Questions tagged [smartcard]
A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.
232
questions
1
vote
1
answer
284
views
Active Directory Certificate authentication trust
When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
- 113
4
votes
1
answer
1k
views
Use GPG smartcard and gpg-agent to protect multiple SSH keys
I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine.
ssh-add -...
- 183
4
votes
1
answer
100
views
Can I use 3 same subkeys to 2 different GPG Smartcards?
Generated keys on an air-gapped PC.
Backed-up my .gpg folder on a USB.
Imported keys to smartcard 1.
Keys deleted
Replaced .pgp folder with .pgp from USB
Imported keys to smartcard 2.
Is this setup ...
- 51
5
votes
1
answer
1k
views
Why can GPG sign messages but not keys?
I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
- 323
3
votes
1
answer
4k
views
Export GPG key from smartcard and import yubikey
I have the OPEN PGP SMARTCARD V2.1 and there I have a signature key, a encryption key and a authentication key stored. The last 8 digits of the signature key is for example: 1234 5678.
Now I want to ...
- 33
0
votes
2
answers
173
views
Can a hacker compromise the system if he can steal one of the factors of the 2FA?
I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack:
They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
- 31
2
votes
3
answers
172
views
Is using a username and smart card two-factor authentication?
Is username counted as one-factor, something you know?
A smart card (which contains the username and user information inside the card) is something you have.
What if the smart card doesn't contain ...
- 121
1
vote
0
answers
126
views
What (small) computer chips are able to run JCOP and are EMV compatible? [closed]
NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV.
Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
- 11
5
votes
0
answers
255
views
Desktop browser that supports Fido U2F over CCID
Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
- 193
3
votes
1
answer
859
views
Which type of smart card supports certificates?
For an IT security demonstration I want to set up a small demo PKI including smart card authentication based on certificates generated by a Certificate Authority, using a class 3 pin pad reader. For ...
- 133
2
votes
0
answers
128
views
What forces SSL exchange to require my smartcard to finish handshake
First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
- 21
9
votes
1
answer
886
views
Signing/certifying keys as a YubiKey user
After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys.
I was surprised to learn that one can only sign keys using ...
- 1,121
1
vote
0
answers
217
views
Where is the ID chip in this card?
I recently attended a Salesforce World Tour. As part of being identifiable and being marketable you get this ID card that the exhibitors scan, so that they can get your name, company, email and ...
- 185
2
votes
0
answers
172
views
Why would anyone steal a boom-gate access card scanner? [closed]
A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator.
I was wondering why would ...
- 21
1
vote
1
answer
2k
views
Is a smartcard single or multi-factor authentication
Since it is only something you have, that makes it single factor authentication right?
- 239
0
votes
1
answer
722
views
Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?
So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B.
Both of them remain in my wallet in close proximity to each other, ...
- 231
4
votes
1
answer
149
views
How to scale smart card authentication?
We are doing a proof of concept project for a client to introduce smart card authentication for his operations admins. Authentication in client's context means mainly SSH access. We encountered a ...
- 141
0
votes
1
answer
482
views
Is identification with NFC bank cards feasible?
Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
- 1,203
1
vote
1
answer
722
views
When generating PKI key pair with a smart card, who decides if the key is exportable?
I'm in the process of obtaining a code signing certificate from a CA that requires the use of a smart card for the generation of the PKI key pair.
However, I would like to be in the possession of the ...
- 183
2
votes
0
answers
1k
views
Does Chrome cache smartcard PIN?
When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
- 131
1
vote
0
answers
190
views
What's the difference between random number evaluation among AIS-31 AIS-20 and NIST sp800-22
I'm trying to know about the evaluation of random number generated by smart card chip. But these standards AIS-31, AIS-20 and NIST sp800-22 confuse me. Could someone help me with a brief explanation ...
- 11
1
vote
1
answer
235
views
Accesing private information in PKI Smart Card without PIN [duplicate]
Cryptographic smart cards such as https://www.acs.com.hk/download-manual/5997/FSP-ACOS5-64-1.04.pdf claims that they provide secure digital-signing and encryption.
If, my smart card were stolen by ...
- 261
1
vote
1
answer
282
views
How can a debit card provide different answers when the same challenge is sent to it multiple times?
I do only banking with my "PostFinance" debit card. The sign-in protocol works like this:
Enter user name and password into web form.
Get a 9 digit challenge number on website.
Type the challenge ...
- 704
2
votes
0
answers
123
views
Security implications of owning a German electronic ID card
I am German and about to renew my ID card.
Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
- 160
0
votes
2
answers
2k
views
Extract smartcard certificate for server to server authentication
I want to get data from a server that accept only client authentication via smartcard and save them to my server. Since they are a lot of data, I want to create a connection between my server and this ...
- 103
5
votes
2
answers
655
views
Can SIM card be locked to the specific equipment?
I'm curious if SIM card can be "personalized" to operate only in the specified mobile equipment in addition to usual PIN security. So the SIM extracted from "legitimate" phone and placed into ...
- 173
6
votes
1
answer
19k
views
What software can be used to read data from smart cards? [closed]
I have recently got this smart card reader. In the description it says that it can be used to read data from fidelity smart cards, library cards, etc.
The technical card compatibility support is as ...
- 181
2
votes
0
answers
872
views
HTTP proxy for smart card based SSL
I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
- 59
5
votes
2
answers
2k
views
Key based encryption for files with the key stored on a USB drive?
