Questions tagged [smartcard]
A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.
232
questions
6
votes
2
answers
830
views
Couldn't credit/debit cards easily be made more secure?
As a person who is going to get my first credit or debit card, I began researching a bit about security of them and a couple of questions came up about why the system is designed the way it is.
I ...
- 271
2
votes
4
answers
1k
views
Best practices for loyalty cards (barcode & NFC)
I am currently trying to determine the best way to go about designing a system that integrates both barcodes and NFC passes.
The barcodes will be displayed on a phone screen. The barcode (2D, Aztec, ...
- 135
3
votes
2
answers
4k
views
Smart Card private key usage
How does an application get the private key from a smart card in order to sign some data?
I presume that the data is being signed by a code running on the main OS (Windows/Linux) and not on the smart ...
- 31
4
votes
1
answer
219
views
Is it better to have a secure channel or secure PIN entry for Smartcards?
Assume I do own a computer, a USB-connected keyboard and a USB-connected contact-based (trusted) chipcard reader with a hardware pinpad.
There are now two types of smartcards relevant to this ...
- 9,580
9
votes
2
answers
2k
views
Smartcard authentication SSH remote client
I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation:
My desktop computer with smartcard has a ssh session to ...
- 91
1
vote
2
answers
676
views
SIM card used with smart card user certificate
Is it possible to put a smart card user certificate (Windows) on a SIM card? (SIM card already has telecom info on it).
I'm using Win 2012 and have tried, but I am getting this error "smart card ...
- 21
9
votes
1
answer
1k
views
Is the OpenPGP implementation of the YubiKey 4 Open Source?
Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
- 1,658
6
votes
3
answers
2k
views
Wouldn't forging the balance of a prepaid telephone card allow to make a lot of calls?
Suppose I have a prepaid public telephone card containing £5 in it. Now I connect this card to my laptop and figure out where in the card £5 is stored. I then change this to £5000, and leave the rest ...
- 173
1
vote
2
answers
296
views
How do hardware OTPs work - from a developer's perspective?
I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage).
Now I ...
- 9,580
3
votes
4
answers
980
views
How do hardware OTPs work?
I've recently stumbled across a number of one-time-password (OTP) smartcards in some of the internet shops specialized on cryptographic equipment.
Now I know / think to know how OTP works with ...
- 9,580
5
votes
2
answers
2k
views
SSH Keybased authentication using Nitrokey
So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer.
Recently I wanted to try and see if I could setup SSH authentication to my ...
- 266
3
votes
2
answers
1k
views
What's the difference between the same model with and without FIPS 140 certification?
We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded ...
- 9,580
1
vote
1
answer
199
views
OpenPGP master key with certificate and authentication capabilities (on a smartcard)
After researching about OpenPGP and smartcards, I came to a dilemma. The usual setup I've seen more widely is a master key (with SC capabilities) and 3 subkeys (with S, E, A each):
pub 4096R/...
3
votes
2
answers
1k
views
Drill a (physical) hole on a g10 openpgp smart card [closed]
I have a g10 smart card (http://g10code.com/p-card.html)
I want to make a hole on it, so I can pass a cord on it and hopefully remember to bring it with me. would I kill the card if I drill a hole on ...
- 33
13
votes
1
answer
8k
views
GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?
I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate).
Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
- 861
7
votes
1
answer
1k
views
Yubikey: How is the OpenPGP key secured by PIN and passphrase?
Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured?
In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
- 861
6
votes
1
answer
1k
views
GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?
When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information?
If so, what information would that be?
- 861
13
votes
1
answer
12k
views
export-secret-key after Yubikey is plugged in
I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
- 133
2
votes
0
answers
176
views
What's the standard protocol for secure contactless communication
A contactless smartcard has to communicate with a reader in a secure way.
The ICAO standard, for example, defines an encryption key (check BAC, EAC and PACE), so that the communication is not ...
- 1,203
1
vote
1
answer
156
views
Smartcard authentification: encrypt/decrypt or ECDSA?
I'm implementing a simple door access control with smart keyfobs.
At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key.
...
- 113
2
votes
1
answer
1k
views
How smart card with client certificate is used during SSL/TLS session
Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session? Will website still 'see' my client certificate (public key) after I removed card from the reader and ...
- 121
1
vote
0
answers
274
views
Missing link between Java javax.smartcardio and OpenPGP functionality
As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file.
Is it possible to encrypt data with ...
- 183
4
votes
2
answers
953
views
EMV as authentication technology and not a data security technology
I'm trying to wrap my head around what I view as EMV chip card security loopholes.
Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
- 41
21
votes
3
answers
19k
views
Do readers for the "Mifare DESFire EV1" smartcard really need to know the card's secret key in order to authenticate the card?
