Smart card reader (was: Re: [Gllug] natwest fantasticness)

[John Winters]

On Tue, 2004-04-06 at 15:34, Richard Jones wrote:
[snip]
> Isn't there a challenge & response involved somehow?  I thought that
> was the point of the chips - otherwise there's no additional security
> over just having a magstripe.

Yes, this is the essential point about smart cards - they're smart.

With a mag stripe you have something entirely passive.  It has some data
on it and given a reader you can read that data.

With a smart card, you have a chip with processing capacity on the
card.  The reader provides power for the chip but the one thing the
reader can't do is simply read the memory of the card.  Instead the
reader can communicate with the card and the card can choose to reveal
information.

Thus you can have the PIN stored on a smart card and the reader can say
to the card, "Is this the right PIN?", with the card replying "Yes",
"No", or even, "You've had 5 guesses in the last 3 minutes - you're not
allowed any more for a while".

John

-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug