United Access GmbH

Although some implementations offer proprietary methods to get e.g. CPLC data, it is not available in the install method (see also this link) and not part of the JavaCard specification. Why is this essential feature missing?

UHF Labels with Computing Capacity

unitedaccess — Thu, 10 Nov 2011 11:51:42 +0000

It can be observed that new developments are under progress embedding cryptographic computing power into passive RFID UHF chips (e.g. https://www-eng.llnl.gov/sens_img_comm/sens_img_comm_rfid.html). So far passive UHF labels were only used to transmit the id and at maximum store some bytes. Now new prototypes are under development offering true cryptographic challenge – response authentication. Although right now the distance for the strong authentication is limited this is an interesting step into the right direction….

Legic prime and PC/SC

unitedaccess — Sun, 06 Nov 2011 11:21:10 +0000

Why is there no reader available on the market reading Legic prime MIM 256 or MIM 1024 serial numbers and provide them via PC/SC interface? Some (quite expensive) USB and serial readers with proprietary interface do exist – but none of them offers a PC/SC compliant Windows driver (signed or unisgned) to issue a “Get UID command” via standard smartcard software (FF CA 00 00 00).

NDA vs. Kerckhoff

unitedaccess — Sun, 06 Nov 2011 11:04:42 +0000

It is ridiculous to make an NDA for basic functionality of a product like it is done for most of smartcard operating system interface specifications!

The security of a smart card OS must not rely on the confidentiality of an unrestricted interface to the outside world.

Nevertheless this procedure is typically requested by security evaluators. Which leaves even more doubts …

Windows Minidriver Setup for XP

unitedaccess — Sun, 06 Nov 2011 10:43:17 +0000

To upgrade a XP system to the new card module / minidriver architecture from MS:

http://support.microsoft.com/kb/909520/en-us

This will allow you to use the “Microsoft Base Smart Card Crypto Provider”

ATR List

unitedaccess — Sun, 06 Nov 2011 10:40:14 +0000

The best ATR list on the web: http://ludovic.rousseau.free.fr/softwares/pcsc-tools/smartcard_list.txt

Smartcard Security General Consideration

unitedaccess — Sun, 06 Nov 2011 09:25:47 +0000

There is nothing like security. Security is just another word for the budget of the attacker.

This general statement also applies to smart cards.

Common Criteria, ITSEC, FIPS … no guarantee to withstand a professional hacking attempt.

By the way: a security evaluation typically does not reveal bugs in the operating system!