Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

Carl-Otto Künnecke
Growing market for PIN applications
By Carl-Otto Künnecke Managing Director, OK systems
Personal Identification Numbers (PINs) are very versatile and can be used for
manifold applications. They are not only utilized in the banking sector (mostly for
debit and with an increasing number also for credit cards), but also become more and
more important for health insurance funds, where secure data are protected with a
password on the chip of a health card. PINs are also employed for ID cards as for
example the new German ID card. In this case PIN and chip form a digital signature
which can be applied in the field of e-government, signing of contracts or secure entry
into public facilities.
In general, the PIN consists mostly of four characters (like they are used to access ATMs). However, some
applications require PINs with more characters. The PIN is generated via an encryption procedure using
different algorithms such as DES (symmetric Data Encryption Standard), RSA (asymmetric encryption
system) or ISO 9564-1.
The entire PIN handling is situated in rooms with highest security levels. If PINs and cards are personalized
in the same building, the processes must be physically disconnected from each other. Due to this risk, PIN
personalization is mostly completely separated from card personalization. The outsourcing trend visible in the
card personalization sector does not have the same momentum for the PIN personalization process.
Even though PINs have become indispensable in bank applications, there is no Visa/ Mastercard
certification for PINs. This affects the products itself as well as PIN generation and transportation to the end
customer. More than ever, transportation is an extremely insecure element when PINs are forwarded to the
end customer or bank agency. In countries where bank cards are sent directly to the customers the PIN is
dispatched delayed by a few days or sent prior to the card mailing. The common understanding is that PIN
and card should never meet in the same post box on the same day. In cases of indirect distribution where the
card holders have to fetch their card and PIN at the local branch office packages of cards and PINs are often
sent by separate courier to the branch. In just a few cases cards and PINs go together with the same carrier
and in the same envelope. What seems to be a high risk can be discounted when PIN and card are not
activated yet. In case of stolen or opened envelopes the cards and PINs are of no use at all. Either by
activating the package at the bank office or by special telephone verification the issuer activates PIN and card
and the customer can use it. The reason for financial institutes to use this approach is reducing dispatch costs
because postage is the biggest portion of the whole product in most cases. By sending only one product the
banks save production costs as well as costs for dispatch and courier services. And the costumer will get one
product instead of two.
Besides this classic process where a printed PIN is used with paper, there are some cases where electronic
transmission is employed like in China. Or – like in Korea – the PIN is generated through the application
form when a card holder applies for a new card. However, due to high security risks these are only
exceptions. Traditionally, PIN letters have been generated on 3-layered carbon copy paper, and have been
labelled with address and PIN on needle printers. Due to visual aspects and security risks this process is not
contemporary any more for many banks. Card carriers and enclosures convey the marketing ideas of the
financial institute and the PIN stills looks like in the beginning of the computerized era. So the change in
demands for a new product which fits the overall corporate design of a financial institute is mostly based on
new marketing needs, but also on the fact that in many countries banks issue several PINs for each customer:
one for ATM, one for electronic banking and sometimes even a third one for ATMs abroad. The oldfashioned
“dot.matrix” makes this impossible and thus application and layout have to be changed.
Therefore, some new processes have been established on the market. All these processes use laser printers to
print the information on the PIN letter. The advantage is that significantly more information can be
forwarded to the end customer. As another benefit the issuers can also use their own color logos and thus
make the PIN letter a means of advertising.
The foundation for all processes currently available on the market is the issuers’ need for corporate design,
secure products and production processes as well as costs for the consumables.
Smart Card & Identity News • January 2008
9