27
votes
Accepted
Wouldn't forging the balance of a prepaid telephone card allow to make a lot of calls?
Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'...
- 135k
26
votes
Accepted
How do GPG smart card devices handle large GPG operations?
The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
- 46.4k
21
votes
Accepted
gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey
Solution
Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.
You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.
If all your private keys are on ...
- 583
19
votes
Accepted
export-secret-key after Yubikey is plugged in
After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of ...
- 781
16
votes
gpg-agent keeps saving pin for a smartcard
I've been looking into this myself. I want to be prompted to enter my PIN every time I request my smart card (Yubikey in my case) to do a sign/encrypt/auth operation. It is possible to enable this ...
- 161
12
votes
Accepted
Drill a (physical) hole on a g10 openpgp smart card
This wouldn't be a problem at all. As you see in the picture in your link, there is a version with a smaller form factor (ID-000). This is the same card just with cut outs.
Everything outside the ...
- 5,973
11
votes
Accepted
GPG encryption subkey on multiple smart cards issue
I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. ...
- 24.4k
10
votes
Accepted
GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?
If you put the subkeys on the YubiKey, you still should keep the primary private key around somewhere -- it is the only entity that can be used to revoke the keys, create new subkeys, modify user IDs, ...
- 24.4k
10
votes
Wouldn't forging the balance of a prepaid telephone card allow to make a lot of calls?
I will answer this although it seems to be worded sketchy. Calling cards, and credit cards do not work in a manner as you infer/interpret. In a calling card system, especially pre-paid cards, when you ...
- 8,692
10
votes
Accepted
Export GPG key from smartcard and import yubikey
Secret keys cannot be exported from OpenPGP smart cards -- that's the very idea behind them. If you created the key on a computer and imported it to the smart card, use the backup to copy it to the ...
- 24.4k
9
votes
Accepted
GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?
You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply?
Cryptographic ...
- 24.4k
8
votes
Accepted
Reading magnetic stripe on a credit/debit card with an EMV chip
The service code on the stripe data will notify you it is a chip capable card and you should use this to prompt for card insertion. US is using the first digit of 2 or 6 to signify a chip card.
Magnet ...
- 196
8
votes
Create certificate without private key with OpenSSL
Yes you can circumvent this fact.
create a fake csr with ANY private key
the CA can use the force_pubkey flag (as mentioned here: https://www.openssl.org/docs/manmaster/man1/x509.html) to sign it ...
8
votes
Accepted
What's the difference between the same model with and without FIPS 140 certification?
[Disclaimer: I'm a developer on a FIPS 140-2 Level 2 software module, and I'm a little disgruntled about the whole process]
The main difference I've seen is that things that are FIPS 140-2 certified ...
- 58.8k
8
votes
Accepted
Is the OpenPGP implementation of the YubiKey 4 Open Source?
No, the Yubikey 4 is not Open Source:
The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to ...
- 1,680
6
votes
Accepted
Smart cards for user authentication - is configuration of PIN complexity important?
As long as the card implements lock-out policies like destroying the key material after 3 incorrect PIN attempts, I'd say a 4 digit PIN is secure. Just make sure there are proper procedures in place ...
- 12.8k
6
votes
Do readers for the "Mifare DESFire EV1" smartcard really need to know the card's secret key in order to authenticate the card?
Edited:
OK. As there is request for "short answer" here is "executive summary" here it is:
Question: “So all the reading devices must know the secret key, too. But there can be many readers from many ...
- 61
6
votes
What software can be used to read data from smart cards?
In the past, i have used CardPeek for this. It is easily extensible through LUA and can therefore adapt to unknown cards. It presents the "files" on the card via a TreeView and offers annotations on "...
- 325
6
votes
Accepted
Is a smartcard single or multi-factor authentication
Factors refer to the three different modes of authentication (although there are more - geographic, time of day, etc, but they're less typically referenced)
The 3 main factors are
1) Something you ...
6
votes
Why can GPG sign messages but not keys?
Signing and key signing is done by different subkeys. You have:
$ gpg --list-secret-keys
sec# rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
Key fingerprint = DEAD BEEF DEAD BEEF DEAD BEEF DEAD ...
- 18.8k
6
votes
Can one use a Credit Card as a Smart Card?
While the EMV chip on credit cards is technically a smart card, It is of a type that is not reprogram-able. (would be a very bad design if it could be)
Most smart cards can be used as a key ...
- 8,803
5
votes
Accepted
What is the state of smart card/computer interoperability
From your question it looks like you ask for PKI smart cards only, so I will skip other types of smart cards.
Some theory first. Computers talk to all smart cards using APDU commands. They are really ...
- 121
5
votes
Smartcard authentication SSH remote client
You can use ssh-agent to add a smart card and then forward agent to the other host. This will let you authenticate on the second host from the first using your local smartcard. In short:
eval `ssh-...
- 5,649
5
votes
Smart Card private key usage
Smart cards that are used for cryptography do generate and use the asymmetric key on the device. They typically employ mechanisms to try and prevent extracting of the private key. This includes wiping ...
- 1,945
5
votes
Smart Card private key usage
Your premise is wrong: the key never leaves the smartcard.
Smartcard normally expose more high level functions as Encrypt/Decrypt/Sign. You pass a plaintext/cyphertext as parameter, and the smartcard ...
- 458
5
votes
Accepted
Couldn't credit/debit cards easily be made more secure?
All very good questions. There is a lot of nuance and history here that short answers have to elide that is worth the research if one is interested.
Couldn't such leaks be avoided if the merchants ...
- 3,487
5
votes
Accepted
Can Revolut be PCI DSS compliant?
Basically, they don't have to be.
While merchants and service providers are often contractually obligated to be PCI-DSS compliant, payment applications tend to be PA-DSS (Payment Application Data ...
- 111
5
votes
GPG encryption subkey on multiple smart cards issue
Running
gpg-connect-agent "scd serialno" "learn --force" /bye
will update the secret key stubs for the PGP keys on the currently
inserted key. So running that after key insertion ...
- 151
5
votes
Key based encryption for files with the key stored on a USB drive?
I would not use that approach. When you mount a USB drive, read a file from it, etc all sorts of copies of that data could end up in OS memory, logs, etc. You'll be fighting an uphill battle to make ...
- 58.8k
5
votes
Is using a username and smart card two-factor authentication?
If the username is secret and not reasonably ex tractable from card, I would say yes.
If the username is not secret, or at least easily guessable because it is strongly based on something not secret ...
- 1,682
Only top scored, non community-wiki answers of a minimum length are eligible