How do EMV contactless cards protect against replay attacks?

Question

I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the company which validates the payment?

Answer 1

The most-authoritative reference on EMV replay (i.e., transaction cloning) is Peter Fillmore's latest talk from Syscan 2015

https://github.com/peterfillmore/Talk-Stuff/blob/master/Syscan2015/PeterFillmore_Syscan2015.pdf

Another great resource is Ricardo Rodriguez's talk from Rooted 2015

http://www.slideshare.net/cgvwzq/on-relaying-nfc-payment-transactions-using-android-devices

Which mentions the NFC Proxy talk from DEF CON 20 by Eddie Lee

https://youtu.be/tFi0vYuYeAI

Of additional interest is Ricardo Rodriguez's whitepaper on EMV relay attacks

http://conference.hitb.org/hitbsecconf2015ams/materials/Whitepapers/Relay%20Attacks%20in%20EMV%20Contactless%20Cards%20with%20Android%20OTS%20Devices.pdf

and Ricardo Rodriguez's website

http://vwzq.net

Some additional validation of these attacks was provided during a HackFu competition by MWR InfoSec

https://hackfu.mwrinfosecurity.com/hackfu-blog/params/post/465447/how-to-hack-a-contactless-payment-system.html

And finally, Michael Roland and Josef Langer write about the downgrade attacks against EMV, as well as the protections built into the protocol. As you can see, originally, the EMV contactless spec itself wanted to provide the protection (long before payment validation), but things don't always work out as planned.

http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12055-woot13-roland.pdf