I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, except making EEPROM read-only?
I also want to implement PKCS11 DLL for my token. Is there any pattern I should follow on storing my public and private keys for the PKCS11 standard.

  • Even if the EEPROM is read-only, wouldn't anyone with an EEPROM reader be able to get your private key, at which moment they can pretend to be that token?
    – Marcin
    Oct 9, 2012 at 13:05
  • @Marcin Even if they can read private key it wouldn't be useful for them. because i will do more action like reading uuid of there token to match my database and also some more...
    – osyan
    Oct 10, 2012 at 7:17
  • 1
    @osyan I would imagine it wouldn't be too hard to spoof a UUID
    – Peanut
    Oct 20, 2012 at 20:02

1 Answer 1


Simply storing a secret on a piece of hardware doesn't help secure anything, (god forbid) we have USB sticks for that. The secret must never leave the piece of hardware in order for it to be effective. A device like a smart card is effective in two-factor authentication because it handles the challenge response.

If your device is as effective as a smart card, then it will have to confront a lot of the same challenges, Such as Side Channel Attacks and other physical attacks.

  • And what about the last part of my question. do you know something about pkcs11 standard to help me more. Thanks Rook
    – osyan
    Oct 10, 2012 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.