Chip and PIN for ID cards: Not such a sharp idea?

The government has proposed adding chip and PIN capabilities to ID cards but questions remain over whether such a move would be beneficial - or even possible - at this late stage in the £4.7bn project.

With doubts over the practical benefits the cards will offer to the public still dogging the project, the Identity and Passport Service (IPS) last week raised the possibility of adding chip and PIN functionality, with IPS chief executive James Hall saying the IPS is now in discussions with the financial services industry.

"One of the issues on the table is whether we should introduce chip and PIN technology in to the card. If we conclude that chip and PIN is a key part of making it useful there's no technical reason why we couldn't do it," Hall said in a statement.

The EMV technology standard that underpins chip and PIN transactions in UK credit and debit cards could be vital in any attempt to make chip and PIN ID cards useful.

EMV is the common technology standard used in card readers and ATMs in the UK that allows them to recognise all chip and PIN cards and be used to authenticate payments and withdrawals at shops and banks across the country. It stands for Europay, MasterCard and Visa, the three payment groups that originally developed the standard.

According to Colin Whittaker, head of security for UK payments association Apacs, the inclusion of EMV tech on ID cards could ultimately see the cards offer a common standard for authenticating identity remotely using the PIN number.

With chip and PIN ID cards, holders could access new government and private sector services online using the PIN to verify their identity. Business too could take advantage of such functionality: instead of phoning an IPS verification line to check staff have permission to work in the UK, companies could ask them to verify their identity using the card's PIN.

If it were possible to add chip and PIN capabilities there could be benefits for the government and taxpayer too: relying on EMV technology and cryptography could cut the cost of implementing the scheme, as the infrastructure to authenticate the cards could be modelled around the tried-and-tested chip and PIN terminals and networks, used to verify card payments across the UK every day.

"All those sorts of technological challenges are understood and a lot of the technology needed to deliver these things using EMV are almost commodity items," Whittaker said.

The inclusion of EMV is not without its downsides, however. Clive Longbottom, service director for business processes facilitation at analyst house Quocirca, questioned the desirability of chip and PIN and warned that adding EMV functionality would make ID cards less secure.

"It will be disastrous to try and add chip and PIN to ID cards as it has proven not to be secure on credit and debit cards. It is less secure than the previous signature-based system," Longbottom said.

"It just goes to demonstrate that the government has no idea of what...

Click here for page two…