1

I am quite new to cards and tokens and trying to get a handle on a couple of issues prior to purchasing and using one.

1- physical access to keys on the card or token: Are all of these devices set up to (or easily configured to) require a pin/pw of some kind prior to use? So, for instance, if the card is lost, a pin must be entered prior to accessing any information or modules (ie, openpgp) that reside on the card?

2- What is the effect of a malicious keylogger on the use of a smart card or token? For instance, if using a USB type token w/smartcard capability, does a keylogger compromise all that is on the device, even if the attacker is unable to physically obtain the usb token?

Improve this question

1 Answer 1

Reset to default
1

Most (all?) of the cards require a PIN and are designed to lock themselves after multiple failed attempts, so physical access to a card is pretty much useless without knowing the PIN as the cards are designed to be tamper-proof. So far I haven't heard of any way to extract the secrets using a hardware-attack in a real world scenario.

A keylogger on a machine will indeed capture the PIN if you're entering it into an application on the computer. That can be mitigated by using a reader with a hardware keypad and entering the PIN on that keypad. That way the PIN never reaches the computer and even a compromised machine won't be able to capture it. All credit card terminals you use when paying are, at the very least a reader like this one (but often are full-featured computers that handle the entire transaction themselves) so the POS system never gets your PIN.

A keylogger will never be able to compromise the card's secrets, as the cards are specifically designed to never reveal them, it will however compromise the PIN and any data you encrypt/decrypt with that card or token.

Improve this answer
3
  • >A keylogger will never be able to compromise the card's secrets, as the cards are specifically designed to never reveal them, it will however compromise the PIN and any data you encrypt/decrypt with that card or token. THat last bit I don't quite get. If the secret key is locked in the card which does all en/de cryption, doesn't the loss of the pin to a keylogger only cause damage if they gain physical control of the card?
    – TrustNoOne
    Mar 10, 2015 at 20:42
  • Ok so I read up on tihs Sykipot exploit and think I get it. So the malware now pretends to be a legit application requesting use of the card and presenting the pin as if you had entered it. So this will work, but only so long as the key is in the computer, right? once the card is pulled they are done
    – TrustNoOne
    Mar 10, 2015 at 21:08
  • From a pgp forum >"To make use of the decryption key the smartcard first requires that a VERIFY command is send to the card. This is what asks for the PIN. After a successful verification of the PIN the card allows the use of the PSO Decrypt command until a power down or a reset operation. Thus an attacking malware only needs to trick you info decrypt an arbitrary message and is then free to use the smartcard without having the reader ask you again for a PIN. " The thread is old, I assume only the process that initiated the VERIFY that can keep decrypting, another process cant hijack the flow
    – TrustNoOne
    Mar 11, 2015 at 3:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .