Edinburgh Research Explorer

Getting to know your Card: Reverse-Engineering the Smart-Card Application Protocol Data Unit

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Related Edinburgh Organisations

Access status

Open

Documents

http://dl.acm.org/citation.cfm?doid=2818000.2818020
Original languageEnglish
Title of host publicationACSAC 2015 Proceedings of the 31st Annual Computer Security Applications Conference
Place of PublicationNew York
PublisherACM
Pages441-450
Number of pages10
ISBN (Electronic)978-1-4503-3682-6
DOIs
StatePublished - 5 Dec 2015

Abstract

Smart-cards are considered to be one of the most secure, tamper-resistant, and trusted devices for implementing confidential operations, such as authentication, key management, encryption and decryption for financial, communication, security and data management purposes. The commonly used RSA PKCS#11 standard defines the Application Programming Interface for cryptographic devices such as smart-cards. Though there has been work on formally verifying the correctness of the implementation of PKCS#11 in the API level, little attention has been paid to the low-level cryptographic protocols that implement it.

We present REPROVE, the first automated system that reverse-engineers the low-level communication between a smart-card and a reader, deduces the card's functionality and translates PKCS#11 cryptographic functions into communication steps. REPROVE analyzes both standard-conforming and proprietary implementations, and does not require access to the card. To the best of our knowledge, REPROVE is the first system to address proprietary implementations and the only system that maps cryptographic functions to communication steps and on-card operations. We have evaluated REPROVE on five commercially available smart-cards and we show how essential functions to gain access to the card's private objects and perform cryptographic functions can be compromised through reverse-engineering traces of the low-level communication.

Research areas

  • Computer security, smart cards, reverse engineering

Download statistics

No data available

ID: 23591991