A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.
11
votes
4answers
217 views
Detecting skimmers and other ATM traps
This question has been bothering me ever since I first heard of ATM skimmers:
Instances of skimming have been reported where the perpetrator has put
a device over the card slot* of an ATM ...
1
vote
0answers
26 views
SAM Card deployment best practice
As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
2
votes
1answer
174 views
Are any Java Card 3.0 smart cards available?
The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens?
The best I've found is ...
2
votes
0answers
39 views
PIV or GIDS compatible token availability
I am researching smartcards for corporate implementation and have hit a small bump. We need to support Windows RT, and Windows RT does not support Windows minidrivers for smartcards. Instead, it only ...
4
votes
1answer
181 views
Setting up Windows laptops to require a smartcard for unlocking
I am looking for details on how to secure a windows laptop using smart cards.
The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
1
vote
1answer
92 views
Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer
I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
3
votes
1answer
92 views
Standards for secure key backup of master keys with secret sharing
In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
0
votes
0answers
64 views
Are there any SmartCards with NFC or Bluetooth technology? [closed]
I'm looking for a Smartcard that has integrated NFC communication, (or any other contact based transfer).
Does this technology exist, and must I rely on non-integrated solutions?
1
vote
2answers
283 views
How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?
Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
0
votes
0answers
48 views
Best strategy using encryption to ensure that only authorized application can access smartcard? [closed]
I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best ...
0
votes
1answer
246 views
How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?
This document describes how there are 3 ways to constrain a SmartCard certificate
The Enhanced Key Usage field defines one or more purposes for which
the public key may be used. RFC 5280 states ...
2
votes
1answer
232 views
What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?
I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.
For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
3
votes
1answer
70 views
What physical, electronic, and software characteristics are important in a smart card?
I'm evaluating smart card readers to store a number of private keys, but don't know where to start.
What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
5
votes
1answer
149 views
What's the use of adding a challenge to a one time password algorithm?
In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
1
vote
1answer
161 views
About performance of Smart card for performing 3DES in a MD5 hash
Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
Another alternative is to store the keys in a Smart card permanently ...
0
votes
0answers
60 views
how to program my own TOKEN using atmega64 [closed]
I'm trying to create a sample security token with Atmega64, And now i'm a little confused about how to program that. As it mentioned in PKCS11 Document token hardware should support about 70 function.
...
5
votes
1answer
162 views
security issue on storing keys and certificate on token
I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
4
votes
2answers
237 views
Are all smart card readers the same?
My bank has me use a credit-card-sized smart card and a USB card reader to authenticate for online transactions. I want to optimize for size when I travel light.
I see that there are small SIM card ...
9
votes
1answer
377 views
Cracking PCI terminal using a trojan based on the card
I have come across an article which states the following:
According to MWR InfoSecurity, cybercriminals can use fake cards
containing a software code to gain access not only to a customer's PIN
...
6
votes
3answers
348 views
Getting started with SmartCards; what equipment do I need, what do I need to know?
I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it.
Are all SmartCard slots capable of reading and writing a blank card?
Are there compatibility ...
5
votes
2answers
126 views
What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?
In many organizations these days, employee IDs are very mutli-functional. They can serve as:
Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
4
votes
1answer
469 views
Blackberry + RIM Bluetooth-based Smart Card Reader
Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?
Can you tell me if it's possible to require only the presence of the card + card ...
1
vote
1answer
314 views
Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader
Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash
We need ...
1
vote
1answer
88 views
How to detect suspicious tokens collected by a hacker
I previously asked a question here What's the use of adding a challenge in the otp algorithm?
Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
2
votes
1answer
421 views
EMV Security? How is it possible that it's secure?
I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
1
vote
1answer
195 views
What makes a secure smartcard secure? Is contactless/RFID better?
In short what security features exist that I should look for in a smart card?
What physical features exist, which are important?
It appears smart cards may exhibit different levels of wear and ...
0
votes
1answer
373 views
When should one use RSACryptoServiceProvider vs AESCryptoServiceProvider
I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES
When should one ...
1
vote
1answer
900 views
What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?
MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.
Based on this and this KB article the EKU section of the certificate should contain "Client ...
4
votes
1answer
179 views
Has the wedge security flaw been fixed for credit cards?
According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed?
Is it the same law as the one ...
1
vote
2answers
82 views
Preventing a socially-engineered transaction
Can you explain what this blog means when it says:
Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
0
votes
1answer
69 views
symetric encryption and signature [closed]
asymetric key is normally used for signature for non repudiation.
But what if one uses EMV CAP in TDS mode as described here http://en.wikipedia.org/wiki/Chip_Authentication_Program ?
Is non ...
3
votes
4answers
418 views
Do any organizations use Smart Cards other than the military?
The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why?
UPDATE
What are the pros/cons of smart cards, compared to other methods?
2
votes
3answers
693 views
Vulnerabilities of RFID Smartcards
Recently my organization wants to move into the smart card system instead of static password. We want to move the entire infrastructure to the smartcard system. we are looking for a single smartcard ...
0
votes
1answer
366 views
Is Data Object on openPGP smartcard v2 encrypted?
currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard.
I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
4
votes
1answer
304 views
Two certificates on smart card
I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?
Background:
In Sweden you can have a "citizen ...
15
votes
3answers
399 views
What is gained by hashing the last block on-device?
Recently I encountered the notion of "hashing the last block on-device".
It means that when computing a digital signature, the hash that serves as input for the actual signature computation is not to ...
6
votes
2answers
349 views
What encryption (if any) is used on electronic credit cards?
Out of curiosity: how do electronic Visa/Master Card debit/credit cards with microchips authenticate a transaction?
Are they stupid storage for a key which is simply read by a reader or do they ...
7
votes
3answers
374 views
Smartcards for Dummies
Are there any defacto resources for understanding the basics of smart cards?
My problem is that I don't know what I don't know about the technology.
Any good primers?
3
votes
1answer
2k views
How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?
My goal is to allow my application to ...
