Security of Electronic Payment Systems: A Comprehensive Survey
---
paper_title: EMV: why payment systems fail

paper_content:

What lessons might we learn from the chip cards used for payments in Europe, now that the U.S. is adopting them too?
---
paper_title: Chip and PIN is Broken

paper_content:

EMV is the dominant protocol used for smart card payments worldwide, with over 730 million cards in circulation. Known to bank customers as “Chip and PIN”, it is used in Europe; it is being introduced in Canada; and there is pressure from banks to introduce it in the USA too. EMV secures credit and debit card transactions by authenticating both the card and the customer presenting it through a combination of cryptographic authentication codes, digital signatures, and the entry of a PIN. In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network. The fraudster performs a man-in-the-middle attack to trick the terminal into believing the PIN verified correctly, while telling the card that no PIN was entered at all. The paper considers how the flaws arose, why they remained unknown despite EMV’s wide deployment for the best part of a decade, and how they might be fixed. Because we have found and validated a practical attack against the core functionality of EMV, we conclude that the protocol is broken. This failure is significant in the field of protocol design, and also has important public policy implications, in light of growing reports of fraud on stolen EMV cards. Frequently, banks deny such fraud victims a refund, asserting that a card cannot be used without the correct PIN, and concluding that the customer must be grossly negligent or lying. Our attack can explain a number of these cases, and exposes the need for further research to bridge the gap between the theoretical and practical security of bank payment systems. It also demonstrates the need for the next version of EMV to be engineered properly.
---
paper_title: Chip and Spin

paper_content:

The views of the authors regarding the liability issues, technical shortcomings and management failures of 'Chip and PIN' card payments are discussed. The UK banks do have a voluntary code of practice that is supposed to indicate liability during computer crimes but it relies on ill defined notions of 'reasonable care'. The use PINs in shops as well as at ATMs greatly increases the likelihood that PINs can be compromised by shoulder-surfing. This is not just a function of the frequency of PIN entry, but also of the environment and the associated social norms. The system has a glaring weakness, if a card is presented at an ATM or POS terminal whose chip is damaged then the device falls back to the magnetic strip operation. According to the author the technical specification behind Chip and PIN EMV is a public standard and will come under attack. The interaction with the credit card is simply done using electronic signals which can be easily routed from anywhere in the world.
---
paper_title: EMV card payments - An update

paper_content:

A report on the status of EMV card payment technology and a look at where this payment technology is heading.
---
paper_title: Chip and PIN is Broken

paper_content:

EMV is the dominant protocol used for smart card payments worldwide, with over 730 million cards in circulation. Known to bank customers as “Chip and PIN”, it is used in Europe; it is being introduced in Canada; and there is pressure from banks to introduce it in the USA too. EMV secures credit and debit card transactions by authenticating both the card and the customer presenting it through a combination of cryptographic authentication codes, digital signatures, and the entry of a PIN. In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network. The fraudster performs a man-in-the-middle attack to trick the terminal into believing the PIN verified correctly, while telling the card that no PIN was entered at all. The paper considers how the flaws arose, why they remained unknown despite EMV’s wide deployment for the best part of a decade, and how they might be fixed. Because we have found and validated a practical attack against the core functionality of EMV, we conclude that the protocol is broken. This failure is significant in the field of protocol design, and also has important public policy implications, in light of growing reports of fraud on stolen EMV cards. Frequently, banks deny such fraud victims a refund, asserting that a card cannot be used without the correct PIN, and concluding that the customer must be grossly negligent or lying. Our attack can explain a number of these cases, and exposes the need for further research to bridge the gap between the theoretical and practical security of bank payment systems. It also demonstrates the need for the next version of EMV to be engineered properly.
---
paper_title: Chip and Spin

paper_content:

The views of the authors regarding the liability issues, technical shortcomings and management failures of 'Chip and PIN' card payments are discussed. The UK banks do have a voluntary code of practice that is supposed to indicate liability during computer crimes but it relies on ill defined notions of 'reasonable care'. The use PINs in shops as well as at ATMs greatly increases the likelihood that PINs can be compromised by shoulder-surfing. This is not just a function of the frequency of PIN entry, but also of the environment and the associated social norms. The system has a glaring weakness, if a card is presented at an ATM or POS terminal whose chip is damaged then the device falls back to the magnetic strip operation. According to the author the technical specification behind Chip and PIN EMV is a public standard and will come under attack. The interaction with the credit card is simply done using electronic signals which can be easily routed from anywhere in the world.
---
paper_title: Chip and Spin

paper_content:

The views of the authors regarding the liability issues, technical shortcomings and management failures of 'Chip and PIN' card payments are discussed. The UK banks do have a voluntary code of practice that is supposed to indicate liability during computer crimes but it relies on ill defined notions of 'reasonable care'. The use PINs in shops as well as at ATMs greatly increases the likelihood that PINs can be compromised by shoulder-surfing. This is not just a function of the frequency of PIN entry, but also of the environment and the associated social norms. The system has a glaring weakness, if a card is presented at an ATM or POS terminal whose chip is damaged then the device falls back to the magnetic strip operation. According to the author the technical specification behind Chip and PIN EMV is a public standard and will come under attack. The interaction with the credit card is simply done using electronic signals which can be easily routed from anywhere in the world.
---
paper_title: Chip and PIN is Broken

paper_content:

EMV is the dominant protocol used for smart card payments worldwide, with over 730 million cards in circulation. Known to bank customers as “Chip and PIN”, it is used in Europe; it is being introduced in Canada; and there is pressure from banks to introduce it in the USA too. EMV secures credit and debit card transactions by authenticating both the card and the customer presenting it through a combination of cryptographic authentication codes, digital signatures, and the entry of a PIN. In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network. The fraudster performs a man-in-the-middle attack to trick the terminal into believing the PIN verified correctly, while telling the card that no PIN was entered at all. The paper considers how the flaws arose, why they remained unknown despite EMV’s wide deployment for the best part of a decade, and how they might be fixed. Because we have found and validated a practical attack against the core functionality of EMV, we conclude that the protocol is broken. This failure is significant in the field of protocol design, and also has important public policy implications, in light of growing reports of fraud on stolen EMV cards. Frequently, banks deny such fraud victims a refund, asserting that a card cannot be used without the correct PIN, and concluding that the customer must be grossly negligent or lying. Our attack can explain a number of these cases, and exposes the need for further research to bridge the gap between the theoretical and practical security of bank payment systems. It also demonstrates the need for the next version of EMV to be engineered properly.
---
paper_title: Chip and Skim: Cloning EMV Cards with the Pre-play Attack

paper_content:

EMV, also known as "Chip and PIN", is the leading system for card payments worldwide. It is used throughout Europe and much of Asia, and is starting to be introduced in North America too. Payment cards contain a chip so they can execute an authentication protocol. This protocol requires point-of-sale (POS) terminals or ATMs to generate a nonce, called the unpredictable number, for each transaction to ensure it is fresh. We have discovered two serious problems: a widespread implementation flaw and a deeper, more difficult to fix flaw with the EMV protocol itself. The first flaw is that some EMV implementers have merely used counters, timestamps or home-grown algorithms to supply this nonce. This exposes them to a "pre-play" attack which is indistinguishable from card cloning from the standpoint of the logs available to the card-issuing bank, and can be carried out even if it is impossible to clone a card physically. Card cloning is the very type of fraud that EMV was supposed to prevent. We describe how we detected the vulnerability, a survey methodology we developed to chart the scope of the weakness, evidence from ATM and terminal experiments in the field, and our implementation of proof-of-concept attacks. We found flaws in widely-used ATMs from the largest manufacturers. We can now explain at least some of the increasing number of frauds in which victims are refused refunds by banks which claim that EMV cards cannot be cloned and that a customer involved in a dispute must therefore be mistaken or complicit. The second problem was exposed by the above work. Independent of the random number quality, there is a protocol failure: the actual random number generated by the terminal can simply be replaced by one the attacker used earlier when capturing an authentication code from the card. This variant of the pre-play attack may be carried out by malware in an ATM or POS terminal, or by a man-in-the-middle between the terminal and the acquirer. We explore the design and implementation mistakes that enabled these flaws to evade detection until now: shortcomings of the EMV specification, of the EMV kernel certification process, of implementation testing, formal analysis, and monitoring customer complaints. Finally we discuss countermeasures. More than a year after our initial responsible disclosure of these flaws to the banks, action has only been taken to mitigate the first of them, while we have seen a likely case of the second in the wild, and the spread of ATM and POS malware is making it ever more of a threat.
---
paper_title: Security Issues for Contactless Smart Cards

paper_content:

We review the current technologies of contactless smart cards and compare them with contact cards. We discuss the problems of implementing encryption in contactless cards, and consider how to solve the problems. We also report the state of standardization of contactless smart card.
---
paper_title: Efficient signature generation by smart cards

paper_content:

We present a new public-key signature scheme and a corresponding authentication scheme that are based on discrete logarithms in a subgroup of units in ? p where p is a sufficiently large prime, e.g., p ? 2512. A key idea is to use for the base of the discrete logarithm an integer ? in ? p such that the order of ? is a sufficiently large prime q, e.g., q ? 2140. In this way we improve the ElGamal signature scheme in the speed of the procedures for the generation and the verification of signatures and also in the bit length of signatures. We present an efficient algorithm that preprocesses the exponentiation of a random residue modulo p.
---
paper_title: IMPLEMENTING ELLIPTIC CURVE CRYPTOGRAPHY ON PC AND SMART CARD

paper_content:

Elliptic Curve Cryptography (ECC) is a relatively new branch of public key ::: cryptography. Its main advantage is that it can provide the same level of ::: security as RSA with significantly shorter keys, which is beneficial for a ::: smart card based implementation. It is also important as a possible alternative ::: of RSA. This paper presents the author´s research concerning ECC and smart ::: cards. ::: The authors introduce their ECC prototype implementation that relies on Java ::: Card technology and is capable of running on smart cards. Test results with ::: various cards are attached. It is also analyzed in what extent algorithms with ::: the complexity of ECC can be executed in smart card environment with limited ::: resources.
---
paper_title: Guide to Elliptic Curve Cryptography

paper_content:

Elliptic curves also figured prominently in the recent proof of Fermat's Last Theorem by Andrew Wiles. Originally pursued for purely aesthetic reasons, elliptic curves have recently been utilized in devising algorithms for factoring integers, primality proving, and in public-key cryptography. In this article, we aim to give the reader an introduction to elliptic curve cryptosystems, and to demonstrate why these systems provide relatively small block sizes, high-speed software and hardware implementations, and offer the highest strength-per-key-bit of any known public-key scheme.
---
paper_title: New Directions in Cryptography

paper_content:

Two kinds of contemporary developments in cryptography are examined. Widening applications of teleprocessing have given rise to a need for new types of cryptographic systems, which minimize the need for secure key distribution channels and supply the equivalent of a written signature. This paper suggests ways to solve these currently open problems. It also discusses how the theories of communication and computation are beginning to provide the tools to solve cryptographic problems of long standing.
---
paper_title: The number field sieve

paper_content:

The number field sieve is an algorithm to factor integers of the form re − s for small positive r and |s|. The algorithm depends on arithmetic in an algebraic number field. We describe the algorithm, discuss several aspects of its implementation, and present some of the factorizations obtained. A heuristic run time analysis indicates that the number field sieve is asymptotically substantially faster than any other known factoring method, for the integers that it applies to. The number field sieve can be modified to handle arbitrary integers. This variant is slower, but asymptotically it is still expected to beat all older factoring methods.
---
paper_title: A method for obtaining digital signatures and public-key cryptosystems

paper_content:

An encryption method is presented with the novel property that publicly revealing an encryption key does not thereby reveal the corresponding decryption key. This has two important consequences: (1) Couriers or other secure means are not needed to transmit keys, since a message can be enciphered using an encryption key publicly revealed by the intented recipient. Only he can decipher the message, since only he knows the corresponding decryption key. (2) A message can be “signed” using a privately held decryption key. Anyone can verify this signature using the corresponding publicly revealed encryption key. Signatures cannot be forged, and a signer cannot later deny the validity of his signature. This has obvious applications in “electronic mail” and “electronic funds transfer” systems. A message is encrypted by representing it as a number M, raising M to a publicly specified power e, and then taking the remainder when the result is divided by the publicly specified product, n , of two large secret primer numbers p and q. Decryption is similar; only a different, secret, power d is used, where e * d ≡ 1(mod (p - 1) * (q - 1)). The security of the system rests in part on the difficulty of factoring the published divisor, n .
---
paper_title: Potential misuse of NFC enabled mobile phones with embedded security elements as contactless attack platforms

paper_content:

In this paper we investigate the possibility that a Near Field Communication (NFC) enabled mobile phone, with an embedded Secure Element (SE), could be used as a mobile token cloning and skimming platform. We show how an attacker could use a NFC mobile phone as such an attack platform by exploiting the existing security controls of the embedded SE and the available contactless APIs. To illustrate the feasibility of these actions we also show how to practically skim and emulate certain tokens typically used in payment and access control applications with a NFC mobile phone. Although such attacks can also be implemented on other contactless platforms, such as custom-built card emulators and modified readers, the NFC-enabled mobile phone has a legitimate form factor, which would be accepted by merchants and arouse less suspicion in public. Finally, we propose several security countermeasures for NFC phones that could prevent such misuse.
---
paper_title: On the Joint Security of Encryption and Signature in EMV ⋆

paper_content:

We provide an analysis of current and future algorithms for signature and encryption in the EMV standards in the case where a single key-pair is used for both signature and encryption. We give a theoretical attack for EMV's current RSA-based algorithms, showing how access to a partial decryption oracle can be used to forge a signature on a freely chosen message. We show how the attack might be integrated into EMV's CDA protocol flow, enabling an attacker with a wedge device to complete an offline transaction without knowing the cardholder's PIN. Finally, the elliptic curve signature and encryption algorithms that are likely to be adopted in a forthcoming version of the EMV standards are analyzed in the single key-pair setting, and shown to be secure.
---
paper_title: Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication

paper_content:

Banks worldwide are starting to authenticate online card transactions using the ‘3-D Secure’ protocol, which is branded as Verified by Visa and MasterCard SecureCode. This has been partly driven by the sharp increase in online fraud that followed the deployment of EMV smart cards for cardholder-present payments in Europe and elsewhere. 3-D Secure has so far escaped academic scrutiny; yet it might be a textbook example of how not to design an authentication protocol. It ignores good design principles and has significant vulnerabilities, some of which are already being exploited. Also, it provides a fascinating lesson in security economics. While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted. 3-D Secure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts. We suggest a path towards more robust authentication that is technologically sound and where the economics would work for banks, merchants and customers – given a gentle regulatory nudge.
---
paper_title: Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication

paper_content:

Banks worldwide are starting to authenticate online card transactions using the ‘3-D Secure’ protocol, which is branded as Verified by Visa and MasterCard SecureCode. This has been partly driven by the sharp increase in online fraud that followed the deployment of EMV smart cards for cardholder-present payments in Europe and elsewhere. 3-D Secure has so far escaped academic scrutiny; yet it might be a textbook example of how not to design an authentication protocol. It ignores good design principles and has significant vulnerabilities, some of which are already being exploited. Also, it provides a fascinating lesson in security economics. While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted. 3-D Secure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts. We suggest a path towards more robust authentication that is technologically sound and where the economics would work for banks, merchants and customers – given a gentle regulatory nudge.
---
paper_title: Understanding Public-Key Infrastructure: Concepts, Standards, and Deployment Considerations

paper_content:

From the Publisher: ::: This book is a tutorial on, and a guide to the deployment of, Public-Key Infrastructures. It covers a broad range of material related to PKIs, including certification, operational considerations and standardization efforts, as well as deployment issues and considerations. Emphasis is placed on explaining the interrelated fields within the topic area, to assist those who will be responsible for making deployment decisions and architecting a PKI within an organization.
---
paper_title: Mobile Payments — State of the Art and Open Problems

paper_content:

We describe electronic payment solutions and the technical problems, which have to be solved in order to make these payments mobile. Mobile payments should be both secure and convenient for the consumer. The problems of implementing mobile payment systems are manifold. The technical capabilities of mobile devices are - at least today - too limited to allow a simple re-use of existing Internet payment protocols. Moreover, a number of different mobile application environments exist today, which differ from a technical perspective as well as from geographical spread. This makes it extremely difficult to define mobile payment protocols, which can be used on a global basis. Therefore, compromise solutions have to be found and standardized, which offer a reasonable level of security based on the existing functions offered in mobile devices and networks.
---
paper_title: Mobile Payments — State of the Art and Open Problems

paper_content:

We describe electronic payment solutions and the technical problems, which have to be solved in order to make these payments mobile. Mobile payments should be both secure and convenient for the consumer. The problems of implementing mobile payment systems are manifold. The technical capabilities of mobile devices are - at least today - too limited to allow a simple re-use of existing Internet payment protocols. Moreover, a number of different mobile application environments exist today, which differ from a technical perspective as well as from geographical spread. This makes it extremely difficult to define mobile payment protocols, which can be used on a global basis. Therefore, compromise solutions have to be found and standardized, which offer a reasonable level of security based on the existing functions offered in mobile devices and networks.
---
paper_title: Implementation Aspects of SET/EMV

paper_content:

