ICカードに利用される暗号アルゴリズムの安全性について：ENV仕様の実装上の問題点を中心に

Size: px

Start display at page:

Download "ICカードに利用される暗号アルゴリズムの安全性について：ENV仕様の実装上の問題点を中心に"

しほこあかさか
5 years ago
Views:

1 IC IC IC ICIC EMVEMV IC EMVIC EMV ICEMVRSAkey TDES TDES-MAC NTT

2 IC IC IC IC EMV JCCA ICJCCA ICEMV EMVIC EMV EMV EMVEMVCo EMV EMV EMVICIC EMV Europay International MasterCard InternationalVisa InternationalIC

3 IC EMV EMVIC ISO/IEC Identification Cards Integrated circuit cards with contactsic IC IC IC JCCAEMV EMV EMV IC EMV ACApplication Cryptogram IC EMVEMVCo MasterCard InternationalEuropay InternationalEMVCoLLC EMVv

4 AC EMVSDAStatic Data Authentication DDADynamic Data Authentication CDACombined DDA / Application cryptogram generation SDAPAN: Primary Account Number SDA DDA CDADDAAC EMVPIN PIN EMV

5 IC PIN PIN: Personal Identification Number PINPIN PIN PINPINPIN EMV EMV AC ATC: Application Transaction Counter AC AC SysK MK MK SK SK SK AC AC AC AC PINEMVISO Banking - PIN management and security PIN

6 EMV EMV EMVEMV EMV EMV EMVRSA SDADDA RSA RSA IC RSA RSA RSA RSARivest, Shamir, and Adleman RSA nn = pqpq RSAmsds := m d mod n

7 IC mod nm 1 m 2 m 1 m 2 m 1 m 2 x mxmxm ( mod n) x Desmedt and Odlyzko RSA mp 1 p 2 p k s := p d 1 p d 2 p kd ( mod n)p i 1 i k p i dp id mod n p id mod n RSA EMV EMVCoISO/IEC Bleichenbacher ISO/IEC CNS ISO/IEC n = 1,024HSHA-1 SR ISO := mbit h 0xBC bit SR ISO = n = 1,024 SRs := SR d mod n esr := SR e mod nsr SR RSA

8 mbit hbit 0xBCbit CNSCoron, Naccache, and Stern CNS PKCS#v PKCS# v e e = 3 PKCS# v SR org := 0x00 0x01 padding 0x00 ID H h paddingpadding64sr org = n 0xFF nid H HIDhm H(m) padding garbagegarbage CNS PKCS#1 v1.5public Key Cryptography Standards #1 version 1.5PKCSRSA PKCS#RSA PKCSS/MIME Secure Multipurpose Internet Mail Extension

9 IC garbage e = 3 n = 3,072 SR org padding garbagesr org SR mod (SR mod = n) SR mod := 0x00 0x01 padding 0x00 ID H h garbage Step SSVID H hgarbage Step Sxh := H(x) a := (ID H h)a xa Step S s := a/ Step Vh := H(x) Step Vs 3 s 3 =( a/ ) 3 = a a 2 / a 3 / =( ID H h) garbage garbage := a 2 / a 3 / Step V0x00 0x01 padding 0x00 ID H h ID H h 0x0001 padding 0x00 ID H h garbages x e e = 3 n = 3,072e = 3 Step Sxa EMV ISO/IEC IC EMVCo pp.

10 SR EMV := 0x6A (n, e ) padding EMV 0xBC + padding EMV = n 288 bit 0xBBn CACertificate Authority EMV e e = EMV padding EMV padding EMV padding EMV padding EMV EMV RSARSA-PSS b Bellare and Rogaway RSA-PSSRSA-Probabilistic Signature SchemeRSA Bellare and Rogaway

11 IC Brenta Lenstra and Verheul EMVCoCA a bemv ba CACertificate AuthorityIC

12 EMVCo EMVICRSA RSARSA EMVIC EMVIC IC key DESkey TDESACApplication Cryptogram key TDES DES AC AC AC AC

13 IC AC EMV EMVIC EMVCop. key TDESE TDES SysK(SysK = 128)ICMK (MK = 128)ICPAN PANSeqxz E y := E (z; x)d x := D (z; y) ICMK MK := E TDES (SysK; (PAN, Seq)) key TDESPANPAN PANPAN key TDES N 120 log 2 NOorshot and Wiener SysK 2 40 key TDES ( PAN ICi, Seq ICi ) SysK E TDES MK IC1 MK IC2 MK ICi SysK

14 PANPAN key TDESAESCamellia EMV EMVCopp. key TDESE TDES ICMK(MK = 128) ATCc (0 c2 16 1)Φ Φ(x, y, j ) := (E TDES (x; y l ( j mod 4)) E TDES (x; y r ( j mod 4) (0xF0))) x = 128y l = y r = 64y = y l y r IK IK 1, j := Φ(MK, 0 128, j ), j = 0, 1, 2, 3. IK i, j := Φ(IK i 1, j/4, IK i 2, j/16, j ), 0 j 4 i 1, 2 i 8. j := catcc SK c SK c := IK 8,c IK 6,c /16. MK IK 1, 0 IK 1, 1 IK 1, 2 IK 1, 3 IK 2, 0 IK 2, 3 IK 2, 15 IK 8, 0 = IK 6, 0 SK 0 IK 8, 1 IK 8, = SK 1

