A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

learn more… | top users | synonyms

34
votes
4answers
4k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
15
votes
3answers
466 views

What is gained by hashing the last block on-device?

Recently I encountered the notion of "hashing the last block on-device". It means that when computing a digital signature, the hash that serves as input for the actual signature computation is not to ...
14
votes
2answers
5k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
9
votes
1answer
523 views

Cracking PCI terminal using a trojan based on the card

I have come across an article which states the following: According to MWR InfoSecurity, cybercriminals can use fake cards containing a software code to gain access not only to a customer's PIN ...
7
votes
2answers
886 views

What encryption (if any) is used on electronic credit cards?

Out of curiosity: how do electronic Visa/Master Card debit/credit cards with microchips authenticate a transaction? Are they stupid storage for a key which is simply read by a reader or do they ...
7
votes
3answers
537 views

Smartcards for Dummies

Are there any defacto resources for understanding the basics of smart cards? My problem is that I don't know what I don't know about the technology. Any good primers?
7
votes
3answers
708 views

Getting started with SmartCards; what equipment do I need, what do I need to know?

I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it. Are all SmartCard slots capable of reading and writing a blank card? Are there compatibility ...
6
votes
1answer
224 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
5
votes
3answers
3k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
5
votes
2answers
2k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
5
votes
1answer
214 views

security issue on storing keys and certificate on token

I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
5
votes
2answers
157 views

What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
5
votes
2answers
565 views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
4
votes
1answer
113 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
4
votes
2answers
610 views

Are all smart card readers the same?

My bank has me use a credit-card-sized smart card and a USB card reader to authenticate for online transactions. I want to optimize for size when I travel light. I see that there are small SIM card ...
4
votes
3answers
256 views

SmartCard + GnuPG: what is stored in my keyring?

I recently bought a Yubikey Neo which can act as a OpenPGP smart card. I'd like to use this to store my private GnuPG key. I've gone through the initial setup and I am able to use the smartcard to ...
4
votes
1answer
717 views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
4
votes
1answer
223 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
3
votes
1answer
5k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
3
votes
1answer
2k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
3
votes
2answers
72 views

Why does my debit card have a stripe AND a chip?

Recently I received a new debit card which has both a magnetic stripe and a chip (as did my previous card). I know the magnetic stripe can be easily copied whereas the chip system hasn't been ...
3
votes
2answers
841 views

Are any Java Card 3.0 smart cards available?

The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens? The best I've found is ...
3
votes
2answers
104 views

Offloading private key operations to a trusted device

If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
3
votes
2answers
79 views

Signing my certificate by using my smart card and eID card?

In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication. I ...
3
votes
1answer
368 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
3
votes
1answer
877 views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
3
votes
0answers
131 views

PIV or GIDS compatible token availability [closed]

I am researching smartcards for corporate implementation and have hit a small bump. We need to support Windows RT, and Windows RT does not support Windows minidrivers for smartcards. Instead, it only ...
2
votes
3answers
1k views

Vulnerabilities of RFID Smartcards

Recently my organization wants to move into the smart card system instead of static password. We want to move the entire infrastructure to the smartcard system. we are looking for a single smartcard ...
2
votes
5answers
665 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
2
votes
1answer
696 views

EMV Security? How is it possible that it's secure?

I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
2
votes
3answers
144 views

Lost Smart Card - extract private key?

Consider you lost your laptop with sensitive data and your smart card that contains the private key for your GnuPG and Truecrypt accounts. The smartcard is secured with a 8-digit PIN. 1) Is it ...
2
votes
2answers
54 views

What to do if you ever lose a smart card?

I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks. My idea is to generate the key using GnuPG on an isolated computer, ...
2
votes
0answers
98 views

SAM Card deployment best practice

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
1
vote
1answer
273 views

Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer

I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
1
vote
1answer
92 views

How to detect suspicious tokens collected by a hacker

I previously asked a question here What's the use of adding a challenge in the otp algorithm? Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
1
vote
1answer
312 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
1
vote
2answers
89 views

Preventing a socially-engineered transaction

Can you explain what this blog means when it says: Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
1
vote
1answer
2k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
1
vote
1answer
555 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
1
vote
1answer
274 views

About performance of Smart card for performing 3DES in a MD5 hash

Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? Another alternative is to store the keys in a Smart card permanently ...
1
vote
0answers
33 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
402 views

How to set up a smart card for web login? [closed]

I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive ...
0
votes
2answers
424 views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
0
votes
4answers
40 views

Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
3answers
125 views

Is it ok to send user's private key away, even if protected with a SSL channel?

I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures. My idea is: an user puts its SmartCard and through a PIN, he gets ...
0
votes
1answer
97 views

symetric encryption and signature [closed]

asymetric key is normally used for signature for non repudiation. But what if one uses EMV CAP in TDS mode as described here http://en.wikipedia.org/wiki/Chip_Authentication_Program ? Is non ...
0
votes
1answer
655 views

Is Data Object on openPGP smartcard v2 encrypted?

currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard. I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
0
votes
1answer
21 views

SmartCard Key Extraction / Alternatives

(1) As it is possible to extract the secret key from a SmartCard using laboratory equipment, I wonder if there is any (new) way to protect against this sort of security breach? Does it affect all ...
0
votes
1answer
118 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
0
votes
1answer
609 views

When should one use RSACryptoServiceProvider vs AESCryptoServiceProvider

I am interested in storing certificates for various purposes on a SmartCard. Since this answer illustrates how there are confusing differences and similarities between RSA and AES When should one ...