I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I enter my PIN?

2 Answers 2


This highly depends on the smart card.

Some card simply provide a key store whereas others provide a complete infrastructure where you send your data and the smart card can sign and/or encrypt the data.

The second type (which is typically meant when using the term smart card) have the advantage that the (private) keys never leave the smart card.

  • Are cards where the keys stay on the card efficient? I remember reading that communication between a smart card and a computer happens over serial. Wouldn't signing a multi-gigabyte binary take a long time?
    – user55960
    Sep 22, 2014 at 18:51
  • 2
    Signatures aren't computed on the entire blob of data, only a hash of that data. The computer can hash it and provide the much smaller hash to the smart card for signing.
    – PwdRsch
    Sep 22, 2014 at 19:08
  • By encrypting not the complete data was meant but only small portions or small datasets.
    – Uwe Plonus
    Sep 22, 2014 at 19:28

When a key never leaves the smart card there's no need to encrypt, but when it is sent to an outside storage, it's obviously different. Both ways are good in terms of security, these are just different realisations.

As an example WWPass PassKey has the Secure Element which is a Java smart card. It is capable of running Java applications. It stores the cryptographic material needed to access the key in the WWPass Secure Cloud. The key is encrypted before being sent to the cloud for security reasons.

You must log in to answer this question.