On Wed, 23 Nov 2005 09:41:46 +0100, khaalel said:
(Others have provided pointers to info on smart cards, so I'm going to make
some comments about the difference between "using a smart card" and "actual
security"...)
The goal is to write the programs and all the associated stuff... in order
to create a DRM-like system: when an user enter his card, a software check
his key (or certificate or...) and if the authentication succeed, the
wanted file (document, video, audio...) is open by the software...
The tough part here is figuring out how to have the software open the file,
but ensure that the contents are in fact inaccessible without the smart card.
In particular, securely handling the data after opening to ensure that the
data can't be saved in an unencrypted form is fiendishly difficult, as every
single DRM scheme to date has demonstrated....
have to learn? Which type of smart cards I have to buy? Which algorithms I
can use (DES, RSA, Elliptic Curves, AES...)??
With the exception of single-DES, which is known to be weak for today's
hardware (triple-DES still has quite some lifetime, at least for
not-too-sensitive data - it's fine for securing a track on a music CD, but
maybe not for a nuclear missle launch code), the algorithm used really doesn't
matter. There's only 3 basic things you actually need to get right:
1) Choosing symmetric or public-key.
2) Choosing a key/data length large enough to make a brute force attack not
worth it (again, this depends on the value of the data being secured).
3) Key management - more actual implementations manage to get this wrong than
do the actual crypto wrong. You can do the crypto in a totally secure manner,
but
it's still total security manure suitable for fertilizing the flower garden if
a keystroke logger can easily sniff the passphrase....
All the rest is details and engineering choices (speed versus power consumption,
and so on)....
pgpZNBkhWHQ2b.pgp
Description: PGP signature
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