15 IC SK c IK 8,c IK 6,c /16 IKMK EMV ICMK( = mk 1 mk 2 )SK ATCc (c = 16)mk 1 = mk 2 = sk 1 = sk 2 = 64 SK sk 1 := mk 1 (0 48 c ) sk 2 := mk 2 (0 48 (c 1 16 )) SK := sk 1 sk 2 IC SKIC c mk 1 := sk 1 (0 48 c )mk 2 := sk 2 (0 48 (c 1 16 )) AC EMV mk 1 mk c 0.0 c 1.1 sk 1 sk 2

16 IC EMVEMV EMVCoDES EMV AC DESkey TDES CBC-MACTDES-MACDES CBC-MACDESkey TDESTDES-MAC IC TDES-MAC m 1 E TDES m 2 m n E TDES E TDES E TDES m 1 m 2 m n E DES E DES E DES E DES D DES E DES k 1 k 1 k 1 k 1 k 2 k 1 DES Cracker DES TDES-MACISO/IEC DES

17 IC DESE DES DESD DES m = (m 1, m 2,, m n )k ( = k 1 k 2 k 1 = k 2 = 64)d d i := E DES (k 1 ; m i d i 1 ), i = 1, 2,, n, d 0 = 0 64 d := E DES (k 1 ; D DES (k 2 ; d n )) TDES-MACDES Step TDES-MAC bit 2 32 m, m d := E DES (k 1 ; D DES (k 2 ; d n )) = E DES (k 1 ; D DES (k 2 ; d n )) d n d i := E DES (k 1 ; m i d i 1 ), i = 1, 2,, n, d 0 = 0 64 d n Step m, m d n = d n k 1 DESbit2 56 k 1 Step k 1 D DES (k 1 ; d)d DES (k 2 ; d n )D DES (k 2 ; d n ) d n 2 56 k 2 TDES-MAC 2 32 DES 2 57 (= ) EMVTDES-MAC DES TDES-MAC ACAC AB P P = 1 e ( A2 / 2B )

18 ICAC TDES-MACAESCamellia CBC-MAC TDES-MAC key TDESEMV key TDES IC AESCamellia ACTDES-MACDES key TDES DES EMV EMV TDES-MAC2 100 CBC-MACAC2 64

19 IC

20 RSA Coron-Naccache -Stern RSA IC Bellare, M., and P. Rogaway, Random Oracles are Practical: A Paradigm for Designing Efficient Protocols, Proc. of 1st ACM Conf. on Computer and Communications Security, ACM Press, 1993, pp , and, The Exact Security of Digital Signatures How to Sign with RSA and Rabin, Advances in Cryptology Proceedings of EUROCRYPT 96, LNCS 1070, Springer- Verlag, 1996, pp Bleichenbacher, D., Forging some RSA signatures with pencil and paper, CRYPTO 2006 Rump Schedule, Brent, R., Recent progress and prospects for integer factorization algorithms, Proc. of COCOON 2000, LNCS 1858, Springer-Verlag, 2000, pp Coron, J. S., D. Naccache, and P. Stern, On the Security of RSA Padding, Proc. of CRYPTO 99, LNCS 1666, Springer-Verlag, 1999, pp Desmedt, Yvo, and A. M. Odlyzko, A chosen text attack on the RSA cryptosystem and some discrete logarithm schemes, Proc. of CRYPTO 85, LNCS 218, Springer-Verlag, 1986, pp EMVCo, EMV2000 Integrated Circuite Card Specification for Payment Systems: Book 2 Security and Key Management, EMVCo, 2000., EMV Integrated Circuite Card Specification for Payment Systems: Book 2 Security and Key Management, EMVCo, 2004., Bulletines-Notices, ( access date: February 28, 2007) International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), ISO/IEC :1999 Information technology Security techniques Message Authentication Codes (MACs) Part 1: Mechanisms using a block cipher, ISO/IEC, 1999., and, ISO/IEC :2002 Information technology Security techniques Digital signature schemes giving message recovery Part 2: Integer factorization based mechanisms, ISO/IEC, Lenstra, A. K., and E. R. Verheul, Selecting Cryptographic Key Sizes, Journal of Cryptology, 14 (4), 2001, pp

21 IC Oorshot, P. C. van, and M. J. Wiener, A known plaintext attack on two-key triple encryption, Advances in Cryptology Proceedings of EUROCRYPT 90, LNCS, vol. 473, Springer-Verlag, 1990, pp Rivest, R. L., A. Shamir, and L. Adleman, A method for obtaining digital signatures and public key cryptosystems, Communications of the ACM, vol. 21, ACM Press, 1978, pp

リテール・バンキング・システムのICカード対応に関する現状とその課題

リテール・バンキング・システムのICカード対応に関する現状とその課題 IC IC IC ATM IC IC ATM IC IC IC IC E-mail: yuuko.tamura@boj.or.jp E-mail: hirokawa@imes.boj.or.jp IC IC MS IC IC IC IC IC IC IC MS IC IC IC IC IC ICIC ICATM ATMIC IC IC ATMMS IC MS IC IC IC IC ATM IC ICIC