Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [smartcard]

A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

1
vote
0answers
56 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
0
votes
1answer
19 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
0
votes
0answers
51 views

Does OpenSC required proprietary Gemalto SafeNet middleware to support Gemalto IDPrime card?

I am interesting by buying a Gemalto IDPrime MD 830 card to be used onto two computers in various scenarios: - Storing certificate (Windows, Linux) - Authentication (Linux) The Windows computer would ...
3
votes
1answer
64 views

Can one use a Credit Card as a Smart Card?

Okay, first question on any Stack Exchange site, and Information Security seems the most fitting for this question. Anyways, I realized that my laptop has a smart card reader. I understand that ...
0
votes
0answers
27 views

EMV card tools of the trade

I am interested in opinions about effective tools of the trade for developers needing to familiarize themselves, through hardware hands-on experience, with the internal details of a EMV smart card ...
0
votes
0answers
19 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
1answer
115 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
0
votes
1answer
65 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
1answer
39 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
1
vote
1answer
79 views

Use GPG smartcard and gpg-agent to protect multiple SSH keys

I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine. ssh-add -...
3
votes
1answer
36 views

Can I use 3 same subkeys to 2 different GPG Smartcards?

Generated keys on an air-gapped PC. Backed-up my .gpg folder on a USB. Imported keys to smartcard 1. Keys deleted Replaced .pgp folder with .pgp from USB Imported keys to smartcard 2. Is this setup ...
1
vote
1answer
126 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
2
votes
1answer
720 views

Export GPG key from smartcard and import yubikey

I have the OPEN PGP SMARTCARD V2.1 and there I have a signature key, a encryption key and a authentication key stored. The last 8 digits of the signature key is for example: 1234 5678. Now I want to ...
0
votes
0answers
25 views

Authentication implications for a mapped PIV certificate

I've been researching smart card auth and the pass the hash vulnerabilities that go along with it. There is a case I'm interested in but can't find documentation on. Some of the devices I've looked ...
0
votes
2answers
114 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
2
votes
3answers
64 views

Is using a username and smart card two-factor authentication?

Is username counted as one-factor, something you know? A smart card (which contains the username and user information inside the card) is something you have. What if the smart card doesn't contain ...
1
vote
0answers
47 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
0answers
56 views

Are there compromised CAC readers for sale?

If a DoD employee needed to purchase a CAC reader for home use and they purchased one from Amazon. Is it possible the reader could contain malware, or in someway capture you pin or other private data?
3
votes
0answers
142 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
2
votes
1answer
341 views

Which type of smart card supports certificates?

For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For ...
2
votes
0answers
42 views

What forces SSL exchange to require my smartcard to finish handshake

First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
4
votes
1answer
319 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
65 views

Where is the ID chip in this card?

I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
2
votes
0answers
130 views

Why would anyone steal a boom-gate access card scanner? [closed]

A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator. I was wondering why would ...
1
vote
1answer
622 views

Is a smartcard single or multi-factor authentication

Since it is only something you have, that makes it single factor authentication right?
0
votes
1answer
72 views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
4
votes
1answer
88 views

How to scale smart card authentication?

We are doing a proof of concept project for a client to introduce smart card authentication for his operations admins. Authentication in client's context means mainly SSH access. We encountered a ...
0
votes
1answer
202 views

Is identification with NFC bank cards feasible?

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
1
vote
1answer
225 views

When generating PKI key pair with a smart card, who decides if the key is exportable?

I'm in the process of obtaining a code signing certificate from a CA that requires the use of a smart card for the generation of the PKI key pair. However, I would like to be in the possession of the ...
2
votes
0answers
591 views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
1
vote
0answers
80 views

What's the difference between random number evaluation among AIS-31 AIS-20 and NIST sp800-22

I'm trying to know about the evaluation of random number generated by smart card chip. But these standards AIS-31, AIS-20 and NIST sp800-22 confuse me. Could someone help me with a brief explanation ...
1
vote
1answer
131 views

Accesing private information in PKI Smart Card without PIN [duplicate]

Cryptographic smart cards such as https://www.acs.com.hk/download-manual/5997/FSP-ACOS5-64-1.04.pdf claims that they provide secure digital-signing and encryption. If, my smart card were stolen by ...
1
vote
1answer
215 views

How can a debit card provide different answers when the same challenge is sent to it multiple times?

I do only banking with my "PostFinance" debit card. The sign-in protocol works like this: Enter user name and password into web form. Get a 9 digit challenge number on website. Type the challenge ...
2
votes
0answers
77 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
0
votes
2answers
501 views

Extract smartcard certificate for server to server authentication

I want to get data from a server that accept only client authentication via smartcard and save them to my server. Since they are a lot of data, I want to create a connection between my server and this ...
3
votes
1answer
243 views

Can SIM card be locked to the specific equipment?

I'm curious if SIM card can be "personalized" to operate only in the specified mobile equipment in addition to usual PIN security. So the SIM extracted from "legitimate" phone and placed into ...
4
votes
1answer
7k views

What software can be used to read data from smart cards? [closed]

I have recently got this smart card reader. In the description it says that it can be used to read data from fidelity smart cards, library cards, etc. The technical card compatibility support is as ...
2
votes
0answers
397 views

HTTP proxy for smart card based SSL

I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
4
votes
2answers
567 views

Key based encryption for files with the key stored on a USB drive?

We're a small startup running a server inside the clients premises and certain files needs to be kept encrypted on that server. We want the decryption to be only possible when we plug in a particular ...
13
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
2
votes
0answers
596 views

First time contactless card payment does not require PIN to enable [closed]

I unwittingly made my first contactless card payment a few days ago: the vendor took my bank card [current account debit card] (I assumed so that they could insert it into their "deskbound" payment ...
3
votes
2answers
226 views

Local Smart Card authentication

I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key. I would like to do a local (no network) authentication of user using the smart card and ...
2
votes
1answer
186 views

What does %APPDATA%\GnuPG\secring.gpg contain after invoking “gpg --card-edit generate”?

For a new smartcard (crypto stick), I've invoked gpg --card-edit, performed the generate command and selected to not create any backup of the generated keys. After key generation has finished, a %...
1
vote
0answers
143 views

Connect RFID readers with system/PC [closed]

I have a Raspberry Pi, HID smartcard (HID iClass Px G8Y), HID Card Reader (RP40 multiClass). What I am trying to do is to read the data from this smartcard via the Card Reader onto my system (Laptop/...
2
votes
1answer
3k views

How does a smart card work? [closed]

My understanding of smart cards is that they are a complete system on a chip. I.E. they have a processor and memory and can perform calculations independent of the system that is communicating with ...
1
vote
0answers
329 views

Which entriey does a Card Verifiable Certificate contain?

Which entries e.g. public key, valid until, etc. does a CVC has and where can I find a good explanation of this elements? - also with the size, which an entry and related to that, which size the ...
3
votes
1answer
211 views

What kind of math is possible in a SmartCard?

I'm interested in programming Prime numbers in an element field on a SmartCard. Where can I learn about a smart card's "inputs" and "outputs" so I can call it from a custom application? The math I ...
3
votes
1answer
188 views

Can someone debit cash from my debit card just with an ATR Number?

So basically I had a debit card, a built-in smart card reader in my laptop and some money in my account. What I did was, I plugged my debit card in my laptop's smart card reader, I copied the ATR ...
4
votes
1answer
796 views

Using Fido U2F or similar as primary authentication method?

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic. Would it be ...
4
votes
1answer
1k views

gpg-agent keeps saving pin for a smartcard

I've found today, that enigmail is decrypting a message without asking me for the smart card's PIN. It is asking only once, and then not ask at all. this is my gpg-agent.conf: default-cache-ttl 0 ...