The threat of credit card fraud is arguably one of the most serious issues in e-commerce, since it makes consumers reluctant to engage in this alternative method of shopping. Secure Electronic Transaction (SET) was invented to address this issue, and it provides effective security for the entire Internet e-commerce transaction. However, SET has not really taken off; implementation issues appear to be the main factor restricting its adoption. Given the existing consumer concerns about e-commerce security, SET still appears to be very relevant to the Internet e-commerce transaction environment. The integration of SET with EMV is a possible route for facilitating the wider use of SET in Internet commerce transactions, since it could simplify user registration. The aim of this paper is to evaluate the effectiveness of SET/EMV integration for fraud reduction in e-commerce. In addition, this paper also considers the implementation feasibility of SET/EMV.
---
paper_title: Implementation Aspects of SET/EMV

paper_content:

The threat of credit card fraud is arguably one of the most serious issues in e-commerce, since it makes consumers reluctant to engage in this alternative method of shopping. Secure Electronic Transaction (SET) was invented to address this issue, and it provides effective security for the entire Internet e-commerce transaction. However, SET has not really taken off; implementation issues appear to be the main factor restricting its adoption. Given the existing consumer concerns about e-commerce security, SET still appears to be very relevant to the Internet e-commerce transaction environment. The integration of SET with EMV is a possible route for facilitating the wider use of SET in Internet commerce transactions, since it could simplify user registration. The aim of this paper is to evaluate the effectiveness of SET/EMV integration for fraud reduction in e-commerce. In addition, this paper also considers the implementation feasibility of SET/EMV.
---
paper_title: Online credit card fraud outpaces physical world

paper_content:

Abstract Figures don’t lie. E-commerce on retail Web sites is on the rise. But worryingly so is online credit card fraud… And it outpaces fraud in the physical world 12-fold.
---
paper_title: Designed to Fail: A USB-Connected Reader for Online Banking

paper_content:

We present a security analysis of an internet banking system used by one of the bigger banks in the Netherlands, in which customers use a USB-connected device --- a smartcard reader with a display and numeric keyboard --- to authorise transactions with their bank card and PIN code. Such a set-up could provide a very strong defence against online attackers, notably Man-in-the-Browser attacks, where an attacker controls the browser and host PC. However, we show that the system we studied is seriously flawed: an attacker who controls an infected host PC can get the smartcard to sign transactions that the user does not explicitly approve, which is precisely what the device is meant to prevent. ::: ::: The flaw is not due to a simple implementation bug in one of the components (e.g. the device or the software components on the PC). It is a more fundamental design flaw, introduced in assigning responsibilities to the different components and designing the protocols between them. ::: ::: The system we studied, used by the Dutch bank ABN-AMRO, was developed by the Swedish company Todos AB. This company has since been acquired by Gemalto. ABN-AMRO is one of the three biggest banks in the Netherlands, with 6.8 million customers. Given the popularity of internet banking in the Netherlands, this means that millions of these devices are in the field. The manufacturer claims this device is "the most secure sign-what-you-see end-user device ever seen"; this paper demonstrates this claim to be false.
---
paper_title: Security without identification: transaction systems to make big brother obsolete

paper_content:

The large-scale automated transaction systems of the near future can be designed to protect the privacy and maintain the security of both individuals and organizations.
---
paper_title: Blind Signatures Based on the Discrete Logarithm Problem

paper_content:

Blind signature schemes, an important cryptographic primitive, are useful in protocols that guarantee the anonymity of the participants. Two new blind signature schemes based on the discrete logarithm problem are presented.
---
paper_title: An inter-bank E-payment protocol based on quantum proxy blind signature

paper_content:

Security and anonymity are essential to E-payment systems. However, with the increasing computing power, existing E-payment systems will gradually become insecure. In this paper, we propose an inter-bank E-payment system which is based on quantum proxy blind signature. Adopting the techniques of quantum key distribution, one-time pad and quantum proxy blind signature, our quantum E-payment system could protect user's anonymity as the traditional E-payment systems do, and also have unconditional security which the classical E-payment systems cannot provide. Furthermore, compared with the existing quantum E-payment systems, the proposed system could support inter-bank transactions.
---
paper_title: An Efficient Electronic Payment System Protecting Privacy

paper_content:

Previously proposed anonymous electronic payment systems have the drawback that the bank has to maintain large databases, which is a handicap for the realization of such systems. In this paper, we present a practical anonymous payment system that significantly reduces the size of such databases. It uses the concept of anonymous accounts and offers anonymity as an add-on feature to existing EFTPOS systems.
---
paper_title: Blind Signatures for Untraceable Payments

paper_content:

Automation of the way we pay for goods and services is already underway, as can be seen by the variety and growth of electronic banking services available to consumers. The ultimate structure of the new electronic payments system may have a substantial impact on personal privacy as well as on the nature and extent of criminal use of payments. Ideally a new payments system should address both of these seemingly conflicting sets of concerns.
---
paper_title: Universal Electronic Cash

paper_content:

This papcr proposcs the first idcal untraccablc elcctronic cash systcm whicli solves the most crucial problem inherent with real cash and all previous tintraceable clcctronic cash systems. The main advantage of the new systcm is that thc customcr can subdivide his cash balance, C (dollars), into many pieccs in any way hc plcases until thc total value of all subtli\kied piccc cquals C. This systcm can bc irnplcmciited cficicntly. In a typical implrnicntation, the data sizc of one pice of clcctronic cash is less than 100 bytes regardlesb of thc face value of piccc, the computation time for cach transaction is scvcral seconds, assuming the existcncc of a Rabin sclicrne cliip. The sccurity of this sclicnic rclies on the difIiciilty of factoring.
---
paper_title: Efficient Offline Electronic Checks

paper_content:

Chaum, Fiat, and Naor proposed an offline check system [1], which has the advantage that the withdrawal and (anonymous) payment of a check are unlinkable. Here we present an improved protocol that saves 91% of the signatures, 41% of the other multiplications, 73% of the divisions, and 33% of the bit transmissions.
---
paper_title: Untraceable Off-line Cash in Wallet with Observers

paper_content:

Incorporating the property of untraceability of payments into off-line electronic cash systems has turned out to be no easy matter. Two key concepts have been proposed in order to attain the same level of security against double-spending as can be trivially attained in systems with full traceability of payments.
---
paper_title: On blind signatures and perfect crimes

paper_content:

David Chaum has introduced the idea of blind signatures, an extension of the concept of digital signatures, as a way to protect the identity and privacy of a user in electronic payment and service networks. Blind signatures also prevent so-called ''dossier creation'' about users by organizations. While the concept of blind signatures still allows authorities to distinguish between valid and false data, it prevents these authorities from connecting specific data or actions to specific users. With the growing emphasis on the protection of the privacy of user data and user actions in electronic systems, blind signatures seem to be a perfect solution. This paper however, discusses a problematic aspect of blind signatures, showing that this perfect solution can potentially lead to perfect crime. We use a real crime case as an example.
---
paper_title: Wallet Databases with Observers

paper_content:

Previously there have been essentially only two models for computers that people can use to handle ordinary consumer transactions: (1) the tamper-proof module, such as a smart card, that the person cannot modify or probe: and (2) the personal workstation whose inner working is totally under control of the individual. The first part of this article argues that a particular combination of these two kinds of mechanism can overcome the limitations of each alone, providing both security and correctness for organizations as well as privacy and even anonymity for individuals.Then it is shown how this combined device, called a wallet, ran carry a database containing personal information. The construction presented ensures that no single part of the device (i.e. neither the tamper-proof part nor the workstation) can learn the contents of the database -- this information can only be recovered by the two parts together.
---
paper_title: An Untraceable Electronic Cash System Using Fair Blind Signatures

paper_content:

Since the blind signature scheme has the unlinkability property, it can be used for untraceable electronic cash systems. The unlinkability property protects the privacy of users; however, it may be abused by criminals, e.g., to launder money or to safely get a ransom. The techniques of fair blind signature are developed to withstand the misuse of unlinkability property. In this paper, we propose not only a user-efficient but also a signer-efficient fair blind signature scheme for untraceable electronic cash. Only with the help from a judge or government, the signer or the banker can derive the link between a signature and the instance of the signing protocol which produces the signature when the unlinkability property is abused. Comparing with existing fair blind signature schemes, our method greatly reduces the computational load of an on-line judge. Hence, the proposed method with an efficient judge can let the signer provide more efficient services to the signature requesters. It is also suitable for the limited computation capacities of users such as smart cards or mobile units. So, the proposed scheme is very useful for e-commerce transactions.
---
paper_title: Secure rewarding schemes

paper_content:

Proposes a secure rewarding scheme in which a reward provider publishes a problem and provides a reward for a person who can supply him a satisfactory solution to the problem. The first qualified claimant with a satisfactory solution to the problem is selected to obtain the reward. The selected claimant can obtain the reward from the reward provider without revealing his identity. Nobody except the selected claimant can get the reward, and the provider cannot decline the selected claimant his entitled reward. In addition, we also propose another secure rewarding scheme with two-way untraceability to protect the privacy of the reward provider as well.
---
paper_title: Untraceable Off-line Cash in Wallet with Observers

paper_content:

