Understanding Security APIs - CrySyS Lab

However, the designers did recognise a clear difference between ‘Terminal Communications’
keys (TCs) and PIN derivation keys or TMKs. TC1 is a terminal communications
key, and Km2 is a second master key that was used to encrypt keys of this
type, keeping them separate from the rest. They were kept separate because terminal
communications keys were not considered to be as valuable as PIN derivation
keys – and there needed to be a transaction to enter a chosen TC key.
Host -> HSM : TC1 (Enter clear TC Key)
HSM -> Host : { TC1 }Km2
TCs needed to be communicated to ATMs in the same way as PIN derivation keys,
so there was a command that worked in a very similar way, encrypting the chosen
TC under a chosen TMK corresponding to a particular ATM.
Host -> HSM : { TC1 }Km2 , { TMK1 }Km (Send TC Key to ATM)
HSM -> Host : { TC1 }TMK1
However, the author spotted that when these two transactions were used together,
given the lack of differentiation between PIN derivation keys and TMKs, there was
a simple attack. It was to enter in a customer PAN, claiming it to be a TC key, and
substitute a PIN derivation key for a TMK in the “send to ATM” transaction.
The Attack
Host -> HSM : PAN (Enter clear TC Key)
HSM -> Host : { PAN }Km2
Host -> HSM : { PAN }Km2 , { PDK1 }Km (Send TC Key to ATM)
HSM -> Host : { PAN }PDK1
Of course, { PAN }PDK1 is simply the customer’s PIN. The full details of this attack
are in section 7.3.2. Just like Anderson’s ‘XOR to Null Key Attack’, this vulnerability
had gone unnoticed for over a decade. How many more attacks were waiting
to be found?
25