Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [smartcard]

A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.

2
votes
1answer
10 views

Can I use 3 same subkeys to 2 different GPG Smartcards?

Generated keys on an air-gapped PC. Backed-up my .gpg folder on a USB. Imported keys to smartcard 1. Keys deleted Replaced .pgp folder with .pgp from USB Imported keys to smartcard 2. Is this setup ...
0
votes
0answers
17 views

Smart Cards with ECC functionalities and unextrectable private keys

I have recently started to look into smart cards with ECC features. Basically, I want to have a Java Card that can calculate ECC signatures and provides some security guarantees that the key used for ...
1
vote
1answer
50 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
0
votes
0answers
32 views

My Private certificate is installed on [Trusted Root] automatically?

I have a smart token from a security company, it holds a private & public keys. When i connect the Token to windows, the private certificate appears in the [Trusted Root] like root certificates. ...
0
votes
0answers
23 views

Setup own infrastructure for a ChipTAN generator

Smartcard readers can not just read bank cards, but also RSA smartcards. I wonder if it is possible to use a ChipTAN generator for other cards too. What is needed to set up a personal infrastructure ...
2
votes
1answer
230 views

Export GPG key from smartcard and import yubikey

I have the OPEN PGP SMARTCARD V2.1 and there I have a signature key, a encryption key and a authentication key stored. The last 8 digits of the signature key is for example: 1234 5678. Now I want to ...
0
votes
0answers
20 views

Authentication implications for a mapped PIV certificate

I've been researching smart card auth and the pass the hash vulnerabilities that go along with it. There is a case I'm interested in but can't find documentation on. Some of the devices I've looked ...
0
votes
2answers
110 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
2
votes
3answers
49 views

Is using a username and smart card two-factor authentication?

Is username counted as one-factor, something you know? A smart card (which contains the username and user information inside the card) is something you have. What if the smart card doesn't contain ...
1
vote
0answers
40 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
0answers
45 views

Are there compromised CAC readers for sale?

If a DoD employee needed to purchase a CAC reader for home use and they purchased one from Amazon. Is it possible the reader could contain malware, or in someway capture you pin or other private data?
2
votes
0answers
107 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
2
votes
1answer
212 views

Which type of smart card supports certificates?

For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For ...
0
votes
0answers
45 views

Crack security code for SLE4428 smart card [duplicate]

I don't know if the security code authentication prevents the card from being copied or not. If it does, how do you crack the 2-byte security code.
2
votes
0answers
36 views

What forces SSL exchange to require my smartcard to finish handshake

First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
3
votes
1answer
203 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
61 views

Where is the ID chip in this card?

I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
2
votes
0answers
130 views

Why would anyone steal a boom-gate access card scanner? [closed]

A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator. I was wondering why would ...
1
vote
1answer
447 views

Is a smartcard single or multi-factor authentication

Since it is only something you have, that makes it single factor authentication right?
0
votes
1answer
70 views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
4
votes
1answer
75 views

How to scale smart card authentication?

We are doing a proof of concept project for a client to introduce smart card authentication for his operations admins. Authentication in client's context means mainly SSH access. We encountered a ...
0
votes
1answer
159 views

Is identification with NFC bank cards feasible?

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
1
vote
1answer
127 views

When generating PKI key pair with a smart card, who decides if the key is exportable?

I'm in the process of obtaining a code signing certificate from a CA that requires the use of a smart card for the generation of the PKI key pair. However, I would like to be in the possession of the ...
2
votes
0answers
491 views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
1
vote
0answers
71 views

What's the difference between random number evaluation among AIS-31 AIS-20 and NIST sp800-22

I'm trying to know about the evaluation of random number generated by smart card chip. But these standards AIS-31, AIS-20 and NIST sp800-22 confuse me. Could someone help me with a brief explanation ...
1
vote
1answer
118 views

Accesing private information in PKI Smart Card without PIN [duplicate]

Cryptographic smart cards such as https://www.acs.com.hk/download-manual/5997/FSP-ACOS5-64-1.04.pdf claims that they provide secure digital-signing and encryption. If, my smart card were stolen by ...
1
vote
1answer
205 views

How can a debit card provide different answers when the same challenge is sent to it multiple times?

