A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

learn more… | top users | synonyms

2
votes
0answers
7 views

Is it better to have a secure channel or secure PIN entry for Smartcards?

Assume I do own a computer, a USB-connected keyboard and a USB-connected contact-based (trusted) chipcard reader with a hardware pinpad. There are now two types of smartcards relevant to this ...
3
votes
1answer
39 views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
0
votes
0answers
39 views

Trying to read and write EF's on a smartcard

Please bear with me, I'm just starting to investigate communicating with smart cards via winscard.lib from within Windows. It is not my intention to try and crack them, I'm just trying to learn the ...
-1
votes
1answer
34 views

SIM card used with smart card user certificate

Is it possible to put a smart card user certificate (Windows) on a SIM card? (SIM card already has telecom info on it). I'm using Win 2012 and have tried, but I am getting this error "smart card ...
5
votes
1answer
106 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
6
votes
3answers
2k views

Wouldn't forging the balance of a prepaid telephone card allow to make a lot of calls?

Suppose I have a prepaid public telephone card containing £5 in it. Now I connect this card to my laptop and figure out where in the card £5 is stored. I then change this to £5000, and leave the rest ...
1
vote
2answers
42 views

How do hardware OTPs work - from a developer's perspective?

I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage). Now I ...
2
votes
3answers
86 views

How do hardware OTPs work?

I've recently stumbled across a number of one-time-password (OTP) smartcards in some of the internet shops specialized on cryptographic equipment. Now I know / think to know how OTP works with ...
0
votes
0answers
20 views

Trusted CA / smart card authentication on Ubuntu

For SSH connections, I want to validate a smart card certificate against a trusted CA and CRLs. I found tons of documentation on how to enable smart card authentication but most of them focus on ...
1
vote
0answers
75 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
3
votes
2answers
41 views

What's the difference between the same model with and without FIPS 140 certification?

We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded ...
0
votes
0answers
12 views

Java card 3 connected edition availability

Why I am unable to find any Java card 3 connected edition development kit with smart cards? Does it mean that the connected edition are not manufactured by any company currently? The idea of ...
1
vote
1answer
33 views

OpenPGP master key with certificate and authentication capabilities (on a smartcard)

After researching about OpenPGP and smartcards, I came to a dilemma. The usual setup I've seen more widely is a master key (with SC capabilities) and 3 subkeys (with S, E, A each): pub 4096R/...
3
votes
2answers
487 views

Drill a (physical) hole on a g10 openpgp smart card [closed]

I have a g10 smart card (http://g10code.com/p-card.html) I want to make a hole on it, so I can pass a cord on it and hopefully remember to bring it with me. would I kill the card if I drill a hole on ...
4
votes
1answer
320 views

GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?

I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate). Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
4
votes
1answer
191 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
5
votes
1answer
109 views

GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?

When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information? If so, what information would that be?
4
votes
1answer
248 views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
2
votes
0answers
91 views

What's the standard protocol for secure contactless communication

A contactless smartcard has to communicate with a reader in a secure way. The ICAO standard, for example, defines an encryption key (check BAC, EAC and PACE), so that the communication is not ...
0
votes
0answers
38 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
2
votes
1answer
174 views

How smart card with client certificate is used during SSL/TLS session

Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session? Will website still 'see' my client certificate (public key) after I removed card from the reader and ...
0
votes
0answers
49 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
2
votes
2answers
137 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
10
votes
2answers
1k views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
1
vote
1answer
145 views

Use HSPD-12 (PIV) Keys for SSH

Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?
5
votes
3answers
177 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
3
votes
1answer
260 views

What is the state of smart card/computer interoperability

Smart cards are the only really secure device that can be used for, among other things, electronic identification. However, there are usability concerns stemming from the lack of standartization. ...
0
votes
0answers
32 views

How do chipped credit cards increase security? [duplicate]

So I've looked at various articles trying to understand how chipped credit cards increase security over traditional credit cards. In the times I've used my card with a chipped reader (wally world, ...
4
votes
2answers
689 views

Smart cards for user authentication - is configuration of PIN complexity important?

In our company domain we are now able to login to Windows using a smart card plus a 4 digit numeric PIN. The same smart card is used to sign e-mails too. My understanding is that authentication to ...
5
votes
0answers
141 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
2
votes
1answer
206 views

How do I find a PKI smart card reader/writer for development (Microsoft .NET)

I would like to learn how to develop software leveraging PKI smart cards. Ideally, I would use Microsoft Base Smart Card CSP, but I really just need the ability to store symmetric and asymmetric keys ...
1
vote
3answers
2k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
6
votes
2answers
123 views

Using smart cards for email encryption and SSH

Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do ...
1
vote
0answers
117 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
0
votes
0answers
190 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
9
votes
2answers
331 views

Electronic identity and digital signatures - why they are different?

It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
2
votes
0answers
148 views

How to do side channel attack on smart cards? [closed]

Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism. This is the mutual authentication mechanism that my card using(Let ...
5
votes
3answers
316 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
0
votes
1answer
48 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
6
votes
3answers
350 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
1
vote
1answer
856 views

Windows Certificate Store - Generating / importing personal certificates using a smartcard?

I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC). Now I'm having the problem, that I own a ...
2
votes
0answers
27 views

Is there a common standard for digitally signing via smart cards?

Am I right that "minidrivers" which are specific to different national or regional smart cards (eg PIV/CAC, Brazil, Estonia, Sweden, France, etc) are needed for digital signatures (RSA)? Can the ...
2
votes
0answers
142 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
2
votes
1answer
312 views

Can I place a private key on a sim card?

After google searching about this idea and yielding very little in results I've come to resort to stack exchange: Is it possible to place a private key on a sim card? Is it possible for a smart ...
3
votes
1answer
175 views

OBKG on smartcard with PKCS#11

I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
4
votes
1answer
534 views

PGP key on smart card: why do I need a “secret key” on disk?

I have a YubiKey NEO on which I have the OpenPGP applet and I have a PGP key installed. I work on 3 different computers and I initialized the card on computer bob. I'm now at computer rob. Someone ...
1
vote
1answer
197 views

Smart Cards / USB token security

I am quite new to cards and tokens and trying to get a handle on a couple of issues prior to purchasing and using one. 1- physical access to keys on the card or token: Are all of these devices set ...
7
votes
4answers
1k views

How to check randomness of random number generators?

Assume that I have a smart card that returns an 8 byte (for example) random value on reception of a command. The question is that: How I can check if this value is really random? (I don't have any ...
0
votes
1answer
375 views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
0
votes
1answer
686 views

Create certificate without private key with OpenSSL

I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely fine,...