Formal analysis of the EMV protocol suite

Authors:
Joeri de Ruiter;Erik Poll
Affiliations:
Digital Security Group, Institute for Computing and Information Science (ICIS), Radboud University Nijmegen, The Netherlands;Digital Security Group, Institute for Computing and Information Science (ICIS), Radboud University Nijmegen, The Netherlands
Venue:
TOSCA'11 Proceedings of the 2011 international conference on Theory of Security and Applications
Year:
2011

Citing 7
Cited 2

An Efficient Cryptographic Protocol Verifier Based on Prolog Rules

CSFW '01 Proceedings of the 14th IEEE workshop on Computer Security Foundations
Verified Interoperable Implementations of Security Protocols

CSFW '06 Proceedings of the 19th IEEE workshop on Computer Security Foundations
Risks and potentials of using EMV for internet payments

WOST'99 Proceedings of the USENIX Workshop on Smartcard Technology on USENIX Workshop on Smartcard Technology
Optimised to Fail: Card Readers for Online Banking

Financial Cryptography and Data Security
Phish and Chips

Security Protocols
Modular verification of security protocol code by typing

Proceedings of the 37th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Chip and PIN is Broken

SP '10 Proceedings of the 2010 IEEE Symposium on Security and Privacy

Designed to fail: a USB-Connected reader for online banking

NordSec'12 Proceedings of the 17th Nordic conference on Secure IT Systems
Union, intersection and refinement types and reasoning about type disjointness for secure protocol implementations

Journal of Computer Security - Foundational Aspects of Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper presents a formal model of the EMV (Europay-MasterCard-Visa) protocol suite in F# and its analysis using the protocol verification tool ProVerif [5] in combination with FS2PV [4]. The formalisation covers all the major options of the EMV protocol suite, including all card authentication mechanisms and both on- and offline transactions. Some configuration parameters have to be fixed to allow any security analysis; here we follow the configuration of Dutch EMV banking cards, but the model could easily be adapted to other configurations. As far as we know this is the first comprehensive formal description of EMV. The convenience and expressivity of F# proved to be a crucial advantage to make the formalisation of something as complex as EMV feasible. Even though the EMV specs amount to over 700 pages, our formal model is only 370 lines of code. Formal analysis of our model with ProVerif is still possible, though this requires some care. Our formal analysis does not reveal any new weaknesses of the EMV protocol suite, but it does reveal all the known weaknesses, as a formal analysis of course should.