Smart card Authentification

From: Rony (joe_the_black_at_yahoo-dot-com.no-spam.invalid)
Date: 08/10/04 

Date: 9 Aug 2004 23:45:20 -0500

Hi,

  I'm curios about how a smart card and a smart card reader,
comunicate in a secure way.

  I'm thinking that they use public key cryptography to exhange the
simmetrical keys. (For example the use, RSA to exchange the DES
keys.)

  For example, the credit cards, have as authority some central point,
like visa, that an terminal (ATM) can connect to, and retrieve the
public key of VISA.

   I will describe you, the way that I think this is happening.

  First the public key of an issuer bank is signed with the private
key of VISA. After this the smart card's own public key is signed by
the private key.

   First , the reader(ATM) requests, the card's issuer public key(that
was previously signed by VISA), and the card, sends this key to the
reader, the reader then verifys the card's issuer public key, that it
has received, using the VISA public key(that he can aquire securely).

   After this, the reader, requests the card's own public key (that
was signed with the issuer's private key), and the reader, verifys,
the publik key of the smart card.
  
   After this , the reader, knows that he can use the public key of
the smart card to encrypt data and send them to the card.

  Now the reader can generate a random number to the card, and encrypt
it, using the public key of the smart card, that he now has, and send
it to the smart card. The smart card can decrypt it, and send the
random number back to the reader, in this way the reader trusting the
smart card , that the smart card poseses the smart card's own private
key associated with the previously verified smart card's own public
key.

   The reverse, the authentification of the reader to the smart card
should happen similarly, this meaning that the smart card, must poses
allready the VISA public key.

  After this authentification, all the messages sent from the reader
to the smart card should be encrypted using the smart card's public
key, and the messages sent from the smartcard to the reader should be
encrypted using the reader's public key. They should do this way to
exchange the simmetric keys.

   In my opinion, using this way of authentification that I can think
of, this might take some time, and maybe I'm wrong, or maybe it takes
less time.

   Please tell me, were I'm wrong.

  I used the example of the credit cards, to be more simple, as VISA,
can be associated with a central authority.

  Thank you.

Relevant Pages

  • Re: Smart card Authentification
    ... > I'm curios about how a smart card and a smart card reader, ... > I'm thinking that they use public key cryptography to exhange the ... > like visa, that an terminal can connect to, and retrieve the ...
    (sci.crypt)
  • Re: Smart Cards?
    ... A smart card uses PKI for authentication and the users smart ... require smart card for logon then there is no way for someone else to logon ... A private key can decrypt what a public key encrypts and can be ...
    (microsoft.public.security)
  • Re: Implementation of CardSignData() in smart card modules (minidrivers)
    ... You should not always add the DigestInfo DER into signature in step 3. ... I'm trying to write a smart card minidriver interfacing the Base CSP ... Performing AT_SIGNATURE public key matching test... ... Provider = Microsoft Base Smart Card Crypto Provider ...
    (microsoft.public.platformsdk.security)
  • Implementation of CardSignData() in smart card modules (minidrivers)
    ... I'm trying to write a smart card minidriver interfacing the Base CSP ... Performing AT_SIGNATURE public key matching test... ... Provider = Microsoft Base Smart Card Crypto Provider ...
    (microsoft.public.platformsdk.security)
  • Re: Smartcard Security - Suggested Hardware
    ... They sell readers, card emulators and inline sniffers to see the data being passed between a smart card and a reader. ... They make quality hardware I've used on a couple of assessments, they also make a great magstripe analysis tool. ... The Smartcard Explores Set is a good starting point. ...
    (Pen-Test)