Protecting TLS‐SA implementations for the challenge‐response feature of EMV‐CAP against challenge collision attacks

Abstract Secure Sockets Layer (SSL)/Transport Layer Security (TLS) session‐aware user authentication (TLS‐SA) can be used to protect SSL/TLS‐based e‐commerce applications against man‐in‐the‐middle (MITM) attacks. The main idea is to make the user authentication depend not only on the user's credentials, but also on state information related to the SSL/TLS session in which the credentials are transferred to the server. This, in turn, allows the server to detect inconsistencies caused by an MITM. There are many possibilities to implement TLS‐SA and to make a user authentication scheme be SSL/TLS session‐aware. In this paper, we take the challenge‐response (C/R) feature of the Europay International, MasterCard, and Visa (EMV) Chip Authentication Program (CAP) as an example, and we argue that a TLS‐SA implementation for this feature is appropriate but susceptible to challenge collision attacks. We then pick challenge collision attacks out as a central theme, and elaborate on a possible protection mechanism. Assuming that the adversary has no access to the browser's graphical user interface (GUI) and cannot retrieve the EMV‐CAP challenge accordingly, the level of protection against challenge collision attacks can be improved considerably by non‐deterministically derivating the challenge from information related to the SSL/TLS session and using encryption to turn a challenge into a response. If the adversary has read access to the browser's GUI, then this approach is counterproductive, and if the adversary even has write access, then the use of EMV‐CAP is insecure and problematic in the first place. Copyright © 2008 John Wiley & Sons, Ltd.