More fun with PINs
-
Thirtysome years ago I designed and built cryptographic modules for EFT processing. Early days... In those days there were two main algorithms for PIN verification. The IBM Derived PIN system used data from the mag stripe (some of the account number and other fields) to crunch up with DES and other things to generate the expected PIN, which was verified by direct comparison (at a processing system, since the terminal did not have the relevant DES keys etc). The (more popular) VISA method took the PIN and some stripe data, crunched them up and came out with a 4 digit value which was compared with the PVV (PIN verification value) from the stripe (or issuer's database). This can be viewed as an elaborate hash function (4 digit PIN -> 4 digit PVV) I investigated its properties as a hash, and (re-)discovered some interesting statistics. Obviously a 1:1 mapping could be fairly easily brute-forced, so information is "destroyed" to make it a one-way operation. As a consequence, looking at the PVV space: 1/e (almost 37%) of PVVs are unreachable - no corresponding PINs 1/e have one PIN mapped to them 1/2e (over 18%) of PVVs have TWO PINs that map to them 1/6e (6%+) of PVVS have THREE PINs that map 1/24e (1.5%+) have FOUR ... and so on So, (back in PIN space) there is a very real chance that your card has more than one PIN that would work. (Good luck finding the other(s)!) That fact blew the mind of more than a few bean-counters and auditors.... With regard to OG's thread below, we had requests from card issuing institutions to NOT generate "simple" PINs. In the end I think we discarded PINs with 4 consecutive digits or more than two repeats. (A little repetition is good - my favoured PINs have two characteristics: They can be keyed by laying my hand over the PIN pad and merely flexing fingers. They include a repeat so even keen watchers wind up missing something.) Some time later, customer selected PINs (and PIN change terminals) hit the streets... Ah, nostalgia (ain't what it used to be)!
Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012