Douglas E. Engert wrote:
Shawn Willden wrote:
On Friday 21 September 2007 09:11:14 am Douglas E. Engert wrote:
What are the security implications to doing this?
In this particular case, I don't care. Both machines are to be
deployed in a secure environment.
In general, though, I think it also doesn't matter that much. Any
reasonable
secure smart card API (I'm talking about the APDU-level API) must
assume that an attacker can get between the card and the reader, or
the reader and the
application.
Not the ones I have seen. The assumption is the user of the card has
physical
control over the reader, and is using the machine in front of him.
A prime example of an attack vector would be to snoop the connection
between the host system, reader and card and extract data such as
the PIN or unencrypted data being transferred over the link if using
the card as a crypto device.
I also see your point, Shawn, that it would be a cool thing to do,
and Paul in my group has that working so you (all) will be able to
see the code soon.
mike
_______________________________________________
Muscle mailing list
Muscle@lists.musclecard.com
http://lists.drizzle.com/mailman/listinfo/muscle
