Vulnerabilities of PKI based smartcards

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Citations (Scopus)

Abstract

PKI-enabled smartcards hold the future of personal identity management and resilience against identity theft. These cards can hold multiple certified identities (e.g. credit card accounts) and provide: Authentication, Data Integrity, Confidentiality and Non-repudiation. Since the private key of the client certificates are stored in the card, and this key cannot be extracted from the card, it provides a high degree of security even when the card is used on an untrusted workstation (or point-of-sale). This paper shows that using PKI enabled smartcards on an un-trusted workstation can allow a variety of attacks to be performed by a malicious software. These attacks range from simple PIN phishing, to more serious attacks such as signatures on unauthorized transactions, authentication of users without consent, unauthorized secure access to SSL enabled web servers as well as remote usage of the smartcard by attackers. We also show that the root cause of such problems is the lack of a secure I/O channel between the user and the card and outline steps that can be taken to ensure such a channel is available making the documented attacks not feasible. We have prototyped the proposed solution and verified that the above attacks can be thwarted.

Original languageEnglish (US)
Title of host publicationProceedings - IEEE Military Communications Conference MILCOM
DOIs
StatePublished - 2007
EventMilitary Communications Conference, MILCOM 2007 - Orlando, FL, United States
Duration: Oct 29 2007Oct 31 2007

Other

OtherMilitary Communications Conference, MILCOM 2007
CountryUnited States
CityOrlando, FL
Period10/29/0710/31/07

Fingerprint

Authentication
Sales
Servers
Malware

ASJC Scopus subject areas

  • Civil and Structural Engineering
  • Electrical and Electronic Engineering

Cite this

Dasgupta, P., Chatha, K., & Gupta, S. (2007). Vulnerabilities of PKI based smartcards. In Proceedings - IEEE Military Communications Conference MILCOM [4455333] https://doi.org/10.1109/MILCOM.2007.4455333

Vulnerabilities of PKI based smartcards. / Dasgupta, Partha; Chatha, Karmvir; Gupta, Sandeep.

Proceedings - IEEE Military Communications Conference MILCOM. 2007. 4455333.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Dasgupta, P, Chatha, K & Gupta, S 2007, Vulnerabilities of PKI based smartcards. in Proceedings - IEEE Military Communications Conference MILCOM., 4455333, Military Communications Conference, MILCOM 2007, Orlando, FL, United States, 10/29/07. https://doi.org/10.1109/MILCOM.2007.4455333
Dasgupta P, Chatha K, Gupta S. Vulnerabilities of PKI based smartcards. In Proceedings - IEEE Military Communications Conference MILCOM. 2007. 4455333 https://doi.org/10.1109/MILCOM.2007.4455333
Dasgupta, Partha ; Chatha, Karmvir ; Gupta, Sandeep. / Vulnerabilities of PKI based smartcards. Proceedings - IEEE Military Communications Conference MILCOM. 2007.
@inproceedings{89beb071a30a48fea00239d0a0622ac1,
title = "Vulnerabilities of PKI based smartcards",
abstract = "PKI-enabled smartcards hold the future of personal identity management and resilience against identity theft. These cards can hold multiple certified identities (e.g. credit card accounts) and provide: Authentication, Data Integrity, Confidentiality and Non-repudiation. Since the private key of the client certificates are stored in the card, and this key cannot be extracted from the card, it provides a high degree of security even when the card is used on an untrusted workstation (or point-of-sale). This paper shows that using PKI enabled smartcards on an un-trusted workstation can allow a variety of attacks to be performed by a malicious software. These attacks range from simple PIN phishing, to more serious attacks such as signatures on unauthorized transactions, authentication of users without consent, unauthorized secure access to SSL enabled web servers as well as remote usage of the smartcard by attackers. We also show that the root cause of such problems is the lack of a secure I/O channel between the user and the card and outline steps that can be taken to ensure such a channel is available making the documented attacks not feasible. We have prototyped the proposed solution and verified that the above attacks can be thwarted.",
author = "Partha Dasgupta and Karmvir Chatha and Sandeep Gupta",
year = "2007",
doi = "10.1109/MILCOM.2007.4455333",
language = "English (US)",
isbn = "1424415136",
booktitle = "Proceedings - IEEE Military Communications Conference MILCOM",

}

TY - GEN

T1 - Vulnerabilities of PKI based smartcards

AU - Dasgupta, Partha

AU - Chatha, Karmvir

AU - Gupta, Sandeep

PY - 2007

Y1 - 2007

N2 - PKI-enabled smartcards hold the future of personal identity management and resilience against identity theft. These cards can hold multiple certified identities (e.g. credit card accounts) and provide: Authentication, Data Integrity, Confidentiality and Non-repudiation. Since the private key of the client certificates are stored in the card, and this key cannot be extracted from the card, it provides a high degree of security even when the card is used on an untrusted workstation (or point-of-sale). This paper shows that using PKI enabled smartcards on an un-trusted workstation can allow a variety of attacks to be performed by a malicious software. These attacks range from simple PIN phishing, to more serious attacks such as signatures on unauthorized transactions, authentication of users without consent, unauthorized secure access to SSL enabled web servers as well as remote usage of the smartcard by attackers. We also show that the root cause of such problems is the lack of a secure I/O channel between the user and the card and outline steps that can be taken to ensure such a channel is available making the documented attacks not feasible. We have prototyped the proposed solution and verified that the above attacks can be thwarted.

AB - PKI-enabled smartcards hold the future of personal identity management and resilience against identity theft. These cards can hold multiple certified identities (e.g. credit card accounts) and provide: Authentication, Data Integrity, Confidentiality and Non-repudiation. Since the private key of the client certificates are stored in the card, and this key cannot be extracted from the card, it provides a high degree of security even when the card is used on an untrusted workstation (or point-of-sale). This paper shows that using PKI enabled smartcards on an un-trusted workstation can allow a variety of attacks to be performed by a malicious software. These attacks range from simple PIN phishing, to more serious attacks such as signatures on unauthorized transactions, authentication of users without consent, unauthorized secure access to SSL enabled web servers as well as remote usage of the smartcard by attackers. We also show that the root cause of such problems is the lack of a secure I/O channel between the user and the card and outline steps that can be taken to ensure such a channel is available making the documented attacks not feasible. We have prototyped the proposed solution and verified that the above attacks can be thwarted.

UR - http://www.scopus.com/inward/record.url?scp=47949097544&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=47949097544&partnerID=8YFLogxK

U2 - 10.1109/MILCOM.2007.4455333

DO - 10.1109/MILCOM.2007.4455333

M3 - Conference contribution

AN - SCOPUS:47949097544

SN - 1424415136

SN - 9781424415137

BT - Proceedings - IEEE Military Communications Conference MILCOM

ER -