Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea.

I know that some implementations of smartcards are weak against physical attacks like using acid to recover the key or other side channel attacks.

Do (relatively) cheap smartcards that are resistant to physical attacks that work with mobile devices exist?

share|improve this question

closed as off-topic by Adi, TildalWave, Xander, Rory Alsop Dec 21 '13 at 14:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Get a laptop with a TPM and use BitLocker – paj28 Dec 21 '13 at 11:50
Why not use multi-factor authentication? You can then have a password, token, and/or keyfile. Doing so removes the problem of one device being compromised. – Polynomial Dec 21 '13 at 12:35
@paj28 i'm talking about mobile phones – More Dec 21 '13 at 14:15
Sorry, what? Why would you "give encryption keys to cloud"? That's not how keyfiles and smart card tokens work... – Polynomial Dec 21 '13 at 14:24

The smart card technology you would need certainly exists; SIM cards which can store and use RSA keys in a tamper-resistant way have even been deployed quite some years ago. If the SIM card can use a private key (subject to PIN code authentication) then the key K for disk encryption could be stored outside of the card in encrypted form, and the card be used to decrypt it when needed.

Availability of hardware does not mean that you can have it, now, in your phone. The SIM card you have is the one provided by your phone operator, who may or may not elect to sell you an RSA-able card. Moreover, even if you have such a card, chances are that there is nothing in the phone OS to take advantage of it, in particular in terms of disk encryption. You could potentially have it with a rooted Android phone, provided that you develop the missing pieces (e.g. TrueCrypt can work with smart cards).

An important point is that all of this is about storing the encryption key in a safe place when the device is powered down. However, card I/O being what it is, it would be very impractical to make the card perform all encryption/decryption for disk access; thus, when the phone is powered up, the disk encryption key will be somewhere in the RAM of the device. Mobile phones are normally kept on continuously, and if your phone is stolen, then it will be powered at that time. An industrious attacker may then use a cold boot attack to recover that key directly from the phone RAM.

share|improve this answer
from my knowledge tamper resistant smart card doesn't exist. are you sure there is tamper resistant smart cards that we can protect them with a low entropy pin to prevent brute force attacks? – More Dec 21 '13 at 14:30
It is tamper resistance, not tamper immunity. Supposedly, breaking through a FIPS 140-2 Level3 card is expensive, sufficiently so that attackers are deterred (depending on the value of the data that is protected). – Tom Leek Dec 21 '13 at 14:45
how much expensive? as i said if attack cost higher than $2k or $10k then its fine (but that liked hack example looks cost $1 for acid nothing more...!) – More Dec 21 '13 at 14:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.