
CoverdesignbyYekaterinaRatner
©2003ARTECHHOUSE,INC.
685CantonStreet
Norwood,MA02062
SET™isatrademarkownedbySETSecureElectronicTransactionLLC.CEPS™isatrademarkofCEPSCo,LLC.
EMV™isatrademarkownedbyEMVCo,LLC.TheauthoracknowledgesthattheuseofthewordEMV™shall
neverimplyauthorizationorendorsementbyEMVCo,LLC,norwillitimplythattheauthorhasobtained
EMVCoapprovalforthecontentofthisbook.TheauthoragreesandacknowledgesthattheuseoftheEMV™
specificationsforwritingthisbookdoesnotcreateanyrelationshipbetweenEMVCoandtheauthor.3-D
Secure™isatrademarkownedbyVisaInternational.3-DSET™isatrademarkownedbyVisaInternational.
SPA™isatrademarkownedbyMasterCardInternational.
Allrightsreserved.PrintedandboundintheUnitedStatesofAmerica.Nopartofthisbookmaybereproduced
orutilizedinanyformorbyanymeans,electronicormechanical,includingphotocopying,recording,orbyany
informationstorageandretrievalsystem,withoutpermissioninwritingfromthepublisher.
Alltermsmentionedinthisbookthatareknowntobetrademarksorservicemarkshavebeenappropriately
capitalized.ArtechHousecannotattesttotheaccuracyofthisinformation.Useofaterminthisbookshouldnot
beregardedasaffectingthevalidityofanytrademarkorservicemark.
InternationalStandardBookNumber:2002033224
LibraryofCongressCatalogCardNumber:1-58053-305-1
10987654321
ToValentina,Cristina,andMatei
.
Contents
Acknowledgments. . . . . . . . . . xv
1 Introduction . . . . . . . . . . . . 1
PartI:Magneticstripedebitandcreditcards 3
PartII:ChipmigrationwithEMV 3
PartIII:RemotedebitandcreditwithEMV 5
Part I: Magnetic Stripe Debit and Credit Cards . 7
2 Payment Card Processing . . . . . . . 9
2.1 Paymentcardprocessingataglance 10
2.2 Rolesinvolvedinpaymentcardprocessing 13
2.3 Paymentcardbrands 15
2.4 Creditanddebitpaymentcards 16
2.5 Focusingonthemagneticstripecard 17
2.5.1 Embossedfinancialdata 18
2.5.2 Financialdataonthemagneticstripe 20
2.6 Threatsandsecurityprotections 24
2.6.1 Channelprotectionversuseavesdropping 25
2.6.2 Cardholderverificationversusimpersonation 27
2.6.3 Staticauthenticatorversusmodifyingfinancialdata 30
2.6.4 Timelinessversuscardcounterfeiting 31
2.6.5 Merchantattacksandcolludingattacks 33
2.7 Processingatthepointofservice 34
vii
viii Contents
2.8 Paymentnetworkandinterchangemessages 37
2.8.1 Messagestructure 38
2.8.2 Messageflows 41
2.9 On-lineauthorization 45
2.10 Clearingandsettlement 47
References 50
Part II: Chip Migration with EMV . . . . 51
3 Chip Migration. . . . . . . . . . . 53
3.1 Abusinesscaseforchipmigration 54
3.2 Anoverviewofthechipcardtechnology 56
3.2.1 Hardwareandsoftwarestructureofchipcards 57
3.2.2 Cardfilesystemandfilereferencing 60
3.2.3 Commandandresponseformat 65
3.2.4 Cardapplicationandterminalapplication 66
3.3 Proprietarypaymentapplication 69
3.3.1 Encodingdataelementswithafixedformat 71
3.3.2 Fixedfilesystemorganization 73
3.3.3 Preestablishedcommandandresponseformats 73
3.3.4 Symmetriccryptographictechnology 76
3.4 Interoperablepaymentapplication 80
3.4.1 Self-determinedencodingofdataelements 82
3.4.2 Customizedfilesystemorganization 84
3.4.3 Variableformatsforcommandsandresponses 87
3.4.4 Asymmetriccryptographicsupport 87
References 90
4 EMV Compliant Data Organization . . . . 91
4.1 OrganizationoftheEMVspecifications 92
4.2 EMVdataelements 96
4.3 EMVfilesystem 99
4.3.1 ADFs 99
4.3.2 AEFs 106
4.3.3 Directorydefinitionfiles 108
Contents ix
4.3.4 Paymentsystemenvironment 112
4.4 EMVapplicationselection 115
4.4.1 BuildingthecandidatelistfromthePSE 118
4.4.2 Buildingthecandidatelistdirectly 119
4.4.3 Finalapplicationselection 121
References 122
5 EMV Certificates . . . . . . . . . 125
5.1 Certificationmechanismandalgorithm 125
5.2 PublickeycertificateforRSAscheme 126
5.3 Entitiesandcertifiers 127
5.3.1 Issuerrequiresapublickeycertificate 127
5.3.2 ICCrequiresapublickeycertificate 128
5.4 Entitypublickeyremainder 129
5.5 EMVcertificationchains 129
5.6 IssuingEMVpublickeycertificates 132
5.6.1 Dataitemsincludedinthecertificate 132
5.6.2 Generatingthepublickeycertificate 135
5.7 VerifyingEMVpublickeycertificates 136
5.7.1 VerificationoftheIssuerPublicKeyCertificate 136
5.7.2 VerificationoftheICCPublicKeyCertificate 138
5.8 Issuingsignedstaticapplicationdata 140
5.8.1 AFL 141
5.8.2 CreatingtheStaticDatatoBeAuthenticated 142
5.8.3 GeneratetheSignedStaticApplicationData 143
5.9 VerifyingtheSignedStaticApplicationData 144
References 145
6 Debit and Credit with EMV . . . . . . 147
6.1 OverviewoftheEMVdebit/credittransaction 148
6.2 Initiateapplicationprocessing 152
6.2.1 TVRandTSI—twowitnessesofterminalprocessing 152
6.2.2 PDOLandGET PROCESSING OPTIONS 153
6.2.3 AIPandAFL 154
6.3 Readapplicationdata 156