I was reading the Wikipedia article on Card security codes (CSC, CVD, CVV, CVC, V-code, SPC, CID, CV2, CVN2, CAcronym2, etc) and a certain assertion caught my eye (emphasis mine):
The CSC for each card (form 1 and 2) is generated by the card issuer when the card is issued. It is calculated by encrypting the bank card number and expiration date (two fields printed on the card) with encryption keys known only to the card issuer, and decimalising the result.
The description sounds a lot like a HMAC using only already public information as the main input - but in any event, given the sheer number of compromised credit-card numbers (with Card security codes) in existence surely it must be possible to derive the issuer's encryption key by now? (Does it matter if it's symmetric encryption or asymmetric?)
If true, then I'm surprised the system is designed like that instead of generating a unique secret key or number, per card, from which the CSC is derived from instead of an institution-wide key - which my question presupposes can be derived from the large number of output values given knowledge of all cleartext input) - because my current understanding of cryptography tells me that the secret key can be derived given enough known cleartext input (compromised card details) and ciphertext output (compromised CSC codes).