Vulnerabilities of PKI based smartcards

Partha Dasgupta, Karmvir Chatha, Sandeep Gupta

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Scopus citations


PKI-enabled smartcards hold the future of personal identity management and resilience against identity theft. These cards can hold multiple certified identities (e.g. credit card accounts) and provide: Authentication, Data Integrity, Confidentiality and Non-repudiation. Since the private key of the client certificates are stored in the card, and this key cannot be extracted from the card, it provides a high degree of security even when the card is used on an untrusted workstation (or point-of-sale). This paper shows that using PKI enabled smartcards on an un-trusted workstation can allow a variety of attacks to be performed by a malicious software. These attacks range from simple PIN phishing, to more serious attacks such as signatures on unauthorized transactions, authentication of users without consent, unauthorized secure access to SSL enabled web servers as well as remote usage of the smartcard by attackers. We also show that the root cause of such problems is the lack of a secure I/O channel between the user and the card and outline steps that can be taken to ensure such a channel is available making the documented attacks not feasible. We have prototyped the proposed solution and verified that the above attacks can be thwarted.

Original languageEnglish (US)
Title of host publicationMilitary Communications Conference, MILCOM 2007
StatePublished - 2007
EventMilitary Communications Conference, MILCOM 2007 - Orlando, FL, United States
Duration: Oct 29 2007Oct 31 2007

Publication series

NameProceedings - IEEE Military Communications Conference MILCOM


OtherMilitary Communications Conference, MILCOM 2007
Country/TerritoryUnited States
CityOrlando, FL

ASJC Scopus subject areas

  • Electrical and Electronic Engineering


Dive into the research topics of 'Vulnerabilities of PKI based smartcards'. Together they form a unique fingerprint.

Cite this