Comments on: Understanding the DNIe, Part I : Device Authentication http://www.limited-entropy.com/dnie-device-auth Not so random thoughts on security featured by Eloi Sanfèlix Mon, 30 Aug 2010 09:13:50 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: Understanding the DNIe, Part III: Hashing and signing « Limited Entropy Dot Com http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-14131 Understanding the DNIe, Part III: Hashing and signing « Limited Entropy Dot Com Tue, 27 Apr 2010 16:46:02 +0000 http://www.limited-entropy.com/?p=556#comment-14131 [...] I come with yet another post about the DNIe. In the previous posts, we have seen how the device authentication procedure works and how to use the resulting keys to perform secure messaging. Now it's time to see [...] [...] I come with yet another post about the DNIe. In the previous posts, we have seen how the device authentication procedure works and how to use the resulting keys to perform secure messaging. Now it's time to see [...]

]]> By: Understanding the DNIe, Part II : Secure Messaging « Limited Entropy Dot Com http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-13650 Understanding the DNIe, Part II : Secure Messaging « Limited Entropy Dot Com Mon, 12 Apr 2010 00:56:48 +0000 http://www.limited-entropy.com/?p=556#comment-13650 [...] go a little further in our way to understand the way the DNIe works. In my previous post I talked about the device authentication procedure and today I'll talk about what happens next, how [...] [...] go a little further in our way to understand the way the DNIe works. In my previous post I talked about the device authentication procedure and today I'll talk about what happens next, how [...]

]]> By: Felipe http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-13202 Felipe Sun, 21 Mar 2010 11:23:03 +0000 http://www.limited-entropy.com/?p=556#comment-13202 Thanks for the article. I'm trying to use DNIe for starting session (Gnome, KDE, ssh, ...) Any suggestion about how to do it? I've found some documentation, but up to now, it has no worked. I use opensuse 11.2 and Kubuntu 9.04. Thanks Thanks for the article.

I’m trying to use DNIe for starting session (Gnome, KDE, ssh, …)
Any suggestion about how to do it? I’ve found some documentation, but up to now, it has no worked.
I use opensuse 11.2 and Kubuntu 9.04.

Thanks

]]> By: Login with SmartCard - openSUSE Forums http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-13192 Login with SmartCard - openSUSE Forums Sat, 20 Mar 2010 23:14:13 +0000 http://www.limited-entropy.com/?p=556#comment-13192 [...] [...] [...] [...]

]]> By: KaR]V[aN http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-12765 KaR]V[aN Sun, 07 Mar 2010 22:38:46 +0000 http://www.limited-entropy.com/?p=556#comment-12765 Seems to be pretty secure... I think. Great article, can't wait for next one. Seems to be pretty secure… I think.

Great article, can’t wait for next one.

]]> By: vierito5 http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-12704 vierito5 Sat, 06 Mar 2010 00:35:25 +0000 http://www.limited-entropy.com/?p=556#comment-12704 Great post! I can't wait for further posts about DNIe and its implementation. I hope this comment it's not caught again by Akismet's jaws Great post! I can’t wait for further posts about DNIe and its implementation.

I hope this comment it’s not caught again by Akismet’s jaws

]]> By: Eloi Sanfèlix http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-12655 Eloi Sanfèlix Thu, 04 Mar 2010 18:24:39 +0000 http://www.limited-entropy.com/?p=556#comment-12655 @Alvaro yes, that's right. The IFD has its own 1024 bit RSA key pair, with a card verifiable certificate signed by the CA of the DNIe. AFAICT both linux and OS X versions of the drivers use the same certificate, which leads me to believe that ALL computers will use the same public/private key pair. So it's not very useful as an authentication mechanism actually...and I initially thought it would not be useful for protecting the privacy and integrity of the secure channel but now I think it actually is unless you hook the RNG of the driver and are able to discover the 32 byte random number the IFD picks. I'd have to look more into it, but my current feeling is that eavesdropping a communication requires both knowing the private key and the random number sent by the IFD, while establishing a secure channel of your own only requires knowing the private key :roll:. And yes, the IFD is the computer in this case... it's what the card sees "on the other end", the logical entity that talks to the card using the iso7816 and the CWA 14980 protocols. Hence, it's the combination of reader+computer, since the reader implements the lower layers of the iso7816 stack (physical layer and link layer [T=0, T=1...] ) and the computer implements the upper layers. @Alvaro yes, that’s right. The IFD has its own 1024 bit RSA key pair, with a card verifiable certificate signed by the CA of the DNIe.

AFAICT both linux and OS X versions of the drivers use the same certificate, which leads me to believe that ALL computers will use the same public/private key pair.

So it’s not very useful as an authentication mechanism actually…and I initially thought it would not be useful for protecting the privacy and integrity of the secure channel but now I think it actually is unless you hook the RNG of the driver and are able to discover the 32 byte random number the IFD picks.

I’d have to look more into it, but my current feeling is that eavesdropping a communication requires both knowing the private key and the random number sent by the IFD, while establishing a secure channel of your own only requires knowing the private key :roll: .

And yes, the IFD is the computer in this case… it’s what the card sees “on the other end”, the logical entity that talks to the card using the iso7816 and the CWA 14980 protocols.

Hence, it’s the combination of reader+computer, since the reader implements the lower layers of the iso7816 stack (physical layer and link layer [T=0, T=1...] ) and the computer implements the upper layers.

]]> By: Alvaro http://www.limited-entropy.com/dnie-device-auth/comment-page-1#comment-12580 Alvaro Tue, 02 Mar 2010 09:47:36 +0000 http://www.limited-entropy.com/?p=556#comment-12580 So, if I understood it right: the IFD has his own public key? And, another doubt: the IFD is the computer trying to access the card, or is it the reader device? So, if I understood it right: the IFD has his own public key?

And, another doubt: the IFD is the computer trying to access the card, or is it the reader device?

]]>