Security Analysis and Implementation of Relay-Resistant Contactless Payments

Abstract

Contactless systems, such as the EMV (Europay, Mastercard and Visa) payment protocol, are vulnerable to relay attacks. The typical countermeasure to this relies ondistance bounding protocols, in which a reader estimates an upper bound on its physical distance from a card by doing round-trip time (RTT) measurements. However, these protocols are trivially broken in the presence of rogue readers. At Financial Crypto 2019, we proposed two novel EMV-based relayresistant protocols: they integrate distance-bounding with the use of hardware roots of trust (HWRoT) in such a way that correct RTT-measurements can no longer be bypassed.Our contributions are threefold: first, we design a calculus to model this advanced type of distance-bounding protocols integrated with HWRoT; as an additional novelty, our calculus is also the first to allow for mobility of cards and readers during a proximity-checking phase. Second, to make it possible to analyse these protocols via more standard mechanisms and tools, we consider a 2018 characterisation of distance-bounding security that does away with physical aspects and relies only on the causality of events; we cast it in our richer calculus and extend its theoretical guarantees to our more expressive models (with mobility, potentially rogue readers, and HWRoT). Due to this extension, we can carry out the security analysis in the standard protocol verification tool ProVerif. Third, we provide the first implementation of Mastercard's relay-resistant EMV protocol PayPass-RRP as well as one of its 2019 extension with HWRoT called PayBCR. We evaluate their efficiency and their robustness to relay attacks, in presence of both honest and rogue readers. Our experiments are the first to show that Mastercard's PayPass-RRP and its HWRoT-based extension PayBCR are both practical in preventing relay attacks of the magnitude shown thus-far in EMV.

So Near and Yet So Far – Symbolic Verification of Distance-Bounding Protocols

“…First, neither our framework nor those proposed in [19,44,45] take mobility into account. We think that this is achievable following the approach recently proposed in [13]. This model allows agents to perform arbitrary movements as soon as they do not move faster than messages.…”

2022 IEEE Symposium on Security and Privacy (SP)

“…RRP was first formally verified in [5]. [44] performs a timing analysis of RRP and finds it secure, but without varying the positions of the card in the field, as we do.…”

“…Symbolic Verification of EMV: Past symbolic-verification models of EMV include [48], [2], [8] and of EMV with distance bounding [47], [26], [5], [49], [44].…”

Breaking and Fixing Unlinkability of the Key Agreement Protocol for 2nd Gen EMV Payments

“…The recent work of Basin, Sasse, and Toro-Pozo [6] contains an overview of attacks on EMV that can lead to fraudulent transactions, e.g., criminals can make high-value purchases using a contactless Visa card without knowing the PIN. Contactless specific relay attacks may be mitigated by using distance-bounding techniques [7], e.g., Boureanu et al verified Mastercard's relay-resistant EMV protocol PayPass-RRP [8].…”