Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm developing a small CRM application that will have to store some sensitive data and I would like to (optionally) supply my users with the possibility to use a readerless smart card (aka "security token", "USB hardware key", etc) to protect their data. My application is aimed to the Linux/KDE platform and will be written in C++ with Qt 4.8 or 5.0. A cross-platform version (Linux/Windows/Mac) could be requested later. This application is aimed to a niche market traditionally characterized by small IT budgets.

I need a USB-Token / Smart-Card with these features:

  1. Ability to integrate with the existing Linux PAM authentication system
  2. Ability to integrate with the existing Linux EFS (encrypted file system)
  3. Ability to generate and store one or more user passwords/keys
  4. Ability to store some user data (protected/encrypted flash memory)
  5. Ability to use TWO different USB tokens with the same application (one for general use, the other one as a backup. The two token can/have to be totally equivalent)
  6. Ability to use a encrypted channel for the application/token communication (that is: some kind of protection against SW/HW keyloggers).

Any suggestion for a good hardware token for this task?

Please note that I would like to do some experiment/testing with this tool before adopting it so I would like to find a solution provider who allow me to download its SDK (maybe with a demo token or a software emulator) before buying tokens in any relevant quantity.

Did you have any good/bad experience with the existing manufacturers of security tokens? Can you address me towards a good product?


share|improve this question

closed as not constructive by Iszi, AviD Mar 20 '12 at 14:57

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Hi Alex, welcome to Information Security. In general, questions should not be "shopping list" questions, i.e. asking for a list of .... A better question would be what criteria should the product be judged on, how to analyze the product, etc. Please see the FAQ, and How to Ask. – AviD Mar 20 '12 at 14:17
Hi AviD, I apologize for the heavily market-oriented question but it is quite hard to tell it in another way. I do have to choose a product (or a "solution") on the market. – AlexBottoni Mar 20 '12 at 14:30
Alex, I understand, but shopping recommendations are offtopic on all SE sites, for a variety of reasons. I suggest you edit this question as I mentioned above, and then flag it for any moderator to reopen. You could also try talking to people directly in our chatroom, The DMZ. – AviD Mar 20 '12 at 14:57