Personal identification number
A Personal Identification Number, pronounced "pin"; (often spoken out loud "PIN number", introducing redundancy) is a numeric or alpha-numeric password used in the process of authenticating a user accessing a system.
PINs are commonly used in smartphones, as a form of personal authentication, so that only those who know the PIN will be able to access the device. After a number of failed attempts of entering the correct PIN, the user may be blocked from trying again for an allocated amount of time, all of the data stored on the device may be deleted, or the user may be asked to enter alternate information that only the owner is expected to know to authenticate. Whether any of the former mentioned phenomenona occur after failed attempts of entering the PIN depends largely upon the device and the owner’s chosen preferences in its settings.
The personal identification number has been the key to flourishing the exchange of private data between different data-processing centers in computer networks for financial institutions, governments, and enterprises.[1] PINs may be used to authenticate banking systems with cardholders, governments with citizens, enterprises with employees, and computers with users, among other uses.
In common usage, PINs are used in ATM or POS transactions,[2] secure access control (e.g. computer access, door access, car access),[3] internet transactions[4] or to log into a restricted website.
History[edit]
The PIN originated with the introduction of the ATM in 1967, as an efficient way for banks to dispense cash to their customers. The first ATM system was that of Barclays in London, in 1967; it accepted cheques with machine-readable encoding, rather than cards, and matched the PIN to the cheque.[5][6][7] 1972, Lloyds Bank issued the first bank card to feature an information-encoding magnetic strip, using a PIN for security.[8]
In 2006, James Goodfellow, the inventor who patented the first personal identification number, was awarded an OBE in the Queen's Birthday Honours.[9]
Financial Services PIN usage[edit]
In the context of a financial transaction, usually both a private "PIN code" and public user identifier is required to authenticate a user to the system. In these situations, typically the user is required to provide a non-confidential user identifier or token (the user ID) and a confidential PIN to gain access to the system. Upon receiving the user ID and PIN, the system looks up the PIN based upon the user ID and compares the looked-up PIN with the received PIN. The user is granted access only when the number entered matches with the number stored in the system. Hence, despite the name, a PIN does not personally identify the user.[10] The PIN is not printed or embedded on the card but is manually entered by the cardholder during automated teller machine (ATM) and point of sale (POS) transactions (such as those that comply with EMV), and in card not present transactions, such as over the Internet or for phone banking.
Financial Services PIN length[edit]
The international standard for financial services PIN management, ISO 9564-1, allows for PINs from four up to twelve digits, but recommends that for usability reasons the card issuer not assign a PIN longer than six digits.[11] The inventor of the ATM, John Shepherd-Barron, had at first envisioned a six-digit numeric code, but his wife could only remember four digits, and that has become the most commonly used length in many places,[6] although banks in Switzerland and many other countries require a six-digit PIN.
Financial Services PIN validation[edit]
There are several main methods of validating PINs. The operations discussed below are usually performed within a hardware security module (HSM).
IBM 3624 method[edit]
One of the earliest ATM models was the IBM 3624, which used the IBM method to generate what is termed a natural PIN. The natural PIN is generated by encrypting the primary account number (PAN), using an encryption key generated specifically for the purpose.[12] This key is sometimes referred to as the PIN generation key (PGK). This PIN is directly related to the primary account number. To validate the PIN, the issuing bank regenerates the PIN using the above method, and compares this with the entered PIN.
Natural PINs can not be user selectable because they are derived from the PAN. If the card is reissued with a new PAN, a new PIN must be generated.
Natural PINs allow banks to issue PIN reminder letters as the PIN can be generated.
IBM 3624 + offset method[edit]
To allow user selectable PINs it is possible to store a PIN offset value. The offset is found by subtracting natural PIN from the customer selected PIN using modulo 10.[13] For example, if the natural PIN is 1234, and the user wishes to have a PIN of 2345, the offset is 1111.
The offset can be stored either on the card track data,[14] or in a database at the card issuer.
To validate the PIN, the issuing bank calculates the natural PIN as in the above method, then adds the offset and compares this value to the entered PIN.
VISA method[edit]
The VISA method is used by many card schemes and is not VISA-specific. The VISA method generates a PIN verification value (PVV). Similar to the offset value, it can be stored on the card's track data, or in a database at the card issuer. This is called the reference PVV.
The VISA method takes the rightmost eleven digits of the PAN excluding the checksum value, a PIN validation key index (PVKI, chosen from one to six) and the required PIN value to make a 64 bit number, the PVKI selects a validation key (PVK, of 128 bits) to encrypt this number. From this encrypted value, the PVV is found.[15]
To validate the PIN, the issuing bank calculates a PVV value from the entered PIN and PAN and compares this value to the reference PVV. If the reference PVV and the calculated PVV match, the correct PIN was entered.
Unlike the IBM method, the VISA method doesn't derive a PIN. The PVV value is used to confirm the PIN entered at the terminal, was also used to generate the reference PVV. The PIN used to generate a PVV can be randomly generated or user selected or even derived using the IBM method.
PIN security[edit]
Financial PINs are often four-digit numbers in the range 0000–9999, resulting in 10,000 possible combinations. Switzerland issues six-digit PINs by default.