We're a small startup running a server inside the clients premises and certain files needs to be kept encrypted on that server. We want the decryption to be only possible when we plug in a particular ...
- 528
19
votes
3
answers
4k
views
GPG encryption subkey on multiple smart cards issue
Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards?
My (simplified) setup is as follows:
Generated a master key ...
- 293
2
votes
0
answers
1k
views
First time contactless card payment does not require PIN to enable [closed]
I unwittingly made my first contactless card payment a few days ago: the vendor took my bank card [current account debit card] (I assumed so that they could insert it into their "deskbound" payment ...
- 166
3
votes
2
answers
658
views
Local Smart Card authentication
I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key.
I would like to do a local (no network) authentication of user using the smart card and ...
- 1,109
2
votes
1
answer
572
views
What does %APPDATA%\GnuPG\secring.gpg contain after invoking "gpg --card-edit generate"?
For a new smartcard (crypto stick), I've invoked gpg --card-edit, performed the generate command and selected to not create any backup of the generated keys. After key generation has finished, a %...
- 123
1
vote
0
answers
245
views
Connect RFID readers with system/PC [closed]
I have a Raspberry Pi, HID smartcard (HID iClass Px G8Y), HID Card Reader (RP40 multiClass).
What I am trying to do is to read the data from this smartcard via the Card Reader onto my system (Laptop/...
- 111
3
votes
1
answer
5k
views
How does a smart card work? [closed]
My understanding of smart cards is that they are a complete system on a chip. I.E. they have a processor and memory and can perform calculations independent of the system that is communicating with ...
- 355
2
votes
0
answers
443
views
Which entriey does a Card Verifiable Certificate contain?
Which entries e.g. public key, valid until, etc. does a CVC has and where can I find a good explanation of this elements? - also with the size, which an entry and related to that, which size the ...
- 229
2
votes
1
answer
403
views
What kind of math is possible in a SmartCard?
I'm interested in programming Prime numbers in an element field on a SmartCard.
Where can I learn about a smart card's "inputs" and "outputs" so I can call it from a custom application?
The math I ...
- 700
2
votes
1
answer
582
views
Can someone debit cash from my debit card just with an ATR Number?
So basically I had a debit card, a built-in smart card reader in my laptop and some money in my account. What I did was, I plugged my debit card in my laptop's smart card reader, I copied the ATR ...
- 121
5
votes
2
answers
2k
views
Using Fido U2F or similar as primary authentication method?
I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic.
Would it be ...
- 151
12
votes
3
answers
3k
views
gpg-agent keeps saving pin for a smartcard
I've found today, that enigmail is decrypting a message without asking me for the smart card's PIN. It is asking only once, and then not ask at all.
this is my gpg-agent.conf:
default-cache-ttl 0
...
5
votes
1
answer
3k
views
How is Fingerprint Authentication Secure?
Lately, biometrics are being used for identity verification everywhere. e-Visas, Passports and even bank transactions (UUIDAI Aadhar system in India is now being used for identity verification, micro-...
- 79
3
votes
1
answer
2k
views
Can Revolut be PCI DSS compliant?
Basically, the Revolut app shows the PAN and CVV by default in-app and it has a "show PIN" option, how can this be compliant?
Here's a screenshot from the app, I have seen the real app and it really ...
- 503
12
votes
1
answer
590
views
Pin required for accessing (smartcard) Card Authentication Slot
So let me set the stage:
I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html
I made a couple ...
- 2,757
3
votes
3
answers
1k
views
mifare classic 1k for micropayments
Can Mifare Classic 1k be used for micro payments in a secure way?
I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 ...
jldesings.eu
1
vote
1
answer
198
views
main and sub encryption key on OpenPGP smartcard
The tutorial for creating and storing keys on an OpenPGP smartcard with GPG by the Free Software Foundation (FSF) at wiki.fsfe.org recommends creating a main and sub key for encryption, where the main ...
- 113
2
votes
0
answers
2k
views
How to add another UID to key on OpenPGP card?
I have an OpenPGP key on a smart card that I've used for some time. I now wish to add some additional email-addresses to the key. So I insert my card into the reader and execute gpg2 --edit-key for my ...
- 21
2
votes
3
answers
8k
views
How do I know if a EMV is SDA, DDA or CDA?
For chip cards (emv), how do I know, based on either BIN (first six digits of card numbers) or on the entire card number, if a card is SDA, DDA or CDA?
I know what it means, but without using a POS or ...
- 21
3
votes
1
answer
562
views
Chip-and-PIN PIN sentry, what it actualy does when signing?
When I use internet banking with my bank I use something called PIN sentry, i.e. this:
(wikimedia commons image)
To use it I insert my chip-an-pin card (chip side in) and press one of the three top ...
- 5,817
1
vote
1
answer
98
views
Is there a way to estimate the difference of temperature or voltage of PC CPU per differet code command?
would like to know if I run code that contains different commands such as: for, if etc. I would like to know if there is a constant change in temperature or voltage on the CPU or on any other ...
- 583
7
votes
3
answers
4k
views
What is the difference between secure element and smart card?
From smartcardalliance.org:
The secure element [...] resides in highly secure crypto chips (usually a smart card chip).
My questions are:
Aside from smart card chip, are there any other types of ...
- 101