Re: SmartCards programming...

[Valdis.Kletnieks () vt edu]

On Wed, 23 Nov 2005 09:41:46 +0100, khaalel said:

(Others have provided pointers to info on smart cards, so I'm going to make
some comments about the difference between "using a smart card" and "actual
security"...)

> The goal is to write the programs and all the associated stuff... in order
> to create a  DRM-like system: when an user enter his card, a software check
> his key (or certificate or...) and if  the authentication succeed, the
> wanted file (document, video, audio...) is open by the software...

The tough part here is figuring out how to have the software open the file,
but ensure that the contents are in fact inaccessible without the smart card.
In particular, securely handling the data after opening to ensure that the
data can't be saved in an unencrypted form is fiendishly difficult, as every
single DRM scheme to date has demonstrated....

> have to learn? Which type of smart cards I have to buy? Which algorithms I
> can use (DES, RSA, Elliptic Curves, AES...)??

With the exception of single-DES, which is known to be weak for today's
hardware (triple-DES still has quite some lifetime, at least for
not-too-sensitive data - it's fine for securing a track on a music CD, but
maybe not for a nuclear missle launch code), the algorithm used really doesn't
matter.  There's only 3 basic things you actually need to get right:

1) Choosing symmetric or public-key.

2) Choosing a key/data length large enough to make a brute force attack not
worth it (again, this depends on the value of the data being secured).

3) Key management - more actual implementations manage to get this wrong than
do the actual crypto wrong.  You can do the crypto in a totally secure manner, but
it's still total security manure suitable for fertilizing the flower garden if
a keystroke logger can easily sniff the passphrase....

All the rest is details and engineering choices (speed versus power consumption,
and so on)....

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/