Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/15/2009
03:27 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Smart Card Alliance: End-To-End Encryption Won't Stop Credit-Card Fraud

Industry association proposes contactless chip cards, says end-to-end encryption isn't enough

The Smart Card Alliance has taken a stand against pure end-to-end encryption as a way to protect credit-card transactions, publishing a position paper this week calling instead for contactless chip cards with dynamic cryptograms.

Merchants and payment processors are under pressure to make changes in how customer card data is protected in the wake of major data breaches over the past two years, such as that of Heartland Payment Systems, which have exposed millions of customer credit and debit cards. The electronic payment industry is considering the adoption of a new ANSI standard, and Heartland is pushing for it to embrace end-to-end encryption of cardholder data.

"End-to-end encryption is designed to protect static data. As long as the transaction data is static, this is another way of combating fraud," says Randy Vanderhoof, executive director of the Smart Card Alliance. But when card data is being entered into a point-of-sale system (POS), for instance, it's still at risk, he says.

"It's like putting a steel door on a grass hut," he says. "Fraudsters will find other ways to get at that static data before it gets there, with things like skimming [the card data] as it's entered into the point of sale system, or cloning cards that are lost or stolen."

The alliance, whose members include Bank of America, MasterCard, Visa, HID Global Corporation, and the State Department, argues in its position paper that contactless chip cards with dynamic cryptograms for each transaction are a better solution than end-to-end encryption.

And if the industry does decide to adopt end-to-end encryption, the alliance recommends the standard allow for "globally-interoperable secure payment transactions using chip card technology in the future," the paper says.

The Smart Card Alliance's Vanderhoof says his organization's proposal is different from pure chip and PIN technology. "We're not advocating that the U.S. needs to go all the way to a full chip and PIN implementation, but chips with dynamic data like contactless payment cards that are on the market today," he says.

He says the proposal basically builds on existing "express" payment card programs from Visa, MasterCard, and American Express that provide more convenient and faster payment than traditional cards. These express cards use contactless card technology.

"The U.S. could see a significant change in fraud by introducing more dynamic data versus magnetic stripe data," Vanderhoof says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7617
PUBLISHED: 2019-08-22
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
CVE-2019-14751
PUBLISHED: 2019-08-22
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
CVE-2019-9153
PUBLISHED: 2019-08-22
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
CVE-2019-9154
PUBLISHED: 2019-08-22
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
CVE-2019-9155
PUBLISHED: 2019-08-22
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.