A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

learn more… | top users | synonyms

0
votes
1answer
26 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Some of you may know that nowadays I think you can purchase chinese cards, where you can write any UID you want, hence emulating the UID of a legitimate Mifare (e.g., Classic) card. My question is: ...
1
vote
0answers
36 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
0
votes
1answer
25 views

SmartCard Key Extraction / Alternatives

(1) As it is possible to extract the secret key from a SmartCard using laboratory equipment, I wonder if there is any (new) way to protect against this sort of security breach? Does it affect all ...
-1
votes
3answers
136 views

Can a smart card with PKI certificate be used to protect a document?

I want to use a smart card (or USB cryptotoken) with a PKI certificate for manual authorisation. Is this possible? I want to put a file (e.g. a word file or even a simple text file) into a smart ...
3
votes
2answers
72 views

Why does my debit card have a stripe AND a chip?

Recently I received a new debit card which has both a magnetic stripe and a chip (as did my previous card). I know the magnetic stripe can be easily copied whereas the chip system hasn't been ...
0
votes
4answers
43 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
3answers
128 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
34
votes
4answers
4k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
0
votes
1answer
29 views

Is a PGP revocation certificate sensitive?

In relation to an openpgp key on a smartcard: Besides revoking the key, is there anything else it can be (ab)used for? Can I just ensure it's reliably stored but not worry about it's confidentiality? ...
2
votes
2answers
55 views

What to do if you ever lose a smart card?

I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks. My idea is to generate the key using GnuPG on an isolated computer, ...
3
votes
2answers
81 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
2
votes
3answers
152 views

Lost Smart Card - extract private key?

Consider you lost your laptop with sensitive data and your smart card that contains the private key for your GnuPG and Truecrypt accounts. The smartcard is secured with a 8-digit PIN. 1) Is it ...
0
votes
2answers
438 views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
-1
votes
1answer
71 views

physical access proof smart card for disk encryption [closed]

Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea. I know that ...
-1
votes
1answer
117 views

mifare classic security [closed]

We know mifare Classic has been broken. My question is, say I store encrypted data (using some out of band RSA encryption) instead of plain data on Mifare Classic card. And also store a signature ...
2
votes
0answers
98 views

SAM Card deployment best practice

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
5
votes
3answers
260 views

SmartCard + GnuPG: what is stored in my keyring?

I recently bought a Yubikey Neo which can act as a OpenPGP smart card. I'd like to use this to store my private GnuPG key. I've gone through the initial setup and I am able to use the smartcard to ...
2
votes
5answers
667 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
3
votes
2answers
853 views

Are any Java Card 3.0 smart cards available?

The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens? The best I've found is ...
3
votes
2answers
106 views

Offloading private key operations to a trusted device

If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
14
votes
2answers
5k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
0
votes
1answer
118 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
5
votes
2answers
570 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
6
votes
1answer
224 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
5
votes
3answers
3k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
1
vote
0answers
404 views

How to set up a smart card for web login? [closed]

I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive ...
3
votes
0answers
134 views

PIV or GIDS compatible token availability [closed]

I am researching smartcards for corporate implementation and have hit a small bump. We need to support Windows RT, and Windows RT does not support Windows minidrivers for smartcards. Instead, it only ...
3
votes
1answer
5k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
1
vote
1answer
277 views

Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer

I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
3
votes
1answer
371 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
5
votes
2answers
2k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
0
votes
1answer
404 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
3
votes
1answer
885 views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
4
votes
1answer
113 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
1
vote
1answer
275 views

About performance of Smart card for performing 3DES in a MD5 hash

Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? Another alternative is to store the keys in a Smart card permanently ...
5
votes
1answer
214 views

security issue on storing keys and certificate on token

I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
4
votes
2answers
614 views

Are all smart card readers the same?

My bank has me use a credit-card-sized smart card and a USB card reader to authenticate for online transactions. I want to optimize for size when I travel light. I see that there are small SIM card ...
9
votes
1answer
526 views

Cracking PCI terminal using a trojan based on the card

I have come across an article which states the following: According to MWR InfoSecurity, cybercriminals can use fake cards containing a software code to gain access not only to a customer's PIN ...
7
votes
3answers
712 views

Getting started with SmartCards; what equipment do I need, what do I need to know?

I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it. Are all SmartCard slots capable of reading and writing a blank card? Are there compatibility ...
5
votes
2answers
157 views

What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
4
votes
1answer
719 views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
1
vote
1answer
556 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
1
vote
1answer
92 views

How to detect suspicious tokens collected by a hacker

I previously asked a question here What's the use of adding a challenge in the otp algorithm? Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
2
votes
1answer
700 views

EMV Security? How is it possible that it's secure?

I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
1
vote
1answer
316 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
0
votes
1answer
612 views

When should one use RSACryptoServiceProvider vs AESCryptoServiceProvider

I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES When should one ...
1
vote
1answer
2k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
4
votes
1answer
224 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
1
vote
2answers
89 views

Preventing a socially-engineered transaction

Can you explain what this blog means when it says: Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
0
votes
1answer
97 views

symetric encryption and signature [closed]

asymetric key is normally used for signature for non repudiation. But what if one uses EMV CAP in TDS mode as described here http://en.wikipedia.org/wiki/Chip_Authentication_Program ? Is non ...