bugtraq - Re: Smart Card

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 01 May 2004 03:56:35 +1200
From: pgut001@...auckland.ac.nz (Peter Gutmann)
To: bugtraq@...urityfocus.com, secprog@...urityfocus.com,
	silkm@...hmail.com
Subject: Re: Smart Card

"Michael Silk" <silkm@...hmail.com> writes:

>I think that if the smart card reader (scr) and the client program (cp)
>establish a ssl-type connection then the only opportunity to observe the
>private key, certificate, is by inspecting the memory of cp. However I don't
>believe that this (or any?) smart cards to this ...

I'm not aware of any readers that establish SSL connections (they wouldn't be
much use if they did, because the PC wouldn't be able to take advantage of the
SSL channel).  It's the host PC that does this, and once the host PC is
compromised you're toast, smart card or none.

Peter.