Questions tagged [smartcard]
A smart card, or chip card, is a fingernail-sized integrated circuit that is often embedded in a credit-card-sized plastic sheet. Smart cards are used as identification badges, banking cards, SIM in mobile phones, for key storage, and more.
232
questions
6
votes
1
answer
8k
views
SIM card - Cryptography
I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...).
Is crypto used only for ...
- 717
0
votes
1
answer
125
views
Proprietary cards [closed]
I was recently reading about automotive fare collection systems and came across loyalty card systems. In these systems, if I understood correctly, each passenger has a card in which a value, not money,...
- 11
0
votes
1
answer
388
views
How is PayPass/payWave secure when PIN is required after presenting the card to the contactless terminal?
The popular claim is that a chip-and-PIN payment card is more secure than a card with magnetic strip because the card data is hidden deep inside the chip and the ATM or POS terminal sends the entered ...
- 2,191
0
votes
1
answer
871
views
SSO software – where is symmetric key stored?
In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ?
When using smartcard, I can understand that ...
- 717
3
votes
1
answer
660
views
Smartcard - main differences between .NET and Java smartcard?
My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard.
More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
- 717
1
vote
1
answer
244
views
Banking card certificate
Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ?
Perhaps a standard exists or a de-facto ...
- 717
5
votes
2
answers
2k
views
Smart Card for RSA private key for SSL?
I have a YubiKey NEO which has a lot of amazing capabilities such as OTP, U2F, and PGP smart card for PGP/GPG and even SSH keys. One of the applications I've discovered recently for the device is a ...
- 6,765
1
vote
1
answer
322
views
Embedded devices with storage for sensitive data
I'm looking for some embedded device that will be able to store sensitive data like certificates, private keys, etc. It should comply with following requirements:
Sensitive data, stored in protected ...
- 13
6
votes
2
answers
9k
views
What is stored on a banking card and how is it protected?
I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
- 717
3
votes
2
answers
417
views
What prevents "money card" (offline smartcard system) from getting duplicated for payment fraud?
I don't know how well known this system is or maybe there are equal systems better known international. So I'll introduce the related points of the system:
It is a paymentsystem where your wallet is ...
- 711
10
votes
1
answer
2k
views
Communication between SIM, baseband and application processor
I currently examine the hidden components of a smartphone, inspired by the research of Weinmann All your baseband belong to us and Karsten Nohl Rooting Sim Cards.
According to Weinmann, the ...
- 253
1
vote
1
answer
237
views
How secure is online banking with smart card? How could it be hacked?
I have read this question and answer but still uncertain how it actually works and how a user could then be hacked. I'm asking because my brother supposedly was hacked and his bank uses exactly this ...
- 255
2
votes
2
answers
1k
views
Does a smart card do encryption or does it just provide a private certificate?
I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I ...
user55960
1
vote
2
answers
800
views
Contactless session on ATM?
I'm currently reading about an access control and saw something interesting about smartcard contact & contactless.
From what I understood from the book, smartcard contact is like an ATM Card. ...
- 23
0
votes
1
answer
881
views
Dump SSL traffic from a Java applet
I have a smartcard that can be read by websites using a Java applet (see http://www.springcard.com/online/applet_pcsc/). I would like to monitor and is to replay packets going from this java applet to ...
- 119
0
votes
1
answer
324
views
Smart Token Security Test [closed]
I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
- 153
1
vote
0
answers
369
views
secure key management using smart card
I have a scenario where I want to encrypt the file data on client machine along with smart card authentication. I have followed a link that states that for smart cards, private key never leaves The ...
- 11
6
votes
1
answer
8k
views
Adding certificate that resides on smartcard to the Microsoft store with private key ownership
How can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store?
In an enrollment system where users generate smartcard certificate ...
user49920
1
vote
1
answer
653
views
How are private keys (sMIME, PGP, etc) synchronized across a user's devices?
Given that user needs to store a copy of the same private key on each of his devices (in order to decrypt email and other data encrypted with the public key) ... what are some general techniques for ...
- 50.6k
3
votes
3
answers
1k
views
Are there commercially available hardware encryption devices over USB? [closed]
I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
- 33
2
votes
2
answers
758
views
Would chip-and-PIN have prevented the Target breach?
Would chip-and-PIN have prevented the Target breach?
As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
- 99.1k
1
vote
0
answers
91
views
Looking for OpenSC compatibile token
I am currently proud user of Feitan ePass2003 with OpenSC, however it is not 100% reliable on Windows, on Linux it's just perfect.
Anyway I started to looking and I have two candidates eToken Pro 64K ...
- 63
8
votes
1
answer
4k
views
How do OTP USB sticks work?
I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
- 6,765
5
votes
1
answer
2k
views
SmartCard for private keys - personal usage
I've just found my notebook has a SmartCard reader.
Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
- 161
7
votes
3
answers
7k
views
Is it good idea to rely on Mifare UID for security/authorization reasons?