Incorporating the property of untraceability of payments into off-line electronic cash systems has turned out to be no easy matter. Two key concepts have been proposed in order to attain the same level of security against double-spending as can be trivially attained in systems with full traceability of payments.
---
paper_title: An inter-bank E-payment protocol based on quantum proxy blind signature

paper_content:

Security and anonymity are essential to E-payment systems. However, with the increasing computing power, existing E-payment systems will gradually become insecure. In this paper, we propose an inter-bank E-payment system which is based on quantum proxy blind signature. Adopting the techniques of quantum key distribution, one-time pad and quantum proxy blind signature, our quantum E-payment system could protect user's anonymity as the traditional E-payment systems do, and also have unconditional security which the classical E-payment systems cannot provide. Furthermore, compared with the existing quantum E-payment systems, the proposed system could support inter-bank transactions.
---
paper_title: Group Blind Digital Signatures: A Scalable Solution to Electronic Cash

paper_content:

In this paper we construct a practical group blind signature scheme. Our scheme combines the already existing notions of blind signatures and group signatures. It is an extension of Camenisch and Stadler's Group Signature Scheme [5] that adds the blindness property. We show how to use our group blind signatures to construct an electronic cash system in which multiple banks can securely distribute anonymous and untraceable e-cash. Moreover, the identity of the e-cash issuing bank is concealed, which is conceptually novel. The space, time, and communication complexities of the relevant parameters and operations are independent of the group size.
---
paper_title: Efficient group signature schemes for large groups

paper_content:

A group signature scheme allows members of a group to sign messages on the group's behalf such that the resulting signature does not reveal their identity. Only a designated group manager is able to identify the group member who issued a given signature. Previously proposed realizations of group signature schemes have the undesirable property that the length of the public key is linear in the size of the group. In this paper we propose the first group signature scheme whose public key and signatures have length independent of the number of group members and which can therefore also be used for large groups. Furthermore, the scheme allows the group manager to add new members to the group without modifying the public key. The realization is based on methods for proving the knowledge of signatures.
---
paper_title: New group signature schemes

paper_content:

Group signatures, introduced by Chaum and van Heijst, allow individual members of a group to sign messages on behalf of the group. The identity of the signer is kept secret except that a group authority can identify the signer if needed. This note presents a new group signature scheme, which hides the identity of the signer unconditionally and (unlike previous similar suggestions) allows new members to join the group. Simplifying this scheme a somewhat more efficient scheme giving computational anonymity is obtained. The group authority identifies the signer using a general method. This method can also be used to simplify three of the schemes suggested by Chaum and van Heijst. Finally, the schemes suggested here can be used to solve an open problem posed by Chaum and van Heijst.
---
paper_title: Group Signatures

paper_content:

In this paper we present a new type of signature for a group of persons, called a group signature, which has the following properties: (i) only members of the group can sign messages; (ii) the receiver can verify that it is a valid group signature, but cannot discover which group member made it; (iii) if necessary, the signature can be "opened", so that the person who signed the message is revealed. ::: ::: The group signatures are a "generalization" of the credential/ membership authentication schemes, in which one person proves that he belongs to a certain group. ::: ::: We present four schemes that satisfy the properties above. Not all these schemes arc based on the same cryptographic assumption. In some of the schemes a trusted centre is only needed during the setup; and in other schemes, each pason can create the group he belongs to.
---
paper_title: Simple Proof of Security of the BB84 Quantum Key Distribution Protocol

paper_content:

We prove that the 1984 protocol of Bennett and Brassard (BB84) for quantum key distribution is secure. We first give a key distribution protocol based on entanglement purification, which can be proven secure using methods from Lo and Chau's proof of security for a similar protocol. We then show that the security of this protocol implies the security of BB84. The entanglement purification based protocol uses Calderbank-Shor-Steane codes, and properties of these codes are used to remove the use of quantum computation from the Lo-Chau protocol.
---
paper_title: Quantum Cryptography

paper_content:

Quantum cryptography could well be the first application of quantum mechanics at the individual quanta level. The very fast progress in both theory and experiments over the recent years are reviewed, with emphasis on open questions and technological issues.
---
paper_title: Quantum information and quantum computation

paper_content:

An inexpensive faucet aerator is provided by three molded parts and a thin metal cup that holds two of the molded parts in assembled relationship. The first molded part is an elongated annulus provided with upstream and downstream recesses separated by an inner ring that helps to break up the liquid flow and serves as an abutment to support a second molded, jet-forming, part in the upstream recess and is arranged to be engaged by the third, molded, part located in the downstream recess and aiding in defining air intake means to the aerator.
---
paper_title: Unconditional security in quantum cryptography

paper_content:

Basic techniques to prove the unconditional security of quantum crypto graphy are described. They are applied to a quantum key distribution protocol proposed by Bennett and Brassard [1984]. The proof considers a practical variation on the protocol in which the channel is noisy and photos may be lost during the transmission. Each individual signal sent into the channel must contain a single photon or any two-dimensional system in the exact state described in the protocol. No restriction is imposed on the detector used at the receiving side of the channel, except that whether or not the received system is detected must be independent of the basis used to measure this system.
---
paper_title: Unconditional security of quantum key distribution over arbitrarily long distances

paper_content:

Quantum key distribution is widely thought to offer unconditional security in communication between two users. Unfortunately, a widely accepted proof of its security in the presence of source, device, and channel noises has been missing. This long-standing problem is solved here by showing that, given fault-tolerant quantum computers, quantum key distribution over an arbitrarily long distance of a realistic noisy channel can be made unconditionally secure. The proof is reduced from a noisy quantum scheme to a noiseless quantum scheme and then from a noiseless quantum scheme to a noiseless classical scheme, which can then be tackled by classical probability theory.
---
paper_title: Attack and improvements of fair quantum blind signature schemes

paper_content:

Blind signature schemes allow users to obtain the signature of a message while the signer learns neither the message nor the resulting signature. Therefore, blind signatures have been used to realize cryptographic protocols providing the anonymity of some participants, such as: secure electronic payment systems and electronic voting systems. A fair blind signature is a form of blind signature which the anonymity could be removed with the help of a trusted entity, when this is required for legal reasons. Recently, a fair quantum blind signature scheme was proposed and thought to be safe. In this paper, we first point out that there exists a new attack on fair quantum blind signature schemes. The attack shows that, if any sender has intercepted any valid signature, he (she) can counterfeit a valid signature for any message and can not be traced by the counterfeited blind signature. Then, we construct a fair quantum blind signature scheme by improved the existed one. The proposed fair quantum blind signature scheme can resist the preceding attack. Furthermore, we demonstrate the security of the proposed fair quantum blind signature scheme and compare it with the other one.
---
paper_title: An inter-bank E-payment protocol based on quantum proxy blind signature

paper_content:

Security and anonymity are essential to E-payment systems. However, with the increasing computing power, existing E-payment systems will gradually become insecure. In this paper, we propose an inter-bank E-payment system which is based on quantum proxy blind signature. Adopting the techniques of quantum key distribution, one-time pad and quantum proxy blind signature, our quantum E-payment system could protect user's anonymity as the traditional E-payment systems do, and also have unconditional security which the classical E-payment systems cannot provide. Furthermore, compared with the existing quantum E-payment systems, the proposed system could support inter-bank transactions.
---
paper_title: Arbitrated quantum-signature scheme

paper_content:

The general principle for a quantum-signature scheme is proposed and investigated based on ideas from classical signature schemes and quantum cryptography. The suggested algorithm is implemented by a symmetrical quantum key cryptosystem and Greenberger-Horne-Zeilinger (GHZ) triplet states and relies on the availability of an arbitrator. We can guarantee the unconditional security of the algorithm, mostly due to the correlation of the GHZ triplet states and the use of quantum one-time pads.
---
paper_title: Fair quantum blind signatures

paper_content:

We present a new fair blind signature scheme based on the fundamental properties of quantum mechanics. In addition, we analyse the security of this scheme, and show that it is not possible to forge valid blind signatures. Moreover, comparisons between this scheme and public key blind signature schemes are also discussed.
---
paper_title: Quantum Digital Signatures

paper_content:

We present a quantum digital signature scheme whose security is based on fundamental principles of quantum physics. It allows a sender (Alice) to sign a message in such a way that the signature can be validated by a number of different people, and all will agree either that the message came from Alice or that it has been tampered with. To accomplish this task, each recipient of the message must have a copy of Alice's"public key,"which is a set of quantum states whose exact identity is known only to Alice. Quantum public keys are more difficult to deal with than classical public keys: for instance, only a limited number of copies can be in circulation, or the scheme becomes insecure. However, in exchange for this price, we achieve unconditionally secure digital signatures. Sending an m-bit message uses up O(m) quantum bits for each recipient of the public key. We briefly discuss how to securely distribute quantum public keys, and show the signature scheme is absolutely secure using one method of key distribution. The protocol provides a model for importing the ideas of classical public key cryptography into the quantum world.
---
paper_title: A weak blind signature scheme based on quantum cryptography

paper_content:

