4

(1) As it is possible to extract the secret key from a SmartCard using laboratory equipment, I wonder if there is any (new) way to protect against this sort of security breach? Does it affect all kinds of SmartCard?

(2) Do eToken/ crypto-token resist such key-extraction attacks? Would the PIN lengh make any difference?

(3) Is there any alternative available (similar to smartcards) with better security that is secure also when the attacker steals them?

4

A smart card is supposed to resist physical tampering.

Heavy hardware such as HSM and payment terminals use active protections: basically, their "secrets" (e.g. private keys) are stored in a SRAM module, with a battery, and they are never completely "off". If they detect a physical breach (there are many sensors inside the box), they proactively destroy their secrets.

Smart cards don't have room for such a battery, so their protection is mostly passive. However, some also keep their keys encrypted, using the PIN code as key. This is an extra layer which tries to thwart physical attacker who opened the case and are ready to plunder the EEPROM/Flash in which the card keys are stored. However, user PIN codes are rarely strong enough to make this encryption much of an obstacle.

For smart cards which use PIN-based encryption in addition to the physical shielding, the PIN entropy can matter (not the length, at least not directly -- secrecy of the PIN depends on how random it is, not on how long it is), but only if that entropy is high enough to be non-negligible. Think "passphrase" here, not PIN.

Smart cards achieve a resistance up to a (rumoured) breach cost of about 5000$, for a 5$ hardware cost. That's a 1000x factor, which is not bad when you think about it. I am not aware of tokens which do better. If you search one (there are many products on the market), look for active protections (with an inner battery) and certifications like "FIPS 140-2 Level 3" or "EAL4+" (certifications don't guarantee robustness, but they signal that the vendor, at least, put significant money on the subject).

  • This does not answer the question. The question is about security of smart cards not about security of battery powered devices! And what PIN are you talking about? – Elmue May 6 '16 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.