4 ms·

Where can you get a trustworthy smartcard?

arete 13y ago
Can't comment on trustworthiness but Kernel Concepts sells a nice OpenPGP smartcard developed by Werner Koch, the GnuPG guy. http://shop.kernelconcepts.de/product_info.php?products_id=42 http://shop.kernelconcepts.de/product_info.php?products_id=4...
- rdl 13y ago
  I like those, but I really really want something which can do bt 4.0le with an existing pairing (stronger than just bluetooth 4.0 le security, though) between my host (ideally, mac/win/linux desktop/laptops, also phones) and the device, with some level of on-device logging, access control, etc. A type 2 pinpad + openpgp smartcard might be the best practical thing right now -- a PIN on the card, plus a passphrase from the host (I think you can require both?). Type 3 showing a hash of what you sign, or a serial number of number of signs, would be even better. The GPF cryptostick (usb) is also nice -- I think you could also take the Werner smartcard and cut it down to a smaller size for a USB stick sized reader. Sadly GPF stick 1.2 is out of stock everywhere.
  - arete 13y ago
    Yeah, Kernel Concepts sells the OpenPGP card in a SIM breakout style too. I really wanted the CryptoStick, looks like they're temporarily about of stock pending the new 2.0 revision, but not holding my breath.
    - rdl 13y ago
      Yeah, I guess I just don't trust smartcards all that much from a hardware security perspective, vs. modules with battery inside a metal envelope. I'm sad Maxim/DS killed the Crypto iButton line -- it was a great compromise between smartcard cost ($20-30) and HSM physical security. The software was never great, though.
  - agwa 13y ago
    > I think you could also take the Werner smartcard and cut it down to a smaller size for a USB stick sized reader Yup, personally I've stuck my OpenPGP card in a Gemplus GemPC USB Shell Token v2: http://www.cdw.com/shop/products/Gemplus-GemPC-USB-Shell-Token-v2-SMART-card-reader-USB/2089792.aspx http://www.cdw.com/shop/products/Gemplus-GemPC-USB-Shell-Tok... If you get the OpenPGP card with a SIM cut-out, assembly is a breeze. Almost as good as a GPF stick.
clarkm 13y ago
I use the YubiKey NEO: http://www.yubico.com/products/yubikey-hardware/yubikey-neo/ http://www.yubico.com/products/yubikey-hardware/yubikey-neo/ It does a lot more than just a standard smart card though. Here's a good post on how it interacts with OpenPGP: http://www.yubico.com/2012/12/yubikey-neo-openpgp/ http://www.yubico.com/2012/12/yubikey-neo-openpgp/
Create 13y ago
Beware of Feitian, SafeNet, RSA etc. G&D seems marginally better -- but ultimately, you would need to trust vendors (which you wouldn't want to). http://hal.inria.fr/docs/00/70/47/90/PDF/RR-7944.pdf http://hal.inria.fr/docs/00/70/47/90/PDF/RR-7944.pdf
- rdl 13y ago
  Yeah, I think it is prudent to be extra cautious of any black box which is security specific, from closely government connected vendors (staff, sales). A CEO would probably be sued by shareholders, or even go to jail, for refusing an extralegal polite request from their 95% customer. (Gov and gov connected banking) to back door devices going to public enemies. The solution is end user verifiable designs. Harder with hardware, but there have to be ways to do it. The risk is highest for single purpose vs general purpose devices. If safenet hsms aren't owned as fuck, I'll eat one.

arete 13y ago

Can't comment on trustworthiness but Kernel Concepts sells a nice OpenPGP smartcard developed by Werner Koch, the GnuPG guy. http://shop.kernelconcepts.de/product_info.php?products_id=42 http://shop.kernelconcepts.de/product_info.php?products_id=4...

rdl 13y ago
I like those, but I really really want something which can do bt 4.0le with an existing pairing (stronger than just bluetooth 4.0 le security, though) between my host (ideally, mac/win/linux desktop/laptops, also phones) and the device, with some level of on-device logging, access control, etc. A type 2 pinpad + openpgp smartcard might be the best practical thing right now -- a PIN on the card, plus a passphrase from the host (I think you can require both?). Type 3 showing a hash of what you sign, or a serial number of number of signs, would be even better. The GPF cryptostick (usb) is also nice -- I think you could also take the Werner smartcard and cut it down to a smaller size for a USB stick sized reader. Sadly GPF stick 1.2 is out of stock everywhere.
- arete 13y ago
  Yeah, Kernel Concepts sells the OpenPGP card in a SIM breakout style too. I really wanted the CryptoStick, looks like they're temporarily about of stock pending the new 2.0 revision, but not holding my breath.
  - rdl 13y ago
    Yeah, I guess I just don't trust smartcards all that much from a hardware security perspective, vs. modules with battery inside a metal envelope. I'm sad Maxim/DS killed the Crypto iButton line -- it was a great compromise between smartcard cost ($20-30) and HSM physical security. The software was never great, though.
- agwa 13y ago
  > I think you could also take the Werner smartcard and cut it down to a smaller size for a USB stick sized reader Yup, personally I've stuck my OpenPGP card in a Gemplus GemPC USB Shell Token v2: http://www.cdw.com/shop/products/Gemplus-GemPC-USB-Shell-Token-v2-SMART-card-reader-USB/2089792.aspx http://www.cdw.com/shop/products/Gemplus-GemPC-USB-Shell-Tok... If you get the OpenPGP card with a SIM cut-out, assembly is a breeze. Almost as good as a GPF stick.

clarkm 13y ago

I use the YubiKey NEO: http://www.yubico.com/products/yubikey-hardware/yubikey-neo/ http://www.yubico.com/products/yubikey-hardware/yubikey-neo/ It does a lot more than just a standard smart card though. Here's a good post on how it interacts with OpenPGP: http://www.yubico.com/2012/12/yubikey-neo-openpgp/ http://www.yubico.com/2012/12/yubikey-neo-openpgp/

Create 13y ago

Beware of Feitian, SafeNet, RSA etc. G&D seems marginally better -- but ultimately, you would need to trust vendors (which you wouldn't want to). http://hal.inria.fr/docs/00/70/47/90/PDF/RR-7944.pdf http://hal.inria.fr/docs/00/70/47/90/PDF/RR-7944.pdf

rdl 13y ago
Yeah, I think it is prudent to be extra cautious of any black box which is security specific, from closely government connected vendors (staff, sales). A CEO would probably be sued by shareholders, or even go to jail, for refusing an extralegal polite request from their 95% customer. (Gov and gov connected banking) to back door devices going to public enemies. The solution is end user verifiable designs. Harder with hardware, but there have to be ways to do it. The risk is highest for single purpose vs general purpose devices. If safenet hsms aren't owned as fuck, I'll eat one.