Abstract In this paper, we present a weak blind signature scheme based on the correlation of EPR (Einstein–Padolsky–Rosen) pairs. Different from classical blind signature schemes and current quantum signature schemes, our quantum blind signature scheme could guarantee not only the unconditionally security but also the anonymity of the message owner. To achieve that, quantum key distribution and one-time pad are adopted in our scheme. Experimental analysis proved that our scheme have the characteristics of non-counterfeit, non-disavowal, blindness and traceability. It has a wide application to E-payment system, E-government, E-business, and etc.
---
paper_title: A group signature scheme based on quantum teleportation

paper_content:

In this paper, we present a group signature scheme using quantum teleportation. Different from classical group signature and current quantum signature schemes, which could only deliver either group signature or unconditional security, our scheme guarantees both by adopting quantum key preparation, quantum encryption algorithm and quantum teleportation. Security analysis proved that our scheme has the characteristics of group signature, non-counterfeit, non-disavowal, blindness and traceability. Our quantum group signature scheme has a foreseeable application in the e-payment system, e-government, e-business, etc.
---
paper_title: An E-payment System Based on Quantum Blind and Group Signature

paper_content:

In this paper, a new E-payment system based on quantum blind and group signature is proposed. Existing E-payment systems based on classical cryptography cannot guarantee the security with the emergency of quantum computers. Compared to the existing E-payment system, our quantum E-payment scheme could protect not only the user’s anonymity but also the inner structure of customer group. In addition, our system adopts quantum key distribution, one-time pad, and audit mechanism to ensure unconditional security.
---
paper_title: Attack and improvements of fair quantum blind signature schemes

paper_content:

Blind signature schemes allow users to obtain the signature of a message while the signer learns neither the message nor the resulting signature. Therefore, blind signatures have been used to realize cryptographic protocols providing the anonymity of some participants, such as: secure electronic payment systems and electronic voting systems. A fair blind signature is a form of blind signature which the anonymity could be removed with the help of a trusted entity, when this is required for legal reasons. Recently, a fair quantum blind signature scheme was proposed and thought to be safe. In this paper, we first point out that there exists a new attack on fair quantum blind signature schemes. The attack shows that, if any sender has intercepted any valid signature, he (she) can counterfeit a valid signature for any message and can not be traced by the counterfeited blind signature. Then, we construct a fair quantum blind signature scheme by improved the existed one. The proposed fair quantum blind signature scheme can resist the preceding attack. Furthermore, we demonstrate the security of the proposed fair quantum blind signature scheme and compare it with the other one.
---
paper_title: An E-payment system based on quantum group signature

paper_content:

Security and anonymity are essential to E-payment systems. However, existing E-payment systems will easily be broken into soon with the emergence of quantum computers. In this paper, we propose an E-payment system based on quantum group signature. In contrast to classical E-payment systems, our quantum E-payment system can protect not only the users' anonymity but also the inner structure of customer groups. Because of adopting the two techniques of quantum key distribution, a one-time pad and quantum group signature, unconditional security of our E-payment system is guaranteed.
---
paper_title: Dissecting Android Malware: Characterization and Evolution

paper_content:

The popularity and adoption of smart phones has greatly stimulated the spread of mobile malware, especially on the popular platforms such as Android. In light of their rapid growth, there is a pressing need to develop effective solutions. However, our defense capability is largely constrained by the limited understanding of these emerging mobile malware and the lack of timely access to related samples. In this paper, we focus on the Android platform and aim to systematize or characterize existing Android malware. Particularly, with more than one year effort, we have managed to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011. In addition, we systematically characterize them from various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. The characterization and a subsequent evolution-based study of representative families reveal that they are evolving rapidly to circumvent the detection from existing mobile anti-virus software. Based on the evaluation with four representative mobile security software, our experiments show that the best case detects 79.6% of them while the worst case detects only 20.2% in our dataset. These results clearly call for the need to better develop next-generation anti-mobile-malware solutions.
---
paper_title: Designed to Fail: A USB-Connected Reader for Online Banking

paper_content:

We present a security analysis of an internet banking system used by one of the bigger banks in the Netherlands, in which customers use a USB-connected device --- a smartcard reader with a display and numeric keyboard --- to authorise transactions with their bank card and PIN code. Such a set-up could provide a very strong defence against online attackers, notably Man-in-the-Browser attacks, where an attacker controls the browser and host PC. However, we show that the system we studied is seriously flawed: an attacker who controls an infected host PC can get the smartcard to sign transactions that the user does not explicitly approve, which is precisely what the device is meant to prevent. ::: ::: The flaw is not due to a simple implementation bug in one of the components (e.g. the device or the software components on the PC). It is a more fundamental design flaw, introduced in assigning responsibilities to the different components and designing the protocols between them. ::: ::: The system we studied, used by the Dutch bank ABN-AMRO, was developed by the Swedish company Todos AB. This company has since been acquired by Gemalto. ABN-AMRO is one of the three biggest banks in the Netherlands, with 6.8 million customers. Given the popularity of internet banking in the Netherlands, this means that millions of these devices are in the field. The manufacturer claims this device is "the most secure sign-what-you-see end-user device ever seen"; this paper demonstrates this claim to be false.
---
paper_title: Wallet Databases with Observers

paper_content:

Previously there have been essentially only two models for computers that people can use to handle ordinary consumer transactions: (1) the tamper-proof module, such as a smart card, that the person cannot modify or probe: and (2) the personal workstation whose inner working is totally under control of the individual. The first part of this article argues that a particular combination of these two kinds of mechanism can overcome the limitations of each alone, providing both security and correctness for organizations as well as privacy and even anonymity for individuals.Then it is shown how this combined device, called a wallet, ran carry a database containing personal information. The construction presented ensures that no single part of the device (i.e. neither the tamper-proof part nor the workstation) can learn the contents of the database -- this information can only be recovered by the two parts together.
---
paper_title: Quantum cryptography: Public key distribution and coin tossing

paper_content:

When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else, even when the users share no secret information initially. We also present a protocol for coin-tossing by exchange of quantum messages, which is secure against traditional kinds of cheating, even by an opponent with unlimited computing power, but ironically can be subverted by use of a still subtler quantum phenomenon, the Einstein-Podolsky-Rosen paradox.
---
paper_title: Secure direct communication with a quantum one-time pad

paper_content:

Quantum secure direct communication is the direct communication of secret messages without first producing a shared secret key. It may be used in some urgent circumstances. Here we propose a quantum secure direct communication protocol using single photons. The protocol uses batches of single photons prepared randomly in one of four different states. These single photons serve as a one-time pad which is used directly to encode the secret messages in one communication process. We also show that it is unconditionally secure. The protocol is feasible with present-day technique.
---
paper_title: Is Bitcoin a Decentralized Currency?

paper_content:

Bitcoin has achieved popularity by promising users a fully decentralized, low-cost virtual currency system. However, a limited set of entities controls Bitcoin's services, decision-making, mining, and incident resolution processes. These entities can decide Bitcoin's fate, bypassing the will of the multitude of users that populate the network.
---
paper_title: Low Cost and Compact Quantum Key Distribution

paper_content:

We present the design of a novel free-space quantum cryptography system, complete with purpose-built software, that can operate in daylight conditions. The transmitter and receiver modules are built using inexpensive off-the-shelf components. Both modules are compact allowing the generation of renewed shared secrets on demand over a short range of a few metres. An analysis of the software is shown as well as results of error rates and therefore shared secret yields at varying background light levels. As the system is designed to eventually work in short-range consumer applications, we also present a use scenario where the consumer can regularly 'top up' a store of secrets for use in a variety of one-time-pad (OTP) and authentication protocols.
---
paper_title: An NFC transceiver with RF-powered RFID transponder mode

paper_content:

A single chip NFC transceiver supporting not only NFC active and passive mode but also 13.56 MHz RFID reader and tag mode was designed and fabricated. The proposed NFC transceiver can operate as a RFID tag even without external power supply thanks to a dual antenna structure for initiator and target. The area increment due to additional target antenna is negligible because the target antenna is constructed by using a shielding layer of initiator antenna.
---
paper_title: Simple Proof of Security of the BB84 Quantum Key Distribution Protocol

paper_content:

We prove that the 1984 protocol of Bennett and Brassard (BB84) for quantum key distribution is secure. We first give a key distribution protocol based on entanglement purification, which can be proven secure using methods from Lo and Chau's proof of security for a similar protocol. We then show that the security of this protocol implies the security of BB84. The entanglement purification based protocol uses Calderbank-Shor-Steane codes, and properties of these codes are used to remove the use of quantum computation from the Lo-Chau protocol.
---
paper_title: NFC Devices: Security and Privacy

paper_content:

