Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [smartcard]

A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

0
votes
0answers
21 views

EMV card tools of the trade

I am interested in opinions about effective tools of the trade for developers needing to familiarize themselves, through hardware hands-on experience, with the internal details of a EMV smart card ...
0
votes
0answers
17 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
1answer
35 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
0
votes
1answer
58 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
0
votes
1answer
83 views

SSH - Implementing OpenSSH Certificates with smartcards

I want to implement public key authentication with CA and smart card. OpenSSH have their own certificate format, which is not x509. I have a server (SSHD) and a client. I already made public key ...
1
vote
1answer
33 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
1
vote
1answer
55 views

Use GPG smartcard and gpg-agent to protect multiple SSH keys

I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine. ssh-add -...
3
votes
1answer
32 views

Can I use 3 same subkeys to 2 different GPG Smartcards?

Generated keys on an air-gapped PC. Backed-up my .gpg folder on a USB. Imported keys to smartcard 1. Keys deleted Replaced .pgp folder with .pgp from USB Imported keys to smartcard 2. Is this setup ...
1
vote
1answer
95 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
2
votes
1answer
470 views

Export GPG key from smartcard and import yubikey

I have the OPEN PGP SMARTCARD V2.1 and there I have a signature key, a encryption key and a authentication key stored. The last 8 digits of the signature key is for example: 1234 5678. Now I want to ...
0
votes
0answers
24 views

Authentication implications for a mapped PIV certificate

I've been researching smart card auth and the pass the hash vulnerabilities that go along with it. There is a case I'm interested in but can't find documentation on. Some of the devices I've looked ...
0
votes
2answers
112 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
2
votes
3answers
61 views

Is using a username and smart card two-factor authentication?

Is username counted as one-factor, something you know? A smart card (which contains the username and user information inside the card) is something you have. What if the smart card doesn't contain ...
1
vote
0answers
47 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
0answers
54 views

Are there compromised CAC readers for sale?

If a DoD employee needed to purchase a CAC reader for home use and they purchased one from Amazon. Is it possible the reader could contain malware, or in someway capture you pin or other private data?
3
votes
0answers
121 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
2
votes
1answer
298 views

Which type of smart card supports certificates?

For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For ...
0
votes
0answers
61 views

Crack security code for SLE4428 smart card [duplicate]

I don't know if the security code authentication prevents the card from being copied or not. If it does, how do you crack the 2-byte security code.
2
votes
0answers
39 views

What forces SSL exchange to require my smartcard to finish handshake

First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
4
votes
1answer
254 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
64 views

Where is the ID chip in this card?

I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
2
votes
0answers
130 views

Why would anyone steal a boom-gate access card scanner? [closed]

A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator. I was wondering why would ...
1
vote
1answer
547 views

Is a smartcard single or multi-factor authentication

Since it is only something you have, that makes it single factor authentication right?
0
votes
1answer
71 views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
4
votes
1answer
84 views

How to scale smart card authentication?

We are doing a proof of concept project for a client to introduce smart card authentication for his operations admins. Authentication in client's context means mainly SSH access. We encountered a ...
0
votes
1answer
183 views

Is identification with NFC bank cards feasible?

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
1
vote
1answer
169 views

When generating PKI key pair with a smart card, who decides if the key is exportable?

I'm in the process of obtaining a code signing certificate from a CA that requires the use of a smart card for the generation of the PKI key pair. However, I would like to be in the possession of the ...
2
votes
0answers
550 views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
1
vote
0answers
74 views

What's the difference between random number evaluation among AIS-31 AIS-20 and NIST sp800-22

I'm trying to know about the evaluation of random number generated by smart card chip. But these standards AIS-31, AIS-20 and NIST sp800-22 confuse me. Could someone help me with a brief explanation ...
1
vote
1answer
126 views

Accesing private information in PKI Smart Card without PIN [duplicate]

Cryptographic smart cards such as https://www.acs.com.hk/download-manual/5997/FSP-ACOS5-64-1.04.pdf claims that they provide secure digital-signing and encryption. If, my smart card were stolen by ...
1
vote
1answer
210 views

How can a debit card provide different answers when the same challenge is sent to it multiple times?

I do only banking with my "PostFinance" debit card. The sign-in protocol works like this: Enter user name and password into web form. Get a 9 digit challenge number on website. Type the challenge ...
2
votes
0answers
75 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
0
votes
2answers
443 views

Extract smartcard certificate for server to server authentication

I want to get data from a server that accept only client authentication via smartcard and save them to my server. Since they are a lot of data, I want to create a connection between my server and this ...
3
votes
1answer
241 views

Can SIM card be locked to the specific equipment?

I'm curious if SIM card can be "personalized" to operate only in the specified mobile equipment in addition to usual PIN security. So the SIM extracted from "legitimate" phone and placed into ...
0
votes
0answers
3k views

How does Mifare Classic Offline Cracker (MFOC) work?

I have been reading up on the vulnerabilities of Mifare Classic and found that with the use of MFOC, one can actually crack the keys that encrypt the data within the Mifare Classic card. However, how ...
4
votes
1answer
6k views

What software can be used to read data from smart cards? [closed]

I have recently got this smart card reader. In the description it says that it can be used to read data from fidelity smart cards, library cards, etc. The technical card compatibility support is as ...
2
votes
0answers
376 views

HTTP proxy for smart card based SSL

I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
4
votes
2answers
518 views

Key based encryption for files with the key stored on a USB drive?

We're a small startup running a server inside the clients premises and certain files needs to be kept encrypted on that server. We want the decryption to be only possible when we plug in a particular ...
11
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
2
votes
0answers
558 views

First time contactless card payment does not require PIN to enable [closed]

I unwittingly made my first contactless card payment a few days ago: the vendor took my bank card [current account debit card] (I assumed so that they could insert it into their "deskbound" payment ...
3
votes
2answers
194 views

Local Smart Card authentication

I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key. I would like to do a local (no network) authentication of user using the smart card and ...
2
votes
1answer
178 views

What does %APPDATA%\GnuPG\secring.gpg contain after invoking “gpg --card-edit generate”?

For a new smartcard (crypto stick), I've invoked gpg --card-edit, performed the generate command and selected to not create any backup of the generated keys. After key generation has finished, a %...
1
vote
0answers
138 views

Connect RFID readers with system/PC [closed]

I have a Raspberry Pi, HID smartcard (HID iClass Px G8Y), HID Card Reader (RP40 multiClass). What I am trying to do is to read the data from this smartcard via the Card Reader onto my system (Laptop/...
2
votes
1answer
3k views

How does a smart card work? [closed]

My understanding of smart cards is that they are a complete system on a chip. I.E. they have a processor and memory and can perform calculations independent of the system that is communicating with ...
1
vote
0answers
324 views

Which entriey does a Card Verifiable Certificate contain?

Which entries e.g. public key, valid until, etc. does a CVC has and where can I find a good explanation of this elements? - also with the size, which an entry and related to that, which size the ...
3
votes
1answer
196 views

What kind of math is possible in a SmartCard?

I'm interested in programming Prime numbers in an element field on a SmartCard. Where can I learn about a smart card's "inputs" and "outputs" so I can call it from a custom application? The math I ...
3
votes
1answer
183 views

Can someone debit cash from my debit card just with an ATR Number?

So basically I had a debit card, a built-in smart card reader in my laptop and some money in my account. What I did was, I plugged my debit card in my laptop's smart card reader, I copied the ATR ...
4
votes
1answer
706 views

Using Fido U2F or similar as primary authentication method?

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic. Would it be ...
3
votes
1answer
917 views

gpg-agent keeps saving pin for a smartcard

I've found today, that enigmail is decrypting a message without asking me for the smart card's PIN. It is asking only once, and then not ask at all. this is my gpg-agent.conf: default-cache-ttl 0 ...
6
votes
1answer
2k views

How is Fingerprint Authentication Secure?

Lately, biometrics are being used for identity verification everywhere. e-Visas, Passports and even bank transactions (UUIDAI Aadhar system in India is now being used for identity verification, micro-...