Systems and methods for cryptographic authentication of contactless cards
Example embodiments of systems and methods for data transmission between a contactless card and a client device in support of a FIDO authentication are provided. In an embodiment, upon receipt of a challenge issued by a server in connection with a pending transaction, the contactless card may authorize the client device to utilize a FIDO private key to respond to the challenge. If the response to the challenge is successful, the FIDO authentication may proceed and the transaction may be completed.
1. A method, comprising:
receiving, by a client application comprising instructions for execution on a client device, a verification from a contactless card, wherein:
the verification permits the use of a Fast Identity Online (FIDO) private key, and
the client device comprises a processor, a memory, and a communication interface;
generating, by the client application using a master key and a diversified key, a FIDO key pair including the FIDO private key and a FIDO public key; and
signing, by the client application, a challenge using the FIDO private key.
2. The method of claim 1 , further comprising:
receiving, by the client application, the challenge from a server; and
transmitting, by the client application, a verification request to the contactless card.
3. The method of claim 2 , further comprising transmitting, by the client application, the signed challenge to the server.
4. The method of claim 3 , further comprising transmitting, by the client application, the FIDO public key to the server.
5. The method of claim 3 , wherein:
the memory of the client device stores identification information, and
the client application is further configured to generate the FIDO key pair using the identification information with the master key and the diversified key.
6. The method of claim 5 , wherein the identification information comprises a site identifier for a website.
7. The method of claim 6 , wherein the server is associated with the website.
8. The method of claim 1 , further comprising storing, by the client application, the FIDO private key in the memory of the client device.
9. A system, comprising:
a processor in data communication with a memory,
wherein the processor is configured to:
receive a verification permitting the use of a Fast Identity Online (FIDO) private key;
generate, using a master key and a diversified key, a FIDO key pair including the FIDO private key and a FIDO public key; and
sign a challenge using the FIDO private key.
10. The system of claim 9 , wherein the processor is further configured to:
receive the challenge from a server;
transmit a verification request to a contactless card; and
transmit the signed challenge to the server.
11. The system of claim 9 , wherein the challenge is created by the FIDO public key.
12. The system of claim 9 , wherein the processor is further configured to receive a verification input prior to signing the challenge using the FIDO private key.
13. The system of claim 9 , wherein:
the memory stores a counter, and
the processor is further configured to generate the diversified key using the master key and the counter.
14. The system of claim 13 , wherein the processor is further configured to receive the counter from a server.
15. The system of claim 9 , wherein the challenge comprises a string of random characters.
16. A non-transitory memory storing a client application, a master key, and a diversified key, wherein:
the client application comprises instructions for execution on a client device comprising a processor, a memory, and a communication interface, and
the client application is configured to:
receive a verification permitting the use of a Fast Identity Online (FIDO) private key;
generate, using a master key and a diversified key, a FIDO key pair including the FIDO private key and a FIDO public key; and
sign a challenge using the FIDO private key.
17. The non-transitory memory of claim 16 , wherein the client application is further configured to:
receive the challenge from a server;
transmit a verification request to a contactless card; and
transmit the signed challenge to the server.
18. The non-transitory memory of claim 17 , wherein:
the non-transitory memory stores identification information, and
the client application is further configured to generate the FIDO key pair using the identification information with the master key and the diversified key.
19. The non-transitory memory of claim 18 , wherein:
the identification information comprises a site identifier for a website, and
the server is associated with the website.
20. The non-transitory memory of claim 16 , wherein the application is further configured to transmit the FIDO public key to a server.