Security Analysis and Implementation of Relay-Resistant Contactless Payments

Ioana Boureanu (1) , Tom Chothia (2) , Alexandre Debant (3, 4, 5) , Stéphanie Delaune (3, 4, 5)

1 UNIS - University of Surrey
2 University of Birmingham [Birmingham]
3 EMSEC - Embedded Security and Cryptography / Sécurité cryptographie embarquée
4 IRISA-D1 - SYSTÈMES LARGE ÉCHELLE
5 CNRS - Centre National de la Recherche Scientifique

Contactless systems, such as the EMV (Europay, Mastercard and Visa) payment protocol, are vulnerable to relay attacks. The typical countermeasure to this relies on so-called proximity checking or distance bounding protocols, whereby the reader estimates an upper bound on its physical distance from the card by doing round-trip time (RTT) measurements. However, these protocols are trivially broken in the presence of rogue readers. At Financial Crypto 2019, two novel EMV-based relay-resistant protocols were proposed: they integrate distance-bounding with the use of hardware roots of trust (HWRoT) in such a way that correct RTT-measurements can no longer be bypassed. Our contributions are threefold. First, we design a calculus to model this advanced type of distance-bounding protocols integrated with HWRoT; as an additional novelty, our calculus is also the first to allow for mobility of cards and readers within a proximity-checking primitive. Second, to be able to analyse these protocols via more standard mechanisms and tools, we consider a 2018 characterisation of distance-bounding security which does away with physical aspects and resides only on causality of events; we cast it in our richer calculus and extend its theoretical guarantees to our more expressive models (with mobility, potentially rogue readers, and HWRoT). Due to this extension, we can then legitimately carry out the security analysis in the standard protocol verification tool ProVerif. Third, we provide the first implementation of Mastercard's relay-resistant EMV protocol PayPass-RRP, as well as one of its 2019 extension with HWRoT called PayBCR. We evaluate their efficiency and their robustness to relay attacks, in presence of both honest and rogue readers. Last but not least, our experiments are the first to show that Mastercard's PayPass-RRP and its HWRoT-based extension PayBCR are both practical in preventing relay attacks of the magnitude shown thus-far in EMV.

Domaines: Cryptographie et sécurité [cs.CR]

Ioana Boureanu, Tom Chothia, Alexandre Debant, Stéphanie Delaune. Security Analysis and Implementation of Relay-Resistant Contactless Payments. CCS, Nov 2020, Virtual Conference, United States. ⟨hal-02917076⟩