1. Decimalisation Table Attacks for PIN cracking “ It takes an average of 15 guesses to determine a four digit PIN using this technique, instead of the 5000 guesses intended. ” Presented by Ji SUN By Mike Bond and Piotr Zieliński University of Cambridge Computer Laboratory Technical Report 560, February 2003, 14 pp.

2. Summary This paper presents an attack on HSM to crack customer PINs using adaptive decimalisation tables and guesses. Terminology Decimalisation table: *-to-1 mapping between hexadecimal and decimal digits HSM (Hardware Security Module): only YES/NO answer PIN (Personal Identification Number) ATM (Automatic Teller Machine, cash machine) PIN Generation Key: a secret DES key

3. Critical comments This paper should talk more about general background information of PIN security.  the architecture of ATM networks,  solutions to this kind of decimalisation table attacks If potentially serious vulnerabilities have been exploited by the bad guys to steal millions of cash from ATM because of publishing of this paper, so do you think bond and Zieliński should publish it in public? My answer is: No.

4. Appreciative comments This paper is very interesting because it mentioned an attacker can discover 7000 PINs in half an hour. ( HSM) 60 PINs/sec * 60 sec/min * 30 min ÷ 15 guesses =7200 PINs Bond and Zieliński described the fundamental techniques behind the decimalisation attacks in great detail. (See next slide)

5. Appreciative comments (cont.) Initial scheme (24 guesses, twice in the worse case) Three Attacks DigitsPossibilities (only in the 2 nd phase)Total Possibilities AAAAA(1)10/2 + 1 = 6 ABABBB(4),AABB(6),AAAB(4)10/2 +14 = 19 ABCAABC(12),ABBC(12),ABCC(12)10/2 + 36 = 41 ABCDABCD(24)10/2 +24 = 29 Average guesses: (6+19+41+29)/4= 23.75 ≈ 24 guesses Adaptive scheme (22 guesses?) PIN Offset Adaptive scheme (16.5 guesses)

6. IBM 3624-Offset PIN Generation Method Account Number:4556 2385 7753 2239 PIN (derivation) key:0505 0505 0505 0505 Dec. Encrypted Acc.:3572 2001 0020 8013 Encrypted Account:3F7C 2001 00CA 8AB3 Decimalisation PIN: 3572 Offset :4344 Customer PIN:7816 Decimalisation Table:0123 4567 8901 2345

7. PIN Verification (Offsets) Validation Data DigitReplacement Intermediate PIN (IPIN) Digit Subtraction module 10 module 10Customer Selected PIN DecimalisationTable Offset EDE Multiple EncryptionCiphertext PIN Generation Key The diagram quoted from: Clulow, J.S. “ I know your PIN ”, RSA Europe, October 2002

8. An example of Decimalisation Attack Dec. Table (0) = 1123456789012345 Dec. PIN = 3572 Offset= 4344 (will pass) Dec. Table (1) = 0223456789012345 Dec. PIN = 3572 Offset= 4344 (will pass) Dec. Table (2) = 0133456789012345 Dec. PIN = 3573 Offset= 4344 (will fail) = 4343 (will pass) In this example, we have identified that the 4 th digit in the original Decimalisation PIN is a 2 and so the 4 th final PIN digit is 2 + 4 = 6 (Dec.PIN + Offset = final PIN is 7816).

9. Questions? Is this decimalisation table attack a hypothetical threat or real one? Should Bond and Zieliński publish these attacks in public?