Re: Smart Card
[email protected] (Peter Gutmann)
| Newsgroups | gmane.comp.security.programming,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <E1BJaNP-0000PH-Vz@medusa01> |
"Michael Silk" <[email protected]> writes: >I think that if the smart card reader (scr) and the client program (cp) >establish a ssl-type connection then the only opportunity to observe the >private key, certificate, is by inspecting the memory of cp. However I don't >believe that this (or any?) smart cards to this ... I'm not aware of any readers that establish SSL connections (they wouldn't be much use if they did, because the PC wouldn't be able to take advantage of the SSL channel). It's the host PC that does this, and once the host PC is compromised you're toast, smart card or none. Peter.