Secure channel establishment between payment device and terminal device

1. A method of establishing a secure channel for communication between a payment device and a terminal device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the payment device has a unique private key d c with a public key Q c =d c G certified by a party trusted by the terminal device, the method comprising:

the payment device generating a blinding factor r and sending a blinded public key R=r·Q c to the terminal device;

the terminal device generating an ephemeral private key d t and a corresponding ephemeral public key Q t =d t G and sending Q t to the payment device;

wherein the payment device generates K c =KDF(r d c ·Q t ) and the terminal device generates K t =KDF(d t ·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the payment device and the terminal device;

wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer;

wherein r·d c is chosen such that z is a factor of r·d c .

2. The method of claim 1 , wherein z is a factor of r.

3. The method of claim 1 , wherein z=z 1 ·z 2 , wherein z 1 and z 2 are integers, and z 1 is a factor of r and z 2 is a factor of d c .

4. The method of claim 1 , wherein G is a point on the NIST P-256 elliptic curve.

5. The method of claim 1 , wherein the terminal device sends its ephemeral public key Q t to the payment device, before receiving the blinded public key R from the payment device.

6. The method of claim 1 , wherein the payment device sends the blinded public key R and an encrypted blinding factor r to the terminal device.

7. The method of claim 6 , wherein the payment device sends an encrypted public key certificate for the card public key Q c with the encrypted blinding factor r.

8. A payment device comprising a processor and a memory and configured to establish a secure channel for communication between the payment device and a terminal device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the payment device has a unique private key d c with a public key Q c =d c G certified by a party trusted by the terminal device:

generating a blinding factor r and sending a blinded public key R=r·Q c to the terminal device;

receiving an ephemeral private key d t and a corresponding ephemeral public key Q t =d t G generated by the terminal device;

generating K=KDF(r d c ·Q t ) while the terminal device generates K t =KDF(d t ·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the payment device and the terminal device;

wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer;

wherein r·d c is chosen such that z is a factor of r·d c .

9. The payment device as claimed in claim 8 , wherein the payment device is an externally powered passive device.

10. The payment device of claim 8 , wherein z=z 1 ·z 2 , wherein z 1 and z 2 are integers, and z 1 is a factor of r and z 2 is a factor of d c .

11. The payment device of claim 8 , wherein the payment device is further configured to send the blinded public key R and an encrypted blinding factor r to the terminal device.

12. The payment device of claim 11 , wherein the payment device is further configured to send an encrypted public key certificate for the card public key Q c with the encrypted blinding factor r.

13. The payment device of claim 8 , wherein z is a factor of r.

14. The payment device as claimed in claim 13 , wherein the payment device is a payment card.

15. A terminal device comprising a processor and a memory and configured to establish a secure channel for communication between a payment device and the terminal device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the payment device has a unique private key d c with a public key Q c =d c G certified by a party trusted by the terminal device:

receiving a blinded public key R=r·Q c from the payment device, which has generated a blinding factor r;

generating an ephemeral private key d t and a corresponding ephemeral public key Q t =d t G and sending Q to the payment device;

while the payment device generates K c =KDF(r d c ·Q t ), generating K t =KDF(d t ·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the payment device and the terminal device;

wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer;

wherein r·d c is chosen such that z is a factor of r·d c .

16. The terminal device of claim 15 , wherein z is a factor of r.

17. The terminal device of claim 15 , wherein z=z 1 ·z 2 , wherein z 1 and z 2 are integers, and z 1 is a factor of r and z 2 is a factor of d c .

18. The terminal device of claim 15 , wherein the terminal device is further configured to send its ephemeral public key Q t to the payment device, before receiving the blinded public key R from the payment device.

19. The terminal device of claim 15 , wherein the terminal device is a terminal of a transaction system.