High-Speed Public-Key based
Electronic Cash Using
Contactless IC Cards
NTT Information Sharing Platform
Laboratories
March 2001.
1

Technology Overview
The world’s first implementation ofpublic-key based e-cash technology on
dual contact/contactless interface ICcards.
 High-speed payment processing, lessthan 0.4 seconds.
2

Why are “High-Speed” and“Contactless” needed?
Contactless allows use just by putting cards
near terminals without removing it from yourpurse.
 High-speed contactless has wide applicationarea:
Kiosks, Convenience stores, Public transports (railways, buses), etc.
Dual interface allows the use of legacy
contact IC card terminals.
3Why Public-Key Based ECash?
Public-key cryptography is the only
solution for valuable versatile e-cash.


e.g. Nation-wide general purpose e-cashcards.

Symmetric cryptography can support
only less-valuable local e-cash.
e.g. Domestic prepaid cards in a park, or
railway’s stored fare cards, etc.
4Why “Contactless”notavailable until now?
RSA-like public-key cryptographyrequires co-processor on IC cards, but:Co-processor consists of complex
hardware, and consumes too much power; Difficult to implement on contactless ICcards.
5

Why was E-Cash Slow?
Slow digital sign generation on IC card

Public-key cryptography is much slower thansymmetric schemes.

Slow data communication
Contact IC card: 9,600bps
 Exchange large amount of data
(e.g. digital signature)

Inefficient IC card command architecture

Lots of interaction between terminal and IC card
occurs during a transaction.
(e.g. transaction management)
6

ApproachElliptic Curve Cryptography (ECDSA*) toreduce computational complexity
 Precalculation – shorten processing time ofdigital signature generation
 Faster data communication
Contactless IC card: 106Kbps (≅10 times faster) Data volume of ECDSA is shorter than that of RSA

Efficient IC card command architecture

Reduce interaction between terminal and IC card
*ECDSA: Elliptic Curve Digital Signature Algorithm
7

RSA vs. ECDSAKey length
Signature
data length
Basicoperations
Computationa
l complexity
Cryptographic
strength

RSA

ECDSA

1024 bits

160 bits

128 bytes

42 bytes

Power of 1024 bitlong integers

XOR and arithmetics of160 bit-long integers

HighLow

Almost equivalent8

Technique of ‘Precalculation’
In ECDSA, some parts can becalculated independently fromthe subject to be signed.
 Precalculation processes
finished in advance.


During loading e-cash into IC
card, or maintenance.

Shorten signature generationtime.

Precalculation
Store enough pairs of precalculated data into IC card.
(e.g. during loading e-cash)…
Signature generation
Combine subject with oneof unused pairs of data.

9

Latest ResultPayment processing time: 385ms (total)

PC TerminalCommunication

IC Card

15ms

180ms

190ms

• Terminal authentication• ECDSA verification• Transaction management• Terminal authentication• ECDSA signature• Transaction logging

Contactless communication•CPU:•CPU: PenIII
PenIII 800MHz
800MHz•RAM:•RAM: 256MB
256MB
•OS:
•OS: Windows98
Windows98•Communication•Communication interface
interface
-- To
To IC
IC card:card: 106Kbps
106Kbps-- To
Terminal:
To Terminal: 115Kbps
115Kbps•Infineon•Infineon SLE66CL160S
SLE66CL160S•CPU:•CPU: 16bit,16bit, 3.39MHz
3.39MHzwithwith EC-accelerator
EC-accelerator•RAM:•RAM: 1.2KB
1.2KB•EEPROM:•EEPROM: 16KB
16KB

10

Applications

Home PCsInternet banking/shopping

PDAs,
Mobile phones Mobile banking/shopping

POS terminals

ATMs
Banking

Payment

Dual I/FIC Card
Fare payment,
commuter passPublic transport
Contactless

IC card pay-phones

Contact11

Demonstration

12