Abstract:

 The research focuses on the offline data authentication mechanism in part 5, 12, 13, 14 of “China Financial Integrated Circuit Card Specifications” (JR/T 0025, referred to as “PBOC”), and evaluates its ability against side channel attacks, differential fault analysis and dictionary attacks. We find out that the offline data authentication has a flaw against financial IC card forgery and experiments on the financial cards issued by the bank verify our finding. Finally we propose several countermeasures against these attacks.

Key words: PBOC 3.0, offline data authentication, dictionary attack, entropy