I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for passing FIPS standard tests. However I was wondering if I can test this token with some tools and check if it's secure. I searched the web but I couldn't find anything useful. Does anybody here have any experience in this area? Any help would be greatly appreciated.

EDIT: Since my question may not be clear as I think, I put it in some practical approach, if I gave you some PKI token and show you some certificates which it has like FIPS-140, PKCS11, ... whould you use this PKI token in your secure applications? In other words, you trust a secure device by certificates which producer claims to have?? What if there is a hardware Torjan or backdoor implemented into device?

closed as unclear what you're asking by Gilles, schroeder, Xander, Mark, Graham Hill Sep 17 '14 at 10:27

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What kind of “smart token”? What security properties do you expect? – Gilles Sep 16 '14 at 21:02
  • Specifically PKI smart Token, and by Security test I mean any security report about this device such as firmware test, performance test and I wish I could perform some hardware tests but I know it needs equipped laboratory. However I have to trust any certificate which the device producer claims to have.@Gilles – A23149577 Sep 17 '14 at 6:50

I think your approach will depend on what requirements your colleague has for the system's security. The token itself performs a very simple job as part of the authentication architecture. What you'll really be testing is the behavior of the software on the server which, presumably, is provided to you by a vendor. To that end, here are a few tests that must pass, at minimum, for you to know that the system is functioning:

  1. Authentication. Provide the correct credentials for the user associated with the token, along with the possession factor (the token's code), and ensure that you are able to access the system.
  2. User-factor pairing. Provide the correct credentials for a different user, along with the possession factor, and ensure that authentication fails.
  3. Factor invalidation. Provide the same possession factor twice in succession, along with valid credentials, and ensure that authentication fails the second time.
  4. Factor expiration. Provide a sufficiently old possession factor along with valid credentials and ensure that authentication fails.

Edit: My answer assumes that you are dealing with a disconnected, multi-factor authentication token. Most commonly, these are time-synchronized. Forgive me for not prodding further if you are dealing with a connected token like a smart card.

Not the answer you're looking for? Browse other questions tagged or ask your own question.