Questions tagged [smartcard]

A smartcard is a card with an embedded chip that may store cryptographic keys and/or perform cryptographic functions. Smartcards are often use as employee ID badges or in contactless credit/debit cards.

Smartcards used for cryptographic functions such as identity verification, signing, and decryption are usually designed so that the cards can generate their own cryptographic public/private key pairs, such that the private key cannot be removed or exported from the card. Using a smartcard to decrypt or sign a piece of data is usually protected by a PIN or passcode.

If you receive a message, whose signature can be validated using the public key, then you know that the message could only have been signed using the private key stored on the smartcard, which means that the message came from someone having physical possession of the smartcard and who knows the PIN or passcode required to use the smartcard. Having the decryption key on the card directly enforces, that without card and PIN knowledge just the encrypted message is available.

SIM cards used in mobile phones are also smart cards, proving an existing account towards network and storing phone numbers and text messages.

EMV cards (also known as "chip and pin") use smartcards to increase security and decrease fraud. The EMV standard, and its test cases, are governed by EMVCo.

Smartcards have a dedicated standard: ISO/IEC 7816 that describes what defines a smartcard from physical characteristics to cryptographic information application, including protocols and commands.

Contactless smart card (such as PayPass and payWave etc) are covered by ISO/IEC 14443; that describe the physical characteristics of the card, power and signal interfaces, transmission and collision detection, and transmission protocols.

EMV cards are also issued with "dual" interfaces that use the same chip on the card and two external interfaces.

1917 questions
4
votes
1 answer

How to use OpenSC to decrypt a message with a private key from a smartcard

We've recently updated to OpenSC 0.15.0 and for some reason we can no longer use it to decrypt a message with the private key from a smartcard. Apparently the same happens whether we use the pkcs11-tool (providaded with OpenSC) and the OpenSSL…
4
votes
1 answer

Where is smart card authentication done for Java Web apps?

I am rather stumped by trying to identify where CAC/Active Directory(AD) authentication comes into play for Java based web applications. Take for example multiple J2E JSF applications hosted on multiple Weblogic containers. Each of those…
angryip
  • 2,140
  • 5
  • 33
  • 67
4
votes
4 answers

What is the purpose of Application Transaction Counter stored in EMV chip for ARQC generation?

In the EMV book 2: security and key management on page 151, it is stated that "The counter results in uniqueness to the cryptograms (ARQC) and provides tracking values for the host verification services, allowing replayed transactions and cloned…
user1887464
  • 533
  • 2
  • 6
  • 11
4
votes
1 answer

GET PROCESSING OPTIONS Response

I am trying to understand how to create a CDOL1 for a smart card, and the applet developer has been less than helpful. When I send a GET PROCESSING OPTIONS command to the card, I get this response: 80 0E 7D 00 40 01 01 00 48 01 03 01 50 01 03 00 90…
iMan Biglari
  • 4,674
  • 1
  • 38
  • 83
4
votes
1 answer

Converting a hex string of a raw image to a bitmap image in JavaScript

Introduction: I am reading image data of fingerprints from smart card and as you know this data save as raw image in smart card. I am developing a client side program which only use java script to read image from scanner of a card reader and show…
Hosein Aqajani
  • 1,553
  • 4
  • 26
  • 46
4
votes
2 answers

What's the difference between CAC cards and a 'generic' smart card?

We're trying to enable our rich client C++ Windows application to utilise DoD CAC cards. We're using a third party library to secure our client/server communication using SSL, and it recognises/handles generic smart cards, but only if the…
Seb Rose
  • 3,628
  • 18
  • 29
4
votes
2 answers

Process method does not receive full APDU command from host?

The host sends the following command to applet to select EF file 00 A4 02 00 02 40 01 The purpose is to select EF file with ID 40 01 (which is specified in the data field of the command). But when I debug the process(APDU apdu) method, the APDU…
neo
  • 618
  • 1
  • 10
  • 29
4
votes
1 answer

How to disable Winscard Discovery in Windows 10?

I'm testing smart cards using ACR122U. However, when I put a card on it, Windows will automatically send APDU commands to it. According to the question windows 8 disable smartcard plug and play, I disabled Smart Card Plug And Play. But I can still…
DANG Fan
  • 854
  • 11
  • 21
4
votes
1 answer

Installing applet (Java Card) on J3A081

I've just created a very simple applet. It's a "hello world" in Java card technology. I pasted a code below. public class helloworld extends Applet { private byte[] echoBytes; private static final short LENGTH_ECHO_BYTES = 256; /** …
Krystian
  • 405
  • 2
  • 4
  • 14
4
votes
6 answers

Data structure of EMV cards

Can anyone tell me what is the data structure of EMV cards? In case of magnetic stripe cards track data is used, which contains PAN, User details, Expiry date, CVV, etc. What do we read when EMV card is inserted into the card reader? I went through…
Shashank B Rai
  • 105
  • 1
  • 8
4
votes
1 answer

Java Card: domain parameters for key agreement?

With the class javacard.security.KeyAgreement (Java Card 3.0.1 classic) it is possible to make an EC-DH key agreement. But there's no specific curve defined. As i understood, the standard IEEE P1363 does not specify domain parameters. So what curve…
P. Sherman
  • 135
  • 1
  • 7
4
votes
2 answers

How To Detect Smart Card Reader Interface Characteristic

I am using winscard.dll within my Dotnet smart card application. My reader, an Omnikey 5321 has both a contact and a contactless interface, which are detected as two different readers. The contactless has the letters "CL" within it's name. I have no…
4
votes
1 answer

Catching memory exception during recursive programming in Java Card

Although recursive programming style isn't recommended in Java Card, I want to make a little test on the Fibonacci algorithm. I wrote a function that compute the Fibonacci's suite for big integers (represented by byte arrays). My code is the…
Raoul722
  • 1,222
  • 13
  • 30
4
votes
0 answers

MULTOS Application Programming Interface

I am working on smart cards and especially Java Card. I encountered a lot of difficulties to developp my own cryptographic algorithm due to the restricted API: no access to the crypto-processor to compute an addition of points on EC or a modular…
Raoul722
  • 1,222
  • 13
  • 30
4
votes
0 answers

Device detect SIM vs USIM

I have a Nokia 301 connected to APDU snoop device. I have 2 SIM cards one older 2G (SIM) card and a newer 3G (USIM). My understanding is that the CLA (of the APDU) would be A0 in the SIM case and 00/80 in the USIM case. I would like to know how the…
QuickPrototype
  • 833
  • 7
  • 18