1

I'm currently reading about an access control and saw something interesting about smartcard contact & contactless.

From what I understood from the book, smartcard contact is like an ATM Card. Then smartcard contactless is like RFID, which is used for door access at a lot of companies.

I was just wondering, is that possible to implement RFID on ATM?

Conventional ATM Machine workflow:

  • insert the ATM card
  • enter the PIN
  • make your transaction
  • finish transaction
  • exit and card comes out

RFID ATM Machine workflow:

  • put the card close to the reader
  • enter the PIN
  • make your transaction
  • finish transaction and exit
  • put your card near the reader once again to finish transaction session.
Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
RizGuard
  • 23
  • 8
  • It's not entirely clear what you are asking. I especially don't understand your last two sentences. Can you clarify? – lzam Sep 10 '14 at 00:47
  • I'm so sorry, if its not clearly understanding.. From what I know RFID have two concern, radio freq hacking and duplicating the card.. Is that why the RFID ATM Machine not popular or hard to implemented ? – RizGuard Sep 10 '14 at 01:15
  • 4
    Are you _sure_ you mean [RFID](http://en.wikipedia.org/wiki/Radio-frequency_identification), or do you actually mean [NFC](http://en.wikipedia.org/wiki/Near_field_communication)? – lzam Sep 10 '14 at 01:21
  • 2
    One possible _concern_ is that this way the ATM machine couldn't _eat_ your card in case it's been revoked for some reason (stolen, locked account,...). So it's not so much of a technical challenge as it is a procedural one, especially with cards offering multiple transaction authorisation methods. The technical challenges can be solved, say using unguessable challenge-response solvers (without knowing a secret that's not shared), something akin to [EVM](http://security.stackexchange.com/q/46319/20074). Please [edit] your question's last few sentences for clarity tho. Cheers! – TildalWave Sep 10 '14 at 01:29
  • Izam ~ thanks for clarify, yes what I mean is NFC, but I'm not quite wrong.. Because NFC also derive from RFID.. – RizGuard Sep 10 '14 at 03:28
  • TildaWave ~ thanks for your answer.. I'm a little understand that.. Why NFC card not suitable to ATM Machine until they found something solution for challenge-response like you said.. Cheers – RizGuard Sep 10 '14 at 03:33
  • 1
    @TildalWave Solution to the "can't eat card" concern: Each card has a different identifier/cert (even multiple cards on the same account should be different) which gets revoked server-side in the case of lost/stolen/locked. This is even more secure than eating the card, since it can be done without actually needing to have the card at an ATM and is also effective globally against any clones. – Iszi Sep 10 '14 at 19:37

2 Answers2

2

First, a note on terminology. Usually:

  • RFID is communication between a passive tag (no power source, acts as a simple memory, without any communication) and a reader. Communication is one-way: the RFID tag has no way to receive information.
  • A contactless smartcard has a credit card form factor and can perform computation (it has a CPU, and its memory is accessed by that CPU, not by the external reader like in the case of an RFID tag). It does not have a power source: the CPU can only work while it is powered by a contactless reader through induction.
  • NFC is bidirectional communication using the same principles as RFID. NFC can work between two powered devices (e.g. a smartphone and a reader in another form factor, or two smartphones) or between a powered device (smartphone, reader) and an unpowered device (a tag (which is only a memory) or a contactless smartcard (which has a CPU)).

This terminology is not always used consistently: NFC tags are sometimes called RFID, for example. There are rewritable tags, which don't contain a CPU but which the reader can overwrite; these are sometimes called RFID tags, sometimes NFC tags.

An ATM card is a contactless smartcard, not an RFID tag nor an NFC device. A contactless smartcard is able to provide security because it contains a memory that cannot be read externally.


Now onto your question. It is certainly possible to perform a transaction with a contactless smartcard using the workflow you describe: first the card identifies itself, then the ATM queries the user for the transaction to perform and possibly validates it against a server, and at the end the ATM performs the transaction if the card is willing.

I don't know if there are ATMs that operate like that, but there are other types of machines that do. For example, to recharge a Paris transport pass, you put your card onto a reader tray (the round purple thing below the screen in the picture below), where it's kept in place, but you can take it off at any time, and the card can be in a wallet or other holder. Normally the card stays on the tray for the duration of the session; I think it does follow the two-phase system outlined above (first read the card information, then interact with the user, then upload the outcome of the transaction to the card).

enter image description here

I remember seeing other transport pass machines where the interaction is closer to what your envision, with an initial swipe and a final swipe. The tray method allows longer interactions, which may be required when the card has to perform costly actions such as a signature, as well as continuous interactions, for example to validate a PIN or some transaction details.

Compared with the contact method, there is a practical usability advantage to the contactless method: the card doesn't have to be a card form factor, you can keep it inside a holder or in your wallet or handbag. In fact, the card doesn't have to be a card at all: the reader can also interact with an NFC-able phone that's emulating a card. I don't think double swipe has a usability advantage compared to a tray, but it may allow the machine to be smaller.

US ATMs operating off the magnetic stripe treat the credit/debit card as a simple memory: you insert the card once at the beginning of the transaction, and that's it. If an ATM is designed to follow the same procedure then a single, initial swipe would be sufficient. However smart cards allow more security than a simple memory since they can do things like generate one-time tokens (e.g. a signature for a given transaction) or validate a PIN and self-destruct after 3 attempts. This requires the card to be available at more times during the transaction.

European ATMs (designed for chip cards) swallow the card and release it at the end of the session. There are security benefits to this. This allows the card to remain swallowed if the user mistypes their PIN three times or if the card has been reported stolen. This also allows the ATM to verify the card form factor, which is the antithesis of contactless; the advantage of insisting on the form factor is that this makes it harder to fool the ATM into believing that the card is present. Relay shims that can be inserted into an ATM do exist but they took a few years to design. Thieves have an advantage if they don't need to bring the actual card to the ATM and can instead use a communication relay: they can use the card very quickly before it's reported stolen (maybe even without the owner noticing); and they can make themselves harder to trace and prosecute since the card thief may be in a different country from the ATM.

The upshot is that contactless ATM transactions are possible. The security afforded is intermediate between what you can achieve with a magnetic stripe and what contact chip card ATMs do. I don't know if there are contactless ATMs yet; the technology is pretty new, on a time scale for banking technology.

Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
0

An RFID ATM card (using traditional RFID with one way communication) doesn't sound like a smart idea. If an attacker could get close enough, he could simply record the ID that the card broadcasts, and create a clone of your ATM card.

NFC, on the other hand, would be much more suitable. Since NFC supports two-way communications, the card can verify itself through some sort of challenge-response mechanism using a secret key that is never broadcasted.

Perhaps, as TildalWave suggested in his comment, NFC is not used in ATMs in order to retain their ability to "eat" your card. Another possible reason is inertia. Banks aren't always to quick to adapt new technologies, and may just not want to fiddle with a system that is "good enough".

lzam
  • 872
  • 5
  • 16