The aim of this paper is to show security measures for NFC (Near Field Communication) use cases and devices. We give a brief overview over NFC technology and evaluate the implementation of NFC in devices. Out of this technology review we derive different use cases and applications based on NFC technology. Based on the use cases we show assets and interfaces of an NFC device that could be a possible target of an attacker. In the following we apply different attacks against the operation modes to show how applications and devices could be protected against such attacks. The information collected is consolidated in a set of threats giving guidelines on how to improve security and overcome privacy issues. This allows integrating NFC technology in a secure way for the end consumer.
---
paper_title: Vulnerabilities in first-generation RFID-enabled credit cards

paper_content:

RFID-enabled credit cards are widely deployed in the United States and other countries, but no public study has thoroughly analyzed the mechanisms that provide both security and privacy. Using samples from a variety of RFID-enabled credit cards, our study observes that (1) the cardholder's name and often credit card number and expiration are leaked in plaintext to unauthenticated readers, (2) our homemade device costing around $150 effectively clones one type of skimmed cards thus providing a proof-of-concept implementation for the RF replay attack, (3) information revealed by the RFID transmission cross contaminates the security of RFID and non-RFID payment contexts, and (4) RFID-enabled credit cards are susceptible in various degrees to a range of other traditional RFID attacks such as skimming and relaying.
---
paper_title: Mixcoin: Anonymity for Bitcoin with Accountable Mixes

paper_content:

We propose Mixcoin, a protocol to facilitate anonymous payments in Bitcoin and similar cryptocurrencies. We build on the emergent phenomenon of currency mixes, adding an accountability mechanism to expose theft. We demonstrate that incentives of mixes and clients can be aligned to ensure that rational mixes will not steal. Our scheme is efficient and fully compatible with Bitcoin. Against a passive attacker, our scheme provides an anonymity set of all other users mixing coins contemporaneously. This is an interesting new property with no clear analog in better-studied communication mixes. Against active attackers our scheme offers similar anonymity to traditional communication mixes.
---
paper_title: Introduction to Cryptography

paper_content:

From the Publisher: ::: Cryptography is a key technology in electronic key systems. It is used to keep data secret, digitally sign documents, access control, etc. Therefore, users should not only know how its techniques work, but they must also be able to estimate their efficiency and security. Based on courses taught by the author, this book explains the basic methods of modern cryptography. It is written for readers with only basic mathematical knowledge that are interested in modern cryptographic algorithms and their mathematical foundation.
---
paper_title: Zerocoin: Anonymous Distributed E-Cash from Bitcoin

paper_content:

Bitcoin is the first e-cash system to see widespread adoption. While Bitcoin offers the potential for new types of financial interaction, it has significant limitations regarding privacy. Specifically, because the Bitcoin transaction log is completely public, users' privacy is protected only through the use of pseudonyms. In this paper we propose Zerocoin, a cryptographic extension to Bitcoin that augments the protocol to allow for fully anonymous currency transactions. Our system uses standard cryptographic assumptions and does not introduce new trusted parties or otherwise change the security model of Bitcoin. We detail Zerocoin's cryptographic construction, its integration into Bitcoin, and examine its performance both in terms of computation and impact on the Bitcoin protocol.
---
paper_title: Managing an NFC Ecosystem

paper_content:

Whereas several NFC trials are already established around the world, currently there are no mass rolls out yet. This is due to several technical as well as administrative issues that have to be dealt with before rolling out such a system. In this paper we present an approach for managing the B2B relations in an near field communication (NFC) ecosystem offering services based on card emulation like loyalty, payment and ticketing. Out of experiences made from trials we show which services are needed in order to manage such an ecosystem and to provide convenience to the user. Further more we discuss functional aspects of such an ecosystem, the parties involved as well as their benefit for participating. Although the technology already given allows a smooth interaction for the consumer, the infrastructure behind the scene is complex and requires the cooperation on different levels to ensure interoperability and a thriving contactless scheme to be deployed.
---
paper_title: Majority is not enough: bitcoin mining is vulnerable

paper_content:

The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners. Conventional wisdom asserts that the mining protocol is incentive-compatible and secure against colluding minority groups, that is, it incentivizes miners to follow the protocol as prescribed. ::: ::: We show that the Bitcoin mining protocol is not incentive-compatible. We present an attack with which colluding miners' revenue is larger than their fair share. The attack can have significant consequences for Bitcoin: Rational miners will prefer to join the attackers, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency. ::: ::: Unless certain assumptions are made, selfish mining may be feasible for any coalition size of colluding miners. We propose a practical modification to the Bitcoin protocol that protects Bitcoin in the general case. It prohibits selfish mining by a coalition that command less than 1/4 of the resources. This threshold is lower than the wrongly assumed 1/2 bound, but better than the current reality where a coalition of any size can compromise the system.
---
paper_title: Quantum cryptography: Public key distribution and coin tossing

paper_content:

When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else, even when the users share no secret information initially. We also present a protocol for coin-tossing by exchange of quantum messages, which is secure against traditional kinds of cheating, even by an opponent with unlimited computing power, but ironically can be subverted by use of a still subtler quantum phenomenon, the Einstein-Podolsky-Rosen paradox.
---
paper_title: Is Bitcoin a Decentralized Currency?

paper_content:

Bitcoin has achieved popularity by promising users a fully decentralized, low-cost virtual currency system. However, a limited set of entities controls Bitcoin's services, decision-making, mining, and incident resolution processes. These entities can decide Bitcoin's fate, bypassing the will of the multitude of users that populate the network.
---
paper_title: Pricing via processing or combatting junk mail

paper_content:

We present a computational technique for combatting junk mail in particular and controlling access to a shared resource in general. The main idea is to require a user to compute a moderately hard, but not intractable, function in order to gain access to the resource, thus preventing frivolous use. To this end we suggest several pricing Junctions, based on, respectively, extracting square roots modulo a prime, the Fiat-Shamir signature scheme, and the Ong-Schnorr-Shamir (cracked) signature scheme.
---
paper_title: Mixcoin: Anonymity for Bitcoin with Accountable Mixes

paper_content:

We propose Mixcoin, a protocol to facilitate anonymous payments in Bitcoin and similar cryptocurrencies. We build on the emergent phenomenon of currency mixes, adding an accountability mechanism to expose theft. We demonstrate that incentives of mixes and clients can be aligned to ensure that rational mixes will not steal. Our scheme is efficient and fully compatible with Bitcoin. Against a passive attacker, our scheme provides an anonymity set of all other users mixing coins contemporaneously. This is an interesting new property with no clear analog in better-studied communication mixes. Against active attackers our scheme offers similar anonymity to traditional communication mixes.
---
paper_title: Zerocoin: Anonymous Distributed E-Cash from Bitcoin

paper_content:

Bitcoin is the first e-cash system to see widespread adoption. While Bitcoin offers the potential for new types of financial interaction, it has significant limitations regarding privacy. Specifically, because the Bitcoin transaction log is completely public, users' privacy is protected only through the use of pseudonyms. In this paper we propose Zerocoin, a cryptographic extension to Bitcoin that augments the protocol to allow for fully anonymous currency transactions. Our system uses standard cryptographic assumptions and does not introduce new trusted parties or otherwise change the security model of Bitcoin. We detail Zerocoin's cryptographic construction, its integration into Bitcoin, and examine its performance both in terms of computation and impact on the Bitcoin protocol.
---
paper_title: PPay: micropayments for peer-to-peer systems

paper_content:

Emerging economic P2P applications share the common need for an efficient, secure payment mechanism. In this paper, we present PPay, a micropayment system that exploits unique characteristics of P2P systems to maximize efficiency while maintaining security properties. We show how the basic PPay protocol far outperforms existing micropayment schemes, while guaranteeing that all coin fraud is detectable, traceable and unprofitable. We also present and analyze several extensions to PPay that further improve efficiency.
---
paper_title: Majority is not enough: bitcoin mining is vulnerable

paper_content:

The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners. Conventional wisdom asserts that the mining protocol is incentive-compatible and secure against colluding minority groups, that is, it incentivizes miners to follow the protocol as prescribed. ::: ::: We show that the Bitcoin mining protocol is not incentive-compatible. We present an attack with which colluding miners' revenue is larger than their fair share. The attack can have significant consequences for Bitcoin: Rational miners will prefer to join the attackers, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency. ::: ::: Unless certain assumptions are made, selfish mining may be feasible for any coalition size of colluding miners. We propose a practical modification to the Bitcoin protocol that protects Bitcoin in the general case. It prohibits selfish mining by a coalition that command less than 1/4 of the resources. This threshold is lower than the wrongly assumed 1/2 bound, but better than the current reality where a coalition of any size can compromise the system.
---
paper_title: KARMA: A Secure Economic Framework for Peer-to-Peer Resource Sharing

paper_content:

