News

Researchers mathematically prove security of next gen EMV chip

November 4, 2013

Current chip technology used at the ATM and POS was developed almost 20 years ago — a fact that has given some deployers pause as they consider implementing the "new" technology. However, EMVCo, which manages and maintains the EMV spec, is currently designing the next generation of the technology to meet long-term industry requirements for both online and offline transactions.

The protocol offers a key agreement system based on elliptic curve cryptography, and was needed due to the constrained nature of payment cards and new requirements for protecting contactless transactions. It was developed by EMVCo and then published on its website as a request for comments. 

University of Bristol researchers responded and proved mathematically that the protocol meets the security goals that it was designed to achieve, according to a news release from the university.

"This is an important step in validating the technology we will all start to use in the future," said Nigel Smart, professor of cryptology at the University of Bristol. "When the previous chip technology was designed, people did not know how to mathematically prove that a protocol satisfied certain security goals. The science of cryptography has advanced and is now at a stage where this is possible and protocols that will be used in the real world can be fully analyzed."

"EMVCo welcomes the initiative of Professor Nigel Smart and his fellow researchers in developing a security proof of this key agreement protocol," said Christina Hulka, chair of the EMVCo board of managers. "EMVCo is of the view that the new cryptographic algorithms and protocols that will be used to secure billions of EMV payment transactions should not only offer optimum performance but also receive the best security analysis that modern cryptology can provide."

Dr. Gaven Watson from the University of Bristol Department of Computer Science will present a paper at the Association of Computing Machinery's Conference on Computer and Communications Security sharing the details of a study that validates the proposed protocol design to be used in future EMV chip cards.   

The paper represents joint work by researchers at Bristol and the Engineering Faculty of Tel-Aviv University.

Read more about EMV.