How does an application get the private key from a smart card in order to sign some data?

I presume that the data is being signed by a code running on the main OS (Windows/Linux) and not on the smart card device. am I correct?

Also, some smart cards involve PINs in the process. Does the PIN add value?

  • 1
    What smartcard?
    – techraf
    Jul 20, 2016 at 10:50
  • So when i want to sign some blob, data is sent to the smartcard reader device and being signed on it?
    – MrD
    Jul 20, 2016 at 11:06
  • Blobs are not signed, the hash of the data is signed. If you want to know more details, please research and if you don't find anything ask a new question.
    – Josef
    Jul 20, 2016 at 11:18
  • Josef, the main question of mine is whether data (lets say hash) is passed to the smartcard reader device to be signed on it or not? you didn't answer the question, which is directly connected to the main one.
    – MrD
    Jul 20, 2016 at 11:40
  • Yes, if you're using a cryptographic smart card, the data is sent to the card to be signed. This includes first taking the hash of the data depending on what algorithm is selected, but that operation is typically done on the card. Jul 21, 2016 at 15:08

2 Answers 2


Smart cards that are used for cryptography do generate and use the asymmetric key on the device. They typically employ mechanisms to try and prevent extracting of the private key. This includes wiping the key material when a PIN has been entered wrong too many times. There has been lots of research into using cryptographic side-channel attacks to extract information by observing the smart card during crypto operations.

As for how applications interact with the smart card, every system I've worked with in the past has used a combination of OpenSC and the PKCS #11 interface it provides. PKCS #11 is the standard for interacting with cryptographic hardware devices like smart cards and HSMs.


Your premise is wrong: the key never leaves the smartcard.

Smartcard normally expose more high level functions as Encrypt/Decrypt/Sign. You pass a plaintext/cyphertext as parameter, and the smartcard hardware/internal software does the requested operation.

As an example, take a look at PKCS #11 interface.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .