EMV (card payment transactions)
The abbreviation EMC ( E uropay International, M aster card and V ISA) denotes a specification for payment cards provided with a processor chip are provided, and for the associated smart card devices ( POS terminals and ATMs ). The letters EMV stand for the three companies that developed the standard : Europay International (now MasterCard Europe ), Mastercard and VISA .
Chip instead of magnetic stripe
In the second half of 1990 year were in several countries of Europe debit cards with microchip equipped to card transactions no longer technically outdated magnetic strip to have to handle. These chips were all proprietary and tailored to the needs of the respective countries. The lack of not being able to be used across borders was quickly recognized and remedied by the EMC standard.
The main advantages of chip technology and thus also reasons for replacing the magnetic stripe with the chip are:
- In contrast to the magnetic stripe, the chip can be effectively protected against duplication or modification by means of technical processes. The chip can carry out encryption without a secret key value being used being able to be read out.
- When using chip cards, the identification of the card authenticity (Card Authentication) and the verification of the PIN (Cardholder Verification) can take place without an online connection.
- In contrast to the magnetic strip, which functions as a purely passive data storage device , a chip is a miniature computer with computing power comparable to a PC from the 1980s, with protected data areas and the use of cryptographic processes. This also enables additional functions such as an electronic wallet and regular customer programs. However, the specification of these additional applications is not part of EMV, as EMV is limited to payment applications.
The EMC standard
Europay International, MasterCard and VISA as the largest payment card organizations jointly developed the EMV standard named after them. The first stable edition of the EMV chip specifications was the EMV'96 Integrated Circuit Card Specification, Version 3.1.1., Which, contrary to its name, was not published until 1998. The restructured, corrected, and expanded EMV 2000 Integrated Circuit Card Specification, Version 4.0, was published in late 2000. This specification applies to all payment cards, ie both debit cards and credit cards . EMV 4.1 is only a revision of the EMV 4.0 standard and was published in June 2004.
The EMC standard is essentially based on the principles of interoperability and flexibility. Interoperability means that the same cross-system and cross-border card and terminal use that exists with magnetic stripe technology is also available with chip card technology. Flexibility means that every payment system must be able to meet individual requirements beyond interoperability. The EMV 4.1 standard is divided into four so-called “books”. Book 1 defines the interface between card and terminal (mechanical behavior, electrical behavior, transport protocol) and the application selection (application selection; the same for all cards and all terminals); Book 2 deals with “Security and Key Management”, Book 3 with the “Application Specification” and Book 4 with the “Interface Requirements”. The system operators (payment transaction systems) can choose their options from the toolbox of the EMV standard, whereby the basic idea is that the terminal must support all of the options listed and only individual options can be used for the card.
For the development of the common standard and its further development, the EMV namesake founded a company of its own, EMVCo LLC . The EMC standard was defined by this company and further developed by it. EMVCo LLC also tests and certifies the manufacturers of EMC-capable devices such as B. ATMs and POS terminals that use EMV technology. They are responsible for meeting the individual needs of the payment transaction systems that go beyond this.
EMV payments
With an EMV payment, an application is selected on the EMV chip. This has an identifier which is printed on the customer receipt. The identifier is called the application identifier (AID or AppID) and consists of a 5-byte registered application provider identifier (RID) and a 2 to 5-byte proprietary application identifier extension (PIX). The RID of the interest group Die Deutsche Kreditwirtschaft is A000000359 and the PIX of the girocard is 1010028001. This is why the AID A0000003591010028001 is on almost every receipt of German girocard payments.
Migration to EMC
To implement the chip technology, the Europay / MasterCard and VISA organizations have drawn up a migration plan according to which all European payment cards should have an EMV chip by 2005 and all European terminals ( cashless sales outlets and ATMs ) should be EMV chip-compatible. Financial incentives should promote the changeover. Terminal migration is rewarded with Europay International / MasterCard International and the issuing of EMV-compatible cards with VISA EU. On January 1, 2005, there was also a so-called liability shift. This means that if a case of damage based on card forgery occurs, the " acquirer " (the contracting company accounting bank) or the " issuer " (the card-issuing bank), who does not support EMV on the terminal or card side, are liable.
On July 1, 2002, DaimlerChrysler Bank was the first German bank to issue a (Visa) credit card with an additional EMV chip on the front. It was expected that with all these measures on cards and terminals, chip technology would spread rapidly (for the time being) parallel to magnetic stripe technology and then replace it in a smooth transition. In fact, almost all credit cards in Germany were still issued in 2008 without an EMV chip, while around 70% of the debit cards (ec cards) on the market were equipped with an EMV chip. In mid-2009, ATMs were 92% EMC-compatible in both Germany and Europe.
After Visa, MasterCard and Discover published their migration plans for the USA in early 2012, the credit card companies began in the last quarter of 2015 to swap credit cards with magnetic stripes for credit cards with EMV chips. Since January 2016, the “ acquirer ” (the contracting company accounting bank) or the “ issuer ” (the card-issuing bank), who do not support EMV on the terminal or card side, have been liable. 10 years after the introduction of EMV technology in Europe, the credit card issuers in the USA have now followed suit.
