Talking about Cryptodevices... which one?

[Andreas Schwier]

On 01/27/2015 05:24 PM, Felix E. Klee wrote:
> A smart card stores the key unencrypted, right?
Quite typically not. The platform we use for the SmartCard-HSM generates
a random AES key during platform initialization and encrypts all key
material in EEPROM under this key. The only time the key is handled in
plain (plain meaning within the protected enclosure of the secure
microcontroller) is when the crypto unit performs a private key operation.

While the device is at rest, key material in EEPROM is encrypted, the
AES key is stored in a CPU memory area separate from the main EEPROM.

The same should be try for OpenPGP cards based on a JavaCard applet.
Can't tell how it is done on other OpenGPG compliant cards.

Of course a more important aspect is resistance to various side channel
attacks (DFA/DPA and a like). Mitigating that risk is quite challenging.

Andreas

> 
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users at gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
> 


-- 

    ---------    CardContact Software & System Consulting
   |.##> <##.|   Andreas Schwier
   |#       #|   Schülerweg 38
   |#       #|   32429 Minden, Germany
   |'##> <##'|   Phone +49 571 56149
    ---------    http://www.cardcontact.de
                 http://www.tscons.de
                 http://www.openscdp.org
                 http://www.smartcard-hsm.com