Cryptographic smart cards such as https://www.acs.com.hk/download-manual/5997/FSP-ACOS5-64-1.04.pdf claims that they provide secure digital-signing and encryption.

If, my smart card were stolen by someone who doesn't know my PIN, how hard it is for them to acquire my private key stored in smart card, or sign/encrypt/decrypt on my behalf


That depends. On the actual card you are using and on the way the card was initialised and the key and PIN configured.

There are two roads a thief could go, to use your key

Firstly, he could just try to use the card the way it is intended, using its official interface (ususally PKCS#11 or PC/SC). Most of the time, usage of a key is protected by a PIN and the PIN has a retry counter (somewhere between 3 and 10, depending on the length of the PIN) which completely blocks the PIN (and thus the key) once reached. So if the card has been configured properly, this should prevent anyone from brute-forcing the PIN

Secondly, a more technically inclined thief could try to circumvent the smartcard's operating system and try to access its flash memory directly. If that is hard-but-doable, very hard or impossible depends on the card used. A lot of cards do have security certifications, which include some (or a lot of) physical protection of the key used. Look out for security certifications of the smartcard (FIPS 140-2 or CC-EAL), those are a good sign that the hardware might be somehow protected (and a lot more expensive)

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.