A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

learn more… | top users | synonyms

3
votes
2answers
447 views

Drill a (physical) hole on a g10 openpgp smart card [closed]

I have a g10 smart card (http://g10code.com/p-card.html) I want to make a hole on it, so I can pass a cord on it and hopefully remember to bring it with me. would I kill the card if I drill a hole on ...
2
votes
1answer
98 views

GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?

I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate). Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
4
votes
1answer
84 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
5
votes
1answer
53 views

GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?

When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information? If so, what information would that be?
4
votes
1answer
77 views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
2
votes
0answers
78 views

What's the standard protocol for secure contactless communication

A contactless smartcard has to communicate with a reader in a secure way. The ICAO standard, for example, defines an encryption key (check BAC, EAC and PACE), so that the communication is not ...
0
votes
0answers
29 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
2
votes
1answer
59 views

How smart card with client certificate is used during SSL/TLS session

Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session? Will website still 'see' my client certificate (public key) after I removed card from the reader and ...
0
votes
0answers
23 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
2
votes
2answers
75 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
9
votes
1answer
385 views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
1
vote
1answer
70 views

Use HSPD-12 (PIV) Keys for SSH

Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?
5
votes
3answers
145 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
1
vote
1answer
140 views

What is the state of smart card/computer interoperability

Smart cards are the only really secure device that can be used for, among other things, electronic identification. However, there are usability concerns stemming from the lack of standartization. ...
0
votes
0answers
31 views

How do chipped credit cards increase security? [duplicate]

So I've looked at various articles trying to understand how chipped credit cards increase security over traditional credit cards. In the times I've used my card with a chipped reader (wally world, ...
4
votes
2answers
462 views

Smart cards for user authentication - is configuration of PIN complexity important?

In our company domain we are now able to login to Windows using a smart card plus a 4 digit numeric PIN. The same smart card is used to sign e-mails too. My understanding is that authentication to ...
4
votes
0answers
120 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
3
votes
1answer
136 views

How do I find a PKI smart card reader/writer for development (Microsoft .NET)

I would like to learn how to develop software leveraging PKI smart cards. Ideally, I would use Microsoft Base Smart Card CSP, but I really just need the ability to store symmetric and asymmetric keys ...
1
vote
3answers
644 views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
6
votes
2answers
95 views

Using smart cards for email encryption and SSH

Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do ...
2
votes
0answers
105 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
0
votes
0answers
108 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
9
votes
2answers
310 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
2
votes
0answers
114 views

How to do side channel attack on smart cards? [closed]

Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism. This is the mutual authentication mechanism that my card using(Let ...
4
votes
2answers
223 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
0
votes
1answer
38 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
5
votes
2answers
233 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
1
vote
1answer
471 views

Windows Certificate Store - Generating / importing personal certificates using a smartcard?

I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC). Now I'm having the problem, that I own a ...
2
votes
0answers
23 views

Is there a common standard for digitally signing via smart cards?

Am I right that "minidrivers" which are specific to different national or regional smart cards (eg PIV/CAC, Brazil, Estonia, Sweden, France, etc) are needed for digital signatures (RSA)? Can the ...
2
votes
0answers
111 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
2
votes
1answer
207 views

Can I place a private key on a sim card?

After google searching about this idea and yielding very little in results I've come to resort to stack exchange: Is it possible to place a private key on a sim card? Is it possible for a smart ...
3
votes
1answer
109 views

OBKG on smartcard with PKCS#11

I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
3
votes
1answer
407 views

PGP key on smart card: why do I need a “secret key” on disk?

I have a YubiKey NEO on which I have the OpenPGP applet and I have a PGP key installed. I work on 3 different computers and I initialized the card on computer bob. I'm now at computer rob. Someone ...
1
vote
1answer
147 views

Smart Cards / USB token security

I am quite new to cards and tokens and trying to get a handle on a couple of issues prior to purchasing and using one. 1- physical access to keys on the card or token: Are all of these devices set ...
7
votes
4answers
762 views

How to check randomness of random number generators?

Assume that I have a smart card that returns an 8 byte (for example) random value on reception of a command. The question is that: How I can check if this value is really random? (I don't have any ...
0
votes
1answer
256 views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
0
votes
1answer
385 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely ...
3
votes
1answer
856 views

SIM card - Cryptography

I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...). Is crypto used only for ...
0
votes
1answer
71 views

Proprietary cards [closed]

I was recently reading about automotive fare collection systems and came across loyalty card systems. In these systems, if I understood correctly, each passenger has a card in which a value, not ...
0
votes
1answer
135 views

How is PayPass/payWave secure when PIN is required after presenting the card to the contactless terminal?

The popular claim is that a chip-and-PIN payment card is more secure than a card with magnetic strip because the card data is hidden deep inside the chip and the ATM or POS terminal sends the entered ...
0
votes
1answer
216 views

SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ? When using smartcard, I can understand that ...
2
votes
1answer
167 views

Smartcard - main differences between .NET and Java smartcard?

My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard. More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
1
vote
1answer
63 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
3
votes
1answer
492 views

Smart Card for RSA private key for SSL?

I have a YubiKey NEO which has a lot of amazing capabilities such as OTP, U2F, and PGP smart card for PGP/GPG and even SSH keys. One of the applications I've discovered recently for the device is a ...
1
vote
1answer
103 views

Embedded devices with storage for sensitive data

I'm looking for some embedded device that will be able to store sensitive data like certificates, private keys, etc. It should comply with following requirements: Sensitive data, stored in protected ...
4
votes
2answers
788 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
3
votes
1answer
169 views

What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?

I don't know how well known this system is or maybe there are equal systems better known international. So I'll introduce the related points of the system: It is a paymentsystem where your wallet is ...
7
votes
1answer
426 views

Connection Android - Baseband Processor - SIM Card

I currently examine the hidden components of a smartphone, inspired by the research of Weinmann All your baseband belong to us and Karsten Nohl Rooting Sim Cards. According to Weinmann, the ...
2
votes
1answer
118 views

How secure is online banking with smart card? How could it be hacked?

I have read this question and answer but still uncertain how it actually works and how a user could then be hacked. I'm asking because my brother supposedly was hacked and his bank uses exactly this ...
1
vote
2answers
288 views

Does a smart card do encryption or does it just provide a private certificate?

I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I ...