CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.2  Media            9  3.2.4  Removable Media

3.2.4.5  Flashcards 1 2 3 3.3  Security Topologies

Smartcard Programming and Encryption

Most smartcards support at least one standard encryption algorithm, since without encryption, anyone who can read the card, can retrieve the data off it. Encryption algorithms that may be available on smartcards include DES, 3DES, Diffie-Hellman, MD5, SHA-1, the NIST-approved DSA, Rinjdael, KEA, RSA, and ECDSA. (Some of these are discussed in more detail in section 4 of this book.)

It has been said that “the nice thing about standards is that there are so many to choose from,” and in the case of smartcards, that’s definitely true. There are at least 25 standards a smartcard can choose to comply with, including ISO/IEC, FIPS, ANSI, X.509 (certificate) and EMV standards, which define physical, electronic, algorithmic and formatting standards.

Important from a security standpoint would be the FIPS-140, Level 3 standards level, an NIST security requirement for cryptographic modules.

A de-facto standard for programmable cards that is gaining in popularity is that of Java support, with other options being Visual Basic or MULTOS. Most new smartcard applications are written in java, so using a Java-based smart card will allow you the greatest choice of applications, as well as comply with the GlobalPlatforms.org standards. Federal Government users choosing a Java-programmable smartcard should make sure that the one they select is FIPS certified, such as Schlumberger’s Java smartcard.

The software running on the card itself is not the only area of compatibility to consider when selecting a smartcard. You should also make sure that the smartcard reader and smart card lifecycle management software you choose works with the operating systems and OS versions on which you plan to use them.

If you are interested in implementing smartcards in your organization, check out the current offerings from ActivCard³²¹, Datakey³²², GemPlus³²³, Oberthur³²⁴ and Schlumberger³²⁵. A great resource to start with is Smart Cards From Scratch³²⁶.

3.2.4.5  Flashcards 1 2 3 3.3  Security Topologies