I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
- 779
1
vote
1
answer
954
views
Use HSPD-12 (PIV) Keys for SSH
Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?
- 211
5
votes
3
answers
622
views
Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?
Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking?
Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
- 50.6k
4
votes
1
answer
2k
views
What is the state of smart card/computer interoperability
Smart cards are the only really secure device that can be used for, among other things, electronic identification. However, there are usability concerns stemming from the lack of standartization.
...
- 1,203
0
votes
0
answers
54
views
How do chipped credit cards increase security? [duplicate]
So I've looked at various articles trying to understand how chipped credit cards increase security over traditional credit cards.
In the times I've used my card with a chipped reader (wally world, ...
- 699
5
votes
2
answers
3k
views
Smart cards for user authentication - is configuration of PIN complexity important?
In our company domain we are now able to login to Windows using a smart card plus a 4 digit numeric PIN. The same smart card is used to sign e-mails too.
My understanding is that authentication to ...
- 628
5
votes
1
answer
771
views
Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?
I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
- 53
3
votes
2
answers
2k
views
How do I find a PKI smart card reader/writer for development (Microsoft .NET)
I would like to learn how to develop software leveraging PKI smart cards. Ideally, I would use Microsoft Base Smart Card CSP, but I really just need the ability to store symmetric and asymmetric keys ...
- 39
1
vote
3
answers
7k
views
EMV credit card cloning: PIN code known by a malicious person
Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code?
If the PIN code is changed, can the cloned card still be used?
- 11
6
votes
3
answers
1k
views
Using smart cards for email encryption and SSH
Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do ...
- 182
2
votes
0
answers
354
views
OpenPGP smartcards compromised by blackhat 2015 simcard hack?
This blackhat was a new sidechannel attack in the SIM-card AES encryption announced.
I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
- 131
0
votes
0
answers
1k
views
In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)
I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
11
votes
2
answers
628
views
Electronic identity and digital signatures - why they are different?
It seems (to me at least) that is is generally accepted that "electronic identity" and "digital signatures" are a different thing. For example, in the Estonian ID card there are two certificates - one ...
- 1,203
2
votes
0
answers
620
views
How to do side channel attack on smart cards? [closed]
Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism.
This is the mutual authentication mechanism that my card using(Let ...
- 829
7
votes
4
answers
3k
views
Reading magnetic stripe on a credit/debit card with an EMV chip
Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
- 73
0
votes
1
answer
178
views
FIPS 201(-2): Central requirements for PIV?
I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed.
I understand that FIPS ...
- 9,580
7
votes
3
answers
5k
views
Malware: extract private keys from smartcard?
We all appreciate smartcards because they secure private keys so they don't get exposed to the world.
But in a production-environment it's often the case that smartcards are staying inserted for a ...
- 9,580
1
vote
1
answer
3k
views
Windows Certificate Store - Generating / importing personal certificates using a smartcard?
I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC).
Now I'm having the problem, that I own a ...
- 9,580
3
votes
1
answer
147
views
Is there a common standard for digitally signing via smart cards?
Am I right that "minidrivers" which are specific to different national or regional smart cards (eg PIV/CAC, Brazil, Estonia, Sweden, France, etc) are needed for digital signatures (RSA)?
Can the ...
- 591
7
votes
1
answer
743
views
How can I sign an rpm package using a smart card?
I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer.
How can I sign my rpm using these extra ...
- 71
5
votes
2
answers
2k
views
Can I place a private key on a sim card?
After google searching about this idea and yielding very little in results I've come to resort to stack exchange:
Is it possible to place a private key on a sim card?
Is it possible for a smart phone ...
3
votes
1
answer
757
views
OBKG on smartcard with PKCS#11
I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
- 261
6
votes
1
answer
2k
views
PGP key on smart card: why do I need a "secret key" on disk?
I have a YubiKey NEO on which I have the OpenPGP applet and I have a PGP key installed. I work on 3 different computers and I initialized the card on computer bob. I'm now at computer rob. Someone ...
- 6,765
1
vote
1
answer
737
views
Smart Cards / USB token security
I am quite new to cards and tokens and trying to get a handle on a couple of issues prior to purchasing and using one.
1- physical access to keys on the card or token: Are all of these devices set ...
- 261
14
votes
4
answers
10k
views
How to check randomness of random number generators?
Assume that I have a smart card that returns an 8 byte (for example) random value on reception of a command. The question is that:
How I can check if this value is really random?
(I don't have any ...
- 829
3
votes
2
answers
2k
views
Getting Certificate KeyContainerName to initialize CspParameters
How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters?
CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
Andrius Dobrotinas
8
votes
2
answers
14k
views
Create certificate without private key with OpenSSL
I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely fine,...
- 161