2010 bug
As of January 1, 2010, around 30 million older EC and credit cards with EMV chips in Germany experienced processing difficulties because the microchips had been programmed incorrectly. Only cards that were equipped with a chip module from Gemalto were affected . As a result, the affected customers could neither withdraw cash from ATMs nor make cashless payments (using EMV transactions) at POS terminals.
As this led to considerable problems in payment transactions, but the banks concerned did not want to exchange the faulty cards for reasons of time and money, the software of the ATMs and payment terminals was temporarily reconfigured as a consequence. In the case of ATMs, the fallback already provided in EMV for faulty cards was used for a short time. Here the transaction "falls" back from the secure chip to the magnetic strip. Since the MM security feature is required on the magnetic stripe of payment cards and for ATMs in German payment transactions, the security of the transaction was guaranteed. At the electronic cash terminals, the process was configured in such a way that the old national electronic cash chip application still present in the affected chip cards was switched over and the faulty EMV application of the chip card was no longer used. These immediate measures were completed within a week.
An update system was then implemented to adapt the faulty data elements in the card, which reconfigured the CDOL1 on the chip card. For this, the data relevant for CDOL1 were prescribed in a different order, in which the 2010 bug no longer occurs. To import the update, a transaction without payment had to be made. The customers were informed of the reconfiguration of the card on the terminal after a successful update.
safety
On February 11, 2010, a group of computer scientists from the University of Cambridge published an effective man-in-the-middle attack against a POS terminal in the in-house Cambridge cafeteria, which was certified according to the British Standard Chip Authentication Program (CAP). The attack makes it possible to confirm the transaction by entering any PIN. In this attack, a fake card that is linked to a real card is pushed into the terminal. The message from the terminal to the chip card, which contains the PIN to be checked, is intercepted and answered with a "PIN OK" message. So the terminal believes that the correct PIN has been entered, while the card assumes that the payment was made with a signature. This attack works because the response message does not have to be cryptographically secured. In Germany, the attack can only work if the outdated German chip operating system SECCOS v5 is used, for which the transition period has now expired. According to the German credit industry (formerly the Central Credit Committee, ZKA), Germany is therefore not affected by the problem.
The EMV specification "Common Payment Application Specification" from 2005 in chapter "15.5.3.4 Terminal Erroneously Considers Offline PIN OK Check" requires a check in the event of a positive PIN verification wrongly accepted by the terminal. The same chapter can also be found as chapter "5.2.5.5.3 Terminal Erroneously Considers Offline PIN OK Check" in the German ZKA specification "Interface Specifications for the SECCOS ICC - EMV Commands" from 2007.
From a technical point of view, after the VERIFY PIN command at 1st GENERATE APPLICATION CRYPTOGRAM in CDOL1, the bit for "PIN verification performed by ICC" is also transferred from the terminal to the card via the Cardholder Verification Method Results (9F34). The card must check this and then request that the user go online or cancel the transaction. This is where the hack should have failed in Great Britain at the latest.
Specifications
- 1996: EMC 3.0
- 1999: EMC 3.1.1
- 2000: EMV 4.0 (EMV 2000)
- 2004: EMC 4.1
- 2008: EMC 4.2
- 2011: EMC 4.3
See also
Web links
Individual evidence
- ↑ Visa update for EMV Chip implementation in the US ( Memento of the original from June 16, 2012 in the Internet Archive ) Info: The archive link was automatically inserted and not yet checked. Please check the original and archive link according to the instructions and then remove this notice.
- ↑ MasterCard Aligns with Visa's US EMV Migration Plans by Publishing its Own EMV Implementation Roadmap ( Memento of the original from June 16, 2012 in the Internet Archive ) Info: The archive link was automatically inserted and not yet checked. Please check the original and archive link according to the instructions and then remove this notice.
- ↑ Discover Implements EMV Mandate for US, Canada and Mexico
- ^ French company to blame for 2010 error Spiegel Online Wirtschaft
- ^ Opinion of the ZKA: Lessons learned from the "2010 problem" - Business Continuity Management in chip card systems ( Memento of the original from September 11, 2010 in the Internet Archive ) Info: The archive link was automatically inserted and not yet checked. Please check the original and archive link according to the instructions and then remove this notice. (PDF; 34 kB)
- ↑ Steven J. Murdoch, Saar Drimer, Ross Anderson, Mike Bond: Chip and PIN is Broken . In: IEEE Symposium on Security and Privacy . 2010 ( cam.ac.uk [PDF]).
- ↑ Statement of the ZKA ( Memento of the original from March 15, 2014 in the Internet Archive ) Info: The archive link was inserted automatically and has not yet been checked. Please check the original and archive link according to the instructions and then remove this notice.
- ↑ Common Payment Application Specification
- ↑ EMC 4.3
