Questions tagged [smartcard]

A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

Filter by
Sorted by
Tagged with
1
vote
1answer
58 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
2
votes
0answers
67 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
0
votes
0answers
49 views

Using smart card for gnupg

I want to buy a smart card to store a gpg private key (I have never used any before). However all options seem quite expensive. If you look for ISO 7816 in AliExpress there are much more affordable ...
0
votes
2answers
132 views

How/What to prompt user for fingerprint login using smartcard?

We are using a PIV smartcard that has biometric information (fingerprint) of the user encoded on the card to login into our application. We have the capability to read the fingerprint from a reader ...
1
vote
0answers
28 views

GPG - use cached key before prompting for other cards when multiple receivers?

When using gpg 2.2.28 & gpg-agent to decrypt a ciphertext that has been encrypted for (any one of) multiple 'receivers', the default behaviour is that it tries to find and use private keys in some ...
2
votes
1answer
114 views

ePassport Chip Authentication - how to verify?

I want to implement Chip Authentication for ePassport documents, and wish to validate my understanding of it. I've managed to get it up and running by using the JMRTD library, specifically the ...
1
vote
0answers
98 views

Does the USB connection have to be trusted when using Yubikey CCID/PIV?

I use a Yubikey in PIV/CCID mode. The PIN is sent from the host computer via automated script and unlocks the Yubikey PIV smartcard. In this mode, is it essential that the USB connection is trusted? ...
0
votes
2answers
112 views

Can ISO 7816 (EMV) based smart card handle interrupts?

ISO 7816 smartcards are typically used in EMV transactions. I know that the card can perform arbitrary actions before sending a response to the terminal in a typical EMV transaction (e.g. signing ...
2
votes
1answer
366 views

What does a TPM have in common with smart cards?

The title really says it all. I'm starting to dig a little bit into computer security and from what I've watched or from what I have read in books or articles there's always a mention of basic smart ...
2
votes
1answer
254 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
1answer
109 views

MFA using PKI certificates [closed]

I'm trying to set up a multi factor authentication using PKIs certificates. A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards. I was looking for a smart ...
1
vote
1answer
490 views

Is it possible to export an expired GPG subkey's public key without signatures?

Based on Is it possible to export a GPG subkey's public component? I got familiar with: gpg --keyid-format long --with-fingerprint --list-key {e-mail} gpg --export --armor --output public-key.asc ...
1
vote
0answers
182 views

How smart cards are blocked?

I have a Yubikey NFC 5, when I enter a wrong PIN or PUK three times the smart card is blocked. Can someone please explain to me how it is blocked ? Does the PIN/PUK functionality is disabled somehow ? ...
0
votes
1answer
116 views

How can hackers steal from a savings account that has no client card? [closed]

Someone I know was stolen a few hundreds dollars from a savings account. Looking at the history, she saw transactions like Uber rides and video games purchases she did not do. This account is used ...
1
vote
1answer
724 views

GnuPG - connecting to specific card reader when multiple reader available

Currently I can use $ gpg --expert --card-status to interact with smartcards that run the OpenPGP applet. Through trial-and-error, it seems that only the first card reader will interact with gpg. ...
2
votes
0answers
140 views

Cryptoki PKCS11 C_Decrypt returns shorter key (decrypted message) than expected

First off let me say I'm fully aware this question can only be answered by the token vendor but I have already contacted them and with the whole COVID situation my hopes of hearing from them soon are ...
0
votes
1answer
290 views

Can one use a gpg smartcard to implement FIDO2?

From what I understand, the idea of FIDO2 is to use symmetric cryptography, with secret key on the token, and public key on the server. When requesting to connect, the server uses the public key to ...
0
votes
2answers
125 views

smart card authentication process

Smart cards (for instance, public transit cards) are widely used in some countries for authentication purposes at universities and workplaces, so that an authorized person can use a printer or access ...
0
votes
2answers
120 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?
4
votes
0answers
104 views

Security implications of using unfused U2F token

I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
7
votes
1answer
3k views

gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey

I have multiple Yubikeys carrying the same GPG secret key. I want to switch from one Yubikey to anohter one on my laptop. The two obviously have different serial numbers. After switching the keys ...
1
vote
0answers
70 views

using public key crypto instead of password for authentication [closed]

I'm the head of IT and development in a small group of enthusiasts spending their free time with a bit of hobby development. We don't have an office yet, but maybe consider to rent some small office ...
3
votes
0answers
112 views

What exactly is the Management Key on a yubikey?

The yubico documentation mentions that a Management Key can be set manually, or it can be inferred in the SoC when setting a PIN for the first time. What exactly is that management key and how does ...
0
votes
0answers
381 views

How to find sniff communication to smart card reader?

I use a smart card reader and I want to know if the reader is secure. How to sniff communication between card and card reader?
1
vote
0answers
817 views

Is it possible to decrypt Outlook Web App S/MIME messages in a web browser with same webclient? [closed]

Normally, you would use a mail client for mail encryption. Though, I can access smartcard security functions from the browser for a secure login. Therefore, is it possible to decrypt Outlook Web App ...
0
votes
1answer
454 views

Cloning Credit/debit card chip [closed]

I have a nice, expensive, metal credit card with a chip but it's from an older card. I’m wanting to rewrite the magnetic stripe and the chip to my new card. I know how to rewrite the magnetic stripe ...
3
votes
1answer
146 views

Technical realization of fraudulent credit card cash withdrawal

Somebody unauthorized in India managed to withdraw cash from my credit card account. The card I use (and which they claim to have used) is a German Visa prepaid card issued by Postbank. It has a chip ...
4
votes
0answers
178 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
4
votes
1answer
988 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
0
votes
0answers
965 views

Does OpenSC required proprietary Gemalto SafeNet middleware to support Gemalto IDPrime card?

I am interesting by buying a Gemalto IDPrime MD 830 card to be used onto two computers in various scenarios: - Storing certificate (Windows, Linux) - Authentication (Linux) The Windows computer would ...
5
votes
1answer
2k views

Can one use a Credit Card as a Smart Card?

Okay, first question on any Stack Exchange site, and Information Security seems the most fitting for this question. Anyways, I realized that my laptop has a smart card reader. I understand that ...
2
votes
1answer
3k views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
1
vote
1answer
272 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
1answer
191 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
4
votes
1answer
1k views

Use GPG smartcard and gpg-agent to protect multiple SSH keys

I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine. ssh-add -...
4
votes
1answer
67 views

Can I use 3 same subkeys to 2 different GPG Smartcards?

Generated keys on an air-gapped PC. Backed-up my .gpg folder on a USB. Imported keys to smartcard 1. Keys deleted Replaced .pgp folder with .pgp from USB Imported keys to smartcard 2. Is this setup ...
5
votes
1answer
946 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
3
votes
1answer
3k views

Export GPG key from smartcard and import yubikey

I have the OPEN PGP SMARTCARD V2.1 and there I have a signature key, a encryption key and a authentication key stored. The last 8 digits of the signature key is for example: 1234 5678. Now I want to ...
0
votes
2answers
139 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
2
votes
3answers
126 views

Is using a username and smart card two-factor authentication?

Is username counted as one-factor, something you know? A smart card (which contains the username and user information inside the card) is something you have. What if the smart card doesn't contain ...
1
vote
0answers
85 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
4
votes
0answers
199 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
3
votes
1answer
736 views

Which type of smart card supports certificates?

For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For ...
2
votes
0answers
91 views

What forces SSL exchange to require my smartcard to finish handshake

First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
9
votes
1answer
788 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
99 views

Where is the ID chip in this card?

I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
2
votes
0answers
142 views

Why would anyone steal a boom-gate access card scanner? [closed]

A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator. I was wondering why would ...
1
vote
1answer
1k views

Is a smartcard single or multi-factor authentication

Since it is only something you have, that makes it single factor authentication right?
0
votes
1answer
230 views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
4
votes
1answer
117 views

How to scale smart card authentication?

We are doing a proof of concept project for a client to introduce smart card authentication for his operations admins. Authentication in client's context means mainly SSH access. We encountered a ...

1
2 3 4 5