Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best algorithm and what the most secure way to manage the secret key between smart card and host application?

I use .net smart card and the host application is developed in .net also . Both framework provide implementation of almost all known algorithms, but i want to exploit these in a most secure way.

share|improve this question
2  
I'm sorry if this seems harsh, but you're in way over your head. Writing secure applications and deploying them isn't something you can learn in one or even a dozen Stack Exchange posts. The first problem you need to tackle is not the encryption algorithm, but the security requirements: what threats are you defending against? What assets are you protecting?What is the expected attacker profile? Once you've done that, work out your cards' lifecycle (manufacturing, provisioning, deployment, maintenance, …). – Gilles Mar 7 at 22:37
I really did not get you. I state my requirements : I am defending against any unauthorized entity that try to read the data stored in the card So only authorized one can decrypt the data. I did not try to "learn" more than trying to do something in best way by getting experts suggestion – hum. Mar 7 at 23:08
1  
What entities will be authorized? Are the applications that will authenticate with the card going to run only on hardware that you control or not? How are you going to defend against breaches? Up to what cost do you need to protect against hardware attacks? What is the cost of an attack against a single card compared with an attack that can be reproduced cheaply? – Gilles Mar 7 at 23:19

closed as not a real question by Gilles, dr jimbob, Lucas Kauffman, Terry Chia, Iszi Mar 8 at 15:11

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.