• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

计算机工程与科学

• 论文 • 上一篇    下一篇

金融IC卡规范脱机动态数据认证的漏洞研究

杜磊,李增局,彭乾,史汝辉,张策   

  1. (北京银联金卡科技有限公司,北京 100070)
  • 收稿日期:2015-06-25 修回日期:2015-10-12 出版日期:2016-10-25 发布日期:2016-10-25
  • 基金资助:

    国家科技重大专项核心电子器件、高端通用芯片及基础软件产品(2014ZX01032401)

Research on the loophole of offline dynamic data
authentication in financial IC card specification

DU Lei,LI Zeng-ju,PENG Qian,SHI Ru-hui,ZHANG Ce   

  1. (Beijing UnionPay Card Technology Ltd.,Beijing 100070,China)
  • Received:2015-06-25 Revised:2015-10-12 Online:2016-10-25 Published:2016-10-25

摘要:

对《中国金融集成电路(IC)卡规范》(JR/R 0025,简称PBOC)第5部分、12部分、13部分、14部分中脱机数据认证机制的安全性进行了研究,分析了脱机数据认证机制抗侧信道攻击、差分错误分析以及字典攻击的能力,防止伪卡的能力,提出了规范实现过程中存在的安全漏洞。通过实际客户的银行卡片对漏洞进行了验证。结论表明该漏洞存在实际使用卡片中。最后提出了规范修改建议,以规避这种安全漏洞。

关键词: PBOC 3.0, 脱机数据认证, 字典攻击,

Abstract:

 The research focuses on the offline data authentication mechanism in part 5, 12, 13, 14 of “China Financial Integrated Circuit Card Specifications” (JR/T 0025, referred to as “PBOC”), and evaluates its ability against side channel attacks, differential fault analysis and dictionary attacks. We find out that the offline data authentication has a flaw against financial IC card forgery and experiments on the financial cards issued by the bank verify our finding. Finally we propose several countermeasures against these attacks.

Key words: PBOC 3.0, offline data authentication, dictionary attack, entropy