From:	Robert Watkins <bob@**.NTU.EDU.AU>
Subject:	Re: Credsticks
Date:	Thu, 9 Feb 1995 00:50:27 +0930

>
> GrIfTeR StEpS iN
>
> Which IS ON THE STICK. the stick holds enough data to tell
> someone where you live, what you look like etc. Some peaple put
> there keycodes on them. All locked away by the
> code/fingerprint/retinal scan it takes to activate the stick...
>
> BUT if you record the stick from a shop terminal it has just
> given you all the details it takes to acsess the bank account.
>
No... You don't understand the system. It goes like this:

The credstick has on it part of a time-dependant algorithim, keyed by a
random number. What this means is that each time it gets activated, the
code it sends to the database to prove that it is YOUR credstick changes.

Without the credstick, you can't do diddly to a person's account without
hacking the bank. If you get the credstick, THEN you can try things like
you mentioned. But, at the minimum, there is a code which can be changed.

Actually, I've no idea if this is how it is done. But this is how it COULD
be done. And it's totally secure, even if the details of the algorithim are
known. Like I said before, the US military uses this kind of tech for ultra
secure real time communications.

> So? if your working from a shop term, the fool stickowner has
> just given the nessasary authorisation to clear a 'payment'. you
> just record this verification (code/finger/retina) as its sent
> out to the bank and the sticks security is lost.

You still need the stick. If the sarariaman who loses the stick doesn't
change the code, then he/she is a fool.

> They're still open to abuse. Creditcard fraud is something like
> 3 billion/year NOW. even if credsticks cut this by 50% its still
> over a billion dollars. And anything you can invent, someone
> else can invent the countermeasure to.

Why??

> >
> > *sigh* look, if you couldn't change the amount on them, they wouldn't be
> > any more usefull than coins and notes, and a damn sight more inconvienent.
> So you CAN alter the amount on a certified credstick
> so whats to stop you hacking one and adding an extra few zeros?
> each credstick type has a maximum value it can hold, but no
> restrictions on who can use it or how many times it works
> ...so you just keep running the
> 1,000 =Y= stick to the limit then paying it into bank accounts

Possible... except that a bank is going to notice it if you keep doing this
kind of thing. Also, if you give certified credsticks serial numbers (quite
feasible), then a check through the logs will turn up rampant abuse of
things like this.

> > You can't have it both ways, Chopper. Either the chips are useless to you,
> > and therefore lightly guarded if at all, or they are very valuable to you,
> > and to the corps, and so they are heavily guarded. Moral of the story:
> > If it's easy to do, then there probably isn't much point in doing it.
> NO NO NO... what Chopper was saying is that the CHIPS are like
> banknote paper.hard to get, but useless unless you know what to
> do with it, so its not as secure as a CASH shipment.
>
I don't know how you Americans do it, but here in Australia, our bank notes
are extruded from the plastic at the mint... And for the two remaining
paper notes, the paper is held just as close to the chest as the cash is.
(But we won't have those for long, anyway)

> > > This DOES happen now, with crooked shops taking your credit
> > > card, copying the signiture and details and using them to buy
> > > stuff.
> >
> > Any secure system will have a time-dependent algorithim as a key, with at
> > least part of the algorithim stored in a place where you can't get it.
> like where? anywhere someone can get to on a regular basis to
> authorise a transaction can't have heavy security.
> You see, you have to balance security and ease-of-use.
> Imagine you had a Timelocked Vault door on your bathroom...
> Very secure, yes?
> Completely useless, as you can't get in without hours waiting.
>
> And how can you use a time dependant algorithm anyway? does the
> stick owner memorise it? <NO> does it get stored on the stick
> <easy to crack it and copy it> or is it in the bank? <useless>

That's not what time-dependant algorithims are... A time dependant
algorithim is a simple algorithim that takes the time as an input, and
returns a result dependant on this time. It's not like a time-lock, you can
always use it, you just get different results. Furthermore, it can have a
random input, which is unique to each card. Follow so far?

Now, both the bank and the credstick probably store a copy of the
algorithim. At the very least, the bank needs a copy. The credstick could
store only the random part, and download the algorithim, or anything in
between. When the credstick sends in its answer, it's compared to the
result the bank gets for the same time. Simple, no?

Now... you could crack open the stick to get it. But to do so, you'll need
the stick. Now, if you've got the stick, the owner doesn't. So the owner is
going to change the code, and get a new stick, making yours useless, and
probably sending out alerts if you try to use it.

> >
> <Fron the Cornflake killer>
> > I like the idea though.
> > But all serious loads of money are seldom transported by road.
> > Because the things you described are likely to happen then.
> > The usual mode of transportation is by air, in case of huge amount of
> > credit.
> ThE GrIfTeR SpEaKs
> what your after isn't the CASH, as thats just numbers in a
> program. what your after is the blank chips they use to make the
> 'sticks, as then you can forge sticks

You still need to hack the bank, though, to set up that side of things.
This isn't a one-way op.

To use creditcard fraud as an example, you can't just send in a random
number and a signature, you have to have an account at the cred firm.

--
Robert Watkins bob@**.ntu.edu.au
Real Programmers never work 9 to 5. If any real programmers
are around at 9 am, it's because they were up all night.