Decimalization table attack
An attack that recovers a bank PIN in about fifteen calls by feeding an HSM doctored decimalization tables.
The IBM 3624 method derives a PIN by encrypting the account number under a PIN key and mapping the resulting hex digits to decimal through a table, usually 0123456789012345. That table is passed in as a parameter on every verification call to the HSM — nobody had considered that the caller might lie about it.
Mike Bond and Piotr Zieliński at Cambridge showed in 2003 that changing a single table entry and watching whether verification still succeeds reveals which digits the PIN contains, and then where they sit. It takes around 15 queries on average. The cryptography was never weak; the interface was. The attack became the textbook case for treating an HSM's API as part of the security model rather than plumbing.