How Chips, Smart Cards and Asymmetric Encryption (PKI) Works

Reading Time: 12 minutes

Public key infrastructure (PKI), the combination of policies, hardware, and software, is very handy when it comes to authentication. It brings the highest security and can easily be incorporated into physical chips inside tokens or smart cards. In this blog post, we will explain how chips, smart cards, and keys using asymmetric encryption (PKI) work. Finally, we will explain how you can connect it all in a clever way to increase your cyber security and make the life of your users even easier than it is today.

The blog post is also available in video format on Vimeo: https://vimeo.com/598743863

Introduction to the hardware

The hardware elements in public key infrastructure (PKI) are essential – but it is easy to get lost in the terminology. There is a wide range of physical tokens, cards, and devices that support PKI – and here is a brief hands-on introduction to hardware.

There’s a lot of hardware that can go hand in hand with PKI such as tokens, cards, and even the smartphone in your pocket. For starters, tokens can come combined with USB such as the USB tokens from Feitian and Yubico. These are both FIDO2 compliant. The token from Yubico can also support X509 certificates.

Standard size smart cards, as you know from ID cards, are commonly combined with PKI elements. One example is the smart card from Thales that contains a FIDO applet as well as a PKI applet – we will explain what an applet is in a later blog post. Another type of smart card is the NXP-based card that consists of both a FIDO token, an API token, as well a Mifare token for using with door systems.

The AirID2 Mini from Certgate is yet another option. It looks like a car key, but basically it’s a wireless smartcard on your key ring that can connect via Bluetooth. And it can run also via NFC and it supports both FIDO2 as well as PKI-based certificates.

And lastly, an iPhone can also hold certificates and use the technology that is inside the phone operating system for PKI. Watch this space, the phone will become a very important item in the coming years for better cybersecurity.

So there you have the basic hardware and terms: tokens, smartcards, FIDO, applets, and the phone in your pocket. Pick carefully and securely.

Passwordless versus 2 Factor Authentication

For those familiar with Zero Trust and these technologies, you know that passwordless is a big thing. It’s heavily discussed, supported, and endorsed by many companies like Microsoft and others who believe we should go into a passwordless world.

The illustration shows the reason why. Password + a two-factor authentication method is secure, but not very convenient. Passwordless is the goal.

Most of us are familiar with authenticator apps such as Google authenticator, push apps, and other 2FA technologies. But what about going passwordless in the sense that you do not even have a username so you can login with your token? The token will be read by the system you connect it to. And to make the authentication smooth, you would just be prompted for something you know, typically a pin code, or something you are, such as a fingerprint or face ID. That’s true passwordless authentication. It’s very convenient, and of course, it’s very secure.

The challenge around passwords is real. They’re easy to get access to, to sniff and to phish, and all these bad things that go on in the cybersecurity world. They are low security, but honestly, it’s still for many people, convenient. This means that until being passwordless is truly more convenient – the dreaded password will remain among us.

The chip

Smart card chips hold more than static photos. Chips play an important role in PKI and are supported in this by an array of standards, operating systems, and technologies. The chip can be used for quite a lot in terms of different use cases and with different methods and technologies.

For a digital sign in, let’s start with the PKI certificate. That’s the place for both keys and where I generate a key. I will get to how this security works with the key pair later, but the key pair and potentially also the certificate connected to this makes a huge difference when we talk about good cyber security.

Obviously the chip can be connected to antennas. This is what you do with the NFC and in the old days, that would be also called the RFID. There’s some misconception on the technologies and some of their differences. Chips are not nessesary for utilizing PKI. PKI is used in many other ways. Combining it with a chip is just one of the things we do.

Your passport has been chipped

Of course, inside my chip, I can store a copy of my photo. You know about that from your passport – and that’s actually what is happening for those of you that have a passport with a chip inside. There will be a digital high-resolution version of the image printed in your passport also in your chip.

So the chip can also hold data, which also goes for information like name, token, dates and other relevant information. Of course, I can also use my chip for facial recognition, if that’s what I want to do. There is technology available supporting that. I can do the same with Iris and fingerprint recognition.

Digital signing is when we authenticate to a system. The chip standards are two ISO standards (ISO/IEC 7816 and ISO/IEC 14443). The first one is for physical contact. The second one is for NFC communication and this is built on this 13.56 megahertz communication.

