The next token we’re going to look at is smart cards. They’ve been around since the mid-1970s when a credit card was first merged with a microprocessor (we refer to the chip on a smart card as an integrated circuit chip, or ICC). Independently, the two have become enormously popular, and coupled they are becoming the runaway favorite choice for tokens. For a complete and much more detailed look at the internals of smart cards we recommend Rankl and Effing’s book the Smart Card Handbook [WOLFGANG] and Dreifus and Monk’s book Smart Cards: A Guide to Building and Managing Smart Card Applications [DRIEFUS].
There are four important standards that define a smart card:
ISO/IEC 7810. This defines the dimensions of the credit card, which are 85.60 mm by 53.98 mm and .76 mm thick. The cards can be made of plas- tic, paper, or another material, but typically the cards are made of plastic, specifically polyvinyl chloride (PVC).
152 Part IV ■ Tokens
ISO/IEC 7816 Parts 1-13 and 15. This defines just about everything else about smart cards. The various parts of the standard address properties such as
The amount of X-rays, UV light, and static electricity they must be able to withstand
How much the card can bend before it breaks
The physical location of ICC; the size of the ICC (10.25 mm by 19.23 mm); the number of ICC contacts (there are 8)
What each contact does; the electrical characteristics of the contacts A common syntax and format for cryptographic information Mechanisms by which to share this information
ISO/IEC 14443 Parts 1-4. This defines what is referred to as Proximity
Cards. This multipart standard specifies contactless smart cards: physical
dimensions as specified in ISO/IEC 7810; radiofrequency (13.56 MHz); communication protocols; transmission protocols. It allows for the card be about 10 cm away from the contactless card reader.
ISO 15693 Parts 1-3. This defines what is referred to as Vicinity Cards. This multipart standard is similar to ISO/IEC 1443 except that the card and card reader can be between 1 and 1.5 meters apart. This standard has never really taken off, but it’s included in this list for completeness.
N O T E There are other standards that apply to what goes on the physical surface of the card, such as embossed letters and magnetic strips, but we’re going to focus on the ICC interface.
There are a number of ways to categorize smart cards, but we’ll keep it simple and use just two categories: how the card is read and the type of card.
Readers. Smart cards work with two types of readers: contact or contactless. With contact card readers, the card needs to be inserted into the reader for it to be read, but with contactless cards the card does not actually need to touch the reader. It needs to be within either 10 cm or 1.5 m of the reader. There are some technical differences between the two read- ers, of course. The contact reader has more available power, whereas the contactless readers have less wear and tear, but need antennas as well as security protocols for communicating with the card and the reader. There is also one big practical difference: Contact readers are about 10 times cheaper than contactless card readers, with contact readers are cur- rently going for around $20, while contactless ones are going for around $200. Some cards now support both and are referred to as combi cards.
Turner c08.tex V3 - 03/26/2008 5:41pm Page 153
Chapter 8 ■ Tokens and Hardware Security Modules 153
Type. With all the marketing hype and brand names in the smart cards retail space it’s easy to be confused about the types of cards. Next, you’ll find a list of the card types in order of increasing security:
Memory-only. Because they have the same form factor as an ICC, some advertise this type of card as a smart card, but these are really on the lowest rung of the security ladder and shouldn’t be considered smart cards at all. In reality, these read-only memory cards are only a lit- tle better than the magnetic strips on the back of credit cards, and even then they’re only better because they can store more informa- tion than the strip alone can, not because they are more secure. Serial Protected. These cards, which are also sometimes referred to as
Segmented Memory Cards or Intelligent Memory Cards, are on the next
step up the security ladder, but they shouldn’t really be considered smart cards either. (They are sometimes grouped with the memory- only cards.) These cards offer both read and write capability. Manufac- turers often claim that these cards support ‘‘authentication,’’ but this usually refers to the card identifier that allows the card to be tracked or the fact that some of the memory can be protected with a PIN or sym- metric key. What makes them better than the memory-only cards is the built-in logic that controls access to the memory on the card, which allows some or all of the memory to be protected.
Wired Logic. One more step up the security ladder are Wired Logic cards, sometimes referred to as ROM-mask cards. The ROM-mask, which contains the chip’s OS, also contains a logic-based state machine supporting encrypted memory and authenticated access to the
memory. However, the ROM is burned in when the card is manu- factured, so once the card leaves the factory, there’s no changing the way the card works. Wired Logic cards really shouldn’t be considered smart cards either.
Secure Microcontroller. These cards are at the top of the smart card ladder, because they really are smart. What puts them above the rest is the addition of a CPU that runs programs, performs calculations, and manages data. These are really the only cards that should be referred to as ‘‘smart cards,’’ so beware of the marketing hype!