IMGCAP(1)]
MasterCard Worldwide has reached an agreement with United States-based security firm Cryptography Research Inc. that requires suppliers of technology used in EMV and contactless bankcards to license countermeasures from the firm designed to thwart attacks exploiting a key vulnerability in smart cards. The agreement follows an out-of-court settlement the firm reached last fall with Visa Inc. after a lawsuit accused the card company of infringing on the firm's patents and engaging in anticompetitive behavior. Visa paid an undisclosed sum to the firm for the alleged antitrust violations and for allegedly using the patented countermeasures on hundreds of millions of EMV or other smart cards issued under the Visa brand dating back to 2001. Visa also agreed to license the firm's defenses to the attack, called Differential Power Analysis. Cryptography Research also accused MasterCard of anticompetitive behavior but did not sue the U.S.-based card company. The agreement, reached last month and announced Thursday, does not indicate how much MasterCard may have had to pay the firm for certifying smart cards in the past using countermeasures that Cryptography Research claims were covered by its patents. "I can't really talk about how much money MasterCard is paying us," Kit Rodgers, Cryptography Research vice president for business development and licensing, tells CardLine Global sister publication Cards&Payments. "I can say products approved prior to the April 16 agreement will remain approved for use with MasterCard." Differential Power Analysis enables hackers to extract the secret key from smart cards and potentially clone banking, identification or other cards and devices. Cryptography Research CEO Paul Kocher and two colleagues in 1998 invented the attack and developed countermeasures. Smart card and chip vendors developed what many contended were their own countermeasures to the attack, but the settlement with Visa and the agreement with MasterCard likely will force all of them to pay Cryptography Research licensing fees if they want to do business in the banking card market. If chip vendors license the technology, it covers card vendors and other suppliers in the value chain, says Rodgers, who does not expect the licensing fees to increase the price of chip cards. "It shouldn't, not when it's spread out over hundreds of millions of cards," he says. Prompted by the settlement in the Visa suit, chip vendors Infineon Technologies of Germany, Japan-based Renasas Technology and Netherlands-based NXP Semiconductors have licensed the technology since September. Among banking chip suppliers that have not, Switzerland-based STMicroelectronics says it is in discussions with the security firm. Christian Delporte, MasterCard vice president, chip center of excellence, said in a statement that the "new requirements and rigorous testing provide enhanced assurances to our smart cards and devices." Spokespersons for the card company referred all other questions to Cryptography Research.
