10

My bank has me use a credit-card-sized smart card and a USB card reader to authenticate for online transactions. I want to optimize for size when I travel light.

I see that there are small SIM card readers, designed to read data from a cell phone SIM card (for backing up your phone book and SMS data). Since these use the same technology of smart cards (do they?) I was wondering if I could buy a small SIM card reader and cut my bank card to the correct size.

Basically, the question is: are all of these USB-based smart card readers interchangeable? Is there a SIM card reader that you could recommend?

| improve this question | |
  • 1
    These chinese SIM card readers often use a custom and non-standard protocol to talk to the PC, which means nothing besides their software will be able to use them. Also you may want to make sure that your bank's reader is standard (CCID) and not some custom crap, otherwise you're out of luck. – user42178 Apr 1 '15 at 14:48
  • 1
    I think it could be interesting to have your feedback here if you actually go on and try with such another card reader :). – WhiteWinterWolf Dec 21 '15 at 11:11
9

Smartcard communication protocols follow well-established standards (connector size and location, voltages, signals, logical transport protocol...) so chances are that card readers are indeed interchangeable. If the bank sent you both the card and the reader then there is a slight probability that they did something fancy which compromises interoperability, but I deem this probability quite low.

(Personal experience with people in the smartcard industry has taught me that these standards are considered by them as part of some kind of revealed religion; they will not trespass without a powerful reason.)

| improve this answer | |
  • Isn't there any chance that, while still complying with well-established standards, the card reader itself contains a key to setup a mutual authentication with the card prior to any operation? Or is such a scenario just science fiction? – WhiteWinterWolf Dec 21 '15 at 11:17
4

What you should look for is CCID (this is a USB standard for smart card readers). While the card<->reader interface is standard, the way the reader talks to the host PC has long been a wild west. Unfortunately you can still buy hardware that has either fancy SoC connections (IIRC some laptop embedded Ricoch and/or Broadcom devices where such?).

Some manufacturers tweak/break CCID as well, so your best bet is this list:

https://ccid.apdu.fr/ccid/section.html

Avoid everything in the red list.

| improve this answer | |
3

You are probably talking about contact smart cards:

enter image description here

These kind of cards are defined bt ISO/IEC 7816:

  • ISO/IEC 7816-1 - Define physical characteristic
  • ISO/IEC 7816-2 - Dimensions and location of the contacts
  • ISO/IEC 7816-3 - Electrical interface and transmission protocols
  • ISO/IEC 7816-4 - Organization, security and commands for interchange

Think of it as a stack, where the lowest numbers define physical/electrical aspects and the highest numbers define application aspects.

If a smartcard reader is ISO/IEC 7816 compliant, then it can communicate with any smartcard.

SIM cards, as far as the hardware is concerned, are just another form factor of common CC sized smart cards.

| improve this answer | |
0

It depends on the application of your bank, but assuming your bank's software is using pkcs11 (and they almost all do), a USB sim format smart card reader is likely to work. One example is the Gemalto IDBridge K30 / K50 (formerly known as the Shell Token). I know it works with pkcs11 for OpenPGP applications, but it should work with any application that follows the standard. Certgate's AirID 2 Mini is another example that works with ID-000 (SIM card) sized smart cards.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.