How secure are smartcards?

[Werner Koch]

On Tue, 26 Jul 2011 18:07, j-001 at ottosson.nu said:

> Even worse though, as I recall from the time when I worked with IBM crypto 
> processors like 4758 etc, a lot of the people inside the (somewhat introvert) 
> banking community working with security, had no clue and actually believed that 

Part of the problem was that many developers over there had an RPG and
COBOL background and were forced to write security software based on a
lower system layer they didn't really understood.

> as long as there is no bugs in the on-board OS.. If however it gets stolen by 
> skilled advisaries, one should regard the keys as compromised, generate 
> revocation certificates and new keys. 

[As usually it depends on your threat model.]

If there is enough money to gain from breaking a card someone will do
it.  See the French 384 bit RSA cards or master key systems like (old)
pay TV cards.  With modern personalized cards you can't get enough in
return for an individual card break and thus it is easier to use much
simpler techniques like faked cameras and keyboards or pinhole cameras.
That can be done in batch mode for many cards and it is easy to retrain
non-geeky crooks to help setting up such a mafia business.  Of course I
am talking about mass-market smartcards and not about specialized
security systems.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.