Cryptographic Pin Processing In EFT Systems

Abstract
A described method of protecting Personal Identification Numbers (PINS) assumes the Point of Sale (POS) terminal is online to a host operating system and that both terminal and host have a cryptographic capability based upon the DES al- gorithm and support a cryptographic key management scheme.1 Subscription by the host and terminal to a communications protocol which can support end-to-end encryption, 2 provides additional security. In this environment a table of user PINS, indexed by user name, is maintained at the host. By permitting customer PIN verification at either the terminal or the host when a transaction is initiated, an exhaustive attack against the PIN becomes as difficult as one against a DES key.

This publication has 2 references indexed in Scilit: