Schneier on Security

Roger • December 5, 2008 5:45 AM

@Skorj:

• PKI is currently weak (because certificates are managed by humans via ordinary email).

Perhaps true, but you don’t need a full PKI for this. The only relevant relationship is between bank and account holder. The bank could (for example) install a signed cert on your phone in your local branch office.

• I don’t carry a cell phone most of the time, and don’t want to.

Fair enough; I share your concern. But, it could also be done on a PDA, or custom hardware made from similar components (but greatly cut down to reduce costs). The cellphone is just a ubiquitous, highly portable computing platform.

• No current cell phone has the smarts to do this, so that would be an infrastructure change.

I don’t believe this is true at all. Many modern cellphones are essentially full fledged computers with configureable software (typically Java MIDlets) and processors (e.g. 237 MHz ARM9) which, while not nearly as powerful as a modern desktop PC, can execute their end of a cryptographic protocol in a tiny fraction of a second. It is fairly common now for even mid-range phones to support SSL web browsing, and some have a PasswordSafe-like facility for caching e-banking passwords for use by the browser.

• The mugger would take my cell phone too.

A well-designed protocol would have forward secrecy, and bind your PIN (or better, since cellphones allow text entry, your password) into the message. Stealing the cert alone would then be useless, and should not even allow cryptanalysis of old captured messages.

Optionally you could also locally encrypt the cert with a (stretched) password, but if such a feature exists it must discourage re-use of the same password used in transactions.

Of course, the mugger could take you prisoner and coerce the password from you. It is essentially impossible for a two-factor system to completely prevent this, although there are ways to mitigate the effects to some degree.

• Wireless communication between the POS and the cell phone is easier to listen/impersonate than anything we use currently, unless the crypto is done exactly right (and what are the odds?)

I agree that wireless comms make everything more dangerous. However, a properly designed system shouldn’t even trust the merchant, and if you assume the merchant may be a thief, then over-the-air eavesdroppers are really somewhat irrelevant. So even with the likelihood of implementation flaws, it will still be far better than what we have.

But yes, I’d be happier with IrDA than RF wireless, and happier still with a wired connection. One other possibility, now that phone displays are getting to QVGA resolution and above, and with phone camera scans of 2-D barcodes becoming a common method of data entry, is 2-D barcode display on the phone screen. Picture a merchant “reader” that has a c. 2 cm wide slot with a small LCD screen below, and a camera above. Insert your phone, and via a series of 2-D barcodes it can hold a structured two-way conversation with the reader optically — enabling a strong cryptographic protocol and physical infrastructure assembled from existing cellphones, MIDlet software, and merchant terminals that could be quickly hacked together from phone components. Local eavesdropping essentially impossible, bandwidth adequate to do the transaction in a fraction of a second, and the phone owner gets physical control over which terminal he is communicating with.