4

After google searching about this idea and yielding very little in results I've come to resort to stack exchange:

  1. Is it possible to place a private key on a sim card?
  2. Is it possible for a smart phone app on Android to use the private key for cryptography? What about iOS? What about Windows based phones?
  3. If (1) and (2) are feasible, why isn't this capability more prevalent in the Android/iOS/Windows?

It would seem that if (1) and (2) were feasible, then it would make so much sense to utilize the capability, and essentially enact cell phone carriers as certificate authorities (CA) (or agencies of CAs).

migrated from crypto.stackexchange.com May 6 '15 at 17:23

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • enact cell phone carriers as certificate authorities the carrier's only job is to provide Internet access, and you should be able to switch carriers without loosing your private keys. And carriers are evil and I would put more trust in a private key printed on a paper sheet left at a coffee shop rather than one stored in any carrier-controlled device. – user42178 May 7 '15 at 19:00
5

In answer to (3)- It was not until recently that API's to do this were readily available without having some significant resources behind you.

Here is a guide to doing what you describe in (1) and (2). http://nelenkov.blogspot.com/2013/09/using-sim-card-as-secure-element.html

There are some applications doing this- the article comments say a bitcoin app is doing exactly as you describe.

2

I would not recommend trusting anything controlled by the carrier to hold private keys. The cards can be updated remotely using a simple SMS, and the security of that is dubious.

Not to mention, corner-cutting and legacy insecure systems are commonplace at mobile carriers, so I would not be surprised that whatever system is used to send updates to the SIM cards was already compromised, and could be used to deliver an update that would secretly exfiltrate your "private" key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.