I do only banking with my "PostFinance" debit card. The sign-in protocol works like this: Enter user name and password into web form. Get a 9 digit challenge number on website. Type the challenge ...
2
votes
0answers
73 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
0
votes
2answers
393 views

Extract smartcard certificate for server to server authentication

I want to get data from a server that accept only client authentication via smartcard and save them to my server. Since they are a lot of data, I want to create a connection between my server and this ...
3
votes
1answer
229 views

Can SIM card be locked to the specific equipment?

I'm curious if SIM card can be "personalized" to operate only in the specified mobile equipment in addition to usual PIN security. So the SIM extracted from "legitimate" phone and placed into ...
0
votes
0answers
3k views

How does Mifare Classic Offline Cracker (MFOC) work?

I have been reading up on the vulnerabilities of Mifare Classic and found that with the use of MFOC, one can actually crack the keys that encrypt the data within the Mifare Classic card. However, how ...
3
votes
1answer
5k views

What software can be used to read data from smart cards? [closed]

I have recently got this smart card reader. In the description it says that it can be used to read data from fidelity smart cards, library cards, etc. The technical card compatibility support is as ...
2
votes
0answers
344 views

HTTP proxy for smart card based SSL

I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
4
votes
2answers
448 views

Key based encryption for files with the key stored on a USB drive?

We're a small startup running a server inside the clients premises and certain files needs to be kept encrypted on that server. We want the decryption to be only possible when we plug in a particular ...
10
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
2
votes
0answers
511 views

First time contactless card payment does not require PIN to enable [closed]

I unwittingly made my first contactless card payment a few days ago: the vendor took my bank card [current account debit card] (I assumed so that they could insert it into their "deskbound" payment ...
3
votes
2answers
184 views

Local Smart Card authentication

I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key. I would like to do a local (no network) authentication of user using the smart card and ...
2
votes
1answer
157 views

What does %APPDATA%\GnuPG\secring.gpg contain after invoking “gpg --card-edit generate”?

For a new smartcard (crypto stick), I've invoked gpg --card-edit, performed the generate command and selected to not create any backup of the generated keys. After key generation has finished, a %...
1
vote
0answers
133 views

Connect RFID readers with system/PC [closed]

I have a Raspberry Pi, HID smartcard (HID iClass Px G8Y), HID Card Reader (RP40 multiClass). What I am trying to do is to read the data from this smartcard via the Card Reader onto my system (Laptop/...
1
vote
1answer
2k views

How does a smart card work? [closed]

My understanding of smart cards is that they are a complete system on a chip. I.E. they have a processor and memory and can perform calculations independent of the system that is communicating with ...
1
vote
0answers
318 views

Which entriey does a Card Verifiable Certificate contain?

Which entries e.g. public key, valid until, etc. does a CVC has and where can I find a good explanation of this elements? - also with the size, which an entry and related to that, which size the ...
3
votes
1answer
174 views

What kind of math is possible in a SmartCard?

I'm interested in programming Prime numbers in an element field on a SmartCard. Where can I learn about a smart card's "inputs" and "outputs" so I can call it from a custom application? The math I ...
3
votes
1answer
178 views

Can someone debit cash from my debit card just with an ATR Number?

So basically I had a debit card, a built-in smart card reader in my laptop and some money in my account. What I did was, I plugged my debit card in my laptop's smart card reader, I copied the ATR ...
2
votes
1answer
635 views

Using Fido U2F or similar as primary authentication method?

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic. Would it be ...
2
votes
1answer
793 views

gpg-agent keeps saving pin for a smartcard

I've found today, that enigmail is decrypting a message without asking me for the smart card's PIN. It is asking only once, and then not ask at all. this is my gpg-agent.conf: default-cache-ttl 0 ...
6
votes
1answer
2k views

How is Fingerprint Authentication Secure?

Lately, biometrics are being used for identity verification everywhere. e-Visas, Passports and even bank transactions (UUIDAI Aadhar system in India is now being used for identity verification, micro-...
0
votes
0answers
62 views

Create Sharepoint connector to apply Digital Signature using Smartcards or USB Tokens?

Is there a document or guide for how to use smartcard or USB Tokens in signing documents and approvals? We have in our company the Sharepoint 2013 server, and our employees have their own ...
4
votes
1answer
467 views

Can Revolut be PCI DSS compliant?

Basically, the Revolut app shows the PAN and CVV by default in-app and it has a "show PIN" option, how can this be compliant? Here's a screenshot from the app, I have seen the real app and it really ...
9
votes
1answer
286 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
3
votes
3answers
607 views

mifare classic 1k for micropayments

Can Mifare Classic 1k be used for micro payments in a secure way? I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 ...