Subject: openpgp card and basiccard RNG
micha137 at gmx.de
Wed Feb 5 09:01:19 CET 2014
> Aparrently the OpenPGP card is based on BasicCard  and from the
> BasicCard FAQ  I read:
> "For Enhanced BasicCards, the card has no hardware generator. The Enhanced
> BasicCards contain a unique manufacturing number which cannot be read from
> outside the card. The Rnd function uses this number to generate random
> numbers which are different for each card.
> For Professional and MultiApplication BasicCards, the random number is
> generated by use of a hardware random number generator."
> Does anybody know which version of BasicCard is used for the OpenPGP cards
> distributed by KernelConcepts.de? If it is the Enhanced version, does the
> use of a pseudorandom generator pose a security risk?
In my opinion a (good) PRNG seeded properly under user control is no
If -as the FAQ seems to tell- it is primed during production, beyond
user control, this implies that normal users have to fully trust the
A malicious manufacturer would be able to completely break privacy based
on the "Enhanced BasicCard" without the user being able to detect this.
An instance is created here, deliberately and unnecessarily, which the
user has to trust. This pattern smells like a backdoor mechanism to
I would outrighly reject to use such a card.
More information about the Gnupg-users