Cryptology is a cool science, and obviously essential in an age of electronic banking. I don’t know very much about it, but I find it fascinating and I’ve been doing some recreational reading on cryptology over the last few weeks.
Here are two problems I’ve long been interested in, but I’m not sure how they work out. First, how do debit card readers use your PIN to verify that you are the owner of the card without giving away the PIN to the entire world? Second, how does the card reader communicate with your bank in a secure way?

In this article I’ll explain my guess about how this works, based on what I’ve been able to piece together from my reading and my imagination (a dangerous combination, I know). If any of my readers can correct my stupidity, please do so!
First, I need to assume that you’re familiar with RSA encryption, but here is a very brief description. RSA uses a very big number (N), a public key (K), and a private key (E). N is determined by multiplying together two large prime numbers (p and q). K and E are calculated from p and q using a detailed algorithm that helps guarantee the RSA process.
The big number N and the public key K are used to convert plaintext into cyphertext, and the big number N and the private key E are used to convert the cyphertext into the original plaintext. Encryption is a one-way process. Once a plaintext is enciphered using N and K, it cannot be decrypted using N and K. Only N and E can be used to decipher the encrypted text. Further, it’s impossible to determine E from N and K. To determine E, we need to factor N into the two very large prime numbers (p and q) that were multiplied to create N. This factorization is essentially impossible, even with the world’s fastest computers.
The security of RSA is invested in (1) keeping E, p, and q absolutely secret, and (2) the numerical difficulty of factoring N to determine p and q. If N is factored, then K and E can be quickly calculated, and the gig is up.
So, my first assumption about debit cards, my bank, and card readers, is that the private key E is never actually calculated. There is no need to decrypt my PIN, since I already know it. Generally, I would think that decryption never actually occurs with electronic transactions that use RSA, because decryption requires the private key E. If the private keys are kept on file at the bank, they’re liable to be stolen, which is no better than just keeping unencrypted PINs on file.
So here is how I think the PIN is authenticated:
First, when I swipe my card at the card reader, the reader takes from the magnetic strip several pieces of information:
- the big number N (the same for all customers at my bank)
- the public key K (unique to me)
- an encrypted PIN, determined and recorded by my bank using N and K when I selected my PIN. The PIN itself is not recorded anywhere, even on the magnetic strip. Suppose my encrypted PIN is 2525.
Next, the following steps take place:
- The card reader asks for my PIN, and I punch it in. Suppose my PIN is 1776.
- The card reader encrypts 1776 using N and K. Suppose it gets 2525.
- The card reader compares 2525 to the encrypted PIN from the magnetic strip. Since these match, the card reader is satisfied that I in fact own the debit card.
The PIN itself is never transmitted over the Internet, and isn’t recorded anywhere. The encrypted PIN is available for stealing, if someone takes my debit card and reads the information on the strip. But the encrypted PIN itself is useless. Without knowing the private key E, which isn’t recorded anywhere, a thief cannot use the encrypted PIN to recover my plaintext PIN.
Now, how does the card reader communicate with my bank in a secure way? I think the key to security here is that my account number and debit card number not be transmitted across the computer network, because a third party could intercept them. The following is my best guess at how this works, although I think I probably have the details wrong:
- The card reader sends the public key K to the bank’s computer. (Since this key is public, there is no security risk involved.) The bank’s computer confirms that K is on file with one of its customers, viz., me. It may seem that K is a de facto account number, and in a sense I suppose it is, but there should be no way to access my account using only K.
- Next, the bank needs to determine that the debit card is legitimately attached to an account at my bank. We don’t want to transmit account numbers across the network, even in encrypted form, because the private key E isn’t stored anywhere. So instead, the bank creates a random number (R), say, 20 digits long, and encrypts it using N and K. Call the encrypted random number R*.
- The bank’s computer sends R (not R*!) to the card reader, with an instruction to encrypt it using its N and K, and send the encryption back.
- The card reader determines R* using R, N, and K and sends it back to the bank’s computer.
- The bank’s computer compares the R* from the card reader to the R* it calculated. If they match, the debit card is authenticated, and I can buy my stuff. They only numbers transmitted across the network are useless random numbers.
Is this really how it works? Remember, I’m guessing about this, and hoping someone can correct me or fill in important details I haven’t thought about. In the method I’ve described, the bank is essentially confirming that the big number N on the debit card’s magnetic strip is correct. But it seems this number could be made public, which I why I think I’m probably wrong about how the account information is communicated between the card reader and my bank. If I am wrong, what am I missing?
Recent Comments