1
$\begingroup$

I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets.

Is it possible? Is there any standards for that from associations?

I was thinking about HMAC but it needs to distribute secret symmetric key to all relevant parties. How to do it without distributing cryptographic key? Also it should prevent to create an oracle.

$\endgroup$
2
  • $\begingroup$ What is PAN? ​ ​ $\endgroup$
    – user991
    Jul 7, 2016 at 21:16
  • $\begingroup$ Primary Account Number (PAN) The primary account number is also referred to as account number or unique payment card number that identifies the issuer and cardholder account. It is typically for either credit or debit cards $\endgroup$ Jul 7, 2016 at 21:20

2 Answers 2

1
$\begingroup$

The Primary Account Number (which can e.g. be a credit card number) often is 16 decimal digits, with the first 6 (Issuer Identification Number) typically guessable, and the last a check digit a public function of the rest. That leaves 9 decimal digits (about 30 bit) of PAN entropy, under the (unwarranted) assumption the 9 digits are assigned randomly.

Thus if a million tokenized PANs for known IIN are known, then on average it's required only a thousand executions of a deterministic tokenization algorithm to untokenize a PAN.

Thus deterministic tokenization must use a secret key. And in addition, it must be made impossible to use by adversaries, at least at high rate. I don't see how alternatives (like using Argon2 or other entropy stretching, or randomizing, or public key) could solve the problem satisfactorily while making the tokenization useful. But then the question did not specify a functional requirement, so I can only guess.

$\endgroup$
-1
$\begingroup$

If the PAN space is sufficiently large then you can use a SHA3-256(Keccak family) and use the required number of bits of the output. I guess in that case you may have to maintain a Card-Data vault for the lookup thing.

$\endgroup$
1
  • $\begingroup$ A common PAN space is 16 digits (53.15 bit), which is not be enough to stop a determined attack if SHA3-256 or something that fast is used. It would be passable with entropy stretching using Argon2 if the PAN was random. But it's not, thus space is not what matters: it's entropy, and typical PAN entropy is much less; like 30 bit give or take a lot. $\endgroup$
    – fgrieu
    Sep 4, 2021 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.