1

In short what security features exist that I should look for in a smart card?

  • What physical features exist, which are important?

    • It appears smart cards may exhibit different levels of wear and tear from normal use, or that of harsh environments, or keeping it in a wallet. Ultimately this usage may cause card failure.

    • Is the card resistant to acid attacks to expose the inner chip?

    • Are there electrical characteristics that prevent deducing the private key through the timing of the signal?

    • If contactless, can the RFID be shut off for privacy & security reasons?

  • What logical security features exist, which are important?

    • How many times was the private key accessed?
Improve this question
1

1 Answer 1

Reset to default
4

Smart card are based on standards defined for hardware and the software (operating system) residing in them. There are many standards which defines the hardware features. You can read through some smart card topics in net for hardware interface and design of an smart card.

In short I will try to give some answers below:

  1. The contactless cards are better than the contact ones as they don't have to go through wear and tear life cycle. The life span of the card is dependent on the number of read and write cycles only.
  2. Even if the card chip or hardware gets damaged cause of acid attacks, it can destroy the card but will never let some one to extract data like keys etc. Data loss is possible but not data theft
  3. A smart card design standard have to implement some time based logics and some advanced techniques to ensure that the private key operations take some fixed time for operations. There are some security embedded in the crypto processor and some implemented in the OS (like unnecessary for loops) to counter the timing attacks. Modern smart cards contains logic to thwart the timing attacks wherein an external device sense the electromagnetic pulse generated around the smart card in the event of RSA operation to estimate the key involved in the operation.
  4. RFID or other modes of contactless protocols cannot be shut for privacy reason. The implementation can have mutual authentication protocol which will let the smart card OS first validate the authenticity of the terminal before engaging on the business operations like select Key and Sign operations.

Smart card are very much secured (In fact most secured element present to my knowledge); but like any other security infra, the real security depends on how the card was initialized, the operation of issuance of card, the standard followed etc.

Improve this answer
4
  • Interesting. I thought RFID would allow a passive attacker to use proximity attacks to get info off the card. I saw a few aluminum cases that prevent this, but thought a card with an on/off switch may be better. Any thoughts?
    – makerofthings7
    Jun 5, 2012 at 14:46
  • Yeah some cases like aluminium are used to protect certain cards which are particularly meant for Id purposes (for example contactless e-passport). The use case of such Id cases are different, they are meant for reading only but for not writing on them and not for performing computations. In that case you are very much right aluminium case helps in enforcing privacy for the holder of the card user.
    – Mohit Sethi
    Jun 6, 2012 at 4:40
  • 1
    To further safeguard privacy, the implementation should use some techniques like for example ICAO ePassprt, where the reader is first required to use OCR to read some text on the card to derive a session key for reading the chip date in contactless mode. Also for reading highly private date like iris and fingerprints terminal authentication is required.
    – Mohit Sethi
    Jun 6, 2012 at 5:12
  • If required, a dual interface card can be used where contactless and contact based interface are present in the same card. Very sensitive information can be made to be only read using contact protocol; also the contact protocol can be extended for computational operations. The application in the smart card can read the protocol used for request can process the request from the reader accordingly.
    – Mohit Sethi
    Jun 6, 2012 at 5:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .