You can't clone the chip.
A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards.
A chip also holds a secret number. ...
The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card.
That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild.
A satellite TV system must face the following challenge: it is one-way. The receivers cannot do anything but receive; they cannot emit anything.
The generic problem is known as broadcast encryption. In practice, things go that way:
Each subscriber has a smartcard, and that card contains a key Ks specific to that subscriber.
The media stream is encrypted ...
The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information.
Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it.
A magnetic stripe ...
From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...
Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'd simply scratch off or cover the conductive surface on the pin which decreased the amount on the card, allowing for infinite free calls on a one-time topup. ...
Does the smart card ever "reveal" the private key to applications like SSH or GPG? If so, it seems anyone who has the PIN and the device itself can still get at the private key, and offers no advantages over regular USB drives. If not, how exactly do applications work without knowing the private key?
The primary advantage of such a token is ...
This is just some extra information but it didn't fit as a comment under Thomas' answer.
There's an interesting pirating method that have made it possible for the cycle to extend way longer than two weeks. It's called CardSharing. Here's how it works:
Somebody buys a legitimate card and inserts it into a modified satellite receiver that will use the card ...
Exact cryptography depends on the bank. The communication standard (ISO 7816) is flexible and does not mandate specific cryptographic algorithms. In practice, you would find the two following models:
The card does symmetric cryptography only (symmetric encryption, MAC). The card has a static identifier (which contains, roughly speaking, the card number and ...
Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking:
When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it".
OK, the above paragraph is not ...
The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader:
To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user.
This is a losing battle and you take a chance every time you use an ATM. Security is relative, that ...
You need to run:
and gpg will do it for you:
/tmp$ mkdir gpgtmp
/tmp$ chmod go-rwx gpgtmp
/tmp$ GNUPGHOME=/tmp/gpgtmp gpg --keyserver pgp.mit.edu --recv F8713BDF
gpg: sleutelring ‘/tmp/gpgtmp/secring.gpg’ is aangemaakt
gpg: sleutelring ‘/tmp/gpgtmp/pubring.gpg’ is aangemaakt
gpg: opvragen sleutel F8713BDF van hkp sleutelserver pgp.mit....
After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of making the key work on a different computer (with the smartcard), but these days, as there is sufficient information stored about the key, all you need is to use --...
Essentially, each subscriber has a key in their smart card. When a new subscriber is added or changes their service, a new group key is sent over the broadcast system, encrypted with that subscriber's key. The keys to actually decrypt individual programs are themselves encrypted with the group key for the set of services that program belongs to. Legitimate ...
This wouldn't be a problem at all. As you see in the picture in your link, there is a version with a smaller form factor (ID-000). This is the same card just with cut outs.
Everything outside the contact area is just plastic. I made you a drawing in paint showing where the actual IC is in the card. Everything outside this box can be removed without any ...
Details depend on bank, card type and country, so they vary quite a lot, but the generic model is the following:
The magnetic stripe contains, mostly, a computer-readable copy of the information embossed on the card: account number, holder name, expiration date.
The chip contains a secret key which is used to "sign" (not necessarily a true signature; often ...
You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply?
Cryptographic Smart Cards
The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations:
create keys ...
I will answer this although it seems to be worded sketchy. Calling cards, and credit cards do not work in a manner as you infer/interpret. In a calling card system, especially pre-paid cards, when you make a call it works like this:
You --> call pre-paid number to enter a PIN
PIN System --> you "What is your PIN #"
You --> enter your PIN
PIN System ...
There are a few different types of Smart Cards, here are the types my old Dell 6420 supports:
Type "A" : ISO14443A — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
Type "B" : ISO14443B — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
ISO15693 (Proximity card)
FIPS201 see also NXP Fire
What are you going to use the Smartcard for? ...
The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.
Smartcard communication protocols follow well-established standards (connector size and location, voltages, signals, logical transport protocol...) so chances are that card readers are indeed interchangeable. If the bank sent you both the card and the reader then there is a slight probability that they did something fancy which compromises interoperability, ...
Assuming the laptops to run under Windows, you would need the following:
a PKI solution to initialize and manage smart cards; each smart card will contain a private key and the associated certificate;
to enable smart card logon so that users open a session on the laptop with the smart card, instead of a password (the smart card itself will require entry of ...
I've been looking into this myself. I want to be prompted to enter my PIN every time I request my smart card (Yubikey in my case) to do a sign/encrypt/auth operation. It is possible to enable this behaviour for signing by enabling forcesig through gpg2 --card-edit (see GnuPG documentation):
forcesig toggle the signature force PIN flag
but not for ...
I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. The secret key subpacket looks like this when displayed through gpg --list-packets:
:secret sub key packet:
version 4, algo 1, created 1358985314, ...
I think this is to ensure that the response entered into the website is a fresh(ish) one. If the one time password was generated directly then it could be used at any point in the future, the server has no way of checking when it was generated. By providing the challenge to the card it means that the response generated can only be used for the transaction ...
EMV is a communication protocol, and by implication it specifies what data must be stored on the credit/debt card. It doesn't specify what technical measures protect the card as a physical device. EMV is irrelevant to your question.
To understand why a chip isn't so easy to duplicate, read about the physical security of smart cards. There isn't much public ...
There is a security standard for smartcards under the Common Criteria scheme: the Smart Card Protection Profile. A protection profile defines the security properties that are expected from a device or system.
The smart card PP is defined for EAL4+. To put it succintly, the EAL defines what aspects of the product's design are evaluated and to what extent (...
GnuPG 2.1.0beta2 supports signing certificates in batch mode:
Support X.509 certificate creation.
Using "gpgsm --genkey" allows the creation of a self-signed
certificate via a new prompt.
Using "gpgsm --genkey --batch" should allow the creation of arbitrary
certificates controlled by a parameter file. An example parameter
Found the solution myself.
There is one smart card platform that implements Java Card 3.0.1 Classic, available as a smart card and as a USB token:
Sm@rtCafé Expert 6.0
StarSign Crypto USB Token
There also seems to be some similar card from CardLogix.
However, these are all Java Card 3.0 Classic, which is very close to Java Card 2.2.2. The minute ...