Peer-to-peer systems are typically designed around the assumption that all peers will willingly contribute resources to a global pool. They thus suffer from freeloaders, that is, participants who consume many more resources than they contribute. In this paper, we propose a general economic framework for avoiding freeloaders in peer-to-peer systems. Our system works by keeping track of the resource consumption and resource contribution of each participant. The overall standing of each participant in the system is represented by a single scalar value, called their karma. A set of nodes, called a bankset, keeps track of each node’s karma, increasing it as resources are contributed, and decreasing it as they are consumed. Our framework is resistant to malicious attempts by the resource provider, consumer, and a fraction of the members of the bank set. We illustrate the application of this framework to a peer-to-peer filesharing
---
paper_title: An Analysis of Anonymity in the Bitcoin System

paper_content:

Anonymity in Bit coin, a peer-to-peer electronic currency system, is a complicated issue. Within the system, users are identified by public-keys only. An attacker wishing to de-anonymize its users will attempt to construct the one to-many mapping between users and public-keys and associate information external to the system with the users. Bitcoinfrustrates this attack by storing the mapping of a user to his or her public-keys on that user's node only and by allowing each user to generate as many public-keys as required. In this paper we consider the topological structure of two networks derived from Bitcoin's public transaction history. We show that the two networks have a non-trivial topological structure, provide complementary views of the Bit coin system and have implications for anonymity. We combine these structures with external information and techniques such as context discovery and flow analysis to investigate an alleged theft of Bit coins, which, at the time of the theft, had a market value of approximately half a million U.S. dollars.
---
paper_title: Digital Signature Records for the NFC Data Exchange Format

paper_content:

The NFC Data Exchange Format (NDEF) is a standardized format for storing formatted data on NFC (Near Field Communication) tags and for transporting data across a peer-to-peer NFC link. Through NDEF and its various record types, events can be triggered on an NFC device by simply touching an NFC-enabled object. The number of use cases and real applications around NFC and NDEF technology increases continuously. However, existing applications provide hardly any protection against (malicious) manipulation of NDEF data. Digital signatures are a means of providing authenticity and integrity of NDEF data. Therefore, the NFC Forum -- which is responsible for the specification of data formats, protocols and applications in regard to the NFC technology -- is working on adding digital signatures to their NDEF format. While their signature record type is still in draft status and has not been released to the public, this paper discusses the various aspects of digitally signing NDEF records. First, we introduce the readers to the NFC Data Exchange Format, its use cases and its potential security threats. After that, we describe the potential of digital signatures for NDEF messages. Finally, we discuss the advantages and disadvantages of various ways to digitally sign an NDEF message.
---
paper_title: Security Vulnerabilities of the NDEF Signature Record Type

paper_content:

The NFC Forum has released a first candidate for their Signature Record Type Definition. This specification adds digital signatures to the NFC Data Exchange Format (NDEF), which is a standardized format for storing formatted data on NFC (Near Field Communication) tags and for transporting data across a peer-to-peer links between NFC devices. With an increasing number of applications of the NFC and NDEF technology, more and more security threats became apparent. The signature record type is supposed to increase security for NDEF application by providing authenticity and integrity to the NDEF data. This paper takes a close look on the recently published Signature Record Type Definition and discusses its various security aspects. First, we introduce the signature record type and its usage. After that, we analyze the security aspects of the current signature method. Finally, we disclose multiple security vulnerabilities of the current Signature Record Type Definition and propose measures to avoid them.
---
paper_title: Do You Talk to Each Poster? Security and Privacy for Interactions with Web Service by Means of Contact Free Tag Readings

paper_content:

The PERvasive serviCe Interaction (PERCI) application allows interaction with Web Services through associated real world objects equipped with contact less tags. The tags are read with a mobile. The read tag content is used to invoke Web Service in the back-end system. The case study presented here is identifying in a structured approach security and privacy requirements of an Near Field Communication (NFC) based application. As the application is leaving the technology research stage and is about to enter some system development stage it was indicated to consider security and privacy for R&D risk management purposes. The application is representative for a service, deployable on a mobile using NFC technology and building on Web Services taking particularly the stake-holder role-specific situations and the operation of the application as an telecommunication service into account. The contributions of the paper relate to (i) the security discussion that avoids threats where this is possible and mitigates the remaining risks where this is necessary and (ii) the way to structure and organize the different aspects of the security and privacy consideration, which can be applied elsewhere too.
---
paper_title: A review of WPAN security: attacks and prevention

paper_content:

WPANs (Wireless Personal Area Networks) fill an important role in local area network technology complementing traditional IEEE 802.11 Wireless LANs. Bluetooth, ZigBee and NFC (Near Field Communications) have emerged as the key WPAN technologies. They are however subject to the usual range of security vulnerabilities found in wireless LANs such as spoofing, snooping, man-in-the-middle, denial of service and other attacks. However security in WPANs is not as mature as it is in Wireless LANs and further work is needed in order to provide comparable protection. This paper examines a range of vulnerabilities and security attacks that can be performed on Bluetooth, ZigBee and NFC WPANs and proposes protection mechanisms that can mitigate risk in each case.
---
paper_title: Secure use of NFC in medical environments

paper_content:

New services are being included in cellular phones since they appeared. Mobile phones were born as devices whose functionality was limited to voice communication, but nowadays it is a computer in our pockets. A new generation of services comes with NFC technology (Near-Field Communications) and cryptographic SIM cards. We present the deployment of services in medical environments that they can be carried out with NFC. We must make a distinction between these two categories of types of services. On one hand, it will be based on cellular phone, where hospital staff (doctors, nurses, etc.) can manage patient?s information, capture data from medical devices and manage of EHR (electronic health record). On the other hand we find a set of services where NFC is used like communication channel to transfer information and to set up of devices implanted in the human body (implants) and other solutions where we take the properties of electromagnetic induction of passive RFID (Radio Frequency Identification) to use as power to recharge batteries of those implants (e.g. pacemakers, glucometers, etc.). Hence, in this paper we show the various security problems in NFC and some solutions for them. Finally (for all these medical services), we define the desirable characteristics of safety that must be accomplished with cryptographic SIM cards and other technologies, to make this a safe and suitable technology for the medical world.
---
paper_title: Vulnerability Analysis and Attacks on NFC-Enabled Mobile Phones

paper_content:

Near Field Communication (NFC)-enabled mobile phones and services are starting to appear in the field, yet no attempt was made to analyze the security of NFC-enabled mobile phones. The situation is critical because NFC is mostly used in the area of payment and ticketing. This paper presents our approach to security testing of NFC-enabled mobile phones. Our approach takes into account not only the NFC-subsystem but also software components that can be controlled through the NFC-interface. Through our testing approach, we were able to identify a number of previously unknown vulnerabilities, some of which can be exploited for spoofing of tag content, an NFC-based worm, and for Denial-of-Service attacks. We further show that our findings can be applied to real world NFC-services.
---
paper_title: Vulnerabilities in first-generation RFID-enabled credit cards

paper_content:

RFID-enabled credit cards are widely deployed in the United States and other countries, but no public study has thoroughly analyzed the mechanisms that provide both security and privacy. Using samples from a variety of RFID-enabled credit cards, our study observes that (1) the cardholder's name and often credit card number and expiration are leaked in plaintext to unauthenticated readers, (2) our homemade device costing around $150 effectively clones one type of skimmed cards thus providing a proof-of-concept implementation for the RF replay attack, (3) information revealed by the RFID transmission cross contaminates the security of RFID and non-RFID payment contexts, and (4) RFID-enabled credit cards are susceptible in various degrees to a range of other traditional RFID attacks such as skimming and relaying.
---
paper_title: Trusting mobile user devices and security modules

paper_content:

The market for devices like mobile phones, multifunctional watches, and personal digital assistants is growing rapidly. Most of these mobile user devices need security for their prospective electronic commerce applications. While new technology has simplified many business and personal transactions, it has also opened the door to high-tech crime. We investigate design options for mobile user devices that are used in legally significant applications.
---
paper_title: Applying relay attacks to Google Wallet

paper_content:

The recent emergence of Near Field Communication (NFC) enabled smart phones resulted in an increasing interest in NFC security. Several new attack scenarios, using NFC devices either as attack platform or as device under attack, have been discovered. One of them is the software-based relay attack. In this paper we evaluate the feasibility of the software-based relay attack in an existing mobile contactless payment system. We give an in-depth analysis of Google Wallet's credit card payment functionality. We describe our prototypical relay system that we used to successfully mount the software-based relay attack on Google Wallet. We discuss the practicability and threat potential of the attack and provide several possible workarounds. Finally, we analyze Google's approach to solving the issue of software-based relay attacks in their recent releases of Google Wallet.
---
paper_title: Dissecting Android Malware: Characterization and Evolution

paper_content:

