Comments on: Why all the fuss about HCE?

By: Dave Birch

Dave Birch — Thu, 03 Apr 2014 16:05:31 +0000

Yes there is no need to use SE with HCE, although there are some models that use both. You can use SE, you just don’t have to.

By: Prakash

Prakash — Thu, 03 Apr 2014 10:26:38 +0000

Hi David,

Well, Nice explanation on HCE. However Still I want to clear my doubts by summarizing HCE, thats how i understood. As I understood HCE is Consumer-Centric model and here SE will not come into picture. Security is maintained thorough tokens which is provided by Trusted Token provider(TTP) (which in case of Issuer-centric model TTP is nothing but SE supplier) Here as SE will not come into picture who will be the TTP.

Thanks and regards,

Prakash

By: HCE is launching - Tomorrow's Transactions

HCE is launching - Tomorrow's Transactions — Mon, 17 Feb 2014 13:34:16 +0000

[…] subject of Host Card Emulation (HCE: see “Why all the fuss about HCE“) seems to wander across almost every client meeting I’m in at the moment. And I’m […]

By: David Whittington

David Whittington — Thu, 28 Nov 2013 11:02:00 +0000

Agreed. It will be interesting to see the future position on HCE from the major payment & transit orgs though. Adoption will start to break the MNO’s hold over UICC and create an alternate/simpler NFC eco-system for providers – token based, card based etc. Maybe a while before we see commercial HCE services whilst security & infrastructure requirements are better understood & met.

By: Alexander Peschkoff

Alexander Peschkoff — Tue, 26 Nov 2013 11:05:08 +0000

David, there are two aspects there: (a) ITSO being SE-based and (b) HCE not supporting such low-level protocols as Mifare etc.

By: David Whittington

David Whittington — Tue, 26 Nov 2013 03:12:31 +0000

Alex- can you elaborate on which ITSO standard mentions HCE cannot be used ? Is this to do with ITSO supporting SE only based tickets/cards ?

By: Alexander Peschkoff

Alexander Peschkoff — Mon, 18 Nov 2013 02:54:16 +0000

Good overview, Dave, but still – as you pointed out – HCE presents more questions than answers… That’s before we touch the subjects of (a) security and (b) transit – you cannot use HCE for transit in the UK, for example, as it’s not ITSO-compliant/compatible (the same goes for the rest of non-EMV transit schemes worldwide…)

By: Stuart Fiske

Stuart Fiske — Mon, 18 Nov 2013 02:07:23 +0000

Gary,
Although you are right about the lack of a EMV contactless acquiring infrastructure in the US, nevertheless US contactless cards still use cryptographic keys to sign a transaction; it’s just that the cryptograms produced need to be mashed down to fit in Track 2 data which makes them weaker than EMV cryptograms.
HCE in the US has the same impact as in EMV markets – if you can reduce the usefulness of the keys to the point that they can be stored outside a secure element (let’s call them tokens) , you can download the token into a smartphone without the need for a TSM or an MNO to be part of the commercials. So the business case for Google Wallet and others just got dramatically better.

By: Gary Y

Gary Y — Sat, 16 Nov 2013 04:57:37 +0000

Dave,
Your explanation of HCE focused on chip-and-PIN implementations but, as you no doubt know, the US has not yet installed the infrastructure to support that technology. Accordingly, Google Wallet, ISIS and other mobile wallet providers appear to have used the “mag-stripe image” method (where essentially the data on the mag stripe is stored in the phone and transmitted to POS terminals) that the US banks implemented with their contactless card schemes. Since most of the terminal infrastructure in the US isn’t equipped to handle security keys transmitted from the card (or mobile phone), it seems likely that only the standard card data is being stored or protected by the secure element. Assuming that’s a correct assumption, how does HCE help Google Wallet and others here?