Secure chips have their privacy standards

The operating system of a chip is a crucial thing and there are multiple options out there. In this case, I’d like to focus on the JCOP operating system from NXP. The JCOP operating system is an open platform and NXP is supporting that in their chip design.

When you look at the applet pointed out in the illustration, what is literally inside the chip itself, you would notice something very important – secure storage. If you have an iPhone, you would know that as a secure enclave. And for others, they can have different wordings for more or less the same function.

The point of secure storage is that when I use my key management tool, I can use my ciphers. I can generate a key pair and my private key will stay in the chip. There is no way that I can get that data out of my chip – it stays inside and I can only communicate with my private key via some given APIs that the chip operating system and the hardware of the chip support.

Taking a deeper dive into the chip operating system, a given chip supports a lot of functionality. Just as an example for cryptography, there is RSA (the key side), DES/TDES, SHA and two others in our sample. The reading speed for a MasterCard transaction is just 200 milliseconds. For Mifare implementation, there are many, many options. The technical options are wide and are constantly being developed.

Get familiar with applets

An applet is a program that is deployed in the card, in the chip, and in the card operating system. They work more or less like the apps that you install on a phone and they can be signed in various ways. What is important with applets is that they have some given functionality.

In this case, the illustration shows the applet details to cards used for authentication to PC and IT equipment, phones, PCs, and websites. What I have highlighted here is the applet for PKI and digital signature based on the European eIDAS standard.

There is a lot in those chips

When it comes to asymmetric encryption, chips play an important role – but it’s not a monolithic role. There are a number of variables that need to be considered. To have a secure tool, it is quite important that the elements work together and that the chip operating system and the card itself all support the protocols and the functionality required by the industry security standards.

Asymmetric encryption (PKI) and the math

When talking about asymmetric key, you need to remember that it’s actually a bigger case of simple mathematics. Typically today we build this starting with a RSA key and I will just give you an example of how that key is actually generated.

Source: https://en.wikipedia.org/wiki/Public-key_cryptography

It’s based on generating a very large random number. And with that random number, you apply that with a key generation application and this will generate two keys – a green public key and the red private key. The private key is the one that I kept in my card or in my chip. It will never leave and that it is not possible to get that out.

So I will have a model now where I have my card and my key and something I can share with other people – my public key. And the way to access my private key is by something I know or something I am, depending on the technology. This means I know something, a pin code or I am something – typically a physical fingerprint in that case.

Math has its advantages

The advantage of doing that is that with this mathematical model it is guaranteed that I always will generate a unique ID. When I generate this large random number, I will always get a random number. There are enough numbers in the universe in the terms of the sizes of these keys that I’m generating. So I’m not concerned that I will run out of numbers. There are plenty and there a lot of research and science around key generation.

So it’s a big area. And for those of you that would like more information, I can recommend these the two URLs shown in the bottom of the illustration.

It is also important to tell you that this is a global standard. It’s used among multiple industries and in multiple use cases. And finally, it’s built, as I said, on simple mathematics. It’s quite straightforward. Authentication is either one or zero – that’s how it is.

Quantum computing is the last thing I just want to mention here. This is something that we’re going to see in the future. There will be people talking about RSA keys, they will be talking about other algorithms. What I can say for now is that this will be supported, of course, by the industry.

It will be supported and it’s being worked on heavily by universities and research people and scientists around the world to address the development of quantum computing in terms of how to work with these keys.

Bob and Alice get authentic messages

Looking at a digital signature, so how does the mathematics actually apply? I think this is where it’s really become clever in terms of modern authentication and modern passwordless processes. I will explain this from a simple message point of view and you could apply the same story to authentication, where the message that Alice sends to Bob could easily be just a challenge that the operating system has submitted to Alice and ask her to sign and send it back.

Source: https://en.wikipedia.org/wiki/Digital_signature & https://en.wikipedia.org/wiki/Public-key_cryptography

So what does Alice actually do? Alice has a message saying “Hello Bob.” Alice signs that with her private key. This is important so she’s using her private key and her pin code, and her smart card to sign this message.

So that message is submitted to Bob and it has attached a signed payload where it’s proved that this is the signing sequence. When Bob then receive this message, he can then verify that the message were done with the private key of Alice by running the mathematics with the public key and when that adds up correctly, it will tell Bob that this message is authentic. It comes from Alice because it’s been signed with Alice’s private key. He cannot see the key, but he can, by using mathematics, simply determine that this is what happened and therefore, he knows that this is Alice and that’s exactly how an authentication also works.

