For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For accessing the reader I want to use OpenCS, also because I want to make additional use of it for disk encryption with LUKS.

I have found readers with pin pads which seem to be supported by OpenCS or offer related drivers, however smart cards seem to be problematic as the information given by vendors is always not very specific regarding PKI. I have been unable to identify a clear standard for smart cards supporting this scenario which would allow me to find suitable products, especially usable pairs of readers and cards. While I have found ISO 7816 of which sections -4 and -8 seem to deal with card commands and certificate storage, I can't find any products referencing these sections; mostly ISO 7816 is mentioned in general, which is not enough as it is also valid for SLE4442 cards which are mere (secure) memory cards without any PKI functionality.

Now the question is, does a standard for this exist, or am I missing an important keyword here?

Just to make sure: I know that for good reasons requests for specific product recommendations are not appreciated here, therefore I am looking for help how to identify usable products myself.

1 Answer 1


Which type of smart card supports certificates?

From the top of my head, 2 cards that are known from having certificates:

  • CAC (Common Access Card)
  • PIV (Personal Identity verification)

However, a more broad answer would be "any smartcard that implements PKCS# 11 standard" (which would be the answer for your second question). The PKCS 11 standard determines how cryptographic tokens are accessed. For a CAC card, a library may be provided. For a PIV, you may want to take a look at the documentation NIST provides for it.

Since what you need to do is just do a security demonstration, I would go with the easy path and use a Yubikey instead. It uses the same protocol that smartcads uses (as a matter of fact, it is detected as one) and you can easily find how to manage card authentication certificates for it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .