Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control the readers.

Our manufacturer can provide these cards with a PIN enabled or set to a predefined value.

What are the recommended workflows or processes for deploying PIN protected SAMs? Somebody mentioned that the SAM has a predefined PIN which is changed to a new random PIN by the terminal on first run. This PIN is then persisted locally?

Another approach is to use the SAMs identity. According to the SAM API doc, each SAM has it's own 32byte Identifier, which the API doc says can be used for local SAM PIN generation.

Any suggestions are welcome. I am also interested to get any recommendations for books on the topic of Smart card development.

share|improve this question
Out of interest, what happens if a SAM card gets stolen? – NULLZ May 17 '13 at 9:01
That's my main concern. I want the SAM to be useless if stolen. – conor May 17 '13 at 11:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.