currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard.
I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based on openPGP v2 smartcard and my question is:
On the card you can store 3 GPG keys (encryption, signing, authentication) or S/MIME equivalent.
There are also a data objects on smartcard when you can store key for TC/LUKS.
So, are those data objects stored on card encrypted with GPG/S-MIME or just protected by smartcard's PIN?
From what I gather reading some documentation online:
So bottom line, if I understand it correctly from the documentation alone, is that the Truecrypt data object is only protected with the PIN.
Speculation: I think it won't make any practical difference however if it were encrypted. You would still need to decrypt it to provide it to Truecrypt, at which point an attacker can intercept it anyway. This is based on my limited understanding, perhaps mistaken, that Truecrypt in this set-up does not actually perform any encryption/decryption operation on the card, but rather only uses it for key storage.
UPDATE: Most smartcards, and also it seems this card, prevent brute-force attacks and will block access after some failed attempts. This should provide some protection still, e.g. if the smartcard is lost or stolen. However, this might not be sufficient against rogue code that might intercept either the PIN or the TC key after the user inputs the correct PIN.