Several systems rely on using UID of smart card for identification/authorization.
For example database stores list of smart card UIDs and corresponding
privileges.
Given that today there exist cards ...
user32987
5
votes
1
answer
3k
views
SmartCard Key Extraction / Alternatives
(1) As it is possible to extract the secret key from a SmartCard using laboratory equipment, I wonder if there is any (new) way to protect against this sort of security breach? Does it affect all ...
- 861
1
vote
0
answers
469
views
Can we create custom APDU for non-smart (memory type) contactless card?
I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it.
Can we create ...
- 11
11
votes
4
answers
27k
views
Why does my debit card have a stripe AND a chip?
Recently I received a new debit card which has both a magnetic stripe and a chip (as did my previous card).
I know the magnetic stripe can be easily copied whereas the chip system hasn't been ...
- 213
1
vote
3
answers
2k
views
Can a smart card with PKI certificate be used to protect a document?
I want to use a smart card (or USB cryptotoken) with a PKI certificate for manual authorisation. Is this possible?
I want to put a file (e.g. a word file or even a simple text file) into a smart card....
- 2,002
0
votes
3
answers
259
views
Is it ok to send user's private key away, even if protected with a SSL channel?
I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures.
My idea is: an user puts its SmartCard and through a PIN, he gets ...
- 47
0
votes
4
answers
212
views
Is it ok to send user's private key away, even if protected with a SSL channel? [duplicate]
I'm developing a webserver that performs digital signatures of (xml, pdf and office) documents and then validates those signatures.
My idea is: an user puts its SmartCard and through a PIN, he gets ...
- 47
2
votes
1
answer
231
views
Is a PGP revocation certificate sensitive?
In relation to an openpgp key on a smartcard:
Besides revoking the key, is there anything else it can be (ab)used for? Can I just ensure it's reliably stored but not worry about it's confidentiality?
- 417
4
votes
2
answers
939
views
What to do if you ever lose a smart card?
I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks.
My idea is to generate the key using GnuPG on an isolated computer, ...
- 417
8
votes
2
answers
2k
views
Signing my certificate by using my smart card and eID card?
In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication.
I ...
5
votes
3
answers
6k
views
Lost Smart Card - extract private key?
Consider you lost your laptop with sensitive data and your smart card that contains the private key for your GnuPG and Truecrypt accounts. The smartcard is secured with a 8-digit PIN.
1) Is it ...
- 861
13
votes
2
answers
18k
views
Cryptography behind chip based credit cards (smart cards)?
Why are chips safer than magnetic stripes?
The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
- 7,375
184
votes
5
answers
59k
views
Why are chips safer than magnetic stripes?
After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip.
In what ways are chips safer than stripes?
- 3,861
-1
votes
1
answer
451
views
physical access proof smart card for disk encryption [closed]
Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea.
I know that ...
- 1
18
votes
5
answers
14k
views
Smart card + GnuPG: what is stored in my keyring/how to adopt smart card?
I recently bought a Yubikey Neo which can act as a OpenPGP smart card. I'd like to use this to store my private GnuPG key. I've gone through the initial setup and I am able to use the smart card to ...
- 185
-1
votes
1
answer
460
views
mifare classic security [closed]
We know mifare Classic has been broken.
My question is, say I store encrypted data (using some out of band RSA encryption) instead of plain data on Mifare Classic card.
And also store a signature ...
- 111
4
votes
1
answer
320
views
Offloading private key operations to a trusted device
If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
- 143
39
votes
2
answers
110k
views
Is it possible to decrypt a satellite TV signal without using a smart card?
And if it is possible, why has it been decided to keep using a smart card for this task?
I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
- 399
0
votes
1
answer
336
views
What are techniques for end users to select keys on a smartcard?
When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy?
For example suppose I have a government issued ID that ...
- 50.6k
34
votes
3
answers
22k
views
How does storing GPG/SSH private keys on smart cards compare to plain USB drives?
I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
- 443
2
votes
0
answers
3k
views
How to set up a smart card for web login? [closed]
I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive ...
- 37
51
votes
4
answers
15k
views
Detecting skimmers and other ATM traps
This question has been bothering me ever since I first heard of ATM skimmers:
Instances of skimming have been reported where the perpetrator has put
a device over the card slot* of an ATM (...
- 10.8k
2
votes
0
answers
183
views
SAM Card deployment best practice
As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
- 261
4
votes
0
answers
495
views
PIV or GIDS compatible token availability [closed]
I am researching smartcards for corporate implementation and have hit a small bump. We need to support Windows RT, and Windows RT does not support Windows minidrivers for smartcards. Instead, it only ...
- 151
2
votes
1
answer
3k
views
Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer
I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
- 121
5
votes
1
answer
30k
views
Setting up Windows laptops to require a smartcard for unlocking
I am looking for details on how to secure a windows laptop using smart cards.
The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
- 153