Introducing TLS-PSK authentication for EMV devices

Access control to online banking accounts is a very critical topic for the always-on emerging society. In order to avoid phising threats resulting from classical mechanisms dealing with login and password tuples, the deployment of two-factor authentication tokens generating One Time Password (OTP) is recommended by many governmental organizations. A procedure based on EMV credit cards (the Chip Authentication Program) is proposed by several financial companies. However, due to passwords lifetime, OTP values may be collected by hackers via phishing attacks. In this paper we present a protocol that merges the CAP approach to the TLS-PSK protocol. As a consequence there is no need to collect OTP values, and phishing attacks don't work, because the mutual authentication between the card bearer and the WEB site is only performed via the SSL session.