0

I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I don't want the certificate to be available for usage outside of my app.

What are my options for achieving this?

I am thinking about creating a password protected private key as a possible solution? Password would then be hardcoded in the reader app.

Improve this question
6
  • Although I guess you are thinking along the right lines, it very much depend on the use case if something is a good solution to your problem. Hardcoding is never a great idea as any developer can grab the password, so having some kind of configuration option or simple caching might be preferable. It also depends on the situation if you want to protect the private key en route from the application to the smart card (which turns this in somewhat of a Russian doll issue, as a smart card is basically a server).
    – Maarten Bodewes
    Jun 9, 2022 at 14:30
  • @MaartenBodewes I suppose these smart card servers are not using TLS? Because I can't trust the devices running the app, so without authentication of the smart card in my app the data can still be "planted"?
    – Savo Pejović
    Jun 9, 2022 at 18:00
  • No, they don't. I mean the whole APDU command/response is basically the same idea as a HTTP request / response, just more compact and of course not web based. Java Card Connected - which never broke through - did work with HTTPS and such, but the basic idea was somewhat flawed (it made it easier to develop for, but the hardware was expensive if not downright missing, and cents matter if you buy a couple of million smart cards).
    – Maarten Bodewes
    Jun 9, 2022 at 20:53
  • And I don't know what you mean with "planted". Once the key pair is trusted and assigned a certificate an adversary cannot replace that with another certificate and private key (you could of course swap cards, if they have the same password).
    – Maarten Bodewes
    Jun 9, 2022 at 23:50
  • "Planted": If the channel between desktop app and smart card is insecure, app could be provided with arbitrary data. This card even contains authentication certificate, but I can't use it to sign transfered data on the card's side...
    – Savo Pejović
    Jun 10, 2022 at 9:16

1 Answer 1

Reset to default
1

As @poncho and @MaartenBodewes said in comments, there is no general solution to this, but there may be something available on your platform.

For example, on an Android device you can get help with this from the OS via the Android Keystore:

Use the Android Keystore provider to let an individual app store its own credentials that only the app itself can access. This provides a way for apps to manage credentials that are usable only by itself while providing the same security benefits that the KeyChain API provides for system-wide credentials.

Windows has something similar in the Data Protection API (DP-API) where the windows kernel helps you encrypt a secret (for example a key or password) either for LocalMachine (ie any process on the machine can decrypt it), or for CurrentUser. So if you're able to create a service account that is only used by your app, then it might do what you want.

In general, a client cert attests that the request came from the right device (assuming you had a secure way to set up and register the key in the first place), but does not attest which application within the device.

Improve this answer
2
  • Does Windows have this capability?
    – Savo Pejović
    Jun 9, 2022 at 15:57
  • @SavoPejović There is something sortof similar with the DP-API. I updated my answer with this.
    – Mike Ounsworth
    Jun 9, 2022 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .