Hello all,
I've been having these ideas lately, about how to implement a bitcoin PoS with a physical card, akin to a Debit Card. I'm pretty sure my ideas are correct, but I'd like to validate a few assumptions first.
After reading some on SIM cards and smart cards in general, I've established following:
- There is protected storage (r/w) on the smart card, and the only way to access it is by using the API provided by the software loaded on the card. (Unless you have a scanning tunneling microscope).
- Software that runs on the card can be either in C or Java
- C is cheaper hardware-wise, but very inflexible. Any changes required at later stages mean huge costs
- Java is cheaper to develop, as it has an integrated development environment and lots of classes (including cryptoapi), but the cards themselves are more expensive
- You can write a program for the smartcard, that executes on the smart card, and is able to do various actions like:
- Authorizing access to the private keys with a PIN
- Validating a digital signature
- Signing a block of data
- Initializing a blank card with a bunch of keypairs
With this is mind, it's not possible to put the block chain on the card, or do any extensive validation, due to processing power constraints.
So the job of doing that should be performed by a terminal. Modern terminals are essentially computers, connected to the network, either via modem, broadband, or GPRS connection. So they are able to keep the block chain fresh.
The issue is this - due to a limited space on the card, I'm not sure if it's possible to keep the entire wallet on the card. So there needs to be some sort of algorithm to quickly scan the block chain to establish the balance available for the keys that are stored on the card.
I've talked to a guy, who's job is writing software for SIM cards, the ones in everyone's cell phones. He said, that a 1Mb JavaCard would cost about $1, if the order is for 50000 cards at once. So it's not too bad.
Next step would be to research how modern POS terminals operate, and whether it's possible to add support for bitcoin processing on them, or maybe even develop something from scratch.
Other thingsTechnically the card can be limited to one keypair, but that would greatly reduce anonymity. I guess there's a possibility of having various classes of bitcoin cards with different amount of keypairs available for usage.
The keypair(s) could be programmed into the card at the time of manufacturing. Problem is that then the keys are available to 3rd party. But then it would be possible to create pre-paid bitcoin cards.
Alternatively, the keypairs could be created by the card itself, at the POS, when money is added.
Also, POS terminal can print out a bitcoin address on the receipt, so you can add more money to the card with regular bitcoin software.
It's also possible to have the card validate the POS, to ensure compliance. If the POS is validated (by crypto-key verification) of course, then (probably) additional safeguards can be implemented, like accepting transactions with no confirmations, but somehow temporarily preventing the card from double-spending, etc. Or give option at payment like "pay with no validations, but the card is locked for next 10 minutes" or "pay regularly, but goods are released upon validation"
IssuesThis is not a bank account access card. It would be an actual wallet card, so if it's lost - the money is gone forever. If it's stolen - the PIN code should prevent access to private keys. It would be possible to create 2 level PIN protection, similar to PIN and PUK in cell phones.
It's also possible to create a "doomsday pin" that wipes the card clean, in case you're under duress, or something out of a spy novel
What do you guys think?
Show Posts
Looks way cool and slick too.
