I am quite new to cards and tokens and trying to get a handle on a couple of iss

Question

I am quite new to cards and tokens and trying to get a handle on a couple of issues prior to purchasing and using one.

1- physical access to keys on the card or token: Are all of these devices set up to (or easily configured to) require a pin/pw of some kind prior to use? So, for instance, if the card is lost, a pin must be entered prior to accessing any information or modules (ie, openpgp) that reside on the card?

2- What is the effect of a malicious keylogger on the use of a smart card or token? For instance, if using a USB type token w/smartcard capability, does a keylogger compromise all that is on the device, even if the attacker is unable to physically obtain the usb token?

Explanation / Answer

Most (all?) of the cards require a PIN and are designed to lock themselves after multiple failed attempts, so physical access to a card is pretty much useless without knowing the PIN as the cards are designed to be tamper-proof. So far I haven't heard of any way to extract the secrets using a hardware-attack in a real world scenario.

A keylogger on a machine will indeed capture the PIN if you're entering it into an application on the computer. That can be mitigated by using a reader with a hardware keypad and entering the PIN on that keypad. That way the PIN never reaches the computer and even a compromised machine won't be able to capture it. All credit card terminals you use when paying are, at the very least a reader like this one (but often are full-featured computers that handle the entire transaction themselves) so the POS system never gets your PIN.

A keylogger will never be able to compromise the card's secrets, as the cards are specifically designed to never reveal them, it will however compromise the PIN and any data you encrypt/decrypt with that card or token.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.