The popularity and adoption of smart phones has greatly stimulated the spread of mobile malware, especially on the popular platforms such as Android. In light of their rapid growth, there is a pressing need to develop effective solutions. However, our defense capability is largely constrained by the limited understanding of these emerging mobile malware and the lack of timely access to related samples. In this paper, we focus on the Android platform and aim to systematize or characterize existing Android malware. Particularly, with more than one year effort, we have managed to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011. In addition, we systematically characterize them from various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. The characterization and a subsequent evolution-based study of representative families reveal that they are evolving rapidly to circumvent the detection from existing mobile anti-virus software. Based on the evaluation with four representative mobile security software, our experiments show that the best case detects 79.6% of them while the worst case detects only 20.2% in our dataset. These results clearly call for the need to better develop next-generation anti-mobile-malware solutions.
---
paper_title: Practical NFC peer-to-peer relay attack using mobile phones

paper_content:

NFC is a standardised technology providing short-range RFID communication channels for mobile devices. Peer-to-peer applications for mobile devices are receiving increased interest and in some cases these services are relying on NFC communication. It has been suggested that NFC systems are particularly vulnerable to relay attacks, and that the attacker's proxy devices could even be implemented using off-the-shelf NFC-enabled devices. This paper describes how a relay attack can be implemented against systems using legitimate peer-to-peer NFC communication by developing and installing suitable MIDlets on the attacker's own NFC-enabled mobile phones. The attack does not need to access secure program memory nor use any code signing, and can use publicly available APIs. We go on to discuss how relay attack countermeasures using device location could be used in the mobile environment. These countermeasures could also be applied to prevent relay attacks on contactless applications using 'passive' NFC on mobile phones.
---
paper_title: A practical relay attack on ISO 14443 proximity cards

paper_content:

Contactless smart cards are used in access control and pay- ment systems. This paper illustrates an attack which effectively allows an attacker to 'borrow' the victim's card for a short period without requir- ing physical access to the victim's card. As a result the legitimate owner will remain unaware of the attack. We show that our hardware success- fully executed a relay attack against an ISO 14443A contactless smart card, up to a distance of 50 m. Simply relaying information between the card and reader over a longer distance does not require the same techni- cal resources from the attacker as hardware tampering or cryptanalysis. This attack is therefore a feasible method for circumventing current se- curity protocols with little effort. Since application-level measures fail to protect against relay attacks, we discuss possible solutions involving characteristics of the physical communication medium.
---
paper_title: Issues in NFC as a form of contactless communication: A comprehensive survey

paper_content:

Near Field Communication, being an emerging technology, has become an attractive area of research in academics as well as in industries due to its flooding growth and promising applications like short range contactless communication for mobile phone and other devices alike. In this regard, a proper understanding and direction of current research of NFC is to be perfectly maintained for the advancement of knowledge and to reduce the bridge gap between its basic theory and application practice. In this paper, we have proposed a thorough survey on NFC and discussed it in terms of our own visualization. We have found the problems available in the current technology of major industries like Apple, Google, Paypal and proposed some new thoughts to solve those. We also have analyzed the NFC business ecosystem and current / future market trends. In other words, this holistic review with the objective of bringing to state-of-the-art in NFC design provides development of knowledge in this field with future research directions.
---
paper_title: Confidence in Smart Token Proximity: Relay Attacks Revisited

paper_content:

Contactless and contact smart card systems use the physical constraints of the communication channel to implicitly prove the proximity of a token. These systems, however, are potentially vulnerable to an attack where the attacker relays communication between the reader and a token. Relay attacks are not new but are often not considered a major threat, like eavesdropping or skimming attacks, even though they arguably pose an equivalent security risk. In this paper we discuss the feasibility of implementing passive and active relay attacks against smart tokens and the possible security implications if an attacker succeeds. Finally, we evaluate the effectiveness of time-out constraints, distance bounding and the use of a additional verification techniques for making systems relay-resistant and explain the challenges still facing these mechanisms.
---
paper_title: Analysis of Applicability of ISO 9564 PIN based Authentication to Closed-Loop Mobile Payment Systems

paper_content:

Payment transactions initiated through a mobile device are growing and security concerns must be ad-dressed. People coming from payment card industry often talk passionately about porting ISO 9564 PIN standard based authentication in open-loop card payment to closed-loop mobile financial transactions and certification of closed-loop payment product or solution against this standard. In reality, so far this standard has not been adopted in closed-loop mobile payment authentication and applicability of this ISO standard must be studied carefully before adoption. The authors do a critical analysis of the applicability of this ISO specification and makes categorical statement about relevance of compliance to closed-loop mobile payment. Security requirements for authentication in closed-loop mobile payment systems are not standardized through ISO 9564 standard, Common Criteria, etc. Since closed-loop mobile payment is a relatively new field, the authors make a case for Common Criteria Recognition Agreement (CCRA) or other standards organization to push for publication of a mobile device-agnostic Protection Profile or standard for it, incorporating the suggested authentication approaches.
---
paper_title: Mobile Security Issues Come to the Forefront

paper_content:

Given the increasing importance mobile devices play in critical applications, including finance and healthcare, how to instill a culture of security and best practices in disclosing weak spots in Internet-enabled mobile communications is paramount. However, two recently uncovered security flaws demonstrate the confusion surrounding who's responsible for patching weaknesses and alerting the public to security vulnerabilities.
---
paper_title: Practical Attack Scenarios on Secure Element-Enabled Mobile Devices

paper_content:

Near Field Communication's card emulation mode is a way to put virtual smart cards into mobile phones. A recently launched application is Google Wallet. Google Wallet turns a phone into a credit card, a prepaid card and a tool to collect gift certificates and discounts. Card emulation mode uses dedicated smart card chips, which are considered to fulfill high security standards. Therefore, card emulation mode is also considered to be safe and secure. However, an NFC-enabled mobile phone introduces a significantly different threat vector. Especially a mobile phone's permanent connectivity to a global network and the possibility to install arbitrary applications onto smart phones open up for several new attack scenarios. This paper gives an overview of the new risks imposed by mobile connectivity and untrusted mobile phone applications. The various APIs for secure element access on different mobile phone platforms and their access control mechanisms are analyzed. The security aspects of mobile phones are explained. Finally, two practical attack scenarios, a method to perform a denial of service (DoS) attack against a secure element and a method to remotely use the applications on a victims secure element without the victim's knowledge, are highlighted.
---

Title: Security of Electronic Payment Systems: A Comprehensive Survey

Section 1: INTRODUCTION
Description 1: This section introduces the growing use of electronic payment systems, outlines the survey's objectives in examining security measures and attack strategies, and provides a roadmap for the rest of the paper.

Section 2: CARD-PRESENT (CP) TRANSACTIONS
Description 2: This section reviews dominant CP transaction systems like EMV, discusses various attack methods, and examines the vulnerabilities in offline authentication.

Section 3: ELLIPTIC CURVE CRYPTOGRAPHY (ECC) IN EMV SMART CARDS
Description 3: This section evaluates the migration from RSA to ECC-based cryptosystems in EMV cards and compares the security and efficiency of both methods.

Section 4: CARD-NOT-PRESENT (CNP) TRANSACTIONS
Description 4: This section evaluates the security of CNP transaction approaches including 3D Secure, 3D SET, SET/EMV, and EMV/CAP protocols.

Section 5: TOKENIZATION
Description 5: This section explores the concept of tokenization introduced by credit card brands to enhance user confidentiality and privacy during online transactions.

Section 6: BLIND SIGNATURES SCHEMES IN E-PAYMENT
Description 6: This section discusses the role of blind signatures and group signatures in electronic cash and e-payment systems to achieve anonymity.

Section 7: QUANTUM CRYPTOGRAPHY IN E-PAYMENT
Description 7: This section explores the role of Quantum Key Distribution (QKD) in electronic payment systems to achieve unconditional security.

Section 8: ELECTRONIC CURRENCY AND PEER TO PEER PAYMENT SYSTEMS
Description 8: This section assesses decentralized electronic payment systems such as Bitcoin, including their use of blockchain technology and related security issues.

Section 9: NFC VULNERABILITIES
Description 9: This section highlights various vulnerabilities in Near Field Communication (NFC) systems and explores potential countermeasures.

Section 10: MIGRATION FROM RFID CARDS TOWARDS NFC ENABLED MOBILE
Description 10: This section discusses the evolution from RFID credit cards to NFC-enabled mobile payment systems and their respective security issues.

Section 11: GOOGLE WALLET, ANDROID PAY, APPLE PAY
Description 11: This section evaluates the security features and vulnerabilities of mobile payment systems like Google Wallet, Android Pay, and Apple Pay.

Section 12: CONCLUSION
Description 12: This section summarizes the survey's findings on the security of electronic payment systems and highlights the need for further improvements in security, user privacy, anonymity, and performance.