Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

Versatile Hardware Security With
Cryptographic RF Smartcards
By Eustace Asanghanwa, Atmel
Affordable True Hardware Security for Mutual Authentication and Data Security
Cryptographic RF smartcards offer true hardware-based security for applications that
need authentication, value storage, identification, and secure access control. It bridges
the complexity and affordability gap between high-end secure microcontroller-based
smartcards used in banking, and low-end cards used for loyalty tracking and access
control, without giving up security.
Eustace Asanghanwa
Developers and service providers can now apply the desired amount of security to their applications without
the complexity and unit costs associated with high-end smartcards. Additionally, there is no tradeoff in
security for low-end smartcards. Example applications include:
‣ Subscription management including cable and satellite TV.
‣ Electronic purses used in Laundromats, energy meters, internet café resources and
transportation.
‣ Information cards including ID cards and driver licenses.
‣ Multi-application cards, for example, a single card that combines multiple functions like hotel
access, mini-bar purchases, movie purchases, and secure access to [high-value] in-room hotel
safes.
Smartcards are available today for a wide range of applications and are classifiable under two broad
categories: Microprocessor-based and memory-based smartcards. Microprocessor-based smartcards embed a
microprocessor, volatile and non-volatile memories, and communication circuitry such as Analog Front-End
(AFE) in an integrated circuit that eventually embeds inside the standard smartcard. They contain
cryptographic routines either in firmware or hardware accelerators to service high-end security applications
like banking and passports. They require special software or operating system developed by security experts
for effective security. Their complex nature allows them to command premium prices in the market. In
addition, these smartcards require external power to support the energy requirements of the microprocessor,
the memories and the cryptographic routines. For this reason, their connectivity to the outside world is
usually contacted in nature, at least for power sourcing. Contacted connectivity demands periodical card
replacement due to worn out contacts. In the rare cases where connectivity is not contacted, as in RFID
cards, power limitations translate into long transaction times making them less practical for mainstream
security applications.
Figure 1: A high level block diagram of a microprocessor smartcard
Smart Card & Identity News • January 2008
11