Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.
Talking about old mag stripe card, the system used to authenticate the transaction is this:
1. The account number is crypted in DES (ora a variant) with a PIN key, the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called natural PIN.
2. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.
3. Account number and offset are stored in the card.
4. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number.
Then it verifies the PIN number:
if user PIN = natural PIN + offset then SUCCESS
Comments
Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.
Talking about old mag stripe card, the system used to authenticate the transaction is this:
1. The account number is crypted in DES (ora a variant) with a PIN key, the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called natural PIN.
2. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.
3. Account number and offset are stored in the card.
4. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number. Then it verifies the PIN number: if user PIN = natural PIN + offset then SUCCESS