Some systems set up default PINs and most allow the customer to set up a PIN or to change the default one, and on some a change of PIN on first access is mandatory. Customers are usually advised not to set up a PIN based on their or their spouse's birthdays, on driver license numbers, consecutive or repetitive numbers, or some other schemes. Some financial institutions do not give out or permit PINs where all digits are identical (such as 1111, 2222, ...), consecutive (1234, 2345, …), numbers that start with one or more zeroes, or the last four digits of the cardholder's social security number or birth date.[citation needed]
Many PIN verification systems allow three attempts, thereby giving a card thief a putative 0.03% probability of guessing the correct PIN before the card is blocked. This holds only if all PINs are equally likely and the attacker has no further information available, which has not been the case with some of the many PIN generation and verification algorithms that financial institutions and ATM manufacturers have used in the past.[16]
Research has been done on commonly used PINs.[17] The result is that without forethought, a sizable portion of users may find their PIN vulnerable. "Armed with only four possibilities, hackers can crack 20% of all PINs. Allow them no more than fifteen numbers, and they can tap the accounts of more than a quarter of card-holders."[18]
Breakable PINs can worsen with length, to wit:
The problem with guessable PINs surprisingly worsens when customers are forced to use additional digits, moving from about a 25% probability with fifteen numbers to more than 30% (not counting 7-digits with all those phone numbers). In fact, about half of all 9-digit PINs can be reduced to two dozen possibilities, largely because more than 35% of all people use the all too tempting 123456789. As for the remaining 64%, there's a good chance they're using their Social Security Number, which makes them vulnerable. (Social Security Numbers contain their own well-known patterns.)[18]
Implementation flaws[edit]
In 2002, two PhD students at Cambridge University, Piotr Zieliński and Mike Bond, discovered a security flaw in the PIN generation system of the IBM 3624, which was duplicated in most later hardware. Known as the decimalization table attack, the flaw would allow someone who has access to a bank's computer system to determine the PIN for an ATM card in an average of 15 guesses.[19][20]
Reverse PIN hoax[edit]
Rumours have been in e-mail circulation claiming that in the event of entering a PIN into an ATM backwards, police will be instantly alerted as well as money being ordinarily issued as if the PIN had been entered correctly.[21] The intention of this scheme would be to protect victims of muggings; however, despite the system being proposed for use in some US states,[22][23] there are no ATMs currently[when?] in existence that employ this software.[citation needed]
Mobile phone passcodes[edit]
A mobile phone may be PIN protected. If enabled, the PIN (also called a passcode) for GSM mobile phones can be between four and eight digits[24] and is recorded in the SIM card. If such a PIN is entered incorrectly three times, the SIM card is blocked until a personal unblocking code (PUC or PUK), provided by the service operator, is entered. If the PUC is entered incorrectly ten times, the SIM card is permanently blocked, requiring a new SIM card from the mobile carrier service.[citation needed]
See also[edit]
References[edit]
- ↑ Higgs, Edward (1998). History and Electronic Artefacts. Oxford University Press. ISBN 0198236336. Search this book on
- ↑ Martin, Keith (2012). Everyday Cryptography: Fundamental Principles and Applications. Oxford University Press. ISBN 9780199695591. Search this book on
- ↑ Cale, Stephane (2013). Mobile Access Safety: Beyond BYOD. Wiley Publishing. ISBN 978-1-84821-435-4. Search this book on
- ↑ "E-Commerce: A Tangled Web for PIN Debit". Digital Transactions. 1 February 2013 – via Associated Press.
- ↑ Jarunee Wonglimpiyara, Strategies of Competition in the Bank Card Business (2005), p. 1-3.
- ↑ 6.0 6.1 "The man who invented the cash machine". BBC. 2007-06-25. Retrieved 2014-06-15.
- ↑ "ATM inventor John Shepherd-Barron dies at 84". Los Angeles Times. 19 May 2010 – via Associated Press.
- ↑ Jarunee Wonglimpiyara, Strategies of Competition in the Bank Card Business (2005), p. 5.
- ↑ "Royal honour for inventor of Pin". BBC. 2006-06-16. Retrieved 2007-11-05.
- ↑ Your ID number is not a password, Webb-site.com, 8 November 2010
- ↑ ISO 9564-1:2011 Financial services — Personal Identification Number (PIN) management and security — Part 1: Basic principles and requirements for PINs in card-based systems, clause 8.1 PIN length
- ↑ "3624 PIN Generation Algorithm". IBM.
- ↑ "PIN Offset Generation Algorithm". IBM.
- ↑ "Track format of magnetic stripe cards". Gae.ucm.es.
- ↑ "PVV Generation Algorithm". IBM.
- ↑ Kuhn, Markus (July 1997). "Probability theory for pickpockets — ec-PIN guessing" (PDF). Retrieved 2006-11-24.
- ↑ Nick Berry (28 September 2012). "The most common PINs: is your bank account vulnerable?". Guardian newspaper website. Retrieved 2013-02-25.
- ↑ 18.0 18.1 Lundin, Leigh (2013-08-04). "PINs and Passwords, Part 1". Passwords. Orlando: SleuthSayers.
Armed with only four possibilities, hackers can crack 20% of all PINs.
- ↑ Zieliński, P & Bond, M (February 2003). "Decimalisation table attacks for PIN cracking" (PDF). 02453. University of Cambridge Computer Laboratory. Retrieved 2006-11-24.
- ↑ "Media coverage". University of Cambridge Computer Laboratory. Retrieved 2006-11-24.
- ↑ "Reverse PIN Panic Code". Retrieved 2007-03-02.
- ↑ Full Text of SB0562 Illinois General Assembly, accessed 2011-07-20
- ↑ sb379_SB_379_PF_2.html Senate Bill 379 Archived 2012-03-23 at the Wayback Machine Georgia General Assembly, published 2006, accessed 2011-07-20
- ↑ 082251615790 GSM 02.17 Subscriber Identity Modules, Functional Characteristics, version 3.2.0, February 1992, clause 3.1.3
This article "Personal identification number" is from Wikipedia. The list of its authors can be seen in its historical. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
