A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

learn more… | top users | synonyms

2
votes
2answers
62 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
1
vote
3answers
252 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
6
votes
4answers
1k views

Why does my debit card have a stripe AND a chip?

Recently I received a new debit card which has both a magnetic stripe and a chip (as did my previous card). I know the magnetic stripe can be easily copied whereas the chip system hasn't been ...
4
votes
1answer
88 views

What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?

I don't know how well known this system is or maybe there are equal systems better known international. So I'll introduce the related points of the system: It is a paymentsystem where your wallet is ...
-1
votes
0answers
30 views

Is Chip and PIN still Broken [duplicate]

http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.pdf Has the industry changed yet the broken EMV standards?
0
votes
1answer
103 views

Dump SSL traffic from a Java applet

I have a smartcard that can be read by websites using a Java applet (see http://www.springcard.com/online/applet_pcsc/). I would like to monitor and is to replay packets going from this java applet to ...
5
votes
0answers
91 views

Connection Android - Baseband Processor - SIM Card

I currently examine the hidden components of a smartphone, inspired by the research of Weinmann All your baseband belong to us and Karsten Nohl Rooting Sim Cards. According to Weinmann, the ...
2
votes
1answer
81 views

How secure is online banking with smart card? How could it be hacked?

I have read this question and answer but still uncertain how it actually works and how a user could then be hacked. I'm asking because my brother supposedly was hacked and his bank uses exactly this ...
3
votes
1answer
273 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
0
votes
2answers
89 views

Does a smart card do encryption or does it just provide a private certificate?

I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I ...
2
votes
1answer
736 views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...
2
votes
2answers
2k views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
0
votes
1answer
79 views

Smart Token Security Test [closed]

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
1
vote
2answers
136 views

Contactless session on ATM?

I'm currently reading about an access control and saw something interesting about smartcard contact & contactless. From what I understood from the book, smartcard contact is like an ATM Card. ...
2
votes
1answer
2k views

How does small dish satellite secure their signal?

For example how does Direct TV's small plastic cards control who receives the TV signal? How is the signal encoded in a way that can allow future updates without the provider needing a new satellite? ...
3
votes
1answer
1k views

Are any Java Card 3.0 smart cards available?

The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens? The best I've found is ...
15
votes
2answers
14k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
1
vote
3answers
653 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges. Given that today there exist cards ...
39
votes
4answers
8k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
0
votes
0answers
70 views

secure key management using smart card

I have a scenario where I want to encrypt the file data on client machine along with smart card authentication. I have followed a link that states that for smart cards, private key never leaves The ...
2
votes
3answers
179 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
1
vote
1answer
153 views

How are private keys (sMIME, PGP, etc) synchronized across a user's devices?

Given that user needs to store a copy of the same private key on each of his devices (in order to decrypt email and other data encrypted with the public key) ... what are some general techniques for ...
5
votes
4answers
494 views

SmartCard + GnuPG: what is stored in my keyring?

I recently bought a Yubikey Neo which can act as a OpenPGP smart card. I'd like to use this to store my private GnuPG key. I've gone through the initial setup and I am able to use the smartcard to ...
0
votes
0answers
46 views

Where is the scope of ISO7816 standard family in smartcard operating systems interoperability?

ISO/ICE 7816 defines a series of standards for using in smart cards. For example, part 4 of these series named "Organization, security and commands for interchange" (which it's last edition has ...
0
votes
0answers
27 views

Looking for OpenSC compatibile token

I am currently proud user of Feitan ePass2003 with OpenSC, however it is not 100% reliable on Windows, on Linux it's just perfect. Anyway I started to looking and I have two candidates eToken Pro 64K ...
2
votes
1answer
188 views

SmartCard for private keys - personal usage

I've just found my notebook has a SmartCard reader. Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
2
votes
0answers
133 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
0
votes
1answer
170 views

SmartCard Key Extraction / Alternatives

(1) As it is possible to extract the secret key from a SmartCard using laboratory equipment, I wonder if there is any (new) way to protect against this sort of security breach? Does it affect all ...
-1
votes
3answers
427 views

Can a smart card with PKI certificate be used to protect a document?

I want to use a smart card (or USB cryptotoken) with a PKI certificate for manual authorisation. Is this possible? I want to put a file (e.g. a word file or even a simple text file) into a smart ...
0
votes
4answers
90 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
3answers
162 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
1answer
71 views

Is a PGP revocation certificate sensitive?

In relation to an openpgp key on a smartcard: Besides revoking the key, is there anything else it can be (ab)used for? Can I just ensure it's reliably stored but not worry about it's confidentiality? ...
2
votes
2answers
114 views

What to do if you ever lose a smart card?

I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks. My idea is to generate the key using GnuPG on an isolated computer, ...
3
votes
2answers
183 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
2
votes
3answers
654 views

Lost Smart Card - extract private key?

Consider you lost your laptop with sensitive data and your smart card that contains the private key for your GnuPG and Truecrypt accounts. The smartcard is secured with a 8-digit PIN. 1) Is it ...
-1
votes
1answer
109 views

physical access proof smart card for disk encryption [closed]

Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea. I know that ...
-1
votes
1answer
155 views

mifare classic security [closed]

We know mifare Classic has been broken. My question is, say I store encrypted data (using some out of band RSA encryption) instead of plain data on Mifare Classic card. And also store a signature ...
2
votes
0answers
112 views

SAM Card deployment best practice

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
4
votes
5answers
793 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
3
votes
1answer
141 views

Offloading private key operations to a trusted device

If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
0
votes
1answer
185 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
5
votes
2answers
776 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
6
votes
1answer
253 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
5
votes
3answers
5k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
1
vote
0answers
535 views

How to set up a smart card for web login? [closed]

I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive ...
3
votes
0answers
193 views

PIV or GIDS compatible token availability [closed]

I am researching smartcards for corporate implementation and have hit a small bump. We need to support Windows RT, and Windows RT does not support Windows minidrivers for smartcards. Instead, it only ...
3
votes
1answer
9k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
1
vote
1answer
411 views

Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer

I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
3
votes
1answer
503 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
6
votes
2answers
3k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...