Re: Smart Card

Hello Michael,

Michael Silk wrote:
>   A bank I am working with provides a Smart Card which is used on our
> clients PC to authorise him to the bank website ... the card stores a
> certificate, and also, i think, a private key.

Today Smart Cards store the certificate and the private key.
And cryptographic operations are done on the Smart Card

If the private key ever leaves the Smart Card (exception: key backup),
the security model of your environment is broken.

>   I am trying to discover if, in the case my clients machine is compromised
> (the machine the Smart Card is connected to), what are the possibilities
> of observing the smart card data as it is transferred ?

If the PIN for the Smart Card is entered in the computer and transfered
to the Smart Card, an program can sniff it.
If the PIN is entered in an seperate PIN pad on the card reader
or the Smart Card reader is a part of your keyboard, it is not possible
to sniff the PIN.

An programm with access to the memory of the application may
read (and insert) data in your connection to the bank server.

Additionally such a program may sign (or decrypt) data with your
key on the Smart Card without the user giving authority to do this.
(but this may be impossible, depending on the card profile)

Bye

Goetz

-- 
Goetz Babin-Ebell, software designer,
TC TrustCenter AG, Sonninstr. 24-28, 20097 Hamburg, Germany
Office: +49-(0)40 80 80 26 -0,  Fax: +49-(0)40 80 80 26 -126
www.trustcenter.de www.betrusted.com