Wolfgang Rankl

Overview about attacks on smart cards

Abstract When compared with data carriers such as cards with magnetic stripes or diskettes, the potential for protecting and securing data is one of the main advantages of cards with electronic chips (smart cards). Consequently, the chip hardware must be designed in an optimum fashion to meet this purpose; this includes the corresponding cryptographic procedures for securing the secret data. However, security is not only dependent on the specialised hardware of the microcontroller or on the cryptographic algorithms implemented in the operating system software. The security of applications for smart cards and the design principles applied by the developers to meet these security needs are of fundamental importance. The essential property of a smart card is its ability to offer a secure environment for data and programs. This article examines the range of possible attacks against smart cards, and the measures that can be used to protect against these attacks.

How to defend against smartcard attacks - Or the amazing number of different ways to check a PIN securely

Since their invention in the 1980s, smartcards have become an universal medium for the secure storage of data and secure execution of programs. The first part of the article describes the different security elements of a smartcard system. This is completed by an explanation of the different types of smart card attacks (invasive, semi invasive, non invasive) and the corresponding mechanisms for protecting the secrets of smart cards. The second part shows on the basis of the forgoing explanations the evolution of attacks and corresponding protection mechanisms against the PIN compare function over the last twenty years.