26
votes
Accepted
How do GPG smart card devices handle large GPG operations?
The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
- 50.4k
22
votes
Accepted
gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey
Solution
Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.
You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.
If all your private keys are on ...
- 613
16
votes
gpg-agent keeps saving pin for a smartcard
I've been looking into this myself. I want to be prompted to enter my PIN every time I request my smart card (Yubikey in my case) to do a sign/encrypt/auth operation. It is possible to enable this ...
- 161
11
votes
Accepted
GPG encryption subkey on multiple smart cards issue
I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. ...
- 24.7k
10
votes
Accepted
Export GPG key from smartcard and import yubikey
Secret keys cannot be exported from OpenPGP smart cards -- that's the very idea behind them. If you created the key on a computer and imported it to the smart card, use the backup to copy it to the ...
- 24.7k
8
votes
Create certificate without private key with OpenSSL
Yes you can circumvent this fact.
create a fake csr with ANY private key
the CA can use the force_pubkey flag (as mentioned here: https://www.openssl.org/docs/manmaster/man1/x509.html) to sign it ...
- 183
6
votes
What software can be used to read data from smart cards?
In the past, i have used CardPeek for this. It is easily extensible through LUA and can therefore adapt to unknown cards. It presents the "files" on the card via a TreeView and offers annotations on "...
- 325
6
votes
Accepted
Is a smartcard single or multi-factor authentication
Factors refer to the three different modes of authentication (although there are more - geographic, time of day, etc, but they're less typically referenced)
The 3 main factors are
1) Something you ...
6
votes
Why can GPG sign messages but not keys?
Signing and key signing is done by different subkeys. You have:
$ gpg --list-secret-keys
sec# rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
Key fingerprint = DEAD BEEF DEAD BEEF DEAD BEEF DEAD ...
- 19k
6
votes
Can one use a Credit Card as a Smart Card?
While the EMV chip on credit cards is technically a smart card, It is of a type that is not reprogram-able. (would be a very bad design if it could be)
Most smart cards can be used as a key ...
- 9,033
5
votes
Accepted
Couldn't credit/debit cards easily be made more secure?
All very good questions. There is a lot of nuance and history here that short answers have to elide that is worth the research if one is interested.
Couldn't such leaks be avoided if the merchants ...
- 3,547
5
votes
Smart Card private key usage
Your premise is wrong: the key never leaves the smartcard.
Smartcard normally expose more high level functions as Encrypt/Decrypt/Sign. You pass a plaintext/cyphertext as parameter, and the smartcard ...
- 478
5
votes
Smart Card private key usage
Smart cards that are used for cryptography do generate and use the asymmetric key on the device. They typically employ mechanisms to try and prevent extracting of the private key. This includes wiping ...
- 1,995
5
votes
Accepted
Can Revolut be PCI DSS compliant?
Basically, they don't have to be.
While merchants and service providers are often contractually obligated to be PCI-DSS compliant, payment applications tend to be PA-DSS (Payment Application Data ...
- 111
5
votes
GPG encryption subkey on multiple smart cards issue
Running
gpg-connect-agent "scd serialno" "learn --force" /bye
will update the secret key stubs for the PGP keys on the currently
inserted key. So running that after key insertion ...
- 151
5
votes
Key based encryption for files with the key stored on a USB drive?
I would not use that approach. When you mount a USB drive, read a file from it, etc all sorts of copies of that data could end up in OS memory, logs, etc. You'll be fighting an uphill battle to make ...
- 59.2k
5
votes
Is using a username and smart card two-factor authentication?
If the username is secret and not reasonably ex tractable from card, I would say yes.
If the username is not secret, or at least easily guessable because it is strongly based on something not secret ...
- 1,682
4
votes
Accepted
Do readers for the "Mifare DESFire EV1" smartcard really need to know the card's secret key in order to authenticate the card?
MIFARE DESFire EV1 can have multiple applications (28), and each application can have multiple files (32) of different types (4). The card itself has a PICC master key plus between 1 and 14 keys per ...
- 709
4
votes
Couldn't credit/debit cards easily be made more secure?
Before buying a product online, a shopper would be redirected to the
payment processor's website and it would be there where the card
details are entered.
That sounds a lot like 3-D Secure (...
- 475
4
votes
How do I know if a EMV is SDA, DDA or CDA?
This is not something that's determined by the account number (BIN or otherwise). Rather, it's determined by the bank that orders the cards and has the chip "personalized" with your account ...
- 1,485
4
votes
Technical realization of fraudulent credit card cash withdrawal
You are correct that a thief needs a physical card and pin to make a withdrawal. Chips cannot be fully cloned (yet, that may change), but magnetic strips can be cloned or created from intercepted chip ...
- 17.4k
4
votes
Is it possible to export an expired GPG subkey's public key without signatures?
While not explicitly stated, apparently --export-minimal drops expired subkeys, which make sense.
The option you need is probably self-sigs-only. However, that is a filter only for import. We would ...
- 19k
3
votes
mifare classic 1k for micropayments
Mifare classic can be completely cloned. You can buy cards with changeable UID as well - I just ordered a bunch. The blocks of the card which require non-default keys can be cracked on a PC using ...
- 873
3
votes
What is the difference between secure element and smart card?
According to globalplatform.org, there are three SE technologies:
Universal Integrated Circuit Card (UICC)
embedded SE
microSD.
From the same website, a secure element is a physical object, not ...
- 111
3
votes
Accepted
Chip-and-PIN PIN sentry, what it actualy does when signing?
There's a sub-specification to EMV known as the Chip Authentication Program (for MasterCard) or Dynamic Passcode Authentication (for Visa).
I'd never run into this before, but according to ...
- 1,485
3
votes
SSH Keybased authentication using Nitrokey
I have a feeling that upon exporting my key it somehow got added to my local key storage making the NitroKey redundant but I am not knowledgable enough about the exact workings to be sure.
If that ...
- 5,989
3
votes
Accepted
Is there a common standard for digitally signing via smart cards?
Minidrivers abstract the actual smart cards so that applications can all talk to them using a common interface. Your app doesn't even need to know nor care about which smartcard it's talking to, or ...
- 12.9k
3
votes
Best practices for loyalty cards (barcode & NFC)
NFC cards can authenticate the reader. Mifare Plus (and Classic as well, but they're broken) can implement ACLs on sectors so that a key must be presented in order to read/write a sector. You can have ...
- 12.9k
3
votes
Can I place a private key on a sim card?
I would not recommend trusting anything controlled by the carrier to hold private keys. The cards can be updated remotely using a simple SMS, and the security of that is dubious.
Not to mention, ...
- 12.9k
3
votes
Are all smart card readers the same?
You are probably talking about contact smart cards:
These kind of cards are defined bt ISO/IEC 7816:
ISO/IEC 7816-1 - Define physical characteristic
ISO/IEC 7816-2 - Dimensions and location of the ...
- 478
Only top scored, non community-wiki answers of a minimum length are eligible