Reversing the process when we go into encryption is when Bob then wants to send a secret message to Alice, then he will use Alice’s public key. He will create a cipher text and Alice will receive the message, and she will then decrypt the information by using her private key. And by that, it’s not necessary to have any shared keys, like a password, or to have a shared secret.

This, in a nutshell, is the way that asymmetric encryption and asymmetric signing works.

The certificate authority – the trust anchor of keys

The certificate for the public key infrastructure is the last thing to note about PKI. Don’t worry, the principle is nothing new – certificates for the public key infrastructure should bring back memories of the little lock icon and SSL certificates.

With a SSL certificate, you can click on the link and the small padlock and you can subsequently see what the website is connected to and more. This process can also be applied for people, for email signing, for digital signing of documents, and many other use cases. It is about applying a label to the key pair and knowing that this key pair has given rights, can do certain things or is connected to a given person.

So how does that work? It works in the way that I generate my key pair in my smart card. I then submit my public key together with a certificate signing request to the certificate authority. The certificate authority can be internal in your own organization, or it can be a national or even international certificate authority.

They will receive your request. They will validate that the data that you submitted are correct and that it’s connected to you as a person or on the given certificate that you are requesting, and that the rules apply.

They will run that process. Finally, they will generate your certificate and sign that with their own private key. And that’s exactly the numbers of certificates you typically see in the certificate chain when you look in a Windows Server or wherever you go, you can look at the chain of trust in a certificate. Typically you see a chain running from a roots CA to an intermediate CA and to the user, depending on how your design is constructed.

Certificates and Certificate Authorities – whether you are simply surfing the web or logging in to a company network, the process is essentially unchanged. You just might not see that little lock icon but the principles remain.

Unwrapping the smart card

The physical smart card is much more complex than it initially appears – and can be constructed in multiple ways. A typical smart card today, especially for the ones that have dual interface, will be built with the outer layers of plastic to protect the inside core of the card.

In this case, there’s an antenna going around on the edge of the card. That’s why you do not put holes in it or use a paper punch. If you put that through your card, it can cut your wires. As shown in the picture, you will see the chip is connected with the wires to the antenna. So in this case, the card will support a dual interface.

You can have different layouts and constructions of these ID cards and even have multiple chips. The type of card shown here, as I said also earlier, is based on NXP JCOP and it can support FIDO. It can also support Desfire. Qualified signature creation is very important when it comes to high levels and highly trusted qualified certificates and is also based on the eIDAS level high identity cards.

These standards are a very important area for the FIPS and the common criteria. Such security standards guarantee that the chip complies to strict rules and can be used in any cases from run from passports, IT authentication, and many other use cases.

Smart Cards
10 x Smart Card PVC NXP J2A081/GX0 V2.4.1 R3 GSM punch
290,00 kr. price exclusive of VAT Add to cart
Smart Cards
10 x Smart Card PVC Dual Interface NXP J3A081/GX0 MF 1K
610,00 kr. price exclusive of VAT Add to cart

Cloning smart cards

The question still lingers: To clone or not to clone. Many people throughout the years have said to me that the smart card can be copied. That’s true – but only halfway. What can get copied are the classic door-access cards, the travel cards, the cards that we use for canteens, and follow-me print cards.

These copy-able cards are more simple and they’re not as advanced as the real PKI-based cards. For simple Mifare cards, these typically have a UID or card serial number CSN. That number can be read very easily and copied to another device. The target can be a phone that acts as a card or it can be another card it can be cloned into. So those technologies are not necessarily guaranteed secure.

Regardless, these Mifare cards are very useful in many, many practical ways. You can compare theme to some of the physical metal keys that we normally use for doors. Some of those keys are not that advanced, they can also be copied or cloned at your local shop.

But going to a PKI-based card with a PKI chip is on a completely different level. Those cards cannot get cloned. This is exactly because of the secure module inside the card and the way that the keys are embedded there. Thanks to the way the card is physically and technically designed, it is simply not possible.

Not all smart cards are created or can be cloned equally – even though they might all look like plastic rectangles at first glance. The technology under the plastic matters.