I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I enter my PIN?


This highly depends on the smart card.

Some card simply provide a key store whereas others provide a complete infrastructure where you send your data and the smart card can sign and/or encrypt the data.

The second type (which is typically meant when using the term smart card) have the advantage that the (private) keys never leave the smart card.

  • Are cards where the keys stay on the card efficient? I remember reading that communication between a smart card and a computer happens over serial. Wouldn't signing a multi-gigabyte binary take a long time? – Thomas T. Sep 22 '14 at 18:51
  • 2
    Signatures aren't computed on the entire blob of data, only a hash of that data. The computer can hash it and provide the much smaller hash to the smart card for signing. – PwdRsch Sep 22 '14 at 19:08
  • By encrypting not the complete data was meant but only small portions or small datasets. – Uwe Plonus Sep 22 '14 at 19:28

When a key never leaves the smart card there's no need to encrypt, but when it is sent to an outside storage, it's obviously different. Both ways are good in terms of security, these are just different realisations.

As an example WWPass PassKey has the Secure Element which is a Java smart card. It is capable of running Java applications. It stores the cryptographic material needed to access the key in the WWPass Secure Cloud. The key is encrypted before being sent to the cloud for security reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.