The traditional magnetic stripe card has become
a necessity for every day life. We use them to get money
from the bank, when shopping, getting fuel, and even identification.
The magnetic stripe works by encoding an identification on a
magnetic tape similar to how a computer writes information onto a
floppy disk. This method, though powerful, has proved to be
insecure in many instances. These cards use a one way
authentication method. The card passes it's information to the
reader and the reader verifies that the information exists on the
reader side. Magnetic cards are easy to reproduce and many use no
form of encryption on their identifier. Cards without PIN numbers
can be used by anyone. Credit card numbers can be passed out over
the phone making purchasing power easy to fraudulate.
MUSCLE - Movement for the Use of Smart Cards in a Linux
Environment. MUSCLE
is a project to coordinate the development of smart cards
and applications under Linux. The purpose is to develop a set of compliant
drivers, API's, and a resource manager for various smart cards and readers
for the GNU environment. Source code is now distributed by this site that
supports the Schlumbeger Reflex 60 line of reader and all ISO-7816-4
compliant smart cards. I would like to see a Linux resource manager for
smart cards and other cryptographic tokens such as Ibuttons or SecureId.
A good standpoint for this is the PC/SC specifications written for
Microsoft OS. I try not to conform to Microsoft but it is VERY
important that security tokens work in conjunction with other OS's.
If you would like to contribute efforts to MUSCLE please contact
corcordt@cs.purdue.edu
The Smart Card is different. By using multi directional interaction
between the card and the reader true authentication of identity can
be met in a more powerful way that is much more secure than the
traditional magnetic stripe card. The card holders identity is held
on the card via a secret key. Unlike magnetic cards this identifier
cannot leave the card so their is never an issue of someone
'sniffing' someone else's identifier.
|
The smart card achieves this
because the card has a small yet powerful computer built into it.
This computer allows the card to interact with the card reader, not
just pass information to it. Just as their are many different uses
for a smart card there are many different flavors of smart cards not
to be confused with optical memory cards. Historically smart cards
have been used as 'purse cards' or stored value cards. These cards
have little functionality and perform very small tasks such as increasing
or decreasing the purse on the card. Some cards such as the
Schlumberger Cryptoflex perform cryptographic functions such as
key and certificate verification, encryption, random number generation,
etc. Others such as the Schlumberger Multiflex cards perform more general
functionality. One of the Multiflex cards, the Cyberflex runs Java binaries on the card making it easier to write high-level programs for the smart card. Most smart cards have little program storage on the card, roughly 3 - 8K. The 100 mm. CPU containe
d on a smart card has roughly the same capability as the 1970's Radio Shack TRS-80 Model 1 Personal Computer. Although the TRS-80 did not run Java binaries or have built in cryptographic functionality, it did operate at roughly the same speed as many mo
dern smart cards.
The smart card is currently used mostly in Europe where it is used as a
pay phone calling card or for vending machines, even ATM's. The United States is beginning to see smart cards in use for GSM phones, laundry, and vending applications. Although the uses for smart cards are numerous, there is still the
cost issue. Magnetic stripe cards cost as little as 6 - 8 cents to make whereas a smart card can cost up to 10 to 15 times that cost. This makes it hard for
companies like credit card companies to send you one of those "pre-approved credit cards" so you can just throw it away. The uses are seeming to outweigh this factor though and smart cards will quickly appear into our every